WO2015039290A1

WO2015039290A1 - Method, device and system for terminal to access network

Info

Publication number: WO2015039290A1
Application number: PCT/CN2013/083681
Authority: WO
Inventors: 马景旺; 欧阳国威; 金辉; 衣强; 朱奋勤
Original assignee: 华为终端有限公司
Priority date: 2013-09-17
Filing date: 2013-09-17
Publication date: 2015-03-26

Abstract

Provided are a method, device and system for a terminal to access a network, which relate to the field of communications, and can prevent communication data leakage and improve public security performance. The method comprises: receiving a message via a packet data gateway, wherein the message comprises an IP address of a terminal and an IP address of a server; and when adding the IP address of the terminal and the IP address of the server, the packet data gateway performing data filtration according to the IP address of the terminal and the IP address of the server in a data transmission process so as to enable the terminal to perform data communication with the server. The embodiments of the present invention are used for a terminal to access a network.

Description

The present invention relates to the field of communications, and in particular, to a method, device, and system for a terminal to access a network.

Background technique

At present, the public security field generally uses a special trunking communication system to realize communication between related personnel. This specialized trunking communication system requires the public safety agency to purchase and construct a trunking communication system by itself, and the input cost is relatively large. Moreover, the current cluster communication system does not support high-speed broadband communication, so that the relevant staff cannot implement a communication method such as video that requires a relatively high access rate. In the prior art, in order to meet the demand for high-rate communication in the public security field, a mobile communication network operated by an operator, such as a fourth-generation communication network, may be enhanced to enhance the mobile communication network, thereby enabling the mobile communication network to support cluster communication, thereby enabling the cluster to Communication uses high-speed access provided by mobile communication networks to achieve broadband trunking communication to meet the needs of the public security field. The terminal used for trunking communication can access the radio access network through the relay, thereby accessing the mobility management entity and the gateway device, and further accessing the cluster communication server through the gateway device, and the cluster communication server is responsible for the cluster communication. Call management and management of cluster group members, etc. In the above process, when the terminal can access the cluster server through the relay, it can also access any server on the network, which may cause communication data leakage between the terminal and the cluster communication server, and public security. reduce.

Summary of the invention

Embodiments of the present invention provide a method, device, and system for a terminal to access a network, which can prevent communication data from being leaked and improve public security performance. A first aspect provides a method for a terminal to access a network, including: a packet data gateway receiving a message, where the message includes an IP address of the terminal, and a service IP address of the server; the IP address of the terminal is added with the IP address of the server, and the data gateway of the packet is in accordance with the IP address of the terminal and the IP address of the server during data transmission Data filtering is performed to facilitate data communication between the terminal and the server. With reference to the first aspect, in a first possible implementation manner, the packet data gateway deletes an IP address of the terminal and an IP address of the server, where the packet data gateway is in a data transmission process, according to the terminal The IP address is filtered with the IP address of the server so that the terminal does not communicate with the server. With reference to the first aspect, in a second possible implementation manner, the message is sent by the proximity server to the packet data gateway by using a mobility management entity and a service gateway; or, the message is a short-range server passing And transmitting, by the mobility management entity and the service gateway, to the packet data gateway; or, the message is sent by the proximity server to the packet data gateway by using a policy and charging rule function entity; wherein, in the message The IP address of the terminal and the IP address of the server are obtained by the proximity server when the server authenticates the terminal by using the proximity server and the relay, or the terminal passes The proximity server is obtained when the relay is registered to the server. With the second possible implementation of the first aspect, in a third possible implementation manner, the packet data gateway adds or deletes an IP address of the terminal according to the identifier information carried in the message, and the The IP address of the server. In combination with the first possible implementation manner of the first aspect or the third possible implementation manner, in a fourth possible implementation manner, when the server allows the terminal to join the group communication by using the relay, The identification information is used to indicate the packet data The gateway adds the IP address of the terminal to the IP address of the server; when the server allows the terminal to exit the group communication by using the relay, the identifier information is used to indicate that the packet data gateway is deleted. The IP address of the terminal and the IP address of the server. With reference to the third possible implementation manner of the first aspect, in a fifth possible implementation manner, the message further includes:

At least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter;

The terminal identifier is used by the network to identify the identity of the terminal, the identifier of the relay is used by the network to identify the identity of the relay, and the relay indication is used to indicate the relay. The quality of service parameter required by the terminal is used by the terminal to request a communication resource from the network. With reference to the first aspect, in a sixth possible implementation manner, the method further includes: when the packet data gateway receives the message, the packet data gateway is configured according to the IP address of the terminal in the message The address and the IP address of the server generate a data aggregation description parameter, and the aggregation description parameter is used by the packet data gateway to update the data filtering template of the relay, and then sent to the relay for data forwarding. A second aspect provides a method for a terminal to access a network, including: acquiring, by a proximity server, an IP address of a terminal and an IP address of a server; the proximity server sending a message to a packet data gateway, where the message includes the terminal An IP address and an IP address of the server; the packet data gateway adds an IP address of the terminal to an IP address of the server, and in a data transmission process, the packet data gateway is based on an IP address of the terminal Data filtering of the server's IP address; The terminal performs data communication with the server after the packet data gateway performs data filtering. With reference to the second aspect, in a first possible implementation manner, the packet data gateway receives the message, deleting an IP address of the terminal and an IP address of the server; in a data transmission process, the grouping The data gateway performs data filtering according to the IP address of the terminal and the IP address of the server; the terminal does not perform data communication with the server when the packet data gateway performs data filtering. With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner, the acquiring, by the short-range server, the IP address of the terminal and the IP address of the server includes: the server passing the short-range server The terminal authenticates the terminal; the proximity server acquires an IP address of the terminal and an IP address of the server from an authentication process; or the proximity server acquires an IP address of the terminal and an IP of the server The address includes: the terminal registers with the relay to the service crying port by using the proximity server, and the proximity server acquires an IP address of the terminal and an IP address of the server from a registration process. . In conjunction with the first possible implementation of the second aspect, in a third possible implementation manner, the sending, by the proximity server, the message to the packet data gateway includes: sending, by the proximity server, the message to mobility management An entity; the mobility management entity sends the message to the packet data gateway via a serving gateway. With reference to the first possible implementation manner of the second aspect, in a fourth possible implementation manner, the sending, by the proximity server, the message to the packet data gateway includes: sending, by the proximity server, the message to the relay; The relay sends the message to a mobility management entity; the mobility management entity sends the message to the packet data gateway via a serving gateway.

With reference to the first possible implementation manner of the second aspect, in a fifth possible implementation manner, the sending, by the proximity server, the message to the packet data gateway includes: sending, by the proximity server, the message to a policy and a meter Fee rule function entity;

The policy and charging rules function entity sends the message to the packet data gateway.

With reference to the third possible implementation manner of the second aspect to the fifth possible implementation manner, in a sixth possible implementation manner, the message further carries identifier information, where the identifier information is used to indicate the packet data. The gateway adds or deletes the IP address of the terminal and the IP address of the server.

With reference to the sixth possible implementation manner of the second aspect, in a seventh possible implementation manner, when the server allows the terminal to join a group communication by using the relay, the identifier information is used to indicate The packet data gateway adds an IP address of the terminal to an IP address of the server; and when the server allows the terminal to exit the group communication by using the relay, the identifier information is used to indicate the grouping The data gateway deletes the IP address of the terminal and the IP address of the server.

In conjunction with the sixth possible implementation of the second aspect, in an eighth possible implementation manner, the message further includes:

a terminal identifier of the terminal, an identifier of the relay, and a relay finger of the relay The terminal identifier is used by the network to identify the identity of the terminal, the identifier of the relay is used by the network to identify the identity of the relay, and the relay indication is used to indicate the relay. The quality of service parameter required by the terminal is used by the terminal to request a communication resource from the network. With reference to the second aspect, in a ninth possible implementation manner, the method further includes: after the short-range server sends the message to the packet data gateway, the packet data gateway is configured according to the message Generating a data aggregation description parameter with the IP address of the terminal and the IP address of the server; the packet data gateway updates the relayed data filtering template according to the aggregation description parameter, and then sends the data filtering template to the relay The relay performs data forwarding according to the data filtering template.

With reference to the fourth possible implementation manner of the second aspect, in a tenth possible implementation manner, the method further includes: before the relay sends the message to the mobility management entity, where And updating the data filtering template according to the IP address of the terminal in the message and the IP address of the server; and the relay performs data forwarding according to the data filtering template. The third aspect provides a packet data gateway, including: a receiving unit, configured to receive a message, where the message includes an IP address of the terminal, and an IP address of the server; and a processing unit, configured to add an IP address of the terminal and the The IP address of the server, in the data transmission process, performing data filtering according to the IP address of the terminal and the IP address of the server, so that the terminal and the server perform data communication. Letter.

In combination with the third aspect, in a first possible implementation manner, the processing unit is further configured to:

Deleting the IP address of the terminal and the IP address of the server, and performing data filtering according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal does not perform with the server. data communication.

With reference to the third aspect, in a second possible implementation manner, the message is sent by the proximity server to the packet data gateway by using a mobility management entity and a service gateway; or, the message is a short-range server passing And transmitting, by the mobility management entity and the service gateway, to the packet data gateway; or, the message is sent by the proximity server to the packet data gateway by using a policy and charging rule function entity; wherein, in the message The IP address of the terminal and the IP address of the server are obtained by the proximity server when the server authenticates the terminal by using the proximity server and the relay, or the terminal passes The proximity server is obtained when the relay is registered to the server. With reference to the second possible implementation manner of the third aspect, in a third possible implementation manner, the processing unit is configured to add or delete the terminal according to the identifier information carried in the message received by the receiving unit. The IP address is associated with the IP address of the server.

In conjunction with the first possible implementation manner of the third aspect or the third possible implementation manner, in a fourth possible implementation manner, when the server allows the terminal to join the group communication by using the relay, The identifier information is used to indicate that the packet data gateway adds an IP address of the terminal to an IP address of the server; when the server allows the terminal to exit the group communication by using the relay, The identification information is used to instruct the packet data gateway to delete the IP of the terminal The address and the IP address of the server. With reference to the third possible implementation manner of the third aspect, in a fifth possible implementation manner, the message further includes:

The terminal identifier is used by the network to identify the identity of the terminal, the identifier of the relay is used by the network to identify the identity of the relay, and the relay indication is used to indicate the relay. The quality of service parameter required by the terminal is used by the terminal to request a communication resource from the network. With reference to the third aspect, in a sixth possible implementation manner, the processing unit is further configured to: when the receiving unit receives the message, according to an IP address of the terminal in the message, and the server The IP address generates a data aggregation description parameter, and the aggregation description parameter is used by the packet data gateway to update the data filtering template of the relay, and then sent to the relay for data forwarding. The fourth aspect provides a communication system, including: a proximity server, configured to acquire an IP address of the terminal and an IP address of the server; and the proximity server is further configured to send a message to the packet data gateway, where the message includes The IP address of the terminal and the IP address of the server; the packet data gateway is configured to add an IP address of the terminal and an IP address of the server, and according to the IP address of the terminal during data transmission The IP address of the server performs data filtering; the terminal is configured to perform data communication with the server after the packet data gateway performs data filtering. With reference to the fourth aspect, in a first possible implementation manner, the packet data a gateway, configured to receive the message, delete an IP address of the terminal and an IP address of the server; during data transmission, perform data filtering according to an IP address of the terminal and an IP address of the server;

The terminal is configured to not perform data communication with the server when the packet data gateway performs data filtering. With reference to the first possible implementation manner of the fourth aspect, in a second possible implementation manner, the server is configured to authenticate the terminal by using the proximity server and the relay; the proximity server, And the terminal is configured to acquire the IP address of the terminal and the IP address of the server from the process of the authentication; or the terminal is configured to register with the server by using the proximity server and the relay; The proximity server is further configured to obtain an IP address of the terminal and an IP address of the server from a registration process. With reference to the first possible implementation manner of the fourth aspect, in a third possible implementation manner, in the process that the short-range server sends the message to the packet data gateway, the short-range server uses Sending the message to the mobility management entity;

The mobility management entity is configured to send the message to the packet data gateway through a serving gateway. With reference to the first possible implementation manner of the fourth aspect, in a fourth possible implementation manner, in the process that the short-range server sends the message to the packet data gateway, the proximity server uses Sending the message to the relay; the relay is configured to send the message to the mobility management entity; the mobility management entity is configured to send the message to the packet via the serving gateway Data gateway. In conjunction with the first possible implementation of the fourth aspect, in a fifth possible implementation, the short-range server sends the message to the packet data gateway The proximity server is configured to send the message to a policy and charging rule function entity, where the policy and charging rule function entity is configured to send the message to the packet data gateway. With reference to the third possible implementation manner of the fourth aspect to the fifth possible implementation manner, in a sixth possible implementation manner, the message further carries identifier information, where the identifier information is used to indicate the packet data The gateway adds or deletes the IP address of the terminal and the IP address of the server. With reference to the sixth possible implementation manner of the fourth aspect, in a seventh possible implementation manner, when the server allows the terminal to join a group communication by using the relay, the identifier information is used to indicate The packet data gateway adds an IP address of the terminal to an IP address of the server; and when the server allows the terminal to exit the group communication by using the relay, the identifier information is used to indicate the grouping The data gateway deletes the IP address of the terminal and the IP address of the server. With reference to the sixth possible implementation manner of the fourth aspect, in an eighth possible implementation manner, the message further includes:

The terminal identifier is used by the network to identify the identity of the terminal, the identifier of the relay is used by the network to identify the identity of the relay, and the relay indication is used to indicate the relay. The quality of service parameter required by the terminal is used by the terminal to request a communication resource from the network. With reference to the fourth aspect, in a ninth possible implementation manner, the packet data gateway is further configured to: after the short-range server sends the message to the packet data gateway, according to the terminal in the message IP address with the IP address of the server Generating data aggregation description parameters;

And the packet data gateway is further configured to: update the data filtering template of the relay according to the aggregation description parameter, and further send the data filtering template to the relay; and the relay is further configured to filter according to the data. The template performs data forwarding. With reference to the fourth possible implementation manner of the fourth aspect, in a tenth possible implementation manner, the relay is further configured to: before the relay sends the message to the mobility management entity, according to The IP address of the terminal and the IP address of the server in the message are updated with a data filtering template; and the relay is further configured to perform data forwarding according to the data filtering template. In a fifth aspect, a packet data gateway is provided, including:

a receiver, configured to receive a message, where the message includes an IP address of the terminal, an IP address of the server, and a processor, configured to add an IP address of the terminal and an IP address of the server, in the process of data transmission, according to the Data filtering is performed on the IP address of the terminal and the IP address of the server, so that the terminal performs data communication with the server. With reference to the fifth aspect, in a first possible implementation manner, the processor deletes an IP address of the terminal and an IP address of the server, and in the data transmission process, according to the IP address of the terminal, The IP address of the server performs data filtering so that the terminal does not perform data communication with the server. With reference to the fifth aspect, in a second possible implementation manner, the message is sent by the proximity server to the packet data gateway by using a mobility management entity and a service gateway; or, the message is a short-range server passing And transmitting, by the mobility management entity and the service gateway, to the packet data gateway; or, the message is sent by the proximity server to the packet data gateway by using a policy and charging rule function entity; The IP address of the terminal in the message and the IP address of the server are obtained by the proximity server when the server authenticates the terminal by using the proximity server and the relay. Or the terminal is obtained when the terminal registers with the relay to the server by the proximity server. With reference to the second possible implementation manner of the fifth aspect, in a third possible implementation, the processor adds or deletes an IP address of the terminal and the server according to the identifier information carried in the message. The IP address of the. In conjunction with the first possible implementation manner of the fifth aspect or the third possible implementation manner, in a fourth possible implementation manner, when the server allows the terminal to join the group communication by using the relay, The identifier information is used to indicate that the packet data gateway adds an IP address of the terminal to an IP address of the server; when the server allows the terminal to exit the group communication by using the relay, The identification information is used to instruct the packet data gateway to delete an IP address of the terminal and an IP address of the server. With reference to the second possible implementation manner of the fifth aspect, in a fifth possible implementation manner, the message further includes: a terminal identifier of the terminal, an identifier of the relay, and a relay of the relay At least one of the indication, the quality of service parameter required by the terminal, and the data aggregation description parameter; wherein the terminal identifier is used by the network to identify the identity of the terminal; the identifier of the relay is used in the network Identifying the identity of the relay; the relay indication is used to indicate that the terminal is a relay; the quality of service parameter required by the terminal is used by the terminal to request a communication resource from the network. With reference to the fifth aspect, in a sixth possible implementation manner, the processor is further configured to: when the receiver receives the message, according to an IP address of the terminal in the message, The IP address of the server generates a data aggregation description parameter, The aggregation description parameter is used by the packet data gateway to update the data filtering template of the relay, and then sent to the relay for data forwarding. Embodiments of the present invention provide a method, a device, and a communication system for a terminal to access a network, and receive a message by using a packet data gateway, where the message includes an IP address of the terminal and an IP address of the server, and the packet data gateway adds the IP address of the terminal to the server. IP address, packet data gateway in the data transmission process, according to the IP address of the terminal and the server's IP address for data concerns, so that the terminal and the server for data communication, can prevent communication data leakage, improve public security performance.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work. 1 is a schematic structural diagram of a communication system according to an embodiment of the present invention; FIG. 2 is a schematic flowchart of a method for a terminal to access a network according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for a terminal to access a network according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a method for a terminal to access a network according to an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a method for a terminal to access a network according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a process interaction between physical devices according to an embodiment of the present invention; FIG. 7 is a schematic flowchart of a method for a terminal to access a network according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of process interaction between physical devices according to an embodiment of the present invention; FIG. 9 is a schematic flowchart of a method for a terminal to access a network according to an embodiment of the present disclosure;

FIG. 10 is a schematic diagram of a process interaction between physical devices according to an embodiment of the present invention; FIG. 1 is a schematic flowchart of a method for a terminal to access a network according to an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a packet data gateway according to an embodiment of the present invention; FIG. 13 is a schematic structural diagram of a proximity server according to an embodiment of the present invention; FIG. FIG. 15 is a schematic structural diagram of a packet data gateway according to an embodiment of the present invention; FIG. 16 is a schematic structural diagram of a proximity server according to an embodiment of the present invention; FIG. 17 is a schematic diagram of a relay structure according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

As shown in FIG. 1 , a communication system provided by an embodiment of the present invention includes a User Equipment (UE), a Relay, and an Evolved-Universal Terrestrial Radio Access Network (E-UTRAN). , Mobile Management Entity (MME), Serving GateWay (S-GW), Packet Data Network Gateway (P-GW), Proximity Server (ProSe Server or PDCF (Proximity Discovery and Communication Control Functionality ) ) and the cluster communication server ( Server ) may also include a Policy and Charging Rules Function ( PCRF ). The terminal can be a user equipment such as a mobile phone, and the relay can pass long-term evolution. The air interface Uu port of the (Long Term Evolution, LTE) is connected to the E-UTRAN, and is connected to the terminal through the direct connection communication technology on the PC5 interface. The radio access network may establish a Radio Resource Control (RRC) connection with the relay so that the relay can communicate with the RRC. In the embodiment of the present invention, the relay may send an attach request to the MME to request a public data network (PDN) connection to the core network (Evolved Packet Core, EPC), and during the establishment of the PDN connection, the relay may request The MME allocates an IPv6 address prefix that is less than 64 bits in length. Then, according to the existing communication procedure, the EPC can establish a PDN connection for the relay through the MME, the S-GW, and the P-GW, and allocate an IPv6 address prefix with less than 64 bits for the relay. After the relay accesses the network, the terminal can use the existing discovery process to discover the relay, and then access the cluster communication server through the relay. The terminal then uses the existing direct communication establishment process to establish a direct connection with the relay. Communication. After the terminal establishes direct communication with the relay, the terminal can complete the authentication or registration process with the proximity server and the cluster communication server through the relay, and then can perform data interaction with the cluster communication server.

In the process of authentication or registration, the proximity server can obtain the Internet Protocol (IP) address of the terminal and the IP address of the cluster communication server, and then sequentially through the relay, the proximity server, the MME, and the S-GW. The IP address of the terminal and the server is transmitted to the P-GW, and the P-GW can add or delete the IP address of the terminal and the IP address of the cluster communication server, and then uplink and downlink of the terminal according to the IP address of the terminal and the IP address of the cluster communication server. The data packet is filtered to achieve the purpose of allowing only the terminal to communicate with the cluster communication server that has been authenticated or registered. The data filtering process may be: For the uplink data packet, the P-GW only forwards the data packet whose source address is the IP address of the terminal, and the destination address is the authenticated or registered server IP address to the cluster server; Packet, the P-GW only forwards the IP address of the server whose source address is authenticated or registered, and the packet whose destination address is the terminal IP address to the terminal. In this way, in the prior art, the terminal can access multiple cluster communication servers, which may cause data leakage, prevent communication data from being leaked, and improve public security performance. An embodiment of the present invention provides a method for a terminal to access a network, as shown in FIG. 2, including:

101. The packet data gateway receives the message, where the message includes an IP address of the terminal and an IP address of the server. The P-GW packet data gateway is an anchor point of a user plane data link between the 3GPP (3rd Generation Partnership Project) and the non-3 GPP network, and is responsible for managing between 3GPP and non-3GPP. Data routing and other functions. Exemplarily, the message may be sent by the short-range server to the P-GW through the MME and the S-GW; or, the message is sent by the short-range server to the P-GW through the relay, the MME, and the S-GW; or The message is that the proximity server sends the P-GW through the PCRF. The IP address of the terminal in the message and the IP address of the server are obtained by the proximity server when the server passes the proximity server and the relay authentication terminal, or the terminal registers with the server through the proximity server and the relay. It should be noted that the server here is the cluster communication server in the above embodiment.

102. The packet data gateway adds the IP address of the terminal and the IP address of the server. During the data transmission process, the packet data gateway performs data filtering according to the IP address of the terminal and the IP address of the server, so that the terminal and the server perform data communication. Exemplarily, when the P-GW deletes the IP address of the terminal and the IP address of the server, the P-GW performs data filtering according to the IP address of the terminal and the IP address of the server during the data transmission process, and the P-GW no longer The server forwards the source address to the terminal IP address, and the destination address is the data packet of the server IP address, so that the terminal does not perform with the server. data communication.

The P-GW may add or delete the IP address of the terminal and the IP address of the server according to the identifier information carried in the message. Specifically, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the P-GW adds the IP address of the terminal and the IP address of the server, and when the server allows the terminal to exit the group communication by using the relay, the identification information It is used to instruct the P-GW to delete the IP address of the terminal and the IP address of the server. An embodiment of the present invention provides a method for a terminal to access a network, where a message is received by a packet data gateway, where the message includes an IP address of the terminal and an IP address of the server, and the packet data gateway adds the IP address of the terminal and the IP address of the server, and the packet data. During the data transmission process, the gateway performs data filtering according to the IP address of the terminal and the IP address of the server, so that the terminal and the server perform data communication, which can prevent communication data from being leaked and improve public security performance. An embodiment of the present invention provides a method for a terminal to access a network, as shown in FIG. 3, including:

201. The short-range server obtains the IP address of the terminal and the IP address of the server. Wherein, the server here can be a cluster communication server. The proximity server can obtain the IP address of the terminal and the cluster communication server from the terminal, through the authentication process of the relay and the proximity server and the cluster communication server, or the process of registering the terminal to the server through the proximity server and the relay. IP address.

202. The short-range server sends a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server, so that when the packet data gateway adds the IP address of the terminal and the IP address of the server, the data is transmitted according to the IP address of the terminal. Data filtering is performed with the IP address of the server to facilitate data communication between the terminal and the server.

Exemplarily, when the proximity server sends a message to the packet data gateway, When the packet data gateway deletes the IP address of the terminal and the IP address of the server, data filtering is performed according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal does not perform data communication with the server. The message is sent to the packet data gateway by the mobility management entity and the service gateway; or the message is sent by the proximity server to the packet data gateway by using the relay, the mobility management entity, and the service gateway; Or, the message is sent by the proximity server to the packet data gateway through the policy and charging rule function entity. The IP address of the terminal in the message and the IP address of the server are obtained when the server passes through the proximity server and the relay authentication terminal, or is obtained when the terminal registers with the server through the proximity server and the relay. . In addition, the message further carries identification information, where the identifier information is used to indicate that the packet data gateway adds or deletes the IP address of the terminal and the IP address of the server. When the server allows the terminal to join the group communication through the relay, the identification information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server; when the server allows the terminal to exit the group communication by using the relay, the identification information is used to indicate The packet data gateway deletes the IP address of the terminal and the IP address of the server. The message may further include: at least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter.

The data filtering here may be: For the uplink data packet, the P-GW only forwards the data packet whose source address is the IP address of the terminal, and the destination address is the authenticated or registered server IP address to the cluster server; for the downlink data packet, The P-GW only forwards the data packet whose source address is the authenticated or registered server and the destination address is the terminal IP address to the terminal. Embodiments of the present invention provide a method for a terminal to access a network, a proximity server Obtaining the IP address of the terminal and the IP address of the server, and the short-range server sends a message to the packet data gateway through the relay, the mobility management entity, and the service gateway, where the message includes the IP address of the terminal and the IP address of the server, so that the packet data gateway adds the terminal. When the IP address and the IP address of the server are used, data is filtered according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal and the server perform data communication, which can prevent communication data from being leaked and improve public security performance. An embodiment of the present invention provides a method for a terminal to access a network, as shown in FIG. 4, including:

301. The relay obtains the IP address of the terminal and the IP address of the server. Exemplarily, the server here can be a cluster communication server. The IP address of the terminal in the message and the IP address of the server are obtained when the server passes through the proximity server and the relay authentication terminal, or is obtained when the terminal registers with the server through the proximity server and the relay. .

302. The relay sends a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server, so that the packet data gateway adds the IP address of the terminal and the IP address of the server, and according to the IP address of the terminal during the data transmission process. The server's IP address is used for data filtering to facilitate data communication between the terminal and the server. Exemplarily, when the relay sends the message to the packet data gateway, the packet data gateway deletes the IP address of the terminal and the IP address of the server, and performs data filtering according to the IP address of the terminal and the IP address of the server during the data transmission, so that The terminal does not communicate data with the server. The message may be sent by the proximity server to the packet data gateway through the relay, the mobility management entity, and the serving gateway. The message may also carry identification information, which is used to indicate that the packet data gateway adds or deletes the IP address of the terminal and the IP address of the server. When the server allows the terminal to join the group communication through the relay, the identification information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server, when the server allows the terminal to pass the relay. When exiting the group communication, the identification information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server. The foregoing message may further include at least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter. The terminal identifier, the identity of the network identifier terminal, the identifier of the relay, the identity used for the network identifier relay, the relay indication, used to indicate the relay as the relay; the quality of service parameter required by the terminal, used by the terminal The network requests communication resources. An embodiment of the present invention provides a method for a terminal to access a network, where an IP address of a terminal and an IP address of a server are obtained by using a relay, and the relay sends a message to the packet data gateway by using the mobility management entity and the service gateway, where the message includes the IP address of the terminal. The address and the IP address of the server, so that the packet data gateway adds the IP address of the terminal and the IP address of the server, and performs data filtering according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal and the server perform data. Communication can prevent communication data from being leaked and improve public safety performance. An embodiment of the present invention provides a method for a terminal to access a network, as shown in FIG. 5, including:

401. The relay establishes an RRC connection with the radio access network, so that the relay communicates with the radio access network. Exemplarily, the relay may serve as a terminal, send a request message to the radio access network E-UTRAN, request to establish an RRC connection with the E-UTRAN, and after the RRC connection is successfully established, the relay can communicate with the E-UTRAN. .

402. The relay initiates an attach request to the mobility management entity, establishes a PDN connection, and requests the mobility management entity to allocate an IPv6 address prefix that is less than 64 bits in length. Exemplarily, the relay may be used as a terminal to initiate an attach request to the mobility management entity MME, requesting to establish a public data network PDN connection with the MME. In the process of requesting to establish a PDN connection with the MME, the relay requesting MME allocates at least one long Less than 64bit IPv6 address prefix.

403. Through the mobility management entity and the service gateway, the packet data gateway establishes a PDN connection for the relay, and allocates an IPv6 address prefix with a length less than 64 bits.

Exemplarily, the PDN connection may be established for the relay by using the MME, the serving gateway S-GW, and the packet data gateway P-GW according to the process of the prior art, and the P-GW may be allocated to the relay at least one IPv6 address less than 64 bits. Prefix.

404. The terminal discovers the relay through the discovery process, and accesses the cluster communication server. Exemplarily, the broadcast message may be sent to multiple terminals by using a relay according to the discovery process in the prior art, so that the terminal can discover the relay according to the broadcast message, and learn that the relay can connect to multiple cluster communication servers. So that the terminal can obtain a cluster communication server that can perform data communication through relay. The cluster communication server is responsible for call management of the cluster communication and management of the cluster group members, and the cluster communication server can broadcast the cluster communication information by means of Multimedia Broadcast Multicast Service (MBMS) broadcast or unicast (for example) Voice, video, etc.) to the terminal.

405. The terminal establishes a process through direct communication, and establishes direct communication with the relay. Exemplarily, the process can be established according to the existing direct communication, so that the terminal establishes a connection with the relay. At the same time, the terminal may select an IPv6 address as the IP address of the terminal from at least one of the IPv6 address prefixes obtained by the relay in the PDN connection, and use the terminal as the IP address of the terminal to perform data communication with the relay and the packet data gateway.

406. The terminal completes the authentication process with the proximity server and the cluster communication server by using the relay, and the proximity server obtains the IP address of the terminal and the IP address of the cluster communication server from the authentication process.

Exemplarily, after the terminal establishes a connection with the relay and obtains its own IP address, the terminal authenticates with the cluster communication server through the relay. Specifically, the terminal may sequentially pass through a relay, a radio access network, an MME, and an S-GW. And the P-GW sends a message to the proximity server, where the message includes the terminal identifier of the terminal, the IP address of the terminal, and the Quality of Service (QOS) parameter required by the terminal, and the proximity server can send the terminal identifier to the cluster communication. The server, the cluster communication server matches the terminal identifier stored in the device according to the terminal identifier, and if the terminal identifier sent by the proximity server exists in the cluster communication server, the terminal passes the authentication with the cluster communication server, that is, the terminal Data interaction may be performed with the cluster communication server; if the terminal identifier sent by the proximity server does not exist in the cluster communication server, the terminal does not pass the authentication with the cluster communication server, that is, the terminal does not perform data with the cluster communication server. Interaction. Then, the cluster communication server sends a response message to the proximity server, where the response message carries the IP address of the cluster communication server and an indication of whether the authentication is passed or not. In the above process, the relay also sends its own relay identifier and relay indication to the proximity server. Or, it is obtained when the terminal registers with the server through the proximity server and the relay. The registration process is similar to the process of authentication, and details are not described herein again. After step 406, the method flow can be:

407a. The proximity server sends an access information configuration message to the mobility management entity, where the access information configuration message includes an IP address of the terminal and an IP address of the cluster communication server. Exemplarily, after obtaining the IP address of the terminal and the IP address of the cluster communication server, the proximity server sends an access information configuration message to the mobility management entity, where the access information configuration message includes the IP address of the terminal and the cluster communication. The IP address of the server may further include at least one of a terminal identifier, a relay identifier, a relay indication, a QoS parameter required by the terminal, and identification information. The terminal identifier, the identity of the network identifier terminal, the relay identifier, the identity used for the network identity relay, the relay indication, used to indicate the relay, and the QoS parameters required by the terminal, used for the terminal to the network The request communication resource; the identification information may also be referred to as an add operation indication, and the add operation indication is a proximity server according to the terminal and the set The authentication result of the group communication server is identified.

408a. The mobility management entity sends a bearer resource request message to the serving gateway, where the bearer resource request message includes an IP address of the terminal and an IP address of the cluster communication server. Exemplarily, after receiving the access information configuration message from the proximity server, the mobility management entity MME sends a bearer resource request message to the serving gateway S-GW, where the request message includes the IP address and the cluster of the terminal in the access information configuration message. The IP address of the communication server also includes the terminal identifier, the relay identifier, the relay indication, the QoS parameters required by the terminal, and the identification information. Thus, the MME forwards the access information configuration message to the S-GW.

409a. The serving gateway sends a bearer resource request message to the packet data gateway, and then proceeds to step 410 or step 412. Exemplarily, the serving gateway S-GW forwards the bearer resource request message received from the MME to the packet data gateway P-GW.

410. The packet data gateway adds an IP address of the terminal in the bearer resource request message and an IP address of the cluster communication server. Illustratively, after receiving the bearer resource request message forwarded by the S-GW, the packet data gateway P-GW may add or delete the IP address of the terminal and the IP address of the trunking communication server according to the identifier information in the bearer resource request message. The identifier information may be used to indicate that the P-GW adds or deletes a mapping relationship between the terminal IP address and the IP address of the cluster communication server for the terminal.

Specifically, when the cluster communication server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the P-GW adds the mapping relationship between the IP address of the terminal and the IP address of the server. For example, when the terminal passes the relay and the authentication result of the cluster communication server is that the terminal passes the authentication with the cluster communication server, the identifier information is used to instruct the P-GW to add the IP address of the terminal and the IP address of the server. Mapping relations.

41 1. The packet data gateway allows the terminal to join the group communication through the relay to perform data communication with the cluster communication server. Exemplarily, according to the implementation of step 410, when the identifier information is used to indicate that the P-GW adds the mapping relationship between the IP address of the terminal and the IP address of the server, the P-GW performs data in a subsequent data transmission process. Filtering, according to the mapping relationship between the IP address of the terminal and the IP address of the cluster communication server, the P-GW allows the terminal to access the group communication through the relay to perform data communication with the cluster communication server.

412. The packet data gateway deletes an IP address of the terminal in the bearer resource request message and an IP address of the cluster communication server. Illustratively, after receiving the bearer resource request message forwarded by the S-GW, the packet data P-GW may be used to instruct the P-GW to add or delete the terminal IP address and the IP address of the cluster communication server for the terminal. The mapping relationship of addresses. The identifier information is used to instruct the P-GW to delete the mapping relationship between the IP address of the terminal and the IP address of the server, when the cluster communication server allows the terminal to exit the group communication by using the relay. For example, when the terminal passes the relay and the authentication result of the cluster communication server is that the terminal does not pass the authentication with the cluster communication server, the identifier information is used to instruct the P-GW to delete the IP address of the terminal and the IP address of the server. Mapping relationship.

413. The packet data gateway allows the terminal to exit the group communication by using the relay, and does not perform data communication with the cluster communication server.

Exemplarily, when the identifier information is used to indicate that the P-GW deletes the mapping relationship between the IP address of the terminal and the IP address of the server, the P-GW performs data filtering in the subsequent transmission process, according to the terminal IP address and the cluster communication server. The IP address, the P-GW allows the terminal to exit the group communication through the relay, and does not perform data communication with the cluster communication server, so that the P-GW only allows the terminal to perform data communication with the cluster communication server through authentication. It can prevent communication data from being leaked and improve public safety performance.

In addition, in the foregoing embodiment, when the packet data gateway P-GW adds a mapping relationship between the terminal IP address and the IP address of the cluster communication server, the P-GW may generate data according to the IP address of the terminal and the IP address of the cluster communication server. Traffic Aggregate Description (TAD), which is used by the P-GW to update the relay's Traffic Filter Template (TFT), and then send Send to relay for data forwarding. When the policy and charging rule function entity is configured in the network

PCC, which triggers the existing PCC process.

According to the description of the foregoing embodiment, the process interaction diagram between the physical devices in the network architecture may be as shown in FIG. 6. In the above method embodiment, after step 406, the above step 407a may be replaced by 407b, and the method flow of the above embodiment may be replaced with FIG. 7 in conjunction with FIG.

407b, the relay obtains the IP address of the terminal and the IP address of the cluster communication server from the proximity server, and sends an access information configuration message to the mobility management entity, where the access information configuration message includes the IP address of the terminal and the cluster communication server. IP address.

Exemplarily, in the above step 406, the proximity server obtains the IP address of the terminal and the IP address of the trunking communication server from the authentication process, and the proximity server can send a message to the relay, where the message includes the IP address of the terminal. And the IP address of the cluster communication server, and the identification information obtained by the short-distance server according to the authentication result, and then the relay obtains the terminal identifier obtained from the terminal and the IP address of the terminal from the authentication process of the terminal and the cluster communication server, The MME, the IP address of the trunking server, the QoS parameters required by the terminal, and the identifier information are included in the access information configuration message, and the access information configuration message is sent to the mobility management entity MME, so that the MME passes the S-GW. Sending the content in the access information configuration message to the P-GW, so that the P-GW performs data filtering according to the IP address of the terminal, the IP address of the cluster communication server, and the identification information, and performs the terminal and the cluster communication server that passes the authentication. Data communication to prevent communication data leakage and improve public safety .

In addition, after obtaining the IP address of the terminal and the IP address of the cluster communication server, the relay may update the TAD parameter according to the IP address of the terminal and the IP address of the cluster communication server, thereby carrying the updated TAD parameter to the The access information configuration message of the mobility management entity is further sent to the P-GW. According to the description of the above embodiment, after replacing the above step 407a with 407b, the network The process interaction diagram between each physical device in the network architecture can be as shown in FIG. 8. Alternatively, in the above method embodiment, after step 406, the above steps 407a to 409a may be replaced by 407c to 408c, and the method flow of the above embodiment may be replaced with FIG.

407c. The proximity server sends an access information configuration message to the policy and charging rule function entity, where the access information configuration message includes an IP address of the terminal and an IP address of the trunking communication server. Exemplarily, in the foregoing step 406, the proximity server obtains the IP address of the terminal and the IP address of the cluster communication server from the authentication process, and then sends an access information configuration message to the policy and charging rule function entity PCRF. The access information configuration message includes an IP address of the terminal and an IP address of the cluster communication server, and may further include a proximity server, and a terminal identifier obtained by the cluster communication server through the proximity server and the relay authentication terminal. Following identification, relay indication, QoS parameters required by the terminal, and identification information. The identifier information may be used to indicate that the P-GW adds or deletes the mapping relationship between the IP address of the terminal and the IP address of the cluster communication server.

408c. The policy and charging rule function entity sends a bearer resource request message to the packet data gateway, where the bearer resource request message includes an IP address of the terminal and an IP address of the trunking communication server. Illustratively, after receiving the access information configuration message, the PCRF may carry the IP address of the terminal in the received access information configuration message during the process of sending a session establishment or session modification with the packet data gateway P-GW. The IP address of the communication server, the terminal identifier, the relay identifier, the relay indication, the QoS parameters required by the terminal, and the identification information, so that the P-GW performs the IP address of the terminal, the IP address of the cluster communication server, and the identification information. Data filtering, data communication between the terminal and the cluster communication server through authentication to prevent communication data leakage and improve public safety performance.

According to the description of the foregoing embodiment, after the steps 407a to 409a are replaced by 407c to 408c, the process interaction diagram between the physical devices in the network architecture may be As shown in Figure 10. An embodiment of the present invention provides a method for a terminal to access a network, where a plurality of IPv6 addresses are obtained through a relay access network, and a terminal establishes direct communication with a relay, and the terminal obtains an IP address from the relay as an IP address of the terminal, and further the terminal Through the relay, the authentication process with the proximity server and the cluster communication server is completed, and the proximity server obtains the IP address of the terminal and the IP address of the cluster communication server from the process of authentication, and then passes through the mobility management entity and the service gateway. The message including the IP address of the terminal and the IP address of the cluster communication server is sent to the packet data gateway, or the IP address of the terminal and the IP address of the cluster communication server are obtained from the short-distance server through the relay, and then the terminal is transmitted to the packet data gateway. The IP address and the IP address of the cluster communication server, or the proximity server sends a message including the IP address of the terminal and the IP address of the cluster communication server to the packet data gateway through the policy and charging rule function entity, and the packet data gateway will Data filtering, only allowing terminals and already Through the group communication server as authentication data communication, so that communication data can be prevented from leakage, improve the public security. Through the description of the foregoing embodiment, after the relay accesses the core network and establishes a connection with the terminal, as shown in FIG. 11, the method includes:

501. The proximity server obtains the IP address of the terminal and the IP address of the server. Optionally, the server obtains the IP address of the terminal and the IP address of the server from the process of authentication by using the proximity server and the relay authentication terminal. Optionally, the terminal registers with the server through the proximity server and the relay, and the proximity server can obtain the IP address of the terminal and the IP address of the server from the registration process.

502. The proximity server sends a message to the packet data gateway, where the message includes an IP address of the terminal and an IP address of the server. Optionally, the message can be sent to the mobility management via the proximity server. The mobility management entity sends a message to the packet data gateway through the service gateway. Optionally, the proximity server sends the message to the relay, and the relay sends the message to the mobility management entity, and the mobility management entity sends the message to the packet data gateway through the service gateway. Optionally, the proximity server sends the message to the policy and charging rule function entity, and the policy and charging rule function entity sends the message to the packet data gateway. The message may further include: at least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter. The terminal is used for the identity of the network identification terminal; the identifier of the relay is used for the identity of the network identity relay; the relay indication is used to indicate the relay as the relay; the quality of service parameter required by the terminal is used for the terminal to the network Request communication resources.

503. The packet data gateway adds the IP address of the terminal and the IP address of the server. During the data transmission process, the packet data gateway performs data filtering according to the IP address of the terminal and the IP address of the server. In the above description, the message further carries identification information, and the identifier information is used to indicate that the packet data gateway adds or deletes the IP address of the terminal and the IP address of the server.

Specifically, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server;

When the server allows the terminal to exit the group communication by relay, the identification information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server.

504. The terminal performs data communication with the server after performing data filtering by the packet data gateway.

Through the above description, it is possible to allow only the terminal to communicate with the server that has been authenticated, or only allow the terminal to communicate with the server that has already been registered. The packet data gateway receives the message, and the identification information indicates that the packet data gateway deletes the terminal.

When the IP address and the IP address of the server are used, during the data transmission process, the packet data gateway performs data filtering according to the IP address of the terminal and the IP address of the server, and the terminal does not perform data communication with the server when the packet data gateway performs data filtering, such that To prevent data leakage and improve public safety performance. An embodiment of the present invention provides a method for a terminal to access a network, where a short-distance server acquires an IP address of a terminal and an IP address of a server, and sends a message to the packet data gateway, where the message includes an IP address of the terminal and an IP address of the server, and the packet data. The gateway adds the IP address of the terminal and the IP address of the server. During the data transmission process, the packet data gateway performs data filtering according to the IP address of the terminal and the IP address of the server, and the terminal performs data communication with the server after data filtering by the packet data gateway. It can prevent communication data from being leaked and improve public safety performance. The embodiment of the present invention provides a packet data gateway 01. As shown in FIG. 12, the method includes: a receiving unit 01 1 configured to receive a message, where the message includes an IP address of the terminal and an IP address of the server. The processing unit 012 is configured to add an IP address of the terminal and an IP address of the server. During data transmission, data filtering is performed according to the IP address of the terminal and the IP address of the server, so that the terminal and the server perform data communication.

Optionally, the processing unit 012 is further configured to: delete the IP address of the terminal and the IP address of the server, and perform data filtering according to the IP address of the terminal and the IP address of the server during the data transmission, so that the terminal does not perform data with the server. Communication. Optionally, the message is sent by the proximity server to the packet data gateway by using the mobility management entity and the service gateway; or, the message is sent by the proximity server to the packet data gateway by using the relay, the mobility management entity, and the service gateway; or , the message is sent by the proximity server through the policy and charging rule function entity To the packet data gateway; wherein, the IP address of the terminal in the message and the IP address of the server are obtained by the proximity server when the server passes the proximity server and the relay authentication terminal, or the terminal passes the proximity server and the relay Obtained when registering to the server.

Optionally, the processing unit 012 adds or deletes the IP address of the terminal and the IP address of the server according to the identifier information carried in the message received by the receiving unit. Optionally, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server;

When the server allows the terminal to exit the group communication by relay, the identification information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server. Optionally, the message further includes:

At least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter; wherein, the terminal identifier is used for identifying the identity of the terminal; The identifier is used for the identifier of the network identifier relay; the relay indication is used to indicate the quality of service parameter required by the terminal, and is used by the terminal to request the communication resource from the network.

Optionally, the processing unit 012 is further configured to: when the receiving unit receives the message, generate a data aggregation description parameter according to the IP address of the terminal in the message and the IP address of the server, and the aggregation description parameter is used to update the relay of the packet data gateway. The data filtering template is sent to the relay for data forwarding. An embodiment of the present invention provides a packet data gateway, which receives a message through a packet data gateway, where the message includes an IP address of the terminal and an IP address of the server, and the packet data gateway adds the IP address of the terminal and the IP address of the server, and the data of the packet data gateway is in the data. During the transmission process, data concerns are made based on the IP address of the terminal and the IP address of the server, so that the terminal and the server perform data communication, which can prevent communication data from being leaked and improve public security performance. The embodiment of the present invention provides a proximity server 02, as shown in FIG. 13, comprising: an obtaining unit 021, configured to obtain an IP address of the terminal and an IP address of the server. The sending unit 022 is configured to send a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server, so that the packet data gateway adds the IP address of the terminal and the IP address of the server, and according to the IP address of the terminal during data transmission Data filtering is performed with the IP address of the server to facilitate data communication between the terminal and the server. Optionally, the sending unit 022 sends the message to the packet data gateway, so that the packet data gateway deletes the IP address of the terminal and the IP address of the server, and performs data filtering according to the IP address of the terminal and the IP address of the server during the data transmission process, so that The terminal does not communicate data with the server. Optionally, the message is sent by the mobility management entity and the service gateway to the packet data gateway by the sending unit 022; or, the message is sent by the sending unit 022 to the packet data gateway by using the relay, the mobility management entity, and the serving gateway; Or, the message is sent by the sending unit 022 to the packet data gateway by the policy and charging rule function entity; wherein, the IP address of the terminal in the message and the IP address of the server are close-range servers in the server through the proximity server and the relay Obtained when the terminal is obtained, or obtained when the terminal registers with the server through the proximity server and the relay. Optionally, the message further carries the identifier information, where the identifier information is used to indicate that the packet data gateway adds or deletes the IP address of the terminal and the IP address of the server. Optionally, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the packet data gateway adds the IP address of the terminal to the IP address of the server; when the server allows the terminal to exit the group communication by using the relay, The information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server. Optionally, the message further includes: at least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter; where the terminal identifier is used for the network Identifying the identity of the terminal; the identity of the relay, the identity used for the network identity relay; the relay indication, used to indicate the quality of service parameter required by the terminal, and the terminal for requesting the communication resource from the network. Optionally, when the sending unit 022 sends a message to the packet data gateway, the packet data gateway generates a data aggregation description parameter according to the IP address of the terminal in the message and the IP address of the server, and the aggregation description parameter is used to update the relay data by the packet data gateway. Filter the template and send it to the relay for data forwarding. The embodiment of the invention provides a short-range server, which obtains the IP address of the terminal and the IP address of the server through the proximity server, and sends a message to the packet data gateway through the relay, the mobility management entity and the service gateway, where the message includes the terminal. The IP address and the IP address of the server, so that the packet data gateway adds the IP address of the terminal and the IP address of the server, and performs data filtering according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal and the server perform data communication. It can prevent communication data from being leaked and improve public safety performance. The embodiment of the present invention provides a relay 03. As shown in FIG. 14, the method includes: an obtaining unit 03 1 configured to obtain an IP address of the terminal and an IP address of the server. The sending unit 032 is configured to send a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server, so that the packet data gateway adds the IP address of the terminal and the IP address of the server, and according to the IP address of the terminal during data transmission Data filtering is performed with the IP address of the server to facilitate data communication between the terminal and the server. Optionally, the sending unit 032 sends the message to the packet data gateway, so that the packet data gateway deletes the IP address of the terminal and the IP address of the server, and performs data filtering according to the IP address of the terminal and the IP address of the server during the data transmission process, so that Yu The terminal does not communicate data with the server. Optionally, the message is sent by the short-range server to the packet data gateway by using the sending unit 032, the mobility management entity, and the serving gateway; wherein, the IP address of the terminal in the message and the IP address of the server are close-range servers passing through the server. Obtained when the server and the relay authentication terminal are obtained, or when the terminal registers with the server through the proximity server and the relay. Optionally, the message further carries the identifier information, where the identifier information is used to indicate that the packet data gateway adds or deletes the IP address of the terminal and the IP address of the server. Optionally, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server;

At least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter; wherein, the terminal identifier is used for identifying the identity of the terminal; The identifier is used for the identifier of the network identifier relay; the relay indication is used to indicate the quality of service parameter required by the terminal, and is used by the terminal to request the communication resource from the network. Optionally, the processing unit 033 is further configured to: when the sending unit 032 sends a message to the packet data gateway, update the data filtering template according to the IP address of the terminal in the message and the IP address of the server, for The data filtering template performs data forwarding. The embodiment of the invention provides a relay, which obtains the IP address of the terminal and the IP address of the server through the relay, and the relay sends a message to the packet data gateway through the mobility management entity and the service gateway, where the message includes the IP address of the terminal and the server. IP address, so When the packet data gateway adds the IP address of the terminal and the IP address of the server, data filtering is performed according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal and the server perform data communication, thereby preventing communication data from being leaked. Improve public safety performance. The embodiment of the present invention provides a packet data gateway 04, as shown in FIG. 15, including a bus 041, a processor 042, a transmitter 043, a receiver 044, and a memory 045, wherein the memory 045 is used to store instructions, and the receiver 044 Executing the instruction is used to receive a message, where the message includes an IP address of the terminal and an IP address of the server; the processor 042 executes the instruction to add the IP address of the terminal and the IP address of the server, and according to the IP address of the terminal during data transmission Data filtering is performed with the IP address of the server to facilitate data communication between the terminal and the server. In the embodiment of the present invention, optionally, the processor 042 executes the instruction for deleting the IP address of the terminal and the IP address of the server, and performing data filtering according to the IP address of the terminal and the IP address of the server during the data transmission process. So that the terminal does not communicate data with the server. In the embodiment of the present invention, optionally, the message is sent by the proximity server to the packet data gateway by using the mobility management entity and the service gateway; or, the message is sent by the proximity server through the relay, the mobility management entity, and the service gateway. To the packet data gateway; or, the message is sent by the near-range server to the packet data gateway through the policy and charging rule function entity; wherein, the IP address of the terminal in the message and the IP address of the server are close-range servers passing through the server Obtained when the server and the relay authentication terminal are obtained, or when the terminal registers with the server through the proximity server and the relay. In the embodiment of the present invention, optionally, the processor 042 executes the instruction to add or delete the IP address of the terminal and the IP address of the server according to the identifier information carried in the message. In the embodiment of the present invention, optionally, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server; when the server allows the terminal to pass the relay When the group communication is exited, the identification information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server. In the embodiment of the present invention, optionally, the message further includes:

At least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter; wherein, the terminal identifier is used for identifying the identity of the terminal; The identifier is used for the identifier of the network identifier relay; the relay indication is used to indicate the quality of service parameter required by the terminal, and is used by the terminal to request the communication resource from the network. In the embodiment of the present invention, optionally, the processor 042 executing the instruction may also be used to:

When receiving the message, the receiver generates a data aggregation description parameter according to the IP address of the terminal in the message and the IP address of the server, and the aggregation description parameter is used for the data filtering template of the packet data gateway update relay, and then sent to the relay for use in the relay. Data forwarding. The embodiment of the invention provides a packet data gateway, which receives a message through a packet data gateway, where the message includes an IP address of the terminal and an IP address of the server. When the packet data gateway adds the IP address of the terminal and the IP address of the server, the packet data gateway In the data transmission process, data concerns are made according to the IP address of the terminal and the IP address of the server, so that the terminal and the server perform data communication, which can prevent communication data from being leaked and improve public security performance. The embodiment of the present invention provides a proximity server 05, as shown in FIG. 16, including a bus 051, a processor 052, a transmitter 053, a receiver 054, and a memory 055, wherein the memory 055 is used to store instructions, and the receiver 054 Executing the instruction is used to obtain the IP address of the terminal and the IP address of the server; the transmitter 053 executes the instruction for sending a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server. The address is such that the packet data gateway adds the IP address of the terminal to the IP address of the server, and performs data filtering according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal and the server perform data communication. In the embodiment of the present invention, optionally, the transmitter 053 executes the instruction for sending the message to the packet data gateway, so that the packet data gateway deletes the IP address of the terminal and the IP address of the server, according to the terminal in the data transmission process. The IP address is filtered with the IP address of the server so that the terminal does not communicate with the server. In the embodiment of the present invention, optionally, the message is sent by the mobility management entity and the service gateway to the packet data gateway by the transmitter 053; or, the message is the transmitter 053 through the relay, the mobility management entity, and the service gateway. Sending to the packet data gateway; or, the message is sent by the transmitter 053 to the packet data gateway through the policy and charging rule function entity; wherein, the IP address of the terminal in the message and the IP address of the server are short-range servers passing through the server Obtained when the proximity server and the relay authentication terminal are obtained, or when the terminal registers with the server through the proximity server and the relay. In the embodiment of the present invention, optionally, the message further carries the identifier information, where the identifier information is used to instruct the packet data gateway to add or delete the IP address of the terminal and the IP address of the server. In the embodiment of the present invention, optionally, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server; when the server allows the terminal to pass the relay When the group communication is exited, the identification information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server. In the embodiment of the present invention, optionally, the message further includes:

At least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter; The terminal identifier, the identity of the network identifier terminal, the identifier of the relay, the identity used for the network identifier relay, the relay indication, used to indicate the relay as the relay; the quality of service parameter required by the terminal, used by the terminal The network requests communication resources. In the embodiment of the present invention, optionally, when the transmitter 053 sends a message to the packet data gateway, the packet data gateway generates a data aggregation description parameter according to the IP address of the terminal in the message and the IP address of the server, and the aggregation description parameter is used. The packet data gateway updates the data filtering template of the relay and sends it to the relay for data forwarding. The embodiment of the invention provides a short-range server, which obtains the IP address of the terminal and the IP address of the server, and sends a message to the packet data gateway through the relay, the mobility management entity and the service gateway, where the message includes the IP of the terminal. The IP address of the address and the server, when the packet data gateway adds the IP address of the terminal and the IP address of the server, performs data filtering according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal and the server perform data communication. It can prevent communication data from being leaked and improve public safety performance. The embodiment of the present invention provides a relay 06, as shown in FIG. 17, including a bus 061, a processor 062, a transmitter 063, a receiver 064, and a memory 065, wherein the memory 065 is used to store instructions, and the receiver 064 performs The instruction is used to obtain the IP address of the terminal and the IP address of the server; the transmitter 063 executes the instruction for sending a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server, so that the packet data gateway adds the IP of the terminal. The IP address of the address and the server is filtered according to the IP address of the terminal and the IP address of the server during data transmission, so that the terminal and the server perform data communication. In the embodiment of the present invention, optionally, the transmitter 063 executes the instruction for sending the message to the packet data gateway, so that the packet data gateway deletes the IP address of the terminal and the IP address of the server, according to the terminal in the data transmission process. The IP address and the IP address of the server are used for data filtering so that the terminal does not communicate with the server. In the embodiment of the present invention, optionally, the message is that the proximity server executes the instruction by the transmitter 063 for sending to the branch through the mobility management entity and the service gateway. The data gateway of the group; wherein, the IP address of the terminal in the message and the IP address of the server are obtained by the proximity server when the server passes the proximity server and the relay authentication terminal, or the terminal is registered by the proximity server and the relay. Obtained when you get to the server. In the embodiment of the present invention, optionally, the message further carries the identifier information, where the identifier information is used to instruct the packet data gateway to add or delete the IP address of the terminal and the IP address of the server. In the embodiment of the present invention, optionally, when the server allows the terminal to join the group communication by using the relay, the identifier information is used to indicate that the packet data gateway adds the IP address of the terminal and the IP address of the server; when the server allows the terminal to pass the relay When the group communication is exited, the identification information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server. In the embodiment of the present invention, optionally, the message further includes:

At least one of a terminal identifier of the terminal, an identifier of the relay, a relay indication of the relay, a quality of service parameter required by the terminal, and a data aggregation description parameter; wherein, the terminal identifier is used for identifying the identity of the terminal; The identifier is used for the identifier of the network identifier relay; the relay indication is used to indicate the quality of service parameter required by the terminal, and is used by the terminal to request the communication resource from the network. In the embodiment of the present invention, optionally, when the transmitter 063 executes the instruction for sending a message to the packet data gateway, the relay updates the data filtering template according to the IP address of the terminal in the message and the IP address of the server, to use The relay forwards data according to the data filtering template. The embodiment of the invention provides a relay, which obtains the IP address of the terminal and the IP address of the server through the relay, and the relay sends a message to the packet data gateway through the mobility management entity and the service gateway, where the message includes the IP address of the terminal and the server. The IP address is such that the packet data gateway adds the IP address of the terminal to the IP address of the server, and performs data filtering according to the IP address of the terminal and the IP address of the server during data transmission. Facilitate data communication between the terminal and the server, which can prevent communication data from being leaked and improve public safety performance.

In the several embodiments provided herein, it should be understood that the disclosed apparatus, methods, and systems may be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. Alternatively, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in electrical, mechanical or other form. Further, in the devices and systems in the various embodiments of the present invention, each functional unit may be integrated in one processing unit, or each unit may be physically included separately, or two or more units may be integrated in one unit. The above units may be implemented in the form of hardware or in the form of hardware plus software functional units. All or part of the steps of implementing the foregoing method embodiments may be performed by hardware related to the program instructions. The foregoing program may be stored in a computer readable storage medium, and when executed, the program includes the steps of the foregoing method embodiments; The foregoing storage medium includes: a USB flash drive, a removable hard disk, a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. medium. The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be stated in the scope of the claims

Claims

claims

1. A method for a terminal to access a network, characterized by including:

The packet data gateway receives the message, the message includes the IP address of the terminal and the IP address of the server;

The packet data gateway adds the IP address of the terminal and the IP address of the server. During the data transmission process, the packet data gateway performs data filtering based on the IP address of the terminal and the IP address of the server, so that Perform data communication between the terminal and the server.

2. The method according to claim 1, characterized in that, the packet data gateway deletes the IP address of the terminal and the IP address of the server, and the packet data gateway deletes the IP address of the terminal according to the data transmission process of the packet data gateway. The IP address of the terminal is filtered with the IP address of the server so that the terminal does not communicate with the server.

3. The method according to claim 1, characterized in that the message is sent by the short-range server to the packet data gateway through the mobility management entity and the serving gateway;

Or, the message is sent by the short-range server to the packet data gateway through the relay, mobility management entity and serving gateway;

Or, the message is sent by the proximity server to the packet data gateway through the policy and charging rule functional entity;

Wherein, the IP address of the terminal and the IP address of the server in the message are obtained by the short-range server when the server authenticates the terminal through the short-range server and the relay, Or it is obtained when the terminal registers with the server through the short-range server and the relay.

4. The method according to claim 3, characterized in that the packet data gateway adds or deletes the IP address of the terminal and the IP address of the server according to the identification information carried in the message.

5. The method according to claim 2 or 4, characterized in that,

When the server allows the terminal to join the group communication through the relay, the identification information is used to instruct the packet data gateway to add the IP address of the terminal and the The IP address of the above server;

When the server allows the terminal to exit the group communication through the relay, the identification information is used to instruct the packet data gateway to delete the IP address of the terminal and the IP address of the server.

6. The method according to claim 4, wherein the message further includes: a terminal identification of the terminal, an identification of the relay, a relay indication of the relay, and information required by the terminal. At least one of a quality of service parameter and a data aggregation description parameter; wherein, the terminal identifier is used by the network to identify the identity of the terminal; the relay identifier is used by the network to identify the identity of the relay; The relay indication is used to indicate serving as a relay; the service quality parameters required by the terminal are used for the terminal to request communication resources from the network.

7. The method according to claim 1, characterized in that, the method further includes: when the packet data gateway receives the message, the packet data gateway determines the IP address of the terminal according to the message. The address and the IP address of the server generate data aggregation description parameters. The aggregation description parameters are used by the packet data gateway to update the data filtering template of the relay, and then are sent to the relay for data forwarding.

8. A method for a terminal to access a network, characterized by including:

The proximity server obtains the IP address of the terminal and the IP address of the server;

The short-range server sends a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server;

The packet data gateway adds the IP address of the terminal and the IP address of the server. During the data transmission process, the packet data gateway performs data filtering according to the IP address of the terminal and the IP address of the server;

The terminal performs data communication with the server after the packet data gateway performs data filtering.

9. The method according to claim 8, characterized in that, upon receiving the message, the packet data gateway deletes the IP address of the terminal and the IP address of the server; during the data transmission process, the packet data gateway deletes the IP address of the terminal and the IP address of the server; The data gateway performs data filtering based on the IP address of the terminal and the IP address of the server; The terminal does not perform data communication with the server when the packet data gateway performs data filtering.

10. The method according to claim 9, wherein the short-range server obtains the IP address of the terminal and the IP address of the server including:

The server authenticates the terminal through the short-range server and relay; the short-range server obtains the IP address of the terminal and the IP address of the server from the authentication process;

Alternatively, the short-range server obtains the IP address of the terminal and the IP address of the server, including:

The terminal registers with the service through the proximity server and the relay. ,

The proximity server obtains the IP address of the terminal and the IP address of the server from the registration process.

11. The method according to claim 9, characterized in that sending a message from the short-range server to the packet data gateway includes:

The short-range server sends the message to the mobility management entity; the mobility management entity sends the message to the packet data gateway through the serving gateway.

12. The method according to claim 9, characterized in that sending a message from the short-range server to the packet data gateway includes:

The proximity server sends the message to the relay;

The relay sends the message to the mobility management entity;

The mobility management entity sends the message to the packet data gateway via the serving gateway.

13. The method according to claim 9, characterized in that sending a message from the short-range server to the packet data gateway includes:

The short-range server sends the message to the policy and charging rules functional entity;

The policy and charging rule functional entity sends the message to the packet data gateway.

14. The method according to any one of claims 11 to 13, characterized in that the message also carries identification information, and the identification information is used to instruct the packet data gateway to add or delete the IP address and IP address of the terminal. The IP address of the server.

15. The method according to claim 14, characterized in that,

When the server allows the terminal to join the group communication through the relay, the identification information is used to instruct the packet data gateway to add the IP address of the terminal and the IP address of the server;

16. The method according to claim 14, characterized in that the message further includes:

At least one of the terminal identification of the terminal, the identification of the relay, the relay indication of the relay, the service quality parameters required by the terminal and the data aggregation description parameters; wherein, the terminal identification is The identity of the terminal used to identify the network; The identity of the relay, used by the network to identify the identity of the relay; The relay indication, used to indicate serving as a relay; The quality of service required by the terminal Parameters used by the terminal to request communication resources from the network.

17. The method according to claim 8, characterized in that the method further includes:

After the short-range server sends the message to the packet data gateway, the packet data gateway generates data aggregation description parameters based on the IP address of the terminal and the IP address of the server in the message;

The packet data gateway updates the data filtering template of the relay according to the aggregation description parameter, and then sends the data filtering template to the relay;

The relay forwards data according to the data filtering template.

18. The method according to claim 12, characterized in that, the method further includes: Before the relay sends the message to the mobility management entity, the relay updates the data filtering template according to the IP address of the terminal and the IP address of the server in the message;

The relay forwards data according to the data filtering template.

19. A packet data gateway, characterized by including:

A receiving unit, configured to receive messages, where the messages include the IP address of the terminal and the IP address of the server;

A processing unit configured to add the IP address of the terminal and the IP address of the server, and perform data filtering according to the IP address of the terminal and the IP address of the server during the data transmission process, so as to facilitate the connection between the terminal and the server. The server performs data communication.

20. The packet data gateway according to claim 19, characterized in that the processing unit is also used to:

Delete the IP address of the terminal and the IP address of the server. During the data transmission process, perform data filtering based on the IP address of the terminal and the IP address of the server, so that the terminal does not communicate with the server. data communication.

21. The packet data gateway according to claim 19, characterized in that the message is sent to the packet data gateway by the short-range server through the mobility management entity and the serving gateway;

22. The packet data gateway according to claim 21, wherein the processing unit adds or deletes the IP address of the terminal and the server according to the identification information carried in the message received by the receiving unit. of the IP address.

23. The packet data gateway according to claim 20 or 22, wherein when the server allows the terminal to join group communication through the relay, the identification information is used to indicate to the packet data gateway Add the IP address of the terminal and the IP address of the server;

24. The packet data gateway according to claim 22, characterized in that the message further includes:

25. The packet data gateway according to claim 19, characterized in that the processing unit is also used to:

When the receiving unit receives the message, it generates data aggregation description parameters according to the IP address of the terminal and the IP address of the server in the message, and the aggregation description parameters are used by the packet data gateway to update all The data filtering template of the relay is then sent to the relay for data forwarding.

26. A communication system, characterized by including:

The short-distance server is used to obtain the IP address of the terminal and the IP address of the server; the short-distance server is also used to send a message to the packet data gateway, where the message includes the IP address of the terminal and the IP address of the server. ;

The packet data gateway is used to add the IP address of the terminal and the IP address of the server, and during the data transmission process, perform data filtering based on the IP address of the terminal and the IP address of the server;

The terminal is used to communicate with the service after the packet data gateway performs data filtering. server for data communication.

27. The communication system according to claim 26, wherein the packet data gateway is configured to receive the message and delete the IP address of the terminal and the IP address of the server;

During the data transmission process, data filtering is performed based on the IP address of the terminal and the IP address of the server;

The terminal is configured to not perform data communication with the server when the packet data gateway performs data filtering.

28. The communication system according to claim 27, characterized in that: the server is configured to authenticate the terminal through the short-range server and the relay; the short-range server is also configured to authenticate from the During the process, the IP address of the terminal and the IP address of the server are obtained;

Or, the terminal is configured to register with the server through the short-distance server and the relay; the short-distance server is also configured to obtain the IP address of the terminal and the server from the registration process. IP address.

29. The communication system according to claim 27, in the process of the short-range server sending the message to the packet data gateway, the short-range server is used to send the message to the mobility management entity ;

The mobility management entity is configured to send the message to the packet data gateway via the serving gateway.

30. The communication system according to claim 29, in the process of the short-range server sending the message to the packet data gateway, the short-range server is used to send the message to the relay;

The relay is used to send the message to the mobility management entity;

3 1. The communication system according to claim 29, characterized in that, in the process of the short-range server sending the message to the packet data gateway, the short-range server is used to send the message. To the policy and billing rules functional entity; The policy and charging rule functional entity is used to send the message to the packet data gateway.

32. The communication system according to any one of claims 29 to 31, characterized in that the message also carries identification information, and the identification information is used to instruct the packet data gateway to add or delete the IP of the terminal. address with the IP address of the server.

33. The communication system according to claim 32, wherein when the server allows the terminal to join the group communication through the relay, the identification information is used to instruct the packet data gateway to add the The IP address of the terminal and the IP address of the server;

34. The communication system according to claim 32, characterized in that the message further includes:

35. The communication system according to claim 26, characterized in that: the packet data gateway is further configured to: after the short-range server sends the message to the packet data gateway, according to the message The IP address of the terminal and the IP address of the server generate data aggregation description parameters;

The packet data gateway is also configured to update the data filtering template of the relay according to the aggregation description parameter, and then send the data filtering template to the relay;

The relay is also used to forward data according to the data filtering template.

36. The communication system according to claim 30, characterized in that: the relay is further configured to: before the relay sends the message to the mobility management entity, according to the The IP address of the terminal and the IP address of the server in the message are used to update the data filtering template;