WO2015032253A1 - 业务权限确定方法和装置 - Google Patents

业务权限确定方法和装置 Download PDF

Info

Publication number
WO2015032253A1
WO2015032253A1 PCT/CN2014/083732 CN2014083732W WO2015032253A1 WO 2015032253 A1 WO2015032253 A1 WO 2015032253A1 CN 2014083732 W CN2014083732 W CN 2014083732W WO 2015032253 A1 WO2015032253 A1 WO 2015032253A1
Authority
WO
WIPO (PCT)
Prior art keywords
web application
application identifier
sent
service
access device
Prior art date
Application number
PCT/CN2014/083732
Other languages
English (en)
French (fr)
Inventor
简海燕
李靖
叶婉玲
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP14841487.3A priority Critical patent/EP3029908B1/en
Publication of WO2015032253A1 publication Critical patent/WO2015032253A1/zh
Priority to US15/060,351 priority patent/US20160191523A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1016—IP multimedia subsystem [IMS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/10—Architectures or entities
    • H04L65/1063—Application servers providing network services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1073—Registration or de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/1066—Session management
    • H04L65/1101—Session protocols
    • H04L65/1104—Session initiation protocol [SIP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present application claims the priority of the Chinese application filed on Sep. 4, 2013, the disclosure of which is incorporated herein by reference.
  • the present invention relates to the field of communications technologies, and in particular, to a service authority determining method and apparatus.
  • WebRTC Web Real-Time Communications
  • the WebRTC service of the 3rd Generation Partnership Project can enable users of the Internet Protocol Multimedia Subsystem (IMS) to pass through a third party.
  • the web application (Web) application accesses the IMS network for communication, and realizes the interworking between the Web and the IMS user equipment. For security and operational considerations, the operator needs to control the IMS user according to the trust relationship between the operator and the third-party web application website. Access to the service rights of the IMS network.
  • the IMS user directly communicates with the IMS network, and needs to sign a corresponding service with the IMS network operator when performing communication.
  • the registration process is initiated to the IMS network, and the application server (hereinafter referred to as AS) obtains the user subscription data through the HSS.
  • AS application server
  • the IMS user sends a session request to the IMS network to the IMS network.
  • the IMS network determines whether the IMS user subscribes to the IMS network according to the user subscription data in the AS, and then determines whether to accept the session request of the IMS user.
  • the IMS network can only control the service rights according to the IMS user subscription data, and cannot accurately control the IMS user accessing the IMS network through the third-party web application.
  • Summary of the invention The embodiment of the invention provides a method and a device for determining the service authority, which are used to solve the technical problem that the IMS user cannot access the IMS network to perform refined service authority control through the third-party web application.
  • a first aspect of the embodiments of the present invention provides a method for determining a service authority, including:
  • the receiving, by the access device, the web application identifier includes:
  • the receiving, by the access device, the web application identifier includes:
  • the receiving, by the access device, the SIP registration message includes:
  • the access device Receiving, by the access device, the SIP registration message that is sent after receiving the web application identifier sent by the operator webpage real-time communication WebRTC authentication system; the web application identifier is that the operator WebRTC authentication system is verifying the slave access The access code received by the device is sent after it is valid.
  • the web application identifier is that the operator WebRTC authentication system is verifying the receiving from the access device Sent after the code is valid.
  • the receiving, by the access device, the session request that is sent by the UE and that carries the web application identifier is received
  • the invitation message sent after the message.
  • the service permission policy corresponding to the web application identifier is pre-configured on the AS, or is obtained by the AS from the home subscriber server HSS.
  • a second aspect of the embodiments of the present invention provides a method for determining a service authority, including:
  • the application server AS receives the webpage application identifier sent by the network device
  • the service permission policy corresponding to the web application identifier is pre-configured on the AS or acquired by the AS from the home subscriber server HSS. .
  • a third aspect of the embodiments of the present invention provides a service authority determining apparatus, including:
  • a receiving module configured to receive a webpage application identifier sent by the access device
  • a sending module configured to send the web application identifier to the application server AS, so that the
  • the AS determines the service authority of the UE according to the service authority policy corresponding to the web application identifier and the service subscription data of the user equipment UE.
  • the receiving module specifically includes:
  • the first receiving unit is configured to receive a session initiation protocol SIP registration message sent by the access device, where the SIP registration message carries the web application identifier.
  • the receiving module specifically includes:
  • the second receiving unit is configured to receive an invite message sent by the access device, where the invite message carries the web application identifier.
  • the first receiving unit is specifically configured to receive, by the access device, a real-time communication WebRTC on a receiving operator webpage And sending, by the authentication system, the SIP registration message sent by the web application identifier; the web application identifier is sent by the operator WebRTC authentication system after verifying that the access code received from the access device is valid.
  • the second receiving unit is specifically configured to receive, by the access device, a sending service provider, a WebRTC authentication system, The invitation message sent after the web application identifier;
  • the web application identifier is sent by the operator WebRTC authentication system after verifying that the access code received from the access device is valid.
  • the second receiving unit is specifically configured to receive, by the access device, the The invitation message sent after the session request message carrying the web application identifier is carried.
  • the service permission policy corresponding to the web application identifier is pre-configured in On the AS, or obtained by the AS from the home subscriber server HSS.
  • a fourth aspect of the embodiments of the present invention provides a service authority determining apparatus, including:
  • a receiving module configured to receive a webpage application identifier sent by the network device
  • a determining module configured to determine, according to the service permission policy corresponding to the web application identifier and the service subscription data of the user equipment UE, the service authority of the UE.
  • the service permission policy corresponding to the web application identifier is pre-configured on the AS or acquired by the AS from a home subscriber server HSS. .
  • the service authority determining method provided by the embodiment of the present invention sends a web application identifier to the network device of the IMS network by using the access device, and the network device forwards the web application identifier to the AS, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, thereby improving the accuracy of the authority control of the network device to the UE accessing the IMS network from the Web application website.
  • FIG. 1 is a schematic flowchart of Embodiment 1 of a method for determining a service authority according to the present invention
  • FIG. 2 is a schematic flowchart of a method for determining a service authority according to a second embodiment of the present invention
  • FIG. 4 is a signaling flowchart of Embodiment 4 of a service authority determining method provided by the present invention
  • FIG. 5 is a schematic flowchart of a fifth embodiment of a service authority determining method according to the present invention
  • FIG. 6 is a schematic structural diagram of a first embodiment of a service authority determining apparatus according to the present invention
  • FIG. 8 is a schematic structural diagram of Embodiment 3 of a service authority determining apparatus according to the present invention
  • FIG. 9 is a schematic structural diagram of Embodiment 4 of a service authority determining apparatus provided by the present invention.
  • FIG. 11 is a schematic structural diagram of Embodiment 2 of a service authority determining apparatus according to the present invention;
  • FIG. 12 is a schematic structural diagram of Embodiment 1 of a service authority determining system provided by the present invention.
  • the user equipment involved in the present application may be a wireless terminal or a wired terminal, and the wireless terminal may be a device that provides voice and/or data connectivity to the user, a handheld device with wireless connectivity, or a wireless modem. Other processing equipment.
  • the wireless terminal can communicate with one or more core networks via a radio access network (eg, RAN, Radio Access Network), which can be a mobile terminal, such as a mobile phone (or "cellular" phone) and with a mobile terminal
  • RAN Radio Access Network
  • the computers for example, can be portable, pocket-sized, handheld, computer-integrated or in-vehicle mobile devices that exchange language and/or data with the wireless access network.
  • FIG. 1 is a schematic flowchart of Embodiment 1 of a method for determining a service authority according to the present invention. This embodiment provides a method for determining a service authority for a UE to access an IMS network through a Web application website.
  • the executor of the following steps is a network device on the IMS network side.
  • the network device may be an Interrogating Call Session Control Function (I-CSCF) network element server or a service session call control (Service Call).
  • I-CSCF Interrogating Call Session Control Function
  • Service Call Service Call
  • the Session Control Function (hereinafter referred to as the S-CSCF) network element server may also be a Proxy Call Session Control Function (P-CSCF) network element server, which is not limited in this embodiment of the present invention;
  • P-CSCF Proxy Call Session Control Function
  • the network device in the embodiment of the present invention is illustrated by using an S-CSCF. As shown in FIG. 1, the method in this embodiment includes:
  • S101 Receive a web application identifier sent by the access device.
  • the UE may be distinguished by using different identifiers.
  • the identifier may be, for example, a card number of a Subscriber Identity Module (SIM) card, and is not limited thereto.
  • SIM Subscriber Identity Module
  • the user logs in to the third-party web application website through the UE. If the user wants to initiate the WebRTC service when browsing the third-party web application website, for example, the user wants to initiate the contact with the seller's WebRTC service when browsing the Taobao website.
  • the third-party application website here is the Taobao website
  • the WebRTC business is the business that contacts the seller.
  • the user sends a login request message to the operator WebRTC authentication system through the UE (the operator Web authentication system also includes the WebRTC portal server, which is actually the user logs in to the WebRTC portal), the login request message.
  • the web application identifier that is, the logo of the Taobao website in the above example) is carried.
  • the operator's WebRTC authentication system sends a WebRTC application identifier to the access device after the login request message is processed in a series of processes, so that the access device sends the Web application identifier to the network device. Meanwhile, the access device can also authenticate from the operator WebRTC.
  • the user identity is obtained in the system, and the user identity is sent to the network device, so that the network device can learn the identity of the UE according to the user identity.
  • the access device may be a WebRTC gateway, or may be another device that accesses the IMS network and has access network functions.
  • the web application identifier sent by the access device to the network device may be carried in the registration message, may be carried in the invitation message, or may be carried in other messages, which is not limited in this embodiment of the present invention.
  • S102 Send the web application identifier to the AS, so that the AS determines the service authority of the UE according to the service right policy corresponding to the web application identifier and the service subscription data of the UE.
  • the network device sends the foregoing web application identifier to the AS; after receiving the web application identifier, the AS determines to reject or accept the UE according to the subscription service data of the UE and the service permission policy corresponding to the web application identifier. Service authority when entering the IMS network.
  • the service permission policy corresponding to the web application identifier may include a mapping relationship between the web application identifier and the service authority of the UE.
  • the service permission policy corresponding to the web application identifier is that the user accesses the IMS from the web application website corresponding to the web application identifier. Industry that can be allowed when the network
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the subscription service data of the UE, and may be: when the AS receives the web application identifier forwarded by the network device, the AS searches for the web application identifier according to the web application identifier.
  • the service authority of the corresponding user is searched for in the contracted service data of the UE in combination with the identity of the user, and the intersection of the two is determined to determine the service that can be allowed when the user accesses the IMS network.
  • the following is a specific example. It is assumed that the user A wants to implement the video service, the voice service, and the short message service in the IMS network.
  • the services that are stored in the AS and the IMS network are the voice service and the short message service. If there is a technology to handle, when user A initiates a session request for video service to the IMS network, it will be rejected by the IMS network, and when the session request for voice and short message service is initiated, it will be accepted by the IMS network. However, it is often the case that when user A accesses the IMS network through different web application websites, the services that can be accepted by the IMS network are different, for example: when user A accesses the IMS network through application website A, and initiates to the IMS network.
  • the session request of the voice service is accepted by the IMS network.
  • the IMS network denies access, so that the user communication cannot be guaranteed.
  • the AS in addition to storing the service subscription data of the UE, the AS also stores different service permission policies corresponding to different web application identifiers, for example, the service authority of the user A corresponding to the application website B is only the short message service.
  • the determined user A accesses the service of the IMS network through the website B.
  • the permission is only the short message service, so that the network device controls the WebRTC service authority of the UE more accurately.
  • the service authority determining method provided by the embodiment of the present invention sends a web application identifier to the network device of the IMS network by using the access device, and the network device forwards the web application identifier to the AS, so that The AS determines the service authority of the UE according to the service privilege policy corresponding to the web application identifier and the subscription service data of the UE, and further improves the accuracy of the privilege control of the network device in the scenario that the UE accesses the IMS network from the web application website.
  • this embodiment provides a specific manner for a network device to obtain a web application identifier from an access device, that is, the foregoing S101 is specifically: receiving a Session Initiation Protocol (SIP) registration message sent by the access device, where the SIP registration message carries the Web application identifier.
  • SIP Session Initiation Protocol
  • the UE after logging in to the third-party web application website, the UE sends a login request message to the WebRTC authentication system, where the login request message carries the web application of the third-party web application website. Logo.
  • the operator web authentication system receives the login request message and authenticates whether the user identity is legal, and determines the user identity. After the authentication is passed, the operator's web authentication system sends an authentication response message to the UE.
  • the authentication response message carries the access code, and the access code is the operator's WebRTC authentication system according to the identity of the UE and the web application identifier.
  • the UE allocates an access code of the network device through the current third-party web application website; the authentication response message also carries the address of the access device. After receiving the foregoing authentication response message, the UE sends a registration request message to the corresponding access device according to the address of the access device in the authentication response message, and the registration request message carries the access code.
  • the operator's WebRTC authentication system performs a series of processing according to the access code, and sends the web application identifier to the access device.
  • the access device initiates a SIP registration process to the network device, that is, sends a SIP registration message to the network device, where the SIP registration message carries the Web application identifier.
  • the network device After receiving the SIP registration message sent by the access device, the network device sends a SIP success message to the access device, so that the access device informs the UE that the registration process ends. Subsequently, the UE may initiate a session flow to the access device.
  • the foregoing session is specifically: the UE sends a WebRTC session request message to the access device, and after receiving the WebRTC session request message, the access device sends an INVITE message to the network device. Then, the network device forwards the web application identifier that is obtained from the SIP registration message to the AS in the received invitation message, so that the AS obtains the service subscription data corresponding to the UE and the service authority corresponding to the web application identifier.
  • the policy determines to reject or accept the session request initiated by the UE when accessing the IMS network. It should be noted that the storage in the AS The service permission policy corresponding to the web application identifier may be pre-configured on the AS, or may be obtained by the AS from a Home Subscriber Server (HSS).
  • HSS Home Subscriber Server
  • this embodiment provides another specific manner for a network device to obtain a web application identifier from an access device.
  • the S101 may be: receiving an invitation message sent by the access device, where the invitation message carries the web application identifier.
  • the UE after logging in to the third-party web application website, the UE sends a login request message to the WebRTC authentication system, where the login request message carries the web application of the third-party web application website. Logo.
  • the operator web authentication system receives the login request message and authenticates whether the user identity is legal, and determines the user identity. After the authentication is passed, the operator's web authentication system sends an authentication response message to the UE.
  • the authentication response message carries the access code, and the access code is the operator's WebRTC authentication system.
  • the user identity and the web application identifier are the UE.
  • the access code of the access network device is allocated through the current third-party web application website; the authentication response message also carries the address of the access device.
  • the UE After receiving the foregoing authentication response message, the UE sends a registration request message to the corresponding access device according to the address of the access device in the authentication response message, and the registration request message carries the access code.
  • the operator's WebRTC authentication system performs a series of processing according to the access code, and sends the web application identifier to the access device.
  • the access device initiates a SIP registration process to the network device, that is, sends a SIP registration message to the network device, where the SIP registration message carries the user identity (does not carry the Web application identifier).
  • the network device After receiving the SIP registration message sent by the access device, the network device sends a SIP success message to the access device, so that the access device informs the UE that the registration process ends. Subsequently, the UE may initiate a session flow to the access device.
  • the session process is specifically: the UE sends a WebRTC session request message to the access device, and after receiving the WebRTC session request message, the access device carries the web application identifier and the user identity previously obtained from the operator WebRTC authentication system in the invitation. The message is sent to the network device. Afterwards, the network device forwards the invitation message carrying the web application identifier and the user identity to the AS, so that the AS determines to reject or accept the UE according to the subscription service data of the UE and the service permission policy corresponding to the web application identifier.
  • a session request initiated when entering the IMS network.
  • the service permission policy corresponding to the web application identifier stored in the AS may be pre-configured on the AS, or may be obtained by the AS from the HSS.
  • this embodiment provides another specific manner for a network device to obtain a web application identifier from an access device.
  • the method that is, the foregoing sending the invitation message sent by the access device, specifically includes: receiving the invitation message sent by the access device after receiving the session request message that is sent by the UE and carrying the web application identifier.
  • the UE sends a login request message to the WebRTC authentication system after logging in to the third-party web application website, where the login request message carries the web application identifier of the third-party web application website.
  • the operator web authentication system receives the login request message and authenticates whether the user identity is legal, and determines the user identity. After the authentication is passed, the operator's web authentication system sends an authentication response message to the UE.
  • the authentication response message carries the access code, and the access code is the operator's WebRTC authentication system.
  • the user identity and the web application identifier are the UE.
  • the access code of the network device is accessed through the current third-party web application website, and the address of the access device is also carried in the authentication response message.
  • the UE After receiving the foregoing authentication response message, the UE sends a registration request message to the corresponding access device according to the address of the access device in the authentication response message, and the registration request message carries the access code.
  • the operator's WebRTC authentication system performs a series of processing according to the access code, and sends the user identity to the access device.
  • the access device initiates a SIP registration process to the network device, that is, sends a SIP registration message to the network device, where the SIP registration message carries the user identity identifier (does not carry the Web application identifier).
  • the network device After receiving the SIP registration message sent by the access device, the network device sends a SIP success message to the access device, so that the access device informs the UE that the registration process ends. Subsequently, the UE may initiate a session flow to the access device.
  • the session process is specifically as follows:
  • the UE sends a WebRTC session request message to the access device, where the WebRTC session request message carries the Web application identifier.
  • the access device After receiving the WebRTC session request message, the access device sends the Web application identifier obtained from the WebRTC session request message to the network device in the invitation message. Then, the network device forwards the invitation message carrying the web application identifier to the AS, so that the AS determines to reject or accept the UE accessing the IMS network according to the subscription service data of the UE and the service permission policy corresponding to the web application identifier. Initiated session request.
  • the service permission policy corresponding to the web application identifier stored in the AS may be pre-configured on the AS, or may be obtained by the AS from the HSS.
  • the service authority determining method provided by the embodiment of the present invention sends a web application identifier to the network device of the IMS network by using the access device, and the network device forwards the web application identifier to the AS, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, thereby improving the accuracy of the authority control of the network device to the UE accessing the IMS network from the Web application website.
  • the embodiment of the present invention provides a specific process for the network device to receive a SIP registration message or an invitation message after the access device obtains the registration request message of the access code sent by the UE, including:
  • the access device After receiving the registration request message carrying the access code sent by the UE, the access device sends the access code to the operator's WebRTC authentication system, so that the WebRTC authentication system verifies the access code and identifies whether the access code is valid. That is, it is determined whether the access code carried in the registration request message of the UE is allocated to the UE by the previous operator WebRTC authentication system. If yes, the operator WebRTC authentication system sends the user identity and the web application identifier to the access device, and the user identity can be an IP Multimedia Public Identity (IMPU) and an IP Multimedia Private Identity (IP Multimedia). Private Identity, hereinafter referred to as IMPI). Then, the access device sends a SIP registration message or an invitation message carrying the web application identifier to the network device.
  • IMPU IP Multimedia Public Identity
  • IP Multimedia IP Multimedia Private Identity
  • the service authority determining method provided by the embodiment of the present invention sends a web application identifier to the network device of the IMS network by using the access device, and the network device forwards the web application identifier to the AS, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, thereby improving the accuracy of the authority control of the network device to the UE accessing the IMS network from the Web application website.
  • FIG. 2 is a schematic flowchart of Embodiment 2 of a method for determining a service authority according to the present invention.
  • This embodiment provides a method for determining a service right of an AS to a UE in a process in which a UE accesses an IMS network through a Web application website. As shown in Figure 2, the method includes:
  • S201 The AS receives the web application identifier sent by the network device.
  • the network device may be an I-CSCF network element server, an S-CSCF network element server, or a P-CSCF network element server, which is not limited in this embodiment of the present invention.
  • the web application identifier sent by the network device to the AS may carry the invitation message and may also be carried in other messages.
  • S202 The AS according to the service authority policy corresponding to the web application identifier and the service sign of the UE The approximate data determines the service authority of the UE.
  • the service permission policy corresponding to the web application identifier may include a mapping relationship between the web application identifier and the service authority, that is, a service that the user can allow when the web application website corresponding to the web application identifier accesses the IMS network.
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE, and may be: when the AS receives the web application identifier sent by the network device, the AS searches for the web application identifier according to the web application identifier.
  • Corresponding user's service authority, and the user's service identity is searched for in the contracted service data of the UE, and the intersection of the two is obtained to determine the service that the user can allow when accessing the IMS network.
  • the service privilege policy corresponding to the web application identifier stored in the AS may be pre-configured on the AS, or may be obtained by the AS from the HSS. Further, the service rights policy obtained by the AS from the HSS may be obtained from the HSS when the UE initiates a registration process to the access device.
  • the following registration process may also be performed:
  • the user logs in to the third-party web application website through the UE. If the user wants to initiate the WebRTC service when browsing the third-party web application website, for example, the user wants to initiate the contact with the seller's WebRTC service when browsing the Taobao website, the third-party application website here. It is the Taobao website, and the WebRTC business is the business that contacts the seller.
  • the user sends a login request message to the WebRTC authentication system through the UE (the operator Web authentication system also includes the WebRTC portal server, which is actually the user logs in to the WebRTC portal), and the login request message carries The web application identifier (ie the logo of the Taobao website in the above example).
  • the operator web authentication system receives the login request message and authenticates the user identity, and determines the user identity. After the authentication is passed, the operator web authentication system sends an authentication response message to the UE, where the authentication response message carries the access code. And the access code is an access code that the operator WebRTC authentication system allocates to the UE to access the IMS network through the current web application website according to the user identity and the web application identifier; the authentication response message further carries the access device. address.
  • the WebRTC authentication system After the access device sends the access code to the operator's WebRTC authentication system, the WebRTC authentication system verifies the access code and identifies whether the access code is valid, that is, determines the access carried in the UE's registration request message. Whether the code is allocated to the UE before the operator's WebRTC authentication system; if yes, the operator WebRTC authentication system sends the user identity to the access device, The identity can be IMPU and IMPI. After the user records the user identity, the access device sends a SIP registration message to the network device, so that the network device sends a SIP success message to the access device, thereby completing the registration process.
  • the method provided by the embodiment of the present invention receives the web application identifier sent by the network device by using the AS, and determines the service authority of the UE according to the stored service authority policy corresponding to the stored web application identifier and the service subscription data of the UE, thereby improving the AS to the UE.
  • FIG. 3 is a signaling flowchart of a third embodiment of a method for determining a service authority according to the present invention.
  • the embodiment provides a method for carrying a web application identifier in a SIP registration message sent by an access device to a network device, so that the AS is configured according to the web application.
  • the network device takes the S-CSCF as an example. As shown in FIG. 3, the method specifically includes:
  • S301 The UE sends a login request message carrying the web application identifier to the operator WebRTC authentication system.
  • the UE may be distinguished by different identity identifiers, and the identity identifier may be, for example, a SIM card number.
  • the user first logs in to the third-party web application website through the UE. If the user wants to initiate the WebRTC service when browsing the third-party web application website, for example, the user wants to initiate the contact with the seller's WebRTC service when browsing the Taobao website, the third-party application here.
  • the website is the Taobao website
  • the WebRTC business is the business that contacts the seller.
  • the user will send a login request message to the WebRTC authentication system (the WebRTC portal is also included in the operator's Web authentication system, in fact, the user logs in to the WebRTC portal), and the login request message carries the Web.
  • Application ID ie the logo of the Taobao website in the above example).
  • the operator web authentication system authenticates the identity of the UE. After the authentication is passed, the authentication response message is sent to the UE.
  • the foregoing authentication response message carries the operator's WebRTC authentication system, according to the identity of the UE and the web application identifier, the UE is allocated an access code for accessing the IMS network and an address of the access device.
  • the operator's WebRTC authentication system authenticates the identity of the UE, that is, whether the identity of the UE is legal. After the identity of the UE is confirmed to be valid, the operator's Web authentication system allocates an access code for accessing the IMS network to the UE, and connects The address of the access code and the access device is carried in the authentication response message and sent to the UE, so that the UE determines the corresponding access device according to the address of the access device.
  • S303 The UE sends a registration request message carrying the access code to the access device.
  • S304 The access device returns the access code to the operator WebRTC authentication system.
  • S305 The operator WebRTC authentication system verifies the access code.
  • the WebRTC authentication system can also send the user identity to the access device. Specifically, the WebRTC authentication system verifies the access code, and determines whether the access code is valid, that is, whether the access code carried in the registration request message of the UE is allocated to the UE by the previous operator WebRTC authentication system; If the access code is valid, the operator's WebRTC authentication system sends a web application identifier to the access device, so that the access device records the web application identifier. Optionally, if the access device receives the user identifier from the WebRTC authentication system, the access device also records the user identity, where the user identity may be IMPU and IMPI.
  • S307 The access device sends a SIP registration message to the S-CSCF.
  • the SIP registration message carries the Web application identifier, and may also carry the user identity identifier. After receiving the SIP registration message, the S-CSCF records the Web application identifier. Optionally, if the SIP registration message received by the S-CSCF carries the user identity and the web application identifier, the S-CSCF records the user identity and the web application identifier.
  • S308 The S-CSCF sends a SIP success message to the access device.
  • the access device sends a registration completion response message to the UE.
  • S310 The UE sends a WebRTC session request message to the access device.
  • S311 The access device sends an invite message to the S-CSCF.
  • the S-CSCF carries the web application identifier to the AS after being carried in the foregoing invitation message.
  • the previous S-CSCF has recorded the web application identifier, so the web application identifier is carried in the above invitation message and forwarded to the AS.
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE.
  • the service permission policy corresponding to the web application identifier is pre-configured on the AS, or is obtained by the AS from the HSS.
  • the service permission policy corresponding to the web application identifier may include a mapping relationship between the web application identifier and the service authority, that is, the user accesses the IMS from the web application website corresponding to the web application identifier.
  • the business that can be allowed when the network is available.
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE, and may be: when the AS receives the web application identifier sent by the network device, the AS searches for the web application identifier according to the web application identifier.
  • the corresponding user's service authority combined with the UE's subscription service data, finds the user's service authority, and the intersection of the two is used to determine the service that the user can allow when accessing the IMS network.
  • the access device sends the web application identifier to the network device of the IMS network, and the network device forwards the web application identifier to the AS, so that the AS according to the service authority policy corresponding to the web application identifier and the UE
  • the subscription service data determines the service authority of the UE, thereby improving the accuracy of the network authority to control the service authority of the UE from the web application website to the IMS network.
  • FIG. 4 is a signaling flowchart of a method for determining a service authority according to a fourth embodiment of the present invention.
  • the embodiment of the present invention provides that a SIP application message sent by an access device to a network device does not carry a web application identifier, but a web application identifier. Carrying in the invitation message sent by the access device to the network device, causing the AS to obtain the web application identifier from the network device, and determining the service authority of the UE according to the web application identifier, where the network device still uses the S-CSCF For example.
  • the method includes:
  • S401 The UE sends a login request message carrying the web application identifier to the operator web authentication system.
  • the user first logs in to the third-party web application website through the UE. If the user wants to initiate the WebRTC service when browsing the third-party web application website, for example, the user wants to initiate the contact with the seller's WebRTC service when browsing the Taobao website, the third-party application here.
  • the website is the Taobao website
  • the WebRTC business is the business that contacts the seller.
  • the user will send a login request message to the WebRTC authentication system (the WebRTC portal is also included in the operator's Web authentication system, in fact, the user logs in to the WebRTC portal), and the login request message carries the Web.
  • Application ID ie the logo of the Taobao website in the above example).
  • the operator web authentication system authenticates the identity of the UE. After the authentication is passed, the authentication response message is sent to the UE.
  • the foregoing authentication response message carries the access code of the access IMS network and the address of the access device for the UE according to the identity of the UE and the web application identifier.
  • the operator's WebRTC authentication system authenticates the identity of the UE, that is, whether the identity of the UE is legal. After the identity of the UE is confirmed to be valid, the operator's WebRTC authentication system allocates an access code for accessing the IMS network to the UE, and connects The address of the access code and the access device is carried in the authentication response message and sent to the UE, so that the UE determines the corresponding access device according to the address of the access device.
  • S403 The UE sends a registration request message carrying an access code to the access device.
  • S404 The access device returns the access code to the operator WebRTC authentication system.
  • S405 The operator WebRTC authentication system verifies the access code.
  • the operator WebRTC authentication system can also send the user identity to the access device.
  • the WebRTC authentication system verifies the access code, and determines whether the access code is valid, that is, whether the access code carried in the registration request message of the UE is allocated to the UE by the previous operator WebRTC authentication system; If the access code is valid, the operator's WebRTC authentication system sends a web application identifier to the access device, so that the access device records the web application identifier.
  • the access device receives the user identifier from the WebRTC authentication system, the access device also records the user identity, where the user identity may be IMPU and IMPI.
  • S407 The access device sends a SIP registration message carrying the user identity to the S-CSCF.
  • S408 The S-CSCF sends a SIP success message to the access device.
  • S409 The access device sends a registration completion response message to the UE.
  • S410 The UE sends a WebRTC session request message to the access device.
  • the access device sends an invite message carrying the web application identifier to the S-CSCF.
  • S412 The S-CSCF forwards the foregoing invitation message to the AS.
  • the S-CSCF has previously recorded the user identity according to the SIP registration message. Therefore, the S-CSCF may also carry the user identity in the invitation message and forward it to the AS.
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE.
  • the service permission policy corresponding to the web application identifier is pre-configured on the AS, or is obtained by the AS from the HSS.
  • the service permission policy corresponding to the web application identifier may include a mapping relationship between the web application identifier and the service authority, that is, a service that the user can be allowed when accessing the IMS network from the web application website corresponding to the web application identifier.
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE, and may be: when the AS receives the web application identifier sent by the network device, the AS searches for the web application identifier according to the web application identifier.
  • the corresponding user's service authority combined with the UE's subscription service data, finds the user's service authority, and the intersection of the two is used to determine the service that the user can allow when accessing the IMS network.
  • the service authority determining method provided by the embodiment of the present invention sends a web application identifier to the network device of the IMS network by using the access device, and the network device forwards the web application identifier to the AS, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, thereby improving the accuracy of the network authority to control the service authority of the UE from the web application website to the IMS network.
  • FIG. 5 is a signaling flowchart of a method for determining a service authority according to a fifth embodiment of the present invention.
  • the embodiment provides a web application identifier in a WebRTC session request message sent by the UE to the access device, so that the AS is configured according to the web application.
  • S501 The UE sends a login request message carrying the web application identifier to the operator web authentication system.
  • the user first logs in to the third-party web application website through the UE. If the user wants to initiate the WebRTC service when browsing the third-party web application website, for example, the user wants to initiate the contact with the seller's WebRTC service when browsing the Taobao website, the third-party application here.
  • the website is the Taobao website
  • the WebRTC business is the business that contacts the seller.
  • the user will send a login request message to the WebRTC authentication system (the WebRTC portal is also included in the operator's Web authentication system, in fact, the user logs in to the WebRTC portal), and the login request message carries the Web.
  • Application ID ie the logo of the Taobao website in the above example).
  • the operator web authentication system authenticates the identity of the UE. After the authentication is passed, the authentication response message is sent to the UE.
  • the foregoing authentication response message carries the operator's WebRTC authentication system, according to the identity of the UE and the web application identifier, the UE is allocated an access code for accessing the IMS network and an address of the access device.
  • the operator web authentication system authenticates the identity of the UE, that is, confirms the identity of the UE. Whether it is legal or not, after the identity of the UE is confirmed to be valid, the operator's Web authentication system allocates an access code for accessing the IMS network to the UE, and carries the access code and the address of the access device in the authentication response message and sends the message to the UE.
  • the UE determines the corresponding access device according to the address of the access device.
  • S503 The UE sends a registration request message carrying an access code to the access device.
  • S504 The access device returns the access code to the operator WebRTC authentication system.
  • the WebRTC authentication system verifies the access code, and determines whether the access code is valid, that is, whether the access code carried in the registration request of the UE is allocated to the UE by the previous operator WebRTC authentication system; if yes, determining The access code is valid, and the operator's WebRTC authentication system sends the user identity to the access device, so that the access device records the user identity; wherein the identity identifier can be an IMPU and an IMPI.
  • S507 The access device sends a SIP registration message carrying the user identity to the S-CSCF.
  • S508 The I/S-CSCF sends a SIP success message to the access device.
  • the access device sends a registration completion response message to the UE.
  • the access device sends a SIP registration request message to the I/S-CSCF, and after receiving the registration request message, the I/S-CSCF records the identity of the UE, and returns a SIP success message to the access device;
  • the ingress device sends a registration completion response message to the UE to complete the entire registration process.
  • S510 The UE sends a WebRTC session request message carrying the web application identifier to the access device.
  • the access device sends an invite message to the I/S-CSCF, where the invite message carries the web application identifier in the WebRTC session request message.
  • S512 The S-CSCF forwards the foregoing invitation message to the AS.
  • the S-CSCF forwards the Web application identifier in the WebRTC session request message to the AS.
  • the S-CSCF may carry the previously recorded user identity and the Web application identifier in the invitation message and forward the message to the AS.
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE.
  • the service permission policy corresponding to the web application identifier is pre-configured on the AS, or is obtained by the AS from the HSS.
  • the service permission policy corresponding to the web application identifier may include a mapping relationship between the web application identifier and the service authority, that is, a service that the user can be allowed when accessing the IMS network from the web application website corresponding to the web application identifier.
  • the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE, and may be: when the AS receives the web application identifier sent by the network device, the AS searches for the web application identifier according to the web application identifier.
  • the corresponding user's service authority combined with the UE's subscription service data, finds the user's service authority, and the intersection of the two is used to determine the service that the user can allow when accessing the IMS network.
  • the service authority determining method provided by the embodiment of the present invention sends a web application identifier to the network device of the IMS network by using the access device, and the network device forwards the web application identifier to the AS, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, thereby improving the accuracy of the network authority to control the service authority of the UE from the web application website to the IMS network.
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.
  • FIG. 6 is a schematic structural diagram of Embodiment 1 of a service authority determining apparatus according to the present invention.
  • the apparatus includes: a receiving module 10, configured to receive a web application identifier sent by an access device; and a sending module 11 configured to: The web application identifier is sent to the AS, so that the AS determines the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE.
  • the service authority determining apparatus receives the web application identifier sent by the access device by using the receiving module, and sends the web application identifier to the AS through the sending module, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, thereby improving the accuracy of the service authority control for the UE to access the IMS network from the Web application website.
  • FIG. 7 is a schematic structural diagram of Embodiment 2 of a service authority determining apparatus according to the present invention.
  • the receiving module 10 includes: a first receiving unit 101, configured to receive the foregoing A SIP registration message sent by the device, where the SIP registration message carries a web application identifier.
  • the service authority determining apparatus provided by the embodiment of the present invention receives and carries by the first receiving unit
  • the SIP registration message of the web application identifier is sent to the AS by the sending module, so that the AS determines the service authority of the UE according to the service authority policy corresponding to the web application identifier and the subscription service data of the UE, thereby improving the network device to the UE.
  • the accuracy of the service authority control in the scenario of accessing the IMS network from the web application website.
  • FIG. 8 is a schematic structural diagram of Embodiment 3 of the service authority determining apparatus provided by the present invention.
  • the receiving module 10 includes: a second receiving unit 102, configured to receive an access device. An invitation message sent, where the invitation message carries a web application identifier.
  • the service authority determining apparatus receives the invitation message carrying the web application identifier by using the second receiving unit, and sends the web application identifier to the AS through the sending module, so that the AS according to the service authority policy corresponding to the web application identifier
  • the subscription service data of the UE determines the service authority of the UE, thereby improving the accuracy of controlling the service authority of the UE in the scenario of accessing the IMS network from the Web application website.
  • the first receiving unit 101 is specifically configured to receive a SIP registration message sent by the access device after receiving the web application identifier sent by the operator WebRTC authentication system; the web application identifier is verified by the operator WebRTC authentication system.
  • the second receiving unit 102 is configured to receive an invitation message sent by the access device after receiving the web application identifier sent by the operator's WebRTC authentication system; the web application identifier It is the above-mentioned operator WebRTC authentication system that transmits after verifying that the access code received from the access device is valid.
  • the foregoing second receiving unit 102 is specifically configured to receive an invitation message sent by the access device after receiving the session request message that carries the web application identifier sent by the UE.
  • the service permission policy corresponding to the foregoing web application identifier is pre-configured on the AS, or obtained by the AS from the HSS.
  • the operator of the WebRTC authentication system may send the user identity to the access device when sending the web application identifier to the access device.
  • the service authority determining apparatus receives the web application identifier sent by the access device by using the receiving module, and sends the web application identifier to the AS through the sending module, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, and improves the control of the service authority of the UE in the scenario of accessing the IMS network from the web application website. Accuracy.
  • FIG. 9 is a schematic structural diagram of Embodiment 4 of a service authority determining apparatus according to the present invention.
  • the apparatus includes: a receiving module 20, configured to receive a web application identifier sent by a network device; and a determining module 21, configured to The service permission policy corresponding to the web application identifier and the service subscription data of the UE determine the service authority of the UE.
  • the service permission policy corresponding to the foregoing web application identifier is pre-configured on the AS or acquired by the AS from the HSS.
  • the service authority determining apparatus receives the web application identifier sent by the network device by the receiving module, and the determining module determines the service authority of the UE according to the service right policy corresponding to the web application identifier and the contracted service data of the UE, thereby improving the pair.
  • the UE accesses the service authority control accuracy in the IMS network scenario from the web application website.
  • FIG. 10 is a schematic structural diagram of Embodiment 1 of a service authority determining apparatus according to the present invention.
  • the apparatus includes: a receiver 30 and a transmitter 31.
  • the receiver 30 is configured to receive the sending by the access device.
  • the web application identifier is configured to send the web application identifier to the AS, so that the AS determines the service authority of the UE according to the service right policy corresponding to the web application identifier and the service subscription data of the UE.
  • the service authority determining device receives the web application identifier sent by the access device through the receiver, and sends the web application identifier to the AS through the sender, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, and improves the accuracy of the service authority control for the UE to access the IMS network from the Web application website.
  • the receiver 31 is configured to receive a SIP registration message sent by the access device, where the SIP registration message carries a Web application identifier.
  • the receiver 31 is configured to receive an invite message sent by the access device, where the invite message carries the web application identifier.
  • the receiver 31 is specifically configured to receive a SIP registration message sent by the access device after receiving the web application identifier sent by the operator WebRTC authentication system; the web application identifier is the operator's WebRTC authentication system verifying the slave access device The received access code is sent after it is valid.
  • the receiver 31 is specifically configured to receive an invite message sent by the access device after receiving the web application identifier sent by the operator WebRTC authentication system; the web application identifier is The operator WebRTC authentication system transmits after verifying that the access code received from the access device is valid.
  • the receiver 31 is specifically configured to receive an invite message sent by the access device after receiving the session request message that carries the web application identifier sent by the UE.
  • the service permission policy corresponding to the foregoing web application identifier is pre-configured on the AS, or obtained by the AS from the HSS.
  • the operator of the WebRTC authentication system may send the user identity to the access device when sending the web application identifier to the access device.
  • the service authority determining device receives the web application identifier sent by the access device through the receiver, and sends the web application identifier to the AS through the sender, so that the AS according to the service authority policy and the UE corresponding to the web application identifier
  • the subscription service data determines the service authority of the UE, and improves the accuracy of the service authority control for the UE to access the IMS network from the Web application website.
  • FIG. 11 is a schematic structural diagram of Embodiment 2 of a service authority determining device according to the present invention.
  • the device includes: a receiver 40 and a processor 41.
  • the receiver 40 is configured to receive a web sent by the network device.
  • the application identifier is used by the processor 41 to determine the service authority of the UE according to the service permission policy corresponding to the web application identifier and the service subscription data of the UE.
  • the service permission policy corresponding to the foregoing web application identifier is pre-configured on the processor 41 or acquired by the processor 41 from the HSS.
  • the service authority determining device receives the web application identifier sent by the network device by using the receiver, and the processor determines the service authority of the UE according to the service right policy corresponding to the web application identifier and the subscription service data of the UE, thereby improving the pair.
  • the UE accesses the service authority control accuracy in the IMS network scenario from the web application website.
  • FIG. 12 is a schematic structural diagram of Embodiment 1 of a service authority determining system according to the present invention.
  • the system includes a first communications device 50 and a second communications device 51.
  • the first communication device 50 may include any of the service authority determining devices shown in FIG. 6 to FIG. 8; or may further include the service authority determining device shown in FIG.
  • the foregoing first communication device 50 may be an S-CSCF, an I-CSCF, or a P-CSCF.
  • the second communication device 51 may include the service authority determining device shown in Fig. 9 described above; or may further include the service authority determining device shown in Fig. 11.
  • the second communication device may be an AS.
  • the service authority determining system receives the network setting by using the first communication device
  • the second application device determines the service authority of the UE according to the service authority policy corresponding to the web application identifier and the subscription service data of the UE, thereby improving the service authority of the UE to access the IMS network scenario from the web application website. Control accuracy.

Abstract

本发明实施例提供一种业务权限确定方法和装置。该方法包括：接收接入设备发送的网页Web应用标识；将所述Web应用标识发送给应用服务器AS，以使所述AS根据所述Web应用标识对应的业务权限策略和用户设备UE的业务签约数据确定所述UE的业务权限。本发明实施例提供的业务权限确定的方法，用以解决现有技术无法对IMS用户从不同的第三方Web应用接入IMS网络进行精细化业务权限控制的技术问题。

Description

业务权限确定方法和装置
本申请要求了 2013年 9月 4日提交的、 申请号为 201310399717.3、 发明名称为 "业务权限确定方法和装置" 的中国申请的优先权， 其全部内 容通过引用结合在本申请中。 技术领域 本发明实施例涉及通信技术领域， 尤其涉及一种业务权限确定方法和装 置。 背景技术 第三代合作伙伴计划 （3rd Generation Partnership Project) 的网页实时 通信（Web Real-Time Communications, 以下简称 WebRTC)业务可以使得 互联网协议多媒体子系统（IP Multimedia Subsystem, 以下简称 IMS)用户 通过第三方网页（Web)应用接入 IMS网络进行通信， 实现 Web和 IMS用户 设备之间的互通， 运营商出于安全和运营的考虑， 需要根据运营商与第三 方 Web应用网站的信任关系， 控制 IMS用户接入 IMS网络的业务权限。
现有技术中， IMS用户直接与 IMS网络进行通信， 并且在进行通信时 需要与 IMS网络运营商进行相应业务的签约。 IMS用户在接入 IMS网络之 前， 向 IMS网络发起注册流程， 实现应用服务器 （Application Server, 以 下简称 AS ) 通过 HSS获取用户签约数据。 上述注册流程完成后， IMS用户 向 IMS网络发送 IMS网络的会话请求， IMS网络根据 AS中的用户签约数据 判断该 IMS用户是否和 IMS网络进行签约，进而决定是否接受该 IMS用户的 会话请求。
然而， 目前 IMS网络只能根据 IMS用户签约数据对业务权限进行控制， 无法对 IMS用户通过第三方 Web应用接入 IMS网络的业务进行准确的权限 控制。 发明内容 本发明实施例提供一种业务权限确定方法和装置， 用以解决现有技术无 法对 IMS用户通过第三方 Web应用接入 IMS网络进行精细化业务权限控制 的技术问题。
本发明实施例第一方面提供一种业务权限确定方法， 包括：
接收接入设备发送的网页 Web应用标识；
将所述 Web应用标识发送给应用服务器 AS,以使所述 AS根据所述 Web 应用标识对应的业务权限策略和用户设备 UE 的业务签约数据确定所述 UE 的业务权限。
结合第一方面， 在第一方面的第一种可能的实施方式中， 所述接收接入 设备发送的 Web应用标识， 包括：
接收所述接入设备发送的会话初始化协议 SIP注册消息， 所述 SIP注册 消息中携带所述 Web应用标识。
结合第一方面， 在第一方面的第二种可能的实施方式中， 所述接收接入 设备发送的 Web应用标识， 包括：
接收所述接入设备发送的邀请消息， 所述邀请消息中携带所述 Web应用 标识。
结合第一方面的第一种可能的实施方式， 在第一方面的第三种可能的实 施方式中， 所述接收所述接入设备发送的 SIP注册消息， 具体包括：
接收所述接入设备在接收运营商网页实时通信 WebRTC认证系统发送的 所述 Web应用标识之后发送的所述 SIP注册消息；所述 Web应用标识是所述 运营商 WebRTC认证系统在验证从接入设备接收的接入码有效后发送的。
结合第一方面的第二种可能的实施方式， 在第一方面的第四种可能的实 施方式中， 所述接收所述接入设备发送的邀请消息， 具体包括：
接收所述接入设备在接收运营商 WebRTC认证系统发送的所述 Web应用 标识之后发送的所述邀请消息；所述 Web应用标识是所述运营商 WebRTC认 证系统在验证从接入设备接收的接入码有效后发送的。
结合第一方面的第二种可能的实施方式， 在第一方面的第五种可能的实 施方式中， 接收所述接入设备在接收到所述 UE发送的携带所述 Web应用标 识的会话请求消息之后发送的所述邀请消息。
结合第一方面至第一方面的第五种可能的实施方式中的任一项， 在第一 方面的第六种可能的实施方式中，所述 Web应用标识对应的业务权限策略为 预先配置在所述 AS上， 或者由所述 AS从归属用户服务器 HSS中获取。
本发明实施例第二方面提供一种业务权限确定方法， 包括：
应用服务器 AS接收网络设备发送的网页 Web应用标识；
根据所述 Web应用标识对应的业务权限策略和用户设备 UE的业务签约 数据确定所述 UE的业务权限。
结合第二方面， 在第二方面的第二种可能的实施方式中， 所述 Web应用 标识对应的业务权限策略为预先配置在所述 AS上或者由所述 AS从归属用户 服务器 HSS中获取的。
本发明实施例第三方面提供一种业务权限确定装置， 包括：
接收模块， 用于接收接入设备发送的网页 Web应用标识；
发送模块， 用于将所述 Web应用标识发送给应用服务器 AS, 以使所述
AS根据所述 Web应用标识对应的业务权限策略和用户设备 UE的业务签约 数据确定所述 UE的业务权限。
结合第三方面， 在第三方面的第一种可能的实施方式中， 所述接收模块 具体包括：
第一接收单元， 用于接收所述接入设备发送的会话初始化协议 SIP注册 消息， 所述 SIP注册消息中携带所述 Web应用标识。
结合第三方面， 在第三方面的第二种可能的实施方式中， 所述接收模块 具体包括：
第二接收单元， 用于接收所述接入设备发送的邀请消息， 所述邀请消息 中携带所述 Web应用标识。
结合第三方面的第一种可能的实施方式， 在第三方面的第三种可能的实 施方式中， 所述第一接收单元具体用于接收所述接入设备在接收运营商网页 实时通信 WebRTC认证系统发送的所述 Web应用标识之后发送的所述 SIP注 册消息；所述 Web应用标识是所述运营商 WebRTC认证系统在验证从接入设 备接收的接入码有效后发送的。
结合第三方面的第二种可能的实施方式， 在第三方面的第四种可能的实 施方式中， 所述第二接收单元具体用于接收所述接入设备在接收运营商 WebRTC认证系统发送的所述 Web应用标识之后发送的所述邀请消息； 所述 Web应用标识是所述运营商 WebRTC认证系统在验证从接入设备接收的接入 码有效后发送的。
结合第三方面的第二种可能的实施方式， 在第三方面的第五种可能的实 施方式中， 所述第二接收单元具体用于接收所述接入设备在接收到所述 UE 发送的携带所述 Web应用标识的会话请求消息之后发送的所述邀请消息。
结合第三方面至第三方面的第五种可能的实施方式中的任一项， 在第三 方面的第六种可能的实施方式中，所述 Web应用标识对应的业务权限策略为 预先配置在所述 AS上， 或者由所述 AS从归属用户服务器 HSS中获取。
本发明实施例第四方面提供一种业务权限确定装置， 包括：
接收模块， 用于接收网络设备发送的网页 Web应用标识；
确定模块， 用于根据所述 Web应用标识对应的业务权限策略和用户设备 UE的业务签约数据确定所述 UE的业务权限。
结合第四方面， 在第四方面的第一种可能的实施方式中， 所述 Web应用 标识对应的业务权限策略为预先配置在所述 AS上或者由所述 AS从归属用户 服务器 HSS中获取的。
本发明实施例提供的业务权限确定方法， 通过接入设备向 IMS网络的网 络设备发送 Web应用标识， 网络设备将该 Web应用标识转发给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，进而提高网络设备对 UE从 Web应用网站接入 IMS网络场景下的 权限控制准确度。 附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案， 下面将对实 施例或现有技术描述中所需要使用的附图做一简单地介绍， 显而易见地， 下 面描述中的附图是本发明的一些实施例， 对于本领域普通技术人员来讲， 在 不付出创造性劳动性的前提下， 还可以根据这些附图获得其他的附图。
图 1为本发明提供的业务权限确定方法实施例一的流程示意图； 图 2为本发明提供的业务权限确定方法实施例二的流程示意图； 图 3为本发明提供的业务权限确定方法实施例三的信令流程图； 图 4为本发明提供的业务权限确定方法实施例四的信令流程图； 图 5为本发明提供的业务权限确定方法实施例五的信令流程图； 图 6为本发明提供的业务权限确定装置实施例一的结构示意图； 图 7为本发明提供的业务权限确定装置实施例二的结构示意图； 图 8为本发明提供的业务权限确定装置实施例三的结构示意图； 图 9为本发明提供的业务权限确定装置实施例四的结构示意图； 图 10为本发明提供的业务权限确定设备实施例一的结构示意图； 图 11为本发明提供的业务权限确定设备实施例二的结构示意图； 图 12为本发明提供的业务权限确定系统实施例一的结构示意图。 具体实施方式
为使本发明实施例的目的、 技术方案和优点更加清楚， 下面将结合本发 明实施例中的附图， 对本发明实施例中的技术方案进行清楚、 完整地描述， 显然， 所描述的实施例是本发明一部分实施例， 而不是全部的实施例。 基于 本发明中的实施例， 本领域普通技术人员在没有做出创造性劳动前提下所获 得的所有其他实施例， 都属于本发明保护的范围。
本申请中涉及的用户设备， 可以是无线终端也可以是有线终端， 无线终 端可以是指向用户提供语音和 /或数据连通性的设备， 具有无线连接功能的手 持式设备、 或连接到无线调制解调器的其他处理设备。 无线终端可以经无线 接入网（例如， RAN, Radio Access Network)与一个或多个核心网进行通信， 无线终端可以是移动终端， 如移动电话 （或称为"蜂窝"电话） 和具有移动终 端的计算机， 例如， 可以是便携式、 袖珍式、 手持式、 计算机内置的或者车 载的移动装置， 它们与无线接入网交换语言和 /或数据。 例如， 个人通信业务 (PCS , Personal Communication Service)电话、无绳电话、会话发起协议（SIP) 话机、无线本地环路（WLL， Wireless Local Loop)站、个人数字助理（PDA, Personal Digital Assistant ) 等设备。 无线终端也可以称为系统、 订户单元 ( Subscriber Unit)、 订户站 ( Subscriber Station) , 移动站 （Mobile Station )、 移动台 （Mobile)、 远程站 （Remote Station ) 接入点 （Access Point ) 远程 终端 （Remote Terminal )、 接入终端 （Access Terminal )、 用户终端 （User Terminal )、用户代理（ User Agent )、用户设备（ User Device )、或用户装备（ User Equipment)。 图 1为本发明提供的业务权限确定方法实施例一的流程示意图， 本实施 例提供了 UE通过 Web应用网站接入 IMS网络的业务权限确定方法。 以下歩 骤的执行主体为 IMS网络侧的网络设备， 该网络设备可以是查询会话呼叫控 制 (Interrogating Call Session Control Function, 以下简称 I-CSCF) 网元服务 器， 还可以是服务会话呼叫控制 （Service Call Session Control Function, 以下 简称 S-CSCF) 网元服务器， 还可以是代理会话呼叫控制（(Proxy Call Session Control Function, 以下简称 P-CSCF) 网元服务器， 本发明实施例对此不做限 制； 本发明实施例中的网络设备是以 S-CSCF举例来说明的。 如图 1所示， 本实施例的方法包括：
S101 : 接收接入设备发送的 Web应用标识。
本发明实施例中， 可以通过不同的身份标识来区分 UE， 身份标识可以是 例如用户身份识别卡（Subscriber Identity Module, 以下简称 SIM)卡的卡号， 当然也不局限于此。
用户通过 UE登录到第三方 Web应用网站， 若该用户在浏览第三方 Web 应用网站时欲发起 WebRTC业务， 例如： 用户在浏览淘宝网站的时候想发起 联系卖家的 WebRTC业务。 这里的第三方应用网站就是淘宝网站， WebRTC 业务就是联系卖家的业务。 此时该用户会通过 UE向运营商 WebRTC认证系 统发送登录请求消息 （这里的运营商 Web认证系统里也包括了 WebRTC门 户网站服务器， 实际上是用户登录到 WebRTC门户网站上） ， 该登录请求消 息中携带 Web应用标识（即上述例子中的淘宝网站的标识）。运营商 WebRTC 认证系统对该登录请求消息进行一系列处理后， 将 WebRTC应用标识发送给 接入设备， 使得接入设备向网络设备发送 Web应用标识； 同时， 接入设备还 可以从运营商 WebRTC认证系统中获取用户身份标识， 并将用户身份标识发 送给网络设备， 使得网络设备能够根据该用户身份标识获知 UE 的身份。 其 中，上述接入设备可以为 WebRTC网关， 还可以为其他接入 IMS网络的具有 接入网络功能的设备。并且接入设备向网络设备发送的 Web应用标识可以携 带在注册消息中， 还可以携带在邀请消息中， 或者还可以携带在其他消息中， 本发明实施例对此不做限制。
S102: 将 Web应用标识发送给 AS, 以使 AS根据 Web应用标识对应的 业务权限策略和 UE的业务签约数据确定 UE的业务权限。 具体的， 网络设备将上述 Web应用标识发送给 AS; AS在接收到 Web 应用标识后， 根据自身所存储的 UE的签约业务数据和上述 Web应用标识对 应的业务权限策略确定拒绝或者接受该 UE接入 IMS网络时的业务权限。
其中， 上述 Web应用标识对应的业务权限策略可以包括该 Web应用标 识与 UE的业务权限的映射关系； 该 Web应用标识对应的业务权限策略是用 户从该 Web应用标识对应的 Web应用网站接入 IMS网络时所能被允许的业
AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的业务权限， 具体可以是： 当 AS接收到网络设备转发的 Web应用标识 时， 根据该 Web应用标识查找该 Web应用标识所对应的用户的业务权限， 并结合该用户的身份标识在 UE 的签约业务数据中查找该用户的业务权限， 取二者的交集， 来确定用户接入 IMS网络时所能被允许的业务。
以下以一个具体的例子进行说明，假设用户 A想要在 IMS网络中实现视 频业务、 语音业务、 短信业务， 在 AS中存储的用户与 IMS网络签约的业务 为语音业务和短信业务， 如果按照现有技术来处理的话， 用户 A在向 IMS网 路发起视频业务的会话请求时， 就会被 IMS网络拒绝， 而发起语音和短信业 务的会话请求时， 就会被 IMS网络所接受。 但是， 往往会出现当用户 A通过 不同的 Web应用网站接入 IMS网络，所能被 IMS网络接受的业务是不同的， 例如： 当用户 A通过应用网站 A接入 IMS网络， 并向 IMS网络发起语音业 务的会话请求， 被 IMS网络接受； 当用户 A通过网站 B接入 IMS网络， 并 向 IMS网络发起语音业务的会话请求时， 却被 IMS网络拒绝接入， 从而使得 用户通信不能保障。 但是在本发明实施例中， AS中除了存储 UE的业务签约 数据， 还存储了不同的 Web应用标识对应的不同的业务权限策略， 例如： 应 用网站 B对应的用户 A的业务权限只有短信业务， 那么结合 UE的签约数据 中规定的用户 A的业务权限 （用户 A与 IMS网络签约的业务是语音业务和 短信业务）， 二者综合评估， 则确定的用户 A通过网站 B接入 IMS网络的业 务权限就只有短信业务， 使得网络设备对于 UE的 WebRTC业务权限控制更 精确。
本发明实施例提供的业务权限确定方法， 通过接入设备向 IMS网络的网 络设备发送 Web应用标识， 网络设备将该 Web应用标识转发给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，进而提高网络设备对 UE从 Web应用网站接入 IMS网络场景下的 权限控制准确度。
进一歩地， 在图 1所示实施例的基础上， 作为本发明实施例的一种可行 的实施方式， 本实施例提供了网络设备从接入设备中获取 Web应用标识的具 体方式， 即上述 S101 具体为： 接收接入设备发送的会话初始化协议 (Session Initiation Protocol, 以下简称 SIP)注册消息，该 SIP注册消息中携带上述 Web 应用标识。
具体的， 如图 1所示的实施例所描述的， UE在登录到第三方 Web应用 网站后向 WebRTC认证系统发送登录请求消息， 该登录请求消息中携带了该 第三方 Web应用网站的 Web应用标识。 运营商 Web认证系统接收该登录请 求消息并认证该用户身份是否合法， 并确定该用户身份标识。 认证通过后， 运营商 Web认证系统会向 UE发送认证响应消息， 该认证响应消息中携带了 接入码，且该接入码为运营商 WebRTC认证系统根据该 UE的身份和 Web应 用标识为该 UE分配通过当前的第三方 Web 应用网站接入网络设备的接入 码； 该认证响应消息中还携带了接入设备的地址。 UE在接收到上述认证响应 消息之后， 根据该认证响应消息中的接入设备的地址向对应的接入设备发送 注册请求消息， 并且该注册请求消息中携带接入码。
之后， 运营商 WebRTC认证系统根据上述接入码进行一系列的处理， 将 上述 Web应用标识发送给接入设备。接入设备此时会向网络设备发起 SIP注 册流程， 即向网络设备发送 SIP注册消息， 该 SIP注册消息中携带 Web应用 标识。网络设备接收到接入设备发送的 SIP注册消息后， 向接入设备发送 SIP 成功消息， 以使得接入设备告知 UE注册流程结束。 后续， UE可以向接入设 备发起会话流程。
上述会话流程具体为： UE向接入设备发送 WebRTC会话请求消息， 接 入设备在接收到该 WebRTC 会话请求消息之后， 向网络设备发送邀请 (INVITE)消息。之后， 网络设备将之前从 SIP注册消息中获取的 Web应用 标识携带在所接收到的邀请消息中转发给 AS, 使得 AS 根据自身所存储的 UE的业务签约数据和上述 Web应用标识对应的业务权限策略确定拒绝或者 接受该 UE接入 IMS网络时发起的会话请求。 需要注意的是， AS中存储的 Web应用标识对应的业务权限策略可以是预先配置在 AS上的，还可以是 AS 从归属用户服务器 （Home Subscriber Server, 以下简称 HSS) 中获取的。
进一歩地， 在图 1所示实施例的基础上， 作为本发明实施例的另一种可 行的实施方式， 本实施例提供了网络设备从接入设备中获取 Web应用标识的 另一种具体方式， 即上述 S101还可以为： 接收接入设备发送的邀请消息， 该 邀请消息中携带 Web应用标识。
具体的， 如图 1所示的实施例所描述的， UE在登录到第三方 Web应用 网站后向 WebRTC认证系统发送登录请求消息， 该登录请求消息中携带了该 第三方 Web应用网站的 Web应用标识。 运营商 Web认证系统接收该登录请 求消息并认证该用户身份是否合法， 并确定该用户身份标识。 认证通过后， 运营商 Web认证系统会向 UE发送认证响应消息， 该认证响应消息中携带了 接入码， 且该接入码为运营商 WebRTC认证系统根据该用户身份和 Web应 用标识为该 UE分配通过当前的第三方 Web 应用网站接入网络设备的接入 码； 该认证响应消息中还携带了接入设备的地址。 UE在接收到上述认证响应 消息之后， 根据该认证响应消息中的接入设备的地址向对应的接入设备发送 注册请求消息， 并且该注册请求消息中携带接入码。
之后， 运营商 WebRTC认证系统根据上述接入码进行一系列的处理， 将 上述 Web应用标识发送给接入设备。接入设备此时会向网络设备发起 SIP注 册流程， 即向网络设备发送 SIP注册消息， 该 SIP注册消息中携带了用户身 份标识 （并未携带 Web应用标识） 。 网络设备接收到接入设备发送的 SIP注 册消息后， 向接入设备发送 SIP成功消息， 以使得接入设备告知 UE注册流 程结束。 后续， UE可以向接入设备发起会话流程。
上述会话流程具体为： UE向接入设备发送 WebRTC会话请求消息， 接 入设备在接收到该 WebRTC会话请求消息之后，将之前从运营商 WebRTC认 证系统获取的 Web应用标识和用户身份标识携带在邀请消息中发送给网络设 备。 之后， 网络设备将该携带 Web应用标识和用户身份标识的邀请消息转发 给 AS,使得 AS根据自身所存储的 UE的签约业务数据和上述 Web应用标识 对应的业务权限策略确定拒绝或者接受该 UE接入 IMS网络时发起的会话请 求。 需要注意的是， AS中存储的 Web应用标识对应的业务权限策略可以是 预先配置在 AS上的， 还可以是 AS从 HSS中获取的。 进一歩地， 在图 1所示实施例的基础上， 作为本发明实施例的第三种可 行的实施方式， 本实施例提供了网络设备从接入设备中获取 Web应用标识的 另一种具体方式， 即上述接收接入设备发送的邀请消息， 具体包括： 接收接 入设备在接收到 UE发送的携带 Web应用标识的会话请求消息之后发送的邀 请消息。
具体的， 如图 1所示实施例所描述的， UE在登录到第三方 Web应用网 站后向 WebRTC认证系统发送登录请求消息， 该登录请求消息中携带了该第 三方 Web应用网站的 Web应用标识。 运营商 Web认证系统接收该登录请求 消息并认证该用户身份是否合法， 并确定该用户身份标识。 认证通过后， 运 营商 Web认证系统会向 UE发送认证响应消息， 该认证响应消息中携带了接 入码， 且该接入码为运营商 WebRTC认证系统根据该用户身份和 Web应用 标识为该 UE分配通过当前的第三方 Web应用网站接入网络设备的接入码， 并且该认证响应消息中还携带了接入设备的地址。 UE在接收到上述认证响应 消息之后， 根据该认证响应消息中的接入设备的地址向对应的接入设备发送 注册请求消息， 并且该注册请求消息中携带接入码。
之后， 运营商 WebRTC认证系统根据上述接入码进行一系列的处理， 将 用户身份标识发送给接入设备。 接入设备此时会向网络设备发起 SIP注册流 程， 即向网络设备发送 SIP注册消息， 该 SIP注册消息中携带了用户身份标 识 （并未携带 Web应用标识） 。 网络设备接收到接入设备发送的 SIP注册消 息后， 向接入设备发送 SIP成功消息， 以使得接入设备告知 UE注册流程结 束。 后续， UE可以向接入设备发起会话流程。
上述会话流程具体为： UE向接入设备发送 WebRTC会话请求消息， 该 WebRTC 会话请求消息中携带了 Web 应用标识。 接入设备在接收到该 WebRTC会话请求消息之后， 将从 WebRTC会话请求消息中获取的 Web应 用标识携带在邀请消息中发送给网络设备。 之后， 网络设备将该携带 Web应 用标识的邀请消息转发给 AS, 使得 AS根据自身所存储的 UE的签约业务数 据和上述 Web 应用标识对应的业务权限策略确定拒绝或者接受该 UE接入 IMS网络时发起的会话请求。 需要注意的是， AS中存储的 Web应用标识对 应的业务权限策略可以是预先配置在 AS上的， 还可以是 AS从 HSS中获取 的。 本发明实施例提供的业务权限确定方法， 通过接入设备向 IMS网络的网 络设备发送 Web应用标识， 网络设备将该 Web应用标识转发给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，进而提高网络设备对 UE从 Web应用网站接入 IMS网络场景下的 权限控制准确度。
在上述实施例的基础上， 本发明实施例提供了接入设备在获取 UE发送 的携带接入码的注册请求消息后， 网络设备接收 SIP注册消息或邀请消息的 具体流程， 包括：
接入设备在接收到 UE发送的携带接入码的注册请求消息后， 将该接入 码发送给运营商 WebRTC认证系统，使得 WebRTC认证系统对接入码进行验 证， 识别该接入码是否有效， 即判断 UE 的注册请求消息中携带的接入码是 否为之前运营商 WebRTC认证系统分配给该 UE的。若是，则运营商 WebRTC 认证系统向接入设备发送用户身份标识和 Web应用标识， 并且该用户身份标 识可以为 IP多媒体公共标识（IP Multimedia Public Identity, 以下简称 IMPU) 和 IP多媒体私有标识（IP Multimedia Private Identity, 以下简称 IMPI)。而后， 接入设备向网络设备发送携带 Web应用标识的 SIP注册消息或者邀请消息。
本发明实施例提供的业务权限确定方法， 通过接入设备向 IMS网络的网 络设备发送 Web应用标识， 网络设备将该 Web应用标识转发给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，进而提高网络设备对 UE从 Web应用网站接入 IMS网络场景下的 权限控制准确度。
图 2为本发明提供的业务权限确定方法实施例二的流程示意图， 本实施 例提供了 UE通过 Web应用网站接入 IMS网络的过程中， AS对 UE业务权 限的确定方法。 如图 2所示， 该方法包括：
S201 : AS接收网络设备发送的 Web应用标识。
其中， 该网络设备可以是 I-CSCF网元服务器， 还可以 S-CSCF网元服务 器， 还可以是 P-CSCF 网元服务器， 本发明实施例对此不做限制。 并且， 网 络设备发送给 AS的 Web应用标识可以携带邀请消息中， 还可以携带在其他 的消息中。
S202: AS根据上述 Web应用标识对应的业务权限策略和 UE的业务签 约数据确定 UE的业务权限。
具体的， 上述 Web应用标识对应的业务权限策略可以包括该 Web应用 标识与业务权限的映射关系， 即用户从该 Web应用标识对应的 Web应用网 站接入 IMS网络时所能被允许的业务。 AS根据 Web应用标识对应的业务权 限策略和 UE的业务签约数据确定 UE的业务权限， 具体可以是： 当 AS接收 到网络设备发送的 Web应用标识时， 根据该 Web应用标识查找该 Web应用 标识所对应的用户的业务权限， 并结合该用户的身份标识在 UE 的签约业务 数据中查找该用户的业务权限， 取二者的交集， 从而来确定用户接入 IMS网 络时所能被允许的业务。
其中， AS中存储的 Web应用标识对应的业务权限策略可以是预先配置 在 AS上的， 还可以是 AS从 HSS中获取。 进一歩的， AS从 HSS中获取的 业务权限策略可以是在 UE向接入设备发起注册流程时从 HSS获取的。
可选的， 在网络设备向 AS发送 Web应用标识之前， 还可以有以下注册 流程：
用户通过 UE登录到第三方 Web应用网站， 若该用户在浏览第三方 Web 应用网站时欲发起 WebRTC业务， 例如： 用户在浏览淘宝网站的时候想发起 联系卖家的 WebRTC业务， 这里的第三方应用网站就是淘宝网站， WebRTC 业务就是联系卖家的业务。 此时该用户会通过 UE向 WebRTC认证系统发送 登录请求消息 （这里的运营商 Web认证系统里也包括了 WebRTC门户网站 服务器， 实际上是用户登录到 WebRTC门户网站上） ， 该登录请求消息中携 带了 Web应用标识 （即上述例子中的淘宝网站的标识） 。
运营商 Web认证系统接收该登录请求消息并认证该用户身份， 确定该用 户身份标识；认证通过后，运营商 Web认证系统会向 UE发送认证响应消息， 该认证响应消息中携带了接入码， 且该接入码为运营商 WebRTC认证系统根 据该用户身份和 Web应用标识为该 UE分配通过当前的 Web应用网站接入 IMS网络的接入码； 该认证响应消息中还携带了接入设备的地址。
之后， 接入设备将上述接入码发送给运营商 WebRTC 认证系统， 使得 WebRTC认证系统对该接入码进行验证，识别该接入码是否有效， 即判断 UE 的注册请求消息中携带的接入码是否为运营商 WebRTC认证系统之前为 UE 分配的； 若是， 则运营商 WebRTC认证系统向接入设备发送用户身份标识， 该身份标识可以为 IMPU和 IMPI。接入设备记录该用户身份标识后向网络设 备发送 SIP注册消息， 以使得网络设备发送 SIP成功消息给接入设备， 进而 完成注册流程。
本发明实施例提供的方法，通过 AS接收网络设备发送的 Web应用标识， 并根据所存储的 Web应用标识对应的业务权限策略和 UE的业务签约数据确 定该 UE的业务权限， 从而提高 AS对 UE从 Web应用网站接入 IMS网络场 景下的业务权限控制准确度。
图 3为本发明提供的业务权限确定方法实施例三的信令流程图， 本实施 例提供了在接入设备发送给网络设备的 SIP注册消息中携带 Web应用标识， 以使 AS根据该 Web应用标识确定 UE的业务权限的过程。 本发明实施例中 网络设备以 S-CSCF为例。 如图 3所示， 该方法具体包括：
S301 : UE向运营商 WebRTC认证系统发送携带 Web应用标识的登录请 求消息。
具体的， 本发明实施例中， 可以通过不同的身份标识来区分 UE， 身份标 识可以是例如 SIM卡的卡号等。
用户首先通过 UE登录到第三方 Web应用网站， 若该用户在浏览第三方 Web应用网站时欲发起 WebRTC业务， 例如： 用户在浏览淘宝网站的时候想 发起联系卖家的 WebRTC 业务， 这里的第三方应用网站就是淘宝网站， WebRTC业务就是联系卖家的业务。此时该用户会向 WebRTC认证系统发送 登录请求消息 （这里的运营商 Web认证系统里也包括了 WebRTC门户网站， 实际上是用户登录到 WebRTC 门户网站上） ， 且在登录请求消息中携带了 Web应用标识 （即上述例子中的淘宝网站的标识） 。
S302: 运营商 Web认证系统对该 UE的身份进行认证； 认证通过后， 向 UE发送认证响应消息。
具体的， 上述认证响应消息中携带运营商 WebRTC认证系统根据该 UE 的身份和 Web应用标识为该 UE分配接入 IMS网络的接入码以及接入设备的 地址。 运营商 WebRTC认证系统对该 UE的身份进行认证， 即确认该 UE的 身份是否合法， 待确认 UE的身份合法后， 运营商 Web认证系统为 UE分配 接入 IMS网络的接入码， 并将接入码和接入设备的地址携带在认证响应消息 中发送给 UE， 使得 UE根据接入设备的地址确定对应的接入设备。 S303: UE向接入设备发送携带接入码的注册请求消息。
S304: 接入设备将接入码返回给运营商 WebRTC认证系统。
S305: 运营商 WebRTC认证系统对该接入码进行验证。
S306: 若上述接入码有效， 则接入设备接收运营商 WebRTC认证系统发 送的 Web应用标识。
可选的， WebRTC认证系统同时也可以发送用户身份标识给接入设备。 具体的， WebRTC认证系统对该接入码进行验证， 识别该接入码是否有 效， 即判断 UE的注册请求消息中携带的接入码是不是之前运营商 WebRTC 认证系统分配给 UE的； 若是， 判断该接入码有效， 则运营商 WebRTC认证 系统向接入设备发送 Web应用标识， 以使接入设备记录该 Web应用标识。 可选的， 如果接入设备从 WebRTC认证系统接收的还有用户标识， 那么接入 设备也会记录用户身份标识， 其中， 该用户身份标识可以为 IMPU和 IMPI。
S307: 接入设备向 S-CSCF发送 SIP注册消息。
其中，该 SIP注册消息中携带 Web应用标识，也可以携带用户身份标识； S-CSCF接收到 SIP注册消息后， 记录 Web应用标识。 可选的， 如果 S-CSCF 接收到的 SIP注册消息中携带了用户身份标识和 Web应用标识，那么 S-CSCF 记录用户身份标识和 Web应用标识。
S308: S-CSCF向接入设备发送 SIP成功消息。
S309: 接入设备向 UE发送注册完成响应消息。
S310: UE向接入设备发送 WebRTC会话请求消息。
S311 : 接入设备向 S-CSCF发送邀请消息。
S312: S-CSCF将 Web应用标识携带在上述邀请消息后转发给 AS。
具体的，之前 S-CSCF已经记录 Web应用标识， 因此将 Web应用标识携 带在上述邀请消息中转发给 AS。
S313: AS根据该 Web应用标识对应的业务权限策略和 UE的业务签约 数据确定 UE的业务权限。
可选的， 所述 Web应用标识对应的业务权限策略为预先配置在所述 AS 上， 或者由所述 AS从 HSS中获取。
上述 Web应用标识对应的业务权限策略可以包括该 Web应用标识与业 务权限的映射关系，即用户从该 Web应用标识对应的 Web应用网站接入 IMS 网络时所能被允许的业务。 AS根据 Web应用标识对应的业务权限策略和 UE 的业务签约数据确定 UE的业务权限， 具体可以是： 当 AS接收到网络设备发 送的 Web应用标识时， 根据该 Web应用标识在查找该 Web应用标识所对应 的用户的业务权限， 并结合 UE 的签约业务数据中查找该用户的业务权限， 取二者的交集， 来确定用户接入 IMS网络时所能被允许的业务。
通过本实施例提供的业务权限确定方法， 接入设备向 IMS网络的网络设 备发送 Web应用标识， 网络设备将该 Web应用标识转发给 AS, 使得 AS根 据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的业务 权限，进而提高网络设备对 UE从 Web应用网站接入 IMS网络场景下的业务 权限控制准确度。
图 4为本发明提供的业务权限确定方法实施例四的信令流程图， 本实施 例涉及提供了接入设备发送给网络设备的 SIP注册消息中不携带 Web应用标 识， 而是将 Web应用标识携带在接入设备发送给网络设备的邀请消息中， 使 得 AS从网络设备中获取 Web应用标识， 并根据该 Web应用标识确定 UE的 业务权限的过程， 此处的网络设备仍然以 S-CSCF来举例。 如图 4所示， 该 方法包括：
S401 : UE向运营商 Web认证系统发送携带 Web应用标识的登录请求消 息。
用户首先通过 UE登录到第三方 Web应用网站， 若该用户在浏览第三方 Web应用网站时欲发起 WebRTC业务， 例如： 用户在浏览淘宝网站的时候想 发起联系卖家的 WebRTC 业务， 这里的第三方应用网站就是淘宝网站， WebRTC业务就是联系卖家的业务。此时该用户会向 WebRTC认证系统发送 登录请求消息 （这里的运营商 Web认证系统里也包括了 WebRTC门户网站， 实际上是用户登录到 WebRTC 门户网站上） ， 且在登录请求消息中携带了 Web应用标识 （即上述例子中的淘宝网站的标识） 。
S402: 运营商 Web认证系统对该 UE的身份进行认证； 认证通过后， 向 UE发送认证响应消息。
具体的， 上述认证响应消息中携带运营商 Web认证系统根据该 UE的身 份和 Web应用标识为该 UE分配接入 IMS网络的接入码以及接入设备的地 址。 运营商 WebRTC认证系统对该 UE的身份进行认证， 即确认该 UE的身 份是否合法， 待确认 UE的身份合法后， 运营商 WebRTC认证系统为 UE分 配接入 IMS网络的接入码， 并将接入码和接入设备的地址携带在认证响应消 息中发送给 UE， 使得 UE根据接入设备的地址确定对应的接入设备。
S403: UE向接入设备发送携带接入码的注册请求消息。
S404: 接入设备将接入码返回给运营商 WebRTC认证系统。
S405: 运营商 WebRTC认证系统对该接入码进行验证。
S406: 若上述接入码有效， 则接入设备接收运营商 WebRTC认证系统发 送的 Web应用标识。
可选的， 运营商 WebRTC认证系统同时也可以发送用户身份标识给接入 设备。
具体的， WebRTC认证系统对该接入码进行验证， 识别该接入码是否有 效， 即判断 UE的注册请求消息中携带的接入码是否为之前运营商 WebRTC 认证系统分配给 UE的； 若是， 判断该接入码有效， 则运营商 WebRTC认证 系统向接入设备发送 Web应用标识， 以使接入设备记录 Web应用标识。 可 选的， 如果接入设备从 WebRTC认证系统接收的还有用户标识， 那么接入设 备也会记录用户身份标识， 其中， 该用户身份标识可以为 IMPU和 IMPI。
S407: 接入设备向 S-CSCF发送携带用户身份标识的 SIP注册消息。
S408: S-CSCF向接入设备发送 SIP成功消息。
S409: 接入设备向 UE发送注册完成响应消息。
S410: UE向接入设备发送 WebRTC会话请求消息。
S411 : 接入设备向 S-CSCF发送携带 Web应用标识的邀请消息。
S412: S-CSCF将上述邀请消息转发给 AS。
具体的， 之前 S-CSCF 已经根据 SIP注册消息记录了用户身份标识， 因 此， 可选的， S-CSCF还可以将用户身份标识也携带在上述邀请消息中转发 给 AS。
S413: AS根据该 Web应用标识对应的业务权限策略和 UE的业务签约 数据确定 UE的业务权限。
可选的， 所述 Web应用标识对应的业务权限策略为预先配置在所述 AS 上， 或者由所述 AS从 HSS中获取。 上述 Web应用标识对应的业务权限策略可以包括该 Web应用标识与业 务权限的映射关系，即用户从该 Web应用标识对应的 Web应用网站接入 IMS 网络时所能被允许的业务。 AS根据 Web应用标识对应的业务权限策略和 UE 的业务签约数据确定 UE的业务权限， 具体可以是： 当 AS接收到网络设备发 送的 Web应用标识时， 根据该 Web应用标识在查找该 Web应用标识所对应 的用户的业务权限， 并结合 UE 的签约业务数据中查找该用户的业务权限， 取二者的交集， 来确定用户接入 IMS网络时所能被允许的业务。
本发明实施例提供的业务权限确定方法， 通过接入设备向 IMS网络的网 络设备发送 Web应用标识， 网络设备将该 Web应用标识转发给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，进而提高网络设备对 UE从 Web应用网站接入 IMS网络场景下的 业务权限控制准确度。
图 5为本发明提供的业务权限确定方法实施例五的信令流程图， 本实施 例提供了在 UE发送给接入设备的 WebRTC会话请求消息中携带 Web应用标 识， 以使 AS根据该 Web应用标识确定 UE的业务权限的过程。如图 5所示， 该方法具体包括：
S501 : UE向运营商 Web认证系统发送携带 Web应用标识的登录请求消 息。
用户首先通过 UE登录到第三方 Web应用网站， 若该用户在浏览第三方 Web应用网站时欲发起 WebRTC业务， 例如： 用户在浏览淘宝网站的时候想 发起联系卖家的 WebRTC 业务， 这里的第三方应用网站就是淘宝网站， WebRTC业务就是联系卖家的业务。此时该用户会向 WebRTC认证系统发送 登录请求消息 （这里的运营商 Web认证系统里也包括了 WebRTC门户网站， 实际上是用户登录到 WebRTC 门户网站上） ， 且在登录请求消息中携带了 Web应用标识 （即上述例子中的淘宝网站的标识） 。
S502: 运营商 Web认证系统对该 UE的身份进行认证； 认证通过后， 向 UE发送认证响应消息。
具体的， 上述认证响应消息中携带运营商 WebRTC认证系统根据该 UE 的身份和 Web应用标识为该 UE分配接入 IMS网络的接入码以及接入设备的 地址。 运营商 Web认证系统对该 UE的身份进行认证， 即确认该 UE的身份 是否合法， 待确认 UE的身份合法后， 运营商 Web认证系统为 UE分配接入 IMS 网络的接入码， 并将接入码和接入设备的地址携带在认证响应消息中发 送给 UE， 使得 UE根据接入设备的地址确定对应的接入设备。
S503: UE向接入设备发送携带接入码的注册请求消息。
S504: 接入设备将接入码返回给运营商 WebRTC认证系统。
S505: 运营商 WebRTC认证系统对该接入码进行验证。
S506: 若上述接入码有效， 则接入设备接收运营商 WebRTC认证系统发 送的用户身份标识。
具体的， WebRTC认证系统对该接入码进行验证， 识别该接入码是否有 效， 即判断 UE的注册请求中携带的接入码是不是之前运营商 WebRTC认证 系统分配给 UE的； 若是， 判断该接入码有效， 则运营商 WebRTC认证系统 向接入设备发送用户身份标识， 以使接入设备记录该用户身份标识； 其中， 该身份标识可以为 IMPU和 IMPI。
S507: 接入设备向 S-CSCF发送携带用户身份标识的 SIP注册消息。 S508: I/S-CSCF向接入设备发送 SIP成功消息。
S509: 接入设备向 UE发送注册完成响应消息。
具体的， 接入设备向 I/S-CSCF发送 SIP注册请求消息， I/S-CSCF接收 到注册请求消息后， 记录 UE的身份标识， 并向接入设备返回 SIP成功消息； 之后， 由接入设备向 UE发送注册完成响应消息， 完成整个注册流程。
S510: UE向接入设备发送携带 Web应用标识的 WebRTC会话请求消息。
S511 : 接入设备向 I/S-CSCF 发送邀请消息， 该邀请消息中携带上述 WebRTC会话请求消息中的 Web应用标识。
S512: S-CSCF将上述邀请消息转发给 AS。
其中， S-CSCF将上述 WebRTC会话请求消息中的 Web应用标识转发给 AS; 可选的， S-CSCF还可以将之前记录的用户身份标识和 Web应用标识 一起携带在邀请消息中转发给 AS。
S513: AS根据该 Web应用标识对应的业务权限策略和 UE的业务签约 数据确定 UE的业务权限。
可选的， 所述 Web应用标识对应的业务权限策略为预先配置在所述 AS 上， 或者由所述 AS从 HSS中获取。 上述 Web应用标识对应的业务权限策略可以包括该 Web应用标识与业 务权限的映射关系，即用户从该 Web应用标识对应的 Web应用网站接入 IMS 网络时所能被允许的业务。 AS根据 Web应用标识对应的业务权限策略和 UE 的业务签约数据确定 UE的业务权限， 具体可以是： 当 AS接收到网络设备发 送的 Web应用标识时， 根据该 Web应用标识在查找该 Web应用标识所对应 的用户的业务权限， 并结合 UE 的签约业务数据中查找该用户的业务权限， 取二者的交集， 来确定用户接入 IMS网络时所能被允许的业务。
本发明实施例提供的业务权限确定方法， 通过接入设备向 IMS网络的网 络设备发送 Web应用标识， 网络设备将该 Web应用标识转发给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，进而提高网络设备对 UE从 Web应用网站接入 IMS网络场景下的 业务权限控制准确度。
本领域普通技术人员可以理解： 实现上述各方法实施例的全部或部分歩 骤可以通过程序指令相关的硬件来完成。 前述的程序可以存储于一计算机可 读取存储介质中。 该程序在执行时， 执行包括上述各方法实施例的歩骤； 而 前述的存储介质包括： ROM、 RAM,磁碟或者光盘等各种可以存储程序代码 的介质。
图 6为本发明提供的业务权限确定装置实施例一的结构示意图， 如图 6 所示， 该装置包括： 接收模块 10， 用于接收接入设备发送的 Web应用标识； 发送模块 11， 用于将 Web应用标识发送给 AS, 以使 AS根据 Web应用标识 对应的业务权限策略和 UE的业务签约数据确定该 UE的业务权限。
本发明实施例提供的业务权限确定装置， 通过接收模块接收接入设备发 送的 Web应用标识， 并通过发送模块将该 Web应用标识发送给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，进而提高对 UE从 Web应用网站接入 IMS网络场景下的业务权限 控制准确度。
图 7为本发明提供的业务权限确定装置实施例二的结构示意图， 在图 6 所示实施例的基础上， 进一歩的， 上述接收模块 10包括： 第一接收单元 101， 用于接收上述接入设备发送的 SIP注册消息， 该 SIP注册消息中携带 Web应 用标识。 本发明实施例提供的业务权限确定装置， 通过第一接收单元接收携带
Web应用标识的 SIP注册消息， 并通过发送模块将该 Web应用标识发送给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据 确定 UE的业务权限， 进而提高网络设备对 UE从 Web应用网站接入 IMS网 络场景下的业务权限控制准确度。
图 8为发明提供的业务权限确定装置实施例三的结构示意图， 在图 6所 示实施例的基础上， 进一歩地， 上述接收模块 10包括： 第二接收单元 102， 用于接收接入设备发送的邀请消息， 该邀请消息中携带 Web应用标识。
本发明实施例提供的业务权限确定装置， 通过第二接收单元接收携带 Web应用标识的邀请消息， 并通过发送模块将该 Web应用标识发送给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的业务权限， 进而提高对 UE从 Web应用网站接入 IMS网络场景下的业 务权限控制准确度。
可选的， 上述第一接收单元 101， 具体用于接收接入设备在接收运营商 WebRTC认证系统发送的 Web应用标识之后发送的 SIP注册消息；该 Web应 用标识是运营商 WebRTC认证系统在验证从接入设备接收的接入码有效后发 送的； 或上述第二接收单元 102， 具体用于接收接入设备在接收运营商 WebRTC认证系统发送的 Web应用标识之后发送的邀请消息；该 Web应用标 识是上述运营商 WebRTC认证系统在验证从接入设备接收的接入码有效后发 送的。
可选的， 上述第二接收单元 102， 具体用于接收上述接入设备在接收到 UE发送的携带 Web应用标识的会话请求消息之后发送的邀请消息。
可选的， 上述 Web应用标识对应的业务权限策略为预先配置在 AS上， 或者由 AS从 HSS中获取。
可选的， 上述运营商 WebRTC认证系统在给接入设备发送 Web应用标 识时， 还可以向接入设备发送用户身份标识。
本发明实施例提供的业务权限确定装置， 通过接收模块接收接入设备发 送的 Web应用标识， 并通过发送模块将该 Web应用标识发送给 AS, 使得 AS根据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的 业务权限，提高对 UE从 Web应用网站接入 IMS网络场景下的业务权限控制 准确度。
图 9为本发明提供的业务权限确定装置实施例四的结构示意图， 如图 9 所示， 该装置包括： 接收模块 20， 用于接收网络设备发送的 Web应用标识； 确定模块 21，用于根据上述 Web应用标识对应的业务权限策略和 UE的业务 签约数据确定 UE的业务权限。
可选的， 上述 Web应用标识对应的业务权限策略为预先配置在 AS上或 者由 AS从 HSS中获取的。
本发明实施例提供的业务权限确定装置， 通过接收模块接收网络设备发 送的 Web应用标识， 确定模块根据该 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的业务权限，进而提高对 UE从 Web应用网站接 入 IMS网络场景下的业务权限控制准确度。
图 10 为本发明提供的业务权限确定设备实施例一的结构示意图， 如图 10所示， 该设备包括： 接收器 30和发送器 31 ; 其中， 接收器 30， 用于接收 接入设备发送的 Web应用标识；发送器 31，用于将 Web应用标识发送给 AS, 以使 AS根据 Web应用标识对应的业务权限策略和 UE的业务签约数据确定 该 UE的业务权限。
本发明实施例提供的业务权限确定设备， 通过接收器接收接入设备发送 的 Web应用标识， 并通过发送器将该 Web应用标识发送给 AS, 使得 AS根 据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的业务 权限，提高对 UE从 Web应用网站接入 IMS网络场景下的业务权限控制准确 度。
可选的， 上述接收器 31， 具体用于接收上述接入设备发送的 SIP注册消 息， 该 SIP注册消息中携带 Web应用标识。
可选的， 上述接收器 31， 具体用于接收接入设备发送的邀请消息， 该邀 请消息中携带 Web应用标识。
可选的， 上述接收器 31 具体用于接收接入设备在接收运营商 WebRTC 认证系统发送的 Web应用标识之后发送的 SIP注册消息；该 Web应用标识是 运营商 WebRTC认证系统在验证从接入设备接收的接入码有效后发送的。
可选的， 上述接收器 31， 具体用于接收接入设备在接收运营商 WebRTC 认证系统发送的 Web应用标识之后发送的邀请消息；该 Web应用标识是上述 运营商 WebRTC认证系统在验证从接入设备接收的接入码有效后发送的。 可选的， 上述接收器 31， 具体用于接收上述接入设备在接收到 UE发送 的携带 Web应用标识的会话请求消息之后发送的邀请消息。
可选的， 上述 Web应用标识对应的业务权限策略为预先配置在 AS上， 或者由 AS从 HSS中获取。
可选的， 上述运营商 WebRTC认证系统在给接入设备发送 Web应用标 识时， 还可以向接入设备发送用户身份标识。
本发明实施例提供的业务权限确定设备， 通过接收器接收接入设备发送 的 Web应用标识， 并通过发送器将该 Web应用标识发送给 AS, 使得 AS根 据 Web应用标识对应的业务权限策略和 UE的签约业务数据确定 UE的业务 权限，提高对 UE从 Web应用网站接入 IMS网络场景下的业务权限控制准确 度。
图 11 为本发明提供的业务权限确定设备实施例二的结构示意图， 如图 11所示， 该设备包括： 接收器 40和处理器 41 ; 其中， 接收器 40， 用于接收 网络设备发送的 Web应用标识； 处理器 41， 用于根据上述 Web应用标识对 应的业务权限策略和 UE的业务签约数据确定 UE的业务权限。
可选的，上述 Web应用标识对应的业务权限策略为预先配置在处理器 41 上或者由处理器 41从 HSS中获取的。
本发明实施例提供的业务权限确定设备， 通过接收器接收网络设备发送 的 Web应用标识，处理器根据该 Web应用标识对应的业务权限策略和 UE的 签约业务数据确定 UE的业务权限，进而提高对 UE从 Web应用网站接入 IMS 网络场景下的业务权限控制准确度。
图 12为本发明提供的业务权限确定系统实施例一的结构示意图，该系统 包括第一通信设备 50和第二通信设备 51。
其中，第一通信设备 50可以包括上述图 6至图 8所示的任一业务权限确 定装置； 或者， 还可以包括图 10所示的业务权限确定设备。 可选的， 上述第 一通信设备 50可以为 S-CSCF， 还可以为 I-CSCF， 还可以为 P-CSCF。
第二通信设备 51可以包括上述图 9所示的业务权限确定装置； 或者， 还 可以包括图 11所示的业务权限确定设备。可选的， 第二通信设备可以为 AS。
本发明实施例提供的业务权限确定系统， 通过第一通信设备接收网络设 备发送的 Web应用标识， 第二通信设备根据该 Web应用标识对应的业务权 限策略和 UE的签约业务数据确定 UE的业务权限， 进而提高对 UE从 Web 应用网站接入 IMS网络场景下的业务权限控制准确度。
最后应说明的是： 以上各实施例仅用以说明本发明的技术方案， 而非对 其限制； 尽管参照前述各实施例对本发明进行了详细的说明， 本领域的普通 技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改， 或者对其中部分或者全部技术特征进行等同替换； 而这些修改或者替换， 并 不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims

权 利 要 求 书
1、 一种业务权限确定方法， 其特征在于， 包括：
接收接入设备发送的网页 Web应用标识；
将所述 Web应用标识发送给应用服务器 AS,以使所述 AS根据所述 Web 应用标识对应的业务权限策略和用户设备 UE 的业务签约数据确定所述 UE 的业务权限。
2、 根据权利要求 1所述的方法， 其特征在于， 所述接收接入设备发送的 Web应用标识， 包括：
接收所述接入设备发送的会话初始化协议 SIP注册消息， 所述 SIP注册 消息中携带所述 Web应用标识。
3、 根据权利要求 1所述的方法， 其特征在于， 所述接收接入设备发送的 Web应用标识， 包括：
接收所述接入设备发送的邀请消息， 所述邀请消息中携带所述 Web应用 标识。
4、 根据权利要求 2所述的方法， 其特征在于， 所述接收所述接入设备发 送的会话初始化协议 SIP注册消息， 具体包括：
接收所述接入设备在接收运营商网页实时通信 WebRTC认证系统发送的 所述 Web应用标识之后发送的所述 SIP注册消息；所述 Web应用标识是所述 运营商 WebRTC认证系统在验证从接入设备接收的接入码有效后发送的。
5、 根据权利要求 3所述的方法， 其特征在于， 所述接收所述接入设备发 送的邀请消息， 具体包括：
接收所述接入设备在接收运营商 WebRTC认证系统发送的所述 Web应用 标识之后发送的所述邀请消息；所述 Web应用标识是所述运营商 WebRTC认 证系统在验证从接入设备接收的接入码有效后发送的。
6、 根据权利要求 3所述的方法， 其特征在于， 所述接收所述接入设备发 送的邀请消息， 具体包括：
接收所述接入设备在接收到所述 UE发送的携带所述 Web应用标识的会 话请求消息之后发送的所述邀请消息。
7、 根据权利要求 1-6任一项所述的方法， 其特征在于， 所述 Web应用 标识对应的业务权限策略为预先配置在所述 AS上，或者由所述 AS从归属用 户服务器 HSS中获取。
8、 一种业务权限确定方法， 其特征在于， 包括：
应用服务器 AS接收网络设备发送的网页 Web应用标识；
根据所述 Web应用标识对应的业务权限策略和用户设备 UE的业务签约 数据确定所述 UE的业务权限。
9、 根据权利要求 8所述的方法， 其特征在于， 所述 Web应用标识对应 的业务权限策略为预先配置在所述 AS上或者由所述 AS从归属用户服务器 HSS中获取的。
10、 一种业务权限确定装置， 其特征在于， 包括：
接收模块， 用于接收接入设备发送的网页 Web应用标识；
发送模块， 用于将所述 Web应用标识发送给应用服务器 AS, 以使所述 AS根据所述 Web应用标识对应的业务权限策略和用户设备 UE的业务签约 数据确定所述 UE的业务权限。
11、根据权利要求 10所述的装置，其特征在于，所述接收模块具体包括: 第一接收单元， 用于接收所述接入设备发送的会话初始化协议 SIP注册 消息， 所述 SIP注册消息中携带所述 Web应用标识。
12、根据权利要求 10所述的装置，其特征在于，所述接收模块具体包括: 第二接收单元， 用于接收所述接入设备发送的邀请消息， 所述邀请消息 中携带所述 Web应用标识。
13、 根据权利要求 11所述的装置， 其特征在于， 所述第一接收单元具体 用于接收所述接入设备在接收运营商网页实时通信 WebRTC认证系统发送的 所述 Web应用标识之后发送的所述 SIP注册消息；所述 Web应用标识是所述 运营商 WebRTC认证系统在验证从接入设备接收的接入码有效后发送的。
14、 根据权利要求 12所述的装置， 其特征在于， 所述第二接收单元具体 用于接收所述接入设备在接收运营商 WebRTC认证系统发送的所述 Web应用 标识之后发送的所述邀请消息；所述 Web应用标识是所述运营商 WebRTC认 证系统在验证从接入设备接收的接入码有效后发送的。
15、 根据权利要求 12所述的装置， 其特征在于， 所述第二接收单元具体 用于接收所述接入设备在接收到所述 UE发送的携带所述 Web应用标识的会 话请求消息之后发送的所述邀请消息。
16、 根据权利要求 10-15任一项所述的装置， 其特征在于， 所述 Web应 用标识对应的业务权限策略为预先配置在所述 AS上，或者由所述 AS从归属 用户服务器 HSS中获取。
17、 一种业务权限确定装置， 其特征在于， 包括：
接收模块， 用于接收网络设备发送的网页 Web应用标识；
确定模块， 用于根据所述 Web应用标识对应的业务权限策略和用户设备 UE的业务签约数据确定所述 UE的业务权限。
18、 根据权利要求 17所述的装置， 其特征在于， 所述 Web应用标识对 应的业务权限策略为预先配置在所述 AS上或者由所述 AS从归属用户服务器 HSS中获取的。
PCT/CN2014/083732 2013-09-04 2014-08-05 业务权限确定方法和装置 WO2015032253A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP14841487.3A EP3029908B1 (en) 2013-09-04 2014-08-05 Service authority determination method and device
US15/060,351 US20160191523A1 (en) 2013-09-04 2016-03-03 Service authority determination method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310399717.3 2013-09-04
CN201310399717.3A CN104426887B (zh) 2013-09-04 2013-09-04 业务权限确定方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/060,351 Continuation US20160191523A1 (en) 2013-09-04 2016-03-03 Service authority determination method and device

Publications (1)

Publication Number Publication Date
WO2015032253A1 true WO2015032253A1 (zh) 2015-03-12

Family

ID=52627778

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/083732 WO2015032253A1 (zh) 2013-09-04 2014-08-05 业务权限确定方法和装置

Country Status (4)

Country Link
US (1) US20160191523A1 (zh)
EP (1) EP3029908B1 (zh)
CN (1) CN104426887B (zh)
WO (1) WO2015032253A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11319613B2 (en) 2020-08-18 2022-05-03 Enviro Metals, LLC Metal refinement

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9912705B2 (en) * 2014-06-24 2018-03-06 Avaya Inc. Enhancing media characteristics during web real-time communications (WebRTC) interactive sessions by using session initiation protocol (SIP) endpoints, and related methods, systems, and computer-readable media
KR20160057873A (ko) * 2014-11-14 2016-05-24 삼성전자주식회사 통신 방법, 전자 장치 및 저장 매체
WO2017066910A1 (zh) * 2015-10-19 2017-04-27 华为技术有限公司 控制策略确定方法、装置及系统
WO2018024325A1 (en) * 2016-08-03 2018-02-08 Telefonaktiebolaget Lm Ericsson (Publ) Guest user access in the ip multimedia subsystem ims
WO2018129723A1 (zh) * 2017-01-13 2018-07-19 华为技术有限公司 一种签约数据集的管理方法、终端及服务器
CN109413085B (zh) * 2018-11-15 2021-05-04 Oppo广东移动通信有限公司 一种控制VoLTE用户注册的方法及装置、设备、存储介质
US10917766B1 (en) * 2020-03-10 2021-02-09 Sprint Communications Company L.P. System and methods for bring your own device eligibility platform
CN113504855B (zh) * 2021-07-13 2023-06-16 读书郎教育科技有限公司 一种Android应用权限确认的提示和时效控制方法及装置
CN117643043A (zh) * 2022-06-27 2024-03-01 北京小米移动软件有限公司 Ims会话方法、装置、通信设备及存储介质
CN116545658A (zh) * 2022-11-09 2023-08-04 阿里巴巴（中国）有限公司 确权方法、系统以及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101098319A (zh) * 2006-06-27 2008-01-02 中国移动通信集团公司 基于ip多媒体子系统的家庭网关及其配置方法
CN101175018A (zh) * 2006-11-01 2008-05-07 中兴通讯股份有限公司 下一代通信网络实现iptv的设备、系统和方法
CN101453426A (zh) * 2007-11-29 2009-06-10 中国电信股份有限公司 一种对象状态信息呈现的系统和方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8909701B2 (en) * 2003-05-02 2014-12-09 Nokia Corporation IMS conferencing policy logic
EP1583312A1 (en) * 2004-04-02 2005-10-05 France Telecom Apparatuses and method for controlling access to an IP multimedia system from an application server
US7778231B2 (en) * 2007-02-21 2010-08-17 At&T Intellectual Property I, L.P. System and method of communication in an IP multimedia subsystem network
JP5269916B2 (ja) * 2008-03-14 2013-08-21 テレフオンアクチーボラゲット エル エム エリクソン（パブル） ローカル・ネットワークへのリモート・アクセスの方法および装置
CN101616126A (zh) * 2008-06-23 2009-12-30 华为技术有限公司 实现数据访问权限控制的方法、装置及系统
CN101729574B (zh) * 2008-10-31 2013-05-08 中兴通讯股份有限公司 一种iptv业务内容分级保护的系统、装置及方法
WO2013072193A2 (en) * 2011-11-14 2013-05-23 Nokia Siemens Networks Oy Method and apparatus for allocating a transfer function
FR2988885A1 (fr) * 2012-03-30 2013-10-04 France Telecom Base de donnees, serveur hss, et serveurs de controle d'un reseau ims

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101098319A (zh) * 2006-06-27 2008-01-02 中国移动通信集团公司 基于ip多媒体子系统的家庭网关及其配置方法
CN101175018A (zh) * 2006-11-01 2008-05-07 中兴通讯股份有限公司 下一代通信网络实现iptv的设备、系统和方法
CN101453426A (zh) * 2007-11-29 2009-06-10 中国电信股份有限公司 一种对象状态信息呈现的系统和方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11319613B2 (en) 2020-08-18 2022-05-03 Enviro Metals, LLC Metal refinement
US11578386B2 (en) 2020-08-18 2023-02-14 Enviro Metals, LLC Metal refinement

Also Published As

Publication number Publication date
EP3029908A4 (en) 2016-07-27
EP3029908B1 (en) 2019-06-12
EP3029908A1 (en) 2016-06-08
CN104426887B (zh) 2018-06-19
US20160191523A1 (en) 2016-06-30
CN104426887A (zh) 2015-03-18

Similar Documents

Publication Publication Date Title
WO2015032253A1 (zh) 业务权限确定方法和装置
US11201861B2 (en) Server for providing a token
JP5709322B2 (ja) 認証方法、システムおよび装置
EP3120591B1 (en) User identifier based device, identity and activity management system
WO2019017840A1 (zh) 网络验证方法、相关设备及系统
WO2016107124A1 (zh) 流量共享方法及装置、终端
EP3427502B1 (en) Methods providing service limitation and related communication device and network node
TW201644236A (zh) 使用用於服務ｃ平面方法的網路符記的高效策略實施
KR20180008411A (ko) 서비스 등록 절차 내에서 다수의 인증을 수행하는 방법
US9319407B1 (en) Authentication extension to untrusted devices on an untrusted network
TWI516151B (zh) 通訊方法與通訊系統
KR101575552B1 (ko) 안전한 데이터 전송
WO2018113536A1 (zh) 一种多设备连通通讯的实现方法及实现系统
US9154949B1 (en) Authenticated delivery of premium communication services to untrusted devices over an untrusted network
WO2019184717A1 (zh) 一种通信方法、及相关产品
JP2016045794A (ja) ネットワークシステムとその端末登録方法
US10348518B2 (en) Method, apparatus, system and media for transmitting messages between networked devices in data communication with a local network access point
WO2017200938A1 (en) Providing a public internet protocol address during wi-fi calling registration
EP2961208A1 (en) Method for accessing a service and corresponding application server, device and system
KR20170019981A (ko) 통화 및 웹 서비스의 연동방법 및 이를 위한 통신서버
JP2013143064A (ja) 端末間で権限情報を中継する方法及びシステム
WO2012129913A1 (zh) Sip终端注册及业务处理的方法、及相关设备
US20160183083A1 (en) User equipment and method for dynamic internet protocol multimedia subsystem (ims) registration
WO2014187423A1 (zh) 标识信息处理方法及装置
WO2018103732A1 (zh) 一种紧急号码的配置、获取方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14841487

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2014841487

Country of ref document: EP