WO2013078678A1

WO2013078678A1 - Method for determining access mode of user equipment, and system and device thereof

Info

Publication number: WO2013078678A1
Application number: PCT/CN2011/083375
Authority: WO
Inventors: 周伟
Original assignee: 华为技术有限公司
Priority date: 2011-12-02
Filing date: 2011-12-02
Publication date: 2013-06-06
Also published as: CN103250446A; CN103250446B

Abstract

Embodiments of the present invention provide a method for determining an access mode of a user equipment (UE), and a system and device thereof. The method comprises: a data gateway acquiring access network discovery and selection function policy information corresponding to a UE, the access network discovery and selection function policy information comprising a first correspondence corresponding to the UE, and the first correspondence being a correspondence between application information and an access mode; the data gateway acquiring a second correspondence corresponding to the UE, the second correspondence being a correspondence between the application information and safety information; the data gateway determining an access mode of the UE according to the first correspondence, the second correspondence, and a data packet to be sent to the UE and being processed by safety protection. By means of the technical solution of the present invention, the access mode of the UE can be determined based on application information in the safety scenario, thereby splitting service flow of the UE.

Description

Method, system and device for determining user equipment access mode

The embodiments of the present invention relate to the field of communications technologies, and in particular, to a method, system, and device for determining a user equipment access mode. Background technique

System Architecture Evolution (SAE) is an evolutionary network architecture initiated by the 3rd Generation Partnership Projective (3GPP). Under the guidance of the SAE evolution plan, a new mobile communication network framework with separate control planes and data planes, namely Evolved Packet System (EPS), is defined.

In an SAE, after an operator deploys EPSs of multiple access types, User Equipment (UE) needs to be based on certain policies, such as signal strength or price factors, in an environment with multiple wireless accesses. To choose a suitable wireless access method. At the same time, the operator also needs to recommend a suitable wireless access mode for the UE according to the current network state, such as signal strength and network load. Therefore, the 3GPP organization proposes an Access Network Discovery and Selection Function (ANDSF) entity, which can formulate a set of policy rules based on the combination of wireless access network information and operator policies. The policy rule can select a suitable access mode for the UE. For example, the ANDSF entity can set the UE to perform the File Transfer Protocol (FTP) service between 8:00 am and 8:00 pm to select the WiFi access mode, so that the UE can select between 8:00 am and 8:00 pm. WiFi access mode access. In the EPS of the ANDSF entity, the technical solution for offloading the service flow of the UE is that the Policy Charging Rule Function (PCRF) entity interacts with the ANDSF entity to obtain a policy rule, and then generates a policy according to the policy rule. And the Policy and Charging Control (PCC) rule, and then the Packet Data Network Gateway (PDN-GW) selects the corresponding bearer according to the PCC rule and the application information of the UE, and performs the service flow of the UE. Split operation.

In practice, the above technical solution for offloading the service flow of the UE based on the application information cannot be applied. In the security scenario, the access mode of the UE cannot be determined, and the traffic of the UE cannot be offloaded. Summary of the invention

The embodiment of the invention provides a method and a system for determining a user equipment access mode, and a packet data gateway, which is used to solve the defect that the access mode of the UE cannot be determined based on the application information in the security scenario in the prior art.

An embodiment of the present invention provides a method for determining a user equipment access mode, including: the data gateway acquiring the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes the user equipment Corresponding first correspondence, the first correspondence is a correspondence between application information and an access method;

The data gateway obtains a second correspondence corresponding to the user equipment, where the second correspondence is a correspondence between the application information and the security information;

The data gateway determines the access mode of the user equipment according to the first correspondence, the second correspondence, and the data packet that is to be sent to the user equipment for security protection processing.

The embodiment of the present invention further provides a method for determining a user equipment access mode, including: accessing a network discovery and selection function entity to obtain an access network discovery and selection function policy information corresponding to a user equipment; the access network discovery and selection function The policy information includes a first correspondence corresponding to the user equipment, where the first correspondence is a correspondence between the application information and the access mode.

The access network discovery and selection function entity acquires a second correspondence relationship corresponding to the user equipment, where the second correspondence relationship is a correspondence between the application information and the security information;

The access network discovery and selection function entity sends the first correspondence relationship and the second correspondence relationship to the data gateway, so that the data gateway is sent to the user equipment according to the first correspondence relationship, the second correspondence relationship, and the The data packet processed by the security protection determines the access mode of the user equipment.

The embodiment of the invention further provides a data gateway, including:

The first obtaining module is configured to obtain the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the first correspondence is Correspondence between application information and access methods; a second acquiring module, configured to acquire a second correspondence corresponding to the user equipment, where the second correspondence is a correspondence between the application information and the security information;

And a determining module, configured to determine, according to the first correspondence, the second correspondence, and the data packet to be sent to the user equipment, the access mode of the user equipment.

The embodiment of the present invention further provides an access network discovery and selection function entity, including: a first acquiring module, configured to acquire access network discovery and selection function policy information corresponding to the user equipment; and the access network discovery and selection function policy The information includes a first correspondence corresponding to the user equipment, where the first correspondence is a correspondence between the application information and the access mode;

a second acquiring module, configured to acquire a second correspondence corresponding to the user equipment, where the second corresponding relationship is a correspondence between the application information and the security information;

a sending module, configured to send the first correspondence and the second correspondence to the data gateway, where the data gateway performs security protection processing according to the first correspondence, the second correspondence, and the user equipment to be sent to the user equipment The data packet determines the access mode of the user equipment.

An embodiment of the present invention further provides a system for determining a user equipment access mode, including: a data gateway and an access network discovery and selection function entity;

The data gateway is configured to receive the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the first correspondence is an application Corresponding relationship between the information and the access mode; receiving a second correspondence corresponding to the user equipment, where the second correspondence is a correspondence between the application information and the security information; according to the first correspondence, the second correspondence, and Dedicating a data packet sent by the user equipment to the user equipment to determine an access mode of the user equipment;

The access network discovery and selection function entity is configured to obtain access network discovery and selection function policy information corresponding to the user equipment; acquire a second correspondence corresponding to the user equipment; and send the access network discovery and selection function policy information And the second correspondence to the data gateway.

The method and system for determining the access mode of the user equipment and the data gateway in the embodiment of the present invention can determine the access mode of the UE based on the application information in the security scenario, so that the service flow of the UE can be implemented. operating. DRAWINGS The drawings used in the embodiments or the description of the prior art are briefly described. It is obvious that the drawings in the following description are some embodiments of the present invention, and are not creative to those skilled in the art. Other drawings can also be obtained from these drawings on the premise of labor.

FIG. 1 is a signaling diagram of a method for determining a UE's access mode according to an embodiment of the present invention; FIG. 2 is a flowchart of a method for determining a UE access mode according to an embodiment of the present invention; A flowchart of a method for determining a UE access mode provided by an embodiment; FIG. 4 is a flowchart of a method for determining a UE access mode according to another embodiment of the present invention; FIG. 5 is a determining UE according to another embodiment of the present invention. A flowchart of a method for determining an access mode; FIG. 6 is a signaling diagram of a method for determining a user equipment access manner according to an embodiment of the present invention;

FIG. 7 is a signaling diagram of a method for determining a user equipment access manner according to another embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a data gateway according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a data gateway according to another embodiment of the present invention;

FIG. 10 is a schematic structural diagram of an ANDSF entity according to an embodiment of the present disclosure;

FIG. 1 is a schematic structural diagram of a system for determining a UE access mode according to an embodiment of the present invention. The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. The embodiments are a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The technical solution provided by the embodiments of the present invention can be applied to various wireless communication networks, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), and Frequency Division Multiple Access (Frequency Division). Multiple Access, FDMA), Orthogonal Frequency-Division Multiple Access (OFDMA), Single Carrier FDMA (SC-FDMA) and other networks Network and so on. The terms "network," and "system" can be replaced with each other. A CDMA network can implement wireless technologies such as Universal Terrestrial Radio Access (UTRA) and CDMA2000. UTRA can include variants of CDMA, WCDMA, and other CDMA. CDMA2000 can cover the Interim Standard (IS) 2000 (IS-2000), IS-95 and IS-856 standards. The TDMA network can implement wireless technologies such as Global System for Mobile Communication (GSM). An OFDMA network can implement such as Evolved UTRA (E-UTRA), Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash OFDMA. And other wireless technologies. UTRA and E-UTRA are UMTS and UMTS evolved versions. 3 GPP is a new version of UMTS that uses E-UTRA in Long Term Evolution (LTE) and LTE Advanced (LTE-A). UTRA, E-UTRA, UMTS, LTE, LTE-A and GSM are described in the documentation of the 3GPP standards organization. CDMA2000 and UMB are described in the documentation of the 3GPP2 standards organization. The technology described in the embodiments of the present invention can also be applied to the wireless network and the wireless technology described above.

In the embodiment of the present invention, a base station (BS) may be a station that communicates with a User Equipment (UE) or other communication station, such as a relay station, and the base station may provide communication coverage of a specific physical area. The base station may provide communication coverage for macro cells, pico cells, femto cells, and/or other types of cells. The macro cell may cover a relatively large geographic area, such as a radius of a few kilometers, and allows unrestricted access by UEs that have subscribed to the service. The Pico cell can cover a relatively small geographical area and can allow unrestricted access by UEs that have subscribed to the service. The Femto cell covers a relatively small geographical area, such as a home, and allows UEs associated with the femto cell to restrict access. The base station serving the macro cell may be referred to as a macro base station, the base station serving the pico cell may be referred to as a pico base station, and the base station serving the femto cell may be referred to as a femto base station or a home base station. A base station can support one or more cells.

In this embodiment of the present invention, UEs may be distributed throughout the wireless network, and each UE may be static or mobile. A UE may be referred to as a terminal, a mobile station, a subscriber unit, a station, or the like. The UE can be a cellular phone, a personal digital assistant (PDA), a wireless modem solution. A modem, a wireless communication device, a handheld device, a laptop computer, a cordless phone, a Wireless Local Loop (WLL) station, and the like. The UE can communicate with a macro base station, a pico base station, a femto base station, and the like.

In the embodiment of the present invention, the ANDSF entity stores ANDSF policy information. The ANDSF policy information includes a first correspondence corresponding to the UE, where the first correspondence includes a correspondence between the application information and the access mode, for example, "application information A, access mode B".

In the embodiment of the present invention, the AAA server is used to store the server of the second correspondence. The second correspondence includes the correspondence between the security information and the application information, for example: "Encryption Algorithm C, Application Information A".

In the embodiment of the present invention, the data gateway may be a PDN-GW, or may be a Gateway General Packet Radio Service (GPRS) Support Node (GGSN). With the advancement of technology, it may also be Other network elements used to perform service flow offloading operations. Those skilled in the art should be aware that the data gateways in different network scenarios are different.

Exemplarily, the application information may be an application identifier, which is used to distinguish different application categories. Illustratively, the application information can be a content type, such as text or video, to distinguish between different content categories. Exemplarily, the application information may also be other information that needs to be obtained by parsing the data message and used to distinguish different data messages. The present invention does not limit the application information.

In order to better illustrate the embodiments of the present invention, the following describes the scenario in which the data gateway is a PDN-GW.

FIG. 1 is a signaling diagram of offloading a service flow of a UE according to the prior art. The method for offloading the service flow of the UE as shown in FIG. 1 may specifically include the following:

100. After the UE is powered on, an attach request is initiated, so as to be attached to the core network. The UE performs data transmission through the PDN-GW in the core network;

101. The UE reports application information to an application function (AF) server; for example, the UE can pass a specific signaling message, such as a session initiation protocol (Session).

The Initiation Protocol (SIP) signaling reports the running application information to the AF server. The application information is the same as the application information involved in the communication between the UE and the communication peer server.

102. The AF server generates session information, and sends the session information to the PCRF entity. For example, after receiving the application information sent by the UE, the AF server generates corresponding session information (in essence, the session information also carries information that can identify the application information of the UE), and establishes an Rx session with the PCRF entity, at the Rx. The session information is sent to the PCRF entity on the interface.

103. A connection is established between the PCRF entity and the ANDSF entity, and the ANDSF policy information corresponding to the application information of the UE is obtained from the ANDSF entity.

104. The PCRF entity generates a PCC rule according to the acquired ANDSF policy information, and sends a PCC rule to the PDN-GW.

For example, the PCRF entity sends a PCC rule to the PDN-GW through the Gx interface. The PCC rule is a PCC rule corresponding to the application information of the UE. The PCC rule includes the correspondence between the application information of the UE and the access mode.

Optionally, if the PCC architecture is not deployed in the network, the following 105 proxy may be used;

105. The PDN-GW establishes a connection with the ANDSF entity, and the PDN-GW obtains corresponding ANDSF policy information from the ANDSF entity.

When the communication peer server delivers the service flow to be sent to the UE to the PDN-GW,

The PDN-GW can obtain the application information of the UE from the service flow, and then obtain the PCC rule corresponding to the UE according to the ANDSF policy information and the application information of the UE.

Further, the method may further include:

106. The PDN-GW performs a corresponding bearer operation, for example, performing a corresponding bearer operation according to a PCC rule corresponding to the application information of the UE in the service flow that is sent to the UE, for example, adding, modifying, or deleting the corresponding bearer, thereby implementing The traffic flow sent to the UE by the receiving communication peer server is offloaded.

For example, the PDN-GW can determine the access mode of the UE according to the PCC rule, so that the corresponding bearer operation can be performed.

The technical solution of the above-mentioned offload processing is applied to the scenario in which the UE is not in the security protection. However, when the UE is in the security scenario, the communication data between the UE and the communication peer server is effectively protected, and the PDN-GW cannot learn the UE. The application information can not determine the access mode of the UE, so that the service flow of the UE cannot be offloaded. Therefore, the following technical solution of the present invention can be used to determine the access mode of the UE in a security scenario, so as to implement traffic offloading of the UE. FIG. 2 is a flowchart of a method for determining an access mode of a UE according to an embodiment of the present invention. For example, the method for determining the UE access mode in this embodiment is the PDN-GW. As shown in FIG. 2, the method for determining the UE access mode in this embodiment includes the following:

200. Obtain an ANDSF policy information corresponding to the UE.

In this embodiment, the ANDSF policy information includes a first correspondence corresponding to the UE, where the first correspondence is a correspondence between the application information and the access mode.

201. Acquire a second correspondence corresponding to the UE.

The second correspondence in the embodiment is the correspondence between the application information and the security information. 202. Determine, according to the first correspondence, the second correspondence, and the data packet that is to be sent to the UE for security protection processing, determine an access mode of the UE.

The application scenario of this embodiment is that the UE is in a security scenario. The security scenario indicates that a secure connection is established between the UE and the communication peer server, and the context data transmitted by the UE is protected by encryption, thereby protecting the data transmitted by the UE from external attacks.

The method for determining the access mode of the user equipment in this embodiment determines the UE by using the correspondence between the application information and the access mode, the correspondence between the application information and the security information, and the data packet to be sent to the UE for security protection processing. Access method. The technical solution of the present embodiment can overcome the problem that the access mode of the UE cannot be determined based on the application information in the security scenario in the prior art, so that the service flow of the UE can be offloaded based on the application information in the security scenario.

It should be noted that the security information in the foregoing embodiment includes information such as a key certificate, a symmetric key, and a security algorithm.

FIG. 3 is a flowchart of a method for determining a UE access mode according to another embodiment of the present invention. As shown in FIG. 3, the method for determining the access mode of the UE in this embodiment is based on the foregoing embodiment shown in FIG. 2, and the technical solution of the present invention is introduced in more detail. The method for determining the UE access mode in this embodiment includes the following:

300. The PDN-GW receives the data packet sent by the communication peer server.

The data packet is sent to the UE, and the data packet is subjected to security protection processing. 301. The PDN-GW sends the ANDSF policy request information that carries the UE identifier to the ANDSF entity, where the ANDSF entity obtains the ANDSF policy information corresponding to the UE.

The identifier of the UE may specifically be an IP address of the UE. The ANDSF policy information is the same as the embodiment shown in FIG. 2, and includes a first correspondence corresponding to the UE, where the first correspondence is closed. The system includes the correspondence between application information and access methods. The ANDSF entity obtains the ANDSF policy information corresponding to the UE, and the ANDSF entity may obtain the ANDSF policy information corresponding to the UE from the preset policy database. The ANDSF policy information may also include a first correspondence corresponding to multiple UEs.

The application scenario of this embodiment is also in the security scenario of the UE. The physical meaning of the security scenario is the same as that of the foregoing embodiment. For details, refer to the description of the foregoing embodiment, which is not described herein.

Optionally, before 300, the UE may have interacted with the ANDSF entity with some requirement information for setting policy information, such as a UE identifier, application information of the UE, and a security information indicator, etc., where the UE identifier may be an IP address of the UE. The security information indicator is used to identify that the UE is in a security scenario, and the data packet sent by the communication peer server that communicates with the UE to the UE is security-protected. Therefore, after receiving the ANDSF policy request information, the ANDSF entity may obtain the second correspondence corresponding to the UE from the security server. Or the ANDSF entity may obtain the second correspondence corresponding to the UE from the security server before 300. The second correspondence includes the correspondence between the application information and the security information.

302. The PDN-GW receives the ANDSF policy information sent by the ANDSF entity and the second correspondence corresponding to the UE.

The second correspondence in this embodiment is the same as the embodiment shown in FIG. 2, and the second correspondence includes the correspondence between the application information and the security information.

303. The PDN-GW obtains application information of the data packet according to the second correspondence and the data packet that is to be sent to the UE for security protection processing.

For example, the security information in the second correspondence is used to parse the security-protected data packet to be sent to the UE, and the application information of the data packet is obtained after parsing; and the data packet obtained after the parsing is determined. Whether the application information corresponds to the application information in the second correspondence relationship, and if the response is successful, the security information and the application information corresponding to the data packet are determined as the security information and the application information in the second correspondence relationship. If the correspondence is not successful, the analysis is not successful. If there is another second correspondence corresponding to the UE, the security information in the other second correspondence may continue to be used for analysis.

The security information in this embodiment may be a key certificate, a symmetric key, a security algorithm, and the like; for example, when the security information is a key certificate, the key certificate may be used on the certificate server. After the verification, the key information is obtained, and the data information is parsed by the key information. When the analysis is successful, the security information is determined to be the security information corresponding to the UE. Or, when the security information is a symmetric key, the symmetric message is used to parse the data packet. When the parsing is successful, the security information is determined to be the security information corresponding to the UE. Or when the security information is a security algorithm, the security algorithm is used to parse the data packet with the existing key information, and the security information is determined to be the security information corresponding to the UE. Other similar security information can be handled by referring to the above example.

The PDN-GW determines the access mode of the UE according to the obtained application information of the data packet and the first correspondence between the ANDSF policy request information corresponding to the UE.

For example, the access mode corresponding to the application information of the data packet is obtained from the first corresponding relationship corresponding to the UE according to the determined application information of the data packet, that is, the access mode of the UE.

The method for determining the access mode of the user equipment in this embodiment, the PDN-GW obtains the application information of the data packet according to the correspondence between the application information and the security information, and the data packet that is to be sent to the UE for security protection processing. And determining the access mode of the UE according to the correspondence between the application information and the access mode. The technical solution of the present embodiment can overcome the problem that the access mode of the UE is determined based on the application information in the security scenario in the prior art, so that the service flow of the UE can be offloaded based on the application information in the security scenario.

The security server in the foregoing embodiment may be an Authentication Authorization and Accounting (hereinafter referred to as AAA) server, a Home Subscriber Server (HSS), a certificate server or an application server, and the like. A server that stores security information and a second correspondence.

FIG. 4 is a flowchart of a method for determining a UE access mode according to still another embodiment of the present invention. As shown in FIG. 4, the method for determining the access mode of the UE in this embodiment is based on the foregoing embodiment shown in FIG. 2, and the technical solution of the present invention is introduced in more detail. The method for determining the UE access mode in this embodiment includes the following:

400. The PDN-GW sends the ANDSF policy request information that carries the UE identifier to the ANDSF entity, so that the ANDSF entity obtains the ANDSF policy information corresponding to the UE.

The ANDSF policy information is the same as the embodiment shown in FIG. 2 and FIG. 3, and includes a first correspondence corresponding to the UE, where the first correspondence includes a corresponding relationship between the application information and the access mode. Department.

401. The PDN-GW receives the ANDSF policy information sent by the ANDSF entity.

402. The PDN-GW receives the data packet sent by the communication peer server.

The data packet is sent to the UE, and the UE is in a security scenario, and the data packet is encrypted and protected.

403. The PDN-GW sends a security information request that carries the UE identifier to the security server, so that the security server obtains the second correspondence corresponding to the UE according to the UE identifier.

The second correspondence in this embodiment is the same as the embodiment shown in FIG. 2 and FIG. 3, and the second correspondence includes the correspondence between the application information and the security information.

404. The PDN-GW receives the second correspondence corresponding to the UE sent by the security server. When there is no interface between the PDN-GW and the security server, in 403, the PDN-GW can send the security of the UE identifier to the security server by using the PCRF entity. Information request. Correspondingly, in the 404, the PDN-GW receives the second correspondence corresponding to the UE sent by the security server through the PCRF entity.

405. The PDN-GW obtains application information of the data packet according to the second correspondence and the data packet that is to be sent to the UE for security protection processing.

406. The PDN-GW determines the access mode of the UE according to the first correspondence between the application information of the data packet and the ANDSF policy request information corresponding to the UE.

405-406 is the same as 303-304 in the embodiment shown in FIG. 3 above. For details, refer to the description of the above embodiment, and details are not described herein again.

The application scenario of the embodiment is still in the security scenario of the UE, and the UE establishes a secure connection with the communication peer server. The physical meaning of the security scenario is the same as that of the related embodiment. For details, refer to the description of the foregoing embodiment. This is not to repeat.

FIG. 5 is a flowchart of a method for determining an access mode of a UE according to another embodiment of the present invention. The execution body of the method for determining the UE access mode in this embodiment may be an ANDSF entity. As shown in FIG. 5, the method for determining the access mode of the UE in this embodiment may include the following steps: 500: Acquire access network discovery and selection function policy information corresponding to the UE;

The access network discovery and selection function policy information includes a first correspondence corresponding to the UE, where the first correspondence is a correspondence between the application information and the access mode;

501. Obtain a second correspondence corresponding to the UE.

The second correspondence relationship is a correspondence between the application information and the security information.

502. Send a first correspondence and a second correspondence to a data gateway.

Sending the first correspondence and the second correspondence to the data gateway, so that the data gateway determines the access mode of the UE according to the first correspondence, the second correspondence, and the data packet that is to be sent to the UE for security protection processing. .

The ANDSF policy information in this embodiment is the same as the foregoing embodiment shown in FIG. 2 to FIG. 4, and includes a first correspondence corresponding to the UE, where the first correspondence includes a correspondence between the application information and the access mode.

The data packet in this embodiment may be a security-processed data packet that is sent to the UE, and the data packet is specifically sent by the communication peer server that communicates with the UE to the PDN-GW.

The method for determining the access mode of the user equipment in this embodiment is to send the corresponding relationship between the acquired application information and the access mode, and the correspondence between the application information and the security information to the data gateway, so that the data gateway determines the access of the UE. The method can be used to overcome the problem that the access mode of the UE is determined based on the application information in the security scenario in the prior art, so that the service flow of the UE is offloaded based on the application information in the security scenario.

Optionally, on the basis of the technical solution of the foregoing embodiment, the 501 obtains the access network discovery and selection function policy information corresponding to the UE, and may specifically obtain the UE corresponding to the UE identifier from the preset policy database. ANDSF policy information.

Optionally, on the basis of the foregoing technical solution, the UE identifier, the UE application information, and the security information indicator sent by the UE may be received before the 501, and the ANDSF entity is The access network discovery and selection function policy information corresponding to the application information of the UE may be obtained according to the identifier of the UE and the application information of the UE, and the ANDSF entity may further learn that the UE and the communication peer server are established according to the security information indicator. The secure connection, the data packets transmitted between the UE and the communication peer server are protected by encryption. Exemplarily, the identifier of the UE, the application information of the UE, and the security information indicator may be reported by the UE to the ANDSF entity when the UE and the ANDSF entity exchange some requirement information for setting policy information.

Further, the method is similar to the method for determining the access mode of the user equipment on the PDN-GW side shown in FIG. 3, in this embodiment, when the ANDSF entity receives the UE identifier sent by the UE, application information of the UE, and security. After the information indicator, the data message sent by the communication peer server to the UE is sent in the security scenario according to the security information indicator. At this time, the ANDSF entity may request the ANDSF from the PDN-GW to the ANDSF entity. Before or after the policy information, the second correspondence of the UE is obtained from the security server. The ANDSF entity may also send the acquired second correspondence to the PDN-GW. For example, you can refer to the following steps:

And sending, by the security server, a security information request that carries the UE identifier, where the security server obtains the second correspondence corresponding to the UE according to the UE identifier.

A2. Receive a second correspondence corresponding to the UE sent by the security server.

A3. Send the second correspondence to the PDN-GW.

When there is no interface between the ANDSF entity and the security server, the foregoing A1 may be: The ANDSF entity sends a security information request carrying the UE identifier to the security server through the PCRF entity. Correspondingly, the A2 may be a second correspondence between the UE and the UE that the security server sends through the PCRF entity.

The ANDSF entity may also send the acquired second correspondence to the PDN-GW along with the ANDSF policy information.

The method for determining the access mode of the user equipment can be used to overcome the problem that the access mode of the UE cannot be determined based on the application information in the security scenario in the prior art, so that the service flow of the UE based on the application information in the security scenario can be implemented. Diversion.

FIG. 6 is a signaling diagram of a method for determining a user equipment access mode according to an embodiment of the present invention. As shown in FIG. 6, the method for determining the access mode of the user equipment in this embodiment may specifically include the following: 600. After the UE is powered on, it is attached to the core network;

601. The UE establishes a secure connection with the communication peer server.

In this manner, the data packet between the subsequent UE and the communication peer server will be transmitted in the security scenario. The physical meaning of the security scenario is the same as that of the foregoing embodiment. For details, refer to the description of the foregoing embodiment, and details are not described herein.

602. The UE and the ANDSF entity exchange policy information, where the UE reports the UE's IP address, application information, and security information indicator to the ANDSF entity.

603. The ANDSF entity sends a security information request that carries the IP address and application information of the UE to the AAA server.

604. The AAA server obtains a second correspondence corresponding to the UE according to the security information request, and sends the second correspondence to the ANDSF entity.

It should be noted that when there is no interface between the ANDSF entity and the AAA server, the ANDSF entity in 603 sends a security information request carrying the IP address and application information of the UE to the AAA server through the PCRF entity. In 604, the AAA server sends the second correspondence to the ANDSF entity by using the PCRF entity.

605. The ANDSF entity obtains the first correspondence in the preset policy database according to the IP address and the application information of the UE.

The first correspondence relationship and the second correspondence relationship in this embodiment are the same as the embodiment shown in Figs. 2 to 5 described above. The first correspondence includes the correspondence between the application information access modes. The second correspondence includes the correspondence between the application information and the security information.

606. The communication peer server sends, to the PDN-GW, a security-protected data packet to be sent to the UE.

Alternatively, the 606 may also be located between 601 and 602.

607. The PDN-GW sends an ANDSF policy request information to the ANDSF entity.

608. The ANDSF entity sends the ANDSF policy information and the second correspondence to the PDN-GW. The ANDSF policy information is the same as the embodiment shown in FIG. 2-5.

609. The PDN-GW parses the security-protected data packet sent to the UE according to the security information in the second correspondence, and obtains the security-protected datagram sent to the UE and the application information in the second correspondence. Correspondingly, the PDN-GW determines according to the first correspondence The access mode of the UE.

Step 609 is the same as 303-304 in the embodiment shown in FIG. 3 above. For details, refer to the description of the above embodiment, and details are not described herein again.

The method provided by the embodiment of the present invention can determine the access mode of the UE based on the application information in a security scenario, and subsequently perform a new or modified bearer process according to the change of the access mode, and perform the traffic according to the determined access mode. Data packets, which enable data distribution in a security scenario.

FIG. 7 is a signaling diagram of a method for determining a user equipment access mode according to still another embodiment of the present invention. As shown in FIG. 7, the method for determining the access mode of the user equipment in this embodiment may specifically include the following:

700. After the UE is powered on, it is attached to the core network;

701. The UE establishes a secure connection with the communication peer server.

702. The PDN-GW sends an ANDSF policy request message carrying an IP address of the UE to the ANDSF entity.

703. The ANDSF entity obtains ANDSF policy information in a preset policy database according to the ANDSF policy request information.

The ANDSF policy information in this embodiment is the same as the embodiment shown in FIG. 2 to FIG. 6 above, and details are not described herein.

704. The ANDSF entity sends ANDSF policy information to the PDN-GW.

705. The communication peer server sends a security-protected data packet sent to the UE to the PDN-GW. 706. The PDN-GW sends a security information request that carries the IP address of the UE to the AAA server.

707. The AAA server obtains a second correspondence corresponding to the UE according to the security information request, and sends the second correspondence to the PDN-GW.

It should be noted that when there is no interface between the PDN-GW and the AAA server, in the 706

The PDN-GW sends a security information request carrying the IP address of the UE to the AAA server through the PCRF entity. In 707, the AAA server sends the second correspondence to the PDN-GW through the PCRF entity.

708. The PDN-GW parses the security-protected data packet sent to the UE according to the security information in the second correspondence, and obtains the security-protected datagram sent to the UE and the application information in the second correspondence. Correspondingly, the PDN-GW determines the access mode of the UE according to the first correspondence.

The step 708 is the same as the 303-304 in the embodiment shown in FIG. 3, and the details of the foregoing embodiment may be referred to, and details are not described herein again.

In summary, the method provided by the embodiment of the present invention may determine the access mode of the UE based on the application information in a security scenario, and subsequently perform a new or modified bearer process according to the change of the access mode, and according to the determined access mode. Divide data packets to implement data distribution in a security scenario.

The foregoing FIG. 6 and FIG. 7 illustrate the technical solution of the embodiment of the present invention by using the security server as an AAA server. In an actual application, the AAA server in the foregoing embodiment may adopt an HSS, a certificate server, an application server, or the like. A server capable of storing security information and a second correspondence is replaced.

Safety information and application information in the second correspondence relationship in the embodiment of the present invention and the first The corresponding relationship between the application information and the access mode in the correspondence relationship is a corresponding relationship, that is, one security information corresponds to one application information, and one application information corresponds to one access mode.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

FIG. 8 is a schematic structural diagram of a data gateway according to an embodiment of the present invention. As shown in FIG. 8, the data gateway of this embodiment includes: a first acquiring module M10, a second acquiring module Mi1, and a determining module M12.

In the data gateway of this embodiment, the first acquiring module M10 is configured to obtain the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes the first correspondence corresponding to the user equipment. Relationship, the first correspondence is a correspondence between the application information and the access mode; the second obtaining module Mi1 is configured to obtain a second correspondence corresponding to the user equipment, where the second correspondence is the application information and the security information Corresponding relationship; the determining module M12 is respectively connected to the first obtaining module M10 and the second acquiring module Mi l, and the determining module M12 is configured to perform security protection according to the first correspondence, the second correspondence, and the user equipment to be sent to the user equipment. The processed data packet determines the access mode of the user equipment.

For the data gateway of the present embodiment, the implementation mechanism for determining the access mode of the UE by using the foregoing module is the same as the implementation of the foregoing related method embodiment. For details, refer to the description of the foregoing related method embodiments, and details are not described herein.

The data gateway of this embodiment can determine the access mode of the UE based on the application information in the security scenario by using the foregoing module, so that the service flow of the UE can be offloaded in the subsequent manner.

FIG. 9 is a schematic structural diagram of a data gateway according to another embodiment of the present invention. As shown in FIG. 9, the data gateway of this embodiment may further include the following in the foregoing embodiment of FIG.

In the data gateway of this embodiment, the first obtaining module M10 may include a first sending unit U101 and a first receiving unit U102. The first sending unit U101 is configured to send an ANDSF policy request information that carries the UE identifier to the ANDSF entity, where the ANDSF entity acquires the UE. Corresponding ANDSF policy information, the ANDSF policy information includes a first correspondence corresponding to the UE. The first receiving unit U102 is configured to receive ANDSF policy information sent by the ANDSF entity. At this time, the corresponding determining module M12 is connected to the first receiving unit U102, and the determining module M12 is configured to use the second corresponding relationship acquired by the second acquiring module Mi1 and the UE corresponding to the ANDSF policy information received by the first receiving unit U102. A correspondence relationship and a data packet to be sent to the UE for security protection processing determine the access mode of the UE.

Optionally, in the PDN-GW device of the embodiment, the second acquiring module M11 may be configured to receive at least one security information corresponding to the UE that is sent by the ANDSF entity, and corresponding at least one second correspondence relationship; The at least one security information and the corresponding at least one second correspondence are obtained by the ANDSF entity from the security server.

Further, in the data gateway of this embodiment, the second obtaining module Mi l may further include a second sending unit U111 and a second receiving unit U112. The second sending unit U111 is configured to send a security information request that carries the UE identifier to the security server, so that the security server obtains the second correspondence corresponding to the UE according to the UE identifier. The second receiving unit U112 is configured to receive a second correspondence corresponding to the UE sent by the security server. Correspondingly, the determining module M12 is further connected to the second receiving unit U112, and the determining module M12 is configured to be used according to the second corresponding relationship received by the second receiving unit U112, and the first acquiring module M10. The first receiving unit U102, as shown in FIG. 9), obtains the first correspondence between the UE and the data packet to be sent to the UE in the ANDSF policy information, and determines the access mode of the UE.

Further, the second sending unit U111 is specifically configured to send, by using the PCRF entity, a security information request that carries the UE identifier to the security server. The second receiving unit U112 may be specifically configured to receive a second correspondence corresponding to the UE that is sent by the security server by using the PCRF entity.

Optionally, the determining module M12 in the foregoing embodiment may further include: an obtaining unit U121 and a determining unit U122. The obtaining unit U121 is connected to the second receiving unit U112, and the obtaining unit U121 is configured to parse the security-protected data packet sent to the user equipment according to the security information in the second correspondence received by the second receiving unit U112. Obtaining the application information of the security-protected data packet sent to the user equipment; the determining unit U122 is respectively connected to the obtaining unit U121 and the second receiving unit U112 and the first receiving unit U102, and the determining unit U122 is configured to Number of security-protected processes sent to the user device And determining, according to the first correspondence corresponding to the UE in the ANDSF policy information received by the first receiving unit U102, the access mode of the user equipment, according to the application information of the message corresponding to the application information in the second corresponding relationship.

Optionally, the data gateway of this embodiment may further include a receiving module M13. The receiving module M13 is configured to receive the security-protected data packet sent by the communication peer server. Specifically, the receiving module M13 is connected to the acquiring unit U121, so that the acquiring unit U121 can be used for the second corresponding relationship received by the second receiving unit U112 and the data of the security protection process to be sent to the user equipment received by the receiving module M13. A packet obtains application information of the data packet.

It should be noted that, as shown in FIG. 9 , only all the foregoing optional technical solutions are combined to form an optional embodiment of the present invention. In practical applications, the foregoing multiple optional technical solutions may also be adopted. Any combination of the modes of the combination forms a plurality of alternative embodiments of the present invention, and details are not described herein.

The data gateway of this embodiment implements the description of the method for determining the connection method of the UE by using the above-mentioned modules and units, and details are not described herein.

FIG. 10 is a schematic structural diagram of an access network discovery and selection function entity according to an embodiment of the present invention. As shown in FIG. 10, the ANDSF entity device of this embodiment includes: a first acquiring module M20, a second acquiring module M21, and a sending module M22.

In the ANDSF entity device of this embodiment, the first acquiring module M20 is configured to obtain the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes the first corresponding to the user equipment. Corresponding relationship, the first correspondence is a correspondence between the application information and the access mode; the second obtaining module M21 is configured to obtain a second correspondence corresponding to the user equipment, where the second correspondence is the application information and the security information Correspondence relationship. The sending module M22 is respectively connected to the first obtaining module M20 and the second obtaining module M21. The sending module M22 is configured to send the first correspondence and the second correspondence to the data gateway, so that the data gateway is based on the first correspondence. The second correspondence and the content to be sent to the user The data packet processed by the security protection of the user equipment determines the access mode of the user equipment.

The ANDSF entity in this embodiment implements the description of the method for determining the access method of the UE by using the foregoing module, and is not described here.

The ANDSF entity of this embodiment can facilitate the data gateway to determine the access mode of the UE based on the application information in the security scenario by using the foregoing module, so that the service flow of the UE can be offloaded in the subsequent manner.

Optionally, the first obtaining module M20 in the foregoing embodiment may obtain the ANDSF policy information of the UE corresponding to the UE identifier from the preset policy database.

Optionally, the second obtaining module M21 may include an indication receiving unit, a sending unit, and a receiving unit. The receiving unit is configured to receive the user equipment identifier and the security information indicator of the user equipment, and the sending unit is configured to send, to the security server, a security information request that carries the user equipment identifier, where the security server obtains the user according to the user equipment identifier. The second correspondence corresponding to the device; the receiving unit is configured to receive a second correspondence corresponding to the user equipment sent by the security server.

The ANDSF entity of the foregoing embodiment implements the description of the method for determining the access method of the UE by using the foregoing module, and details are not described herein.

The ANDSF entity of the foregoing embodiment can facilitate the data gateway to determine the access mode of the UE based on the application information in the security scenario by using the foregoing module, so that the service flow of the UE can be offloaded in the subsequent manner.

The security server in the above device embodiment may still be an AAA server, an HSS, a certificate server, an application server, or the like, which is capable of storing security information and a correspondence between the security information and the application information.

FIG. 11 is a schematic structural diagram of a system for determining a UE access mode according to an embodiment of the present invention. As shown in FIG. 11, the system for determining the access mode of the UE in this embodiment may include: a data gateway 30 and an ANDSF entity 40.

The data gateway 30 is configured to receive the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the first correspondence is Correspondence between application information and access method; receiving the a second correspondence corresponding to the user equipment, where the second correspondence is a correspondence between the application information and the security information; according to the first correspondence, the second correspondence, and the security protection process to be sent to the user equipment Data packet, determining the access mode of the user equipment;

The ANDSF 40 is configured to obtain access network discovery and selection function policy information corresponding to the user equipment, obtain a second correspondence corresponding to the user equipment, and send the access network discovery and selection function policy information and the second correspondence to Data gateway.

Further, the data gateway 30 is specifically configured to obtain the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, and the first correspondence The relationship is the correspondence between the application information and the access mode; the second correspondence corresponding to the user equipment is obtained, where the second correspondence is the correspondence between the application information and the security information; and the security information is parsed according to the second correspondence The security-processed data packet sent to the user equipment obtains the application information of the security-protected data packet sent to the user equipment; and the security-protected data sent to the user equipment When the application information of the packet corresponds to the application information in the second correspondence, the access mode of the user equipment is determined according to the first correspondence.

Further, the ANDSF 40 is specifically configured to obtain the access network discovery and selection function policy information corresponding to the user equipment, receive the user equipment identifier and the security information indicator of the user equipment, and send a security information request that carries the user equipment identifier to the security server. And obtaining, by the security server, the second correspondence corresponding to the user equipment according to the user equipment identifier; receiving a second correspondence corresponding to the user equipment sent by the security server; sending the access network discovery and selection function policy information and The second correspondence is to the data gateway.

The system for determining the access mode of the UE in this embodiment is implemented by using the foregoing data gateway 30 and the ANDSF entity 40, and the implementation mechanism for determining the access mode of the UE is the same as that of the foregoing related method embodiment. The record of the example is not mentioned here.

In the system for determining the access mode of the UE, the data gateway 30 and the ANDSF entity 40 can determine the access mode of the UE based on the application information in the security scenario, so that the service flow of the UE can be offloaded in the subsequent manner. .

It is also known in the art that various illustrative logical blocks and steps listed in the embodiments of the present invention can be softened by electronic hardware or computer. , or a combination of both. To clearly demonstrate the interchangeability of hardware and software

( interchangeability ) , the various descriptions above! The functions of the "detail components" and the steps have been generally described. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the overall system. Those skilled in the art can The application may be implemented in a variety of ways, but such implementation should not be construed as being beyond the scope of the embodiments of the invention.

The various illustrative logic blocks, modules and circuits described in the embodiments of the invention may be implemented by general purpose processors, digital signal processors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic. The device, discrete gate or transistor logic, discrete hardware components, or any combination of the above are designed to implement or operate the functions described. The general purpose processor may be a microprocessor, which may alternatively be any conventional processor, controller, microcontroller or state machine. The processor may also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration. achieve.

The steps of the method or algorithm described in the embodiments of the present invention may be directly embedded in hardware, a software module executed by a processor, or a combination of the two. The software modules can be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium in the art. Illustratively, the storage medium can be coupled to the processor such that the processor can read information from the storage medium and can write information to the storage medium. Alternatively, the storage medium can also be integrated into the processor. The processor and the storage medium can be placed in an ASIC, and the ASIC can be placed in the user terminal. Alternatively, the processor and the storage medium may also be provided in different components in the user terminal.

In one or more exemplary designs, the above-described functions described in the embodiments of the present invention may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, these functions may be stored on a computer readable medium, or transmitted in a form or code, on a computer readable medium. Computer readable media includes computer storage media and communication media that facilitates the transfer of computer programs from one place to another. The storage medium can be any available media that any general purpose or special computer can access. For example, such computer readable media can include, but is not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage Storage or other magnetic storage device, or any other medium that can be used to carry or store program code in the form of instructions or data structures and other forms that can be read by a general purpose or special computer, or general or special processor. In addition, any connection can be appropriately defined as a computer readable medium, for example, if the software is from a website site, server or other remote resource through a coaxial cable, fiber optic computer, twisted pair, digital subscriber line (DSL) Or wirelessly transmitted in, for example, infrared, wireless, and microwave, is also included in a defined computer readable medium. The disks and discs include compact disks, laser disks, optical disks, DVDs, floppy disks, and Blu-ray disks. Disks typically replicate data magnetically, while disks typically optically replicate data with a laser. Combinations of the above may also be included in a computer readable medium.

The above description of the description of the present invention may enable any of the art to utilize or implement the present invention. Any modifications based on the disclosure should be considered as obvious in the art. The basic principles described herein can be applied to other variants. Without departing from the spirit and scope of the invention. Therefore, the present disclosure is not limited to the described embodiments and designs, but may be extended to the maximum extent consistent with the principles of the invention and the novel features disclosed.

Claims

Claim

A method for determining a user equipment access mode, comprising:

The data gateway obtains the access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the first correspondence relationship is application information. Correspondence with access methods;

The data gateway obtains a second correspondence corresponding to the user equipment, where the second correspondence relationship is a correspondence between the application information and security information;

The data gateway determines the access mode of the user equipment according to the first correspondence, the second correspondence, and the data packet of the security protection process to be sent to the user equipment.

The method according to claim 1, wherein the data gateway acquires the second correspondence corresponding to the user equipment, including:

The data gateway receives the second correspondence corresponding to the user equipment that is sent by the access network and the user equipment, and the second correspondence corresponding to the user equipment is the access network discovery and selection function entity. Secure server obtained.

The data gateway sends a security information request that carries the user equipment identifier to the security server, so that the security server obtains the second correspondence corresponding to the user equipment according to the user equipment identifier;

The data gateway receives a second correspondence corresponding to the user equipment sent by the security server.

4. The method of claim 3, wherein

And the sending, by the data gateway, the security information request that carries the user equipment identifier to the security server, where the data gateway sends the security information request that carries the user equipment identifier to the security server by using a policy charging rule function entity. ;

Receiving, by the data gateway, the second correspondence corresponding to the user equipment that is sent by the security server, where: the data gateway receives, by the data server, the user equipment that is sent by the security server by using the policy charging rule function entity The second correspondence.

The method according to any one of claims 1-4, wherein the data gateway is based on the first correspondence, the second correspondence, and security to be sent to the user equipment. The data packet to be processed is protected, and the access mode of the user equipment is determined, including:

The data gateway parses the security-protected data packet sent to the user equipment according to the security information in the second correspondence, and obtains the security-protected data sent to the user equipment. Application information of the message;

And determining, by the data gateway, the user according to the first correspondence, if the application information of the security-protected data packet sent to the user equipment is corresponding to the application information in the second corresponding relationship Access mode of the device.

A method for determining a user equipment access manner, which is characterized in that:

The access network discovery and selection function entity acquires access network discovery and selection function policy information corresponding to the user equipment; the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the a correspondence relationship between the application information and the access mode; the access network discovery and selection function entity acquires a second correspondence corresponding to the user equipment, where the second correspondence relationship is the application information and the security information Correspondence relationship;

The access network discovery and selection function entity sends the first correspondence relationship and the second correspondence relationship to a data gateway, where the data gateway is configured according to the first correspondence relationship, the second correspondence relationship, and The security-processed data packet sent to the user equipment determines the access mode of the user equipment.

The method according to claim 6, wherein the access network discovery and the selection function entity acquire the second correspondence corresponding to the user equipment, including:

Receiving, by the access network discovery and selection function entity, a user equipment identifier and a security information indicator of the user equipment;

The access network discovery and selection function entity sends a security information request carrying the user equipment identifier to the security server, so that the security server obtains the second correspondence corresponding to the user equipment according to the user equipment identifier;

The access network discovery and selection function entity receives a second correspondence corresponding to the user equipment sent by the security server.

8. A data gateway, comprising:

a first acquiring module, configured to acquire access network discovery and selection function policy information corresponding to the user equipment, where the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the first Correspondence relationship is the correspondence between application information and access mode; And a second corresponding node, configured to acquire a second correspondence corresponding to the user equipment, where the second correspondence is a correspondence between the application information and security information;

And a determining module, configured to determine, according to the first correspondence, the second correspondence, and the data packet that is to be sent to the user equipment for security protection processing, determining an access mode of the user equipment.

The data gateway according to claim 8, wherein the second acquiring module is configured to receive a second correspondence corresponding to the user equipment sent by the access network discovery and selection function entity; The second correspondence corresponding to the user equipment is obtained by the access network discovery and selection function entity from the security server.

The data gateway according to claim 8, wherein the second obtaining module comprises:

a second sending unit, configured to send, to the security server, a security information request that carries the user equipment identifier, where the security server obtains a second correspondence corresponding to the user equipment according to the user equipment identifier;

And a second receiving unit, configured to receive a second correspondence corresponding to the user equipment sent by the security server.

1 1. The data gateway according to claim 10, characterized in that:

The second sending unit is configured to send, by using a policy charging rule function entity, the security information request that carries the user equipment identifier to the security server;

The second receiving unit is configured to receive a second correspondence corresponding to the user equipment that is sent by the security server by using the policy charging rule function entity.

The data gateway according to any one of claims 8 to 1, wherein the determining module comprises:

An obtaining unit, configured to parse the security-protected data packet sent to the user equipment according to the security information in the second correspondence, to obtain the security protection processing sent to the user equipment Application information of the data message;

a determining unit, configured to determine, according to the first correspondence, when the application information of the security-protected data packet sent to the user equipment corresponds to the application information in the second corresponding relationship User equipment access method.

13. An access network discovery and selection function entity, comprising: a first acquiring module, configured to acquire access network discovery and selection function policy information corresponding to the user equipment, where the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the first Correspondence relationship is the correspondence between application information and access mode;

And a second corresponding node, configured to acquire a second correspondence corresponding to the user equipment, where the second correspondence is a correspondence between the application information and security information;

a sending module, configured to send the first correspondence and the second correspondence to a data gateway, where the data gateway is sent to the user according to the first correspondence, the second correspondence, and the second gateway The data packet processed by the security protection of the device determines the access mode of the user equipment.

The access network discovery and selection function entity according to claim 13, wherein the second obtaining module comprises:

And an indication receiving unit, configured to receive the user equipment identifier and the security information indication of the user equipment;

a sending unit, configured to send, to the security server, a security information request that carries the user equipment identifier, where the security server obtains a second response relationship corresponding to the user equipment according to the user equipment identifier;

And a receiving unit, configured to receive a second corresponding relationship corresponding to the user equipment sent by the security server.

A system for determining a user equipment access mode, comprising: a data gateway and an access network discovery and selection function entity;

The data gateway is configured to receive access network discovery and selection function policy information corresponding to the user equipment, where the access network discovery and selection function policy information includes a first correspondence corresponding to the user equipment, where the first Corresponding relationship is a correspondence between the application information and the access mode; receiving a second correspondence corresponding to the user equipment, where the second correspondence is a correspondence between the application information and the security information; according to the first correspondence Determining, by the second corresponding relationship, the data packet of the security protection process to be sent to the user equipment, the access mode of the user equipment; the access network discovery and selection function entity, The access network discovery and selection function policy information corresponding to the user equipment is obtained; the second correspondence corresponding to the user equipment is obtained; and the access network discovery and selection function policy information and the second correspondence relationship are sent to the data gateway.

The system according to claim 15, wherein the data gateway is specifically configured to acquire access network discovery and selection function policy information corresponding to the user equipment; And the first function corresponding to the user equipment, the first corresponding relationship is a correspondence between the application information and the access mode, and the second corresponding relationship corresponding to the user equipment is obtained. The second correspondence is a correspondence between the application information and the security information; and the security-processed data packet sent to the user equipment is parsed according to the security information in the second correspondence, to obtain the sending The application information of the security-protected data packet of the user equipment; the application information of the security-protected data packet sent to the user equipment and the application information in the second correspondence relationship Corresponding, determining, according to the first correspondence, an access mode of the user equipment.

The system according to claim 15 or 16, wherein the access network discovery and selection function entity is specifically configured to acquire access network discovery and selection function policy information corresponding to the user equipment; a user equipment identifier and a security information indicator of the user equipment; sending, to the security server, a security information request that carries the user equipment identifier, where the security server obtains a second correspondence corresponding to the user equipment according to the user equipment identifier And receiving a second correspondence corresponding to the user equipment sent by the security server; and sending the access network discovery and selection function policy information and the second correspondence to the data gateway.