WO2015100615A1

WO2015100615A1 - Method and apparatus for processing service packet, and gateway device

Info

Publication number: WO2015100615A1
Application number: PCT/CN2013/091111
Authority: WO
Inventors: 胡翔; 胡玉胜; 郭建成; 张翀
Original assignee: 华为技术有限公司
Priority date: 2013-12-31
Filing date: 2013-12-31
Publication date: 2015-07-09
Also published as: CN104995891A; CN104995891B

Abstract

Embodiments of the present invention provide a method for processing a service packet, a user equipment, and a gateway device. The method comprises: a gateway device receiving a service packet, the service packet carrying an application identification, and the application identification being used for indicating an application to which the service packet belongs; the gateway device identifying the application to which the service packet belongs according the application identification; and the gateway device executing a processing policy on the service packet according to a pre-established correspondence between the application and the processing policy. In the embodiments of the present invention, by carrying an application identification in a service packet and pre-storing the application identification in a gateway device, the gateway device can identify an application according to matching between the application identification carried in the service packet and the application identification stored in the gateway device, thereby improving the rate of identifying the application by the gateway device.

Description

Method, device and gateway device for processing business _3⁄4 text

Embodiments of the present invention relate to the field of wireless communications, and, more particularly, to a method, apparatus, and gateway device for processing a service profile. Background technique

With the popularity of smart terminals, the use of applications (APP) is becoming more widespread. There are many different applications, mainly maintained and managed by their respective OTT (Over The Top) vendors.

Currently, cooperation between mobile network operators and OTT vendors is becoming more widespread. For example, Alibaba provides free traffic packets for users who use its Taobao, Tmall and other applications; Guangzhou Unicom and Telecom have launched WeChat traffic packages.

In the case of using a mobile network, the gateway device of the core network in the mobile network needs to identify the application to which the service message belongs, so that different processing policies (such as charging policy and QoS policy) can be used for different applications.

In the prior art, the operator usually uses DPI (Deep Packet Inspection) to identify the application type of the application to which the service message belongs. However, DPI-based identification requires the creation of a signature library at the gateway device of the core network. Due to the frequent update of the application, the update of the feature library often cannot keep up with the update speed of the application, and the recognition rate is low. Summary of the invention

The embodiment of the invention provides a method, a device and a gateway device for processing a service packet, so as to improve the recognition rate of the application of the service packet by the gateway device.

The first aspect provides a method for processing a service packet, where: the gateway device receives a service packet, where the service carries an application identifier, where the application identifier is used to indicate an application to which the service text belongs; The gateway device identifies the application to which the service packet belongs according to the application identifier. The gateway device performs the processing policy on the service packet according to the corresponding relationship between the application and the processing policy.

With reference to the first aspect, in an implementation manner of the first aspect, the gateway device stores a corresponding relationship between the application identifier and an application, and the identifying the application according to the application identifier includes: And determining, according to the application identifier carried in the service text, and the corresponding relationship between the application identifier and the application, the application corresponding to the application identifier is determined as an application to which the service packet belongs.

In conjunction with the first aspect, or any one of the foregoing implementation manners, in another implementation manner of the first aspect, the service packet further carries a security check code, where the security check code is used to verify the location For the security of the service packet, the gateway device further stores the corresponding relationship between the application identifier and the application, and the identifying the application according to the application identifier, including: according to the service packet Carrying the application identifier, and the corresponding relationship between the application identifier and the key, determining the key; generating a reference check code according to the key; and using the reference check code and the security check code When the matching is performed, the application corresponding to the application identifier is determined as the application to which the service 4 belongs.

In conjunction with the first aspect, or any one of the foregoing implementation manners, in another implementation manner of the first aspect, the key is a temporary key generated by the key server for the application, The application identifier carried in the service text, and the corresponding relationship between the application identifier and the key, before determining the key, the method further includes: sending a request message to the key server, where the request message is used And requesting the key server to generate the temporary key for the application; receiving a response message sent by the key server, where the response message carries the temporary key.

In conjunction with the first aspect, or any one of the foregoing implementation manners, in another implementation manner of the first aspect, the service packet further carries a version number of the application, and the gateway device further stores the The application identifier, the version number, and the correspondence between the keys, the determining the key according to the application identifier carried in the service packet, and the correspondence between the application identifier and the key The method includes: selecting, according to the application identifier and the version number carried in the service text, and the corresponding relationship between the application identifier, the version number, and the key, selecting the application identifier and the version number. The key.

With reference to the first aspect, or any one of the foregoing implementation manners, in another implementation manner of the first aspect, the generating the reference check code according to the key, the method includes: generating, based on the key, based on the MD5 The reference check code.

With reference to the first aspect, or any one of the foregoing implementation manners, in another implementation manner of the first aspect, the processing policy is a charging policy of the application, and the applying and processing according to the pre-establishment The policy corresponding to the policy performs the processing policy on the service packet, including: charging the service packet according to the charging policy.

The second aspect provides a method for processing a service packet, including: generating a service packet, where the service packet carries an application identifier, where the application identifier is used to indicate that the service packet belongs to Transmitting, by the gateway device of the core network, the service packet.

With reference to the second aspect, in an implementation manner of the second aspect, the service packet further carries a security check code, where the security check code is used to verify the security of the service packet. Before generating the service packet, the method further includes: acquiring a key corresponding to the application; and generating the security check code according to the key.

With reference to the second aspect, or any one of the foregoing implementation manners, in another implementation manner of the second aspect, the key is a temporary key generated by the key server for the application, and the acquiring the application Corresponding key, including: sending a request message to the key server, the request message is used to request the key server to generate the temporary key for the application; and receiving a response message sent by the key server The response message carries the temporary key.

With reference to the second aspect, or any one of the foregoing implementation manners, in another implementation manner of the second aspect, the key is a built-in key of an application to which the service packet belongs, and the acquiring the application is corresponding to The key includes: extracting the built-in key.

In conjunction with the second aspect, or any one of the foregoing implementation manners, in another implementation manner of the second aspect, the service packet further carries a version number of an application that generates the service packet.

With the second aspect, or any one of the foregoing implementation manners, in another implementation manner of the second aspect, the generating the security check code according to the key includes: according to the key, and The security check code is generated based on MD5.

In a third aspect, a gateway device is provided, including: a first receiving unit, configured to receive a service packet, where the service carries an application identifier, where the application identifier is used to indicate an application to which the service text belongs; a unit, configured to identify, according to the application identifier that is carried in the service packet that is received by the first receiving unit, an application to which the service packet belongs, and an execution unit, configured to identify according to the pre-established identification unit The corresponding relationship between the application and the processing policy performs the processing policy on the service packet.

With reference to the third aspect, in an implementation manner of the third aspect, the gateway device stores a corresponding relationship between the application identifier and an application, where the identifying unit is specifically configured to be used according to the service And determining, by the application identifier, the application identifier that is stored in the gateway device, and the application identifier and the application, the application corresponding to the application identifier is determined to be an application to which the service >3⁄4 text belongs.

In conjunction with the third aspect, or any one of the foregoing implementation manners, in another implementation manner of the third aspect, the service packet further carries a security check code, where the security check code is used to verify the location Shuye The security of the service message, the gateway device further stores the corresponding relationship between the application identifier, the application and the key, and the identification unit is specifically configured to use the application identifier carried in the text according to the service, and Determining a correspondence between the application identifier and the key, determining the key; generating a reference check code according to the key; and when the reference check code matches the security check code, corresponding to the application identifier The application is determined to be the application to which the business "3⁄4 text belongs.

In conjunction with the third aspect, or any one of the foregoing implementation manners, in another implementation manner of the third aspect, the key is a temporary key generated by the key server for the application, and the gateway device further includes a sending unit, configured to send a request message to the key server, where the request message is used to request the key server to generate the temporary key for the application, and a second receiving unit, configured to receive the secret a response message sent by the key server, where the response message carries the temporary key.

With the third aspect, or any one of the foregoing implementation manners, in another implementation manner of the third aspect, the service packet further carries a version number of the application, and the gateway device further stores the The application identifier, the version number, and the corresponding relationship of the key, the identification unit is specifically configured to use the application identifier and the version number carried in the service according to the service, and the application identifier, Selecting, by the version number and the key, the key corresponding to the application identifier and the version number.

In conjunction with the third aspect, or any one of the foregoing implementation manners, in another implementation manner of the third aspect, the identifying unit is specifically configured to generate the reference check code based on the MD5 according to the key.

In conjunction with the third aspect, or any one of the foregoing implementation manners, in another implementation manner of the third aspect, the executing unit is specifically configured to perform charging according to the charging policy.

The fourth aspect provides an apparatus for processing a service packet, including: a first generating unit, configured to generate a service > 3⁄4 text, where the service > 3⁄4 text carries an application identifier, where the application identifier is used to indicate the service And the sending unit is configured to send the service packet generated by the first generating unit to the gateway device of the core network.

With the fourth aspect, in an implementation manner of the fourth aspect, the service packet further includes a security check code, where the security check code is used to check security of the service packet, The device further includes: an obtaining unit, configured to acquire a key corresponding to the application; and a second generating unit, configured to generate the security check code according to the key.

With reference to the fourth aspect, or any one of the foregoing implementation manners, in another implementation manner of the fourth aspect, the key is a temporary key generated by the key server for the application, and the acquiring unit has The body is configured to send a request message to the key server, where the request message is used to request the key server to generate the temporary key for the application; and receive a response message sent by the key server, the response The temporary key is carried in the message.

With reference to the fourth aspect, or any one of the foregoing implementation manners, in another implementation manner of the fourth aspect, the key is a built-in key of an application to which the service packet belongs, and the acquiring unit is specifically configured to: Extract the built-in key.

In conjunction with the fourth aspect, or any one of the foregoing implementation manners, in another implementation manner of the fourth aspect, the service packet further carries a version number of an application that generates the service packet.

In conjunction with the fourth aspect, or any one of the foregoing implementation manners, in another implementation manner of the fourth aspect, the second generating unit is specifically configured to generate, according to the key, based on the message digest algorithm MD5 Security check code.

In the embodiment of the present invention, the application identifier is carried in the service packet, and the application identifier is pre-stored in the gateway device, and the gateway device can identify the application according to the matching between the application identifier carried in the service packet and the application identifier stored in the gateway device. , thereby improving the recognition rate of the gateway device to the application. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments of the present invention will be briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. Other drawings may also be obtained from those of ordinary skill in the art in view of the drawings.

FIG. 1 is a schematic flowchart of a method for processing a service message according to an embodiment of the present invention.

FIG. 2 is a schematic flowchart of a method for processing a service message according to an embodiment of the present invention.

FIG. 3 is a diagram of a networking architecture according to an embodiment of the present invention.

FIG. 4 is a flow chart of a method for processing a service packet according to the network architecture of FIG. 3 according to an embodiment of the present invention.

FIG. 5 is a flowchart of a method for processing a service message according to an embodiment of the present invention.

FIG. 6 is a schematic block diagram of a gateway device according to an embodiment of the present invention.

FIG. 7 is a schematic block diagram of an apparatus for processing a service message according to an embodiment of the present invention.

FIG. 8 is a schematic block diagram of a gateway device according to an embodiment of the present invention.

FIG. 9 is a schematic block diagram of an apparatus for processing a service message according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without making creative labor are within the scope of the present invention.

In the embodiment of the present invention, an application identifier is added to a service packet, in order to solve the problem that the gateway device has a low recognition rate for the application of the service packet. The application identifier can generate an application identifier corresponding to each application by means of cooperation between the OTT vendor and the operator of the mobile network to identify the application. The operator can store the application identifier of the contracted application in the gateway device. When the application generates the service, the application identifier of the application may be added to the application. When the service packet passes the foregoing gateway device, the gateway device may extract the application identifier carried in the service packet and match the stored application identifier to achieve the purpose of identifying the application.

It should be understood that the technical solution of the present invention can be applied to various communication systems, such as: GSM (Global System of Mobile communication) system, CDMA (Code Division Multiple Access) system, WCDMA (Wideband Code) Wideband Code Division Multiple Access system, GPRS (General Packet Radio Service), LTE (Long Term Evolution) system, LTE-A (Advanced Long Term Evolution) System, UMTS (Universal Mobile Telecommunication System, etc.).

It should be understood that, in the embodiment of the present invention, the UE (User Equipment) includes but is not limited to an MS (Mobile Station), a Mobile Terminal, a Mobile Telephone, and a handset. And portable equipment, etc., the user equipment can communicate with one or more core networks via a RAN (Radio Access Network), for example, the user equipment can be a mobile phone (or "cellular" The telephone, the computer with wireless communication function, etc., the user equipment can also be a portable, pocket, handheld, computer built-in or vehicle-mounted mobile device.

It should be understood that the above gateway device is related to the type of mobile network used by the terminal. For example, it may be a GGSN (Gateway GPRS Support Node) in the GPRS network; it may also be a PGW (Packet Data Network Gateway) in LTE; or a PDSN in CDMA 2000 ( The Packet Data Serving Node and the like are not specifically limited in the embodiment of the present invention. FIG. 1 is a schematic flowchart of a method for processing a service message according to an embodiment of the present invention. The method can be performed by a gateway device of the core network, such as GGSN/PGW. The method of Figure 1 includes:

110. The gateway device receives the service text, where the service identifier carries the application identifier, and the application identifier is used to indicate the application to which the service text belongs.

The foregoing service message may be generated by an application on the UE or the UE (for example, may be a client of the application). The application of the UE or the UE sends the packet to the SP Provider (Service Provider Server) of the application through the foregoing gateway device.

The above business documents can also be generated by the SP Server. For example, the SP server sends a service packet to the UE through the gateway device. In the embodiment of the present invention, the UE generates a service packet, and the gateway device forwards the service text to the SP server as an example. The SP server generates a service text, and the specific manner of sending the service packet to the gateway device corresponds to the UE side. To avoid repetition, it is not described in detail.

The application identifier may be an application ID specially established for identifying an application, and the application and the application ID are corresponding to each other, so that the gateway device can accurately identify the application according to the application ID. Specifically, the application ID can be established by means of negotiation between the mobile network operator and the OTT vendor. For example, a mobile network operator may require that an OTT vendor configure a dedicated application ID for each application and record the application ID on the gateway device before the application goes public.

The above application identifier may also use existing identification information as long as the identification information can accurately distinguish different applications. For example, the application name of each application; or the combination of the application name and the version number, etc., is not specifically limited in the embodiment of the present invention. The operator of the mobile network can pre-record the identification information of each contracted application at the gateway device. When the application on the UE generates the service packet, the identifier information may be embedded in the service packet for the gateway device to identify.

120. The gateway device identifies, according to the application identifier, an application to which the service packet belongs.

It should be understood that the step 120 may include: the gateway device extracting the application identifier from the service packet; and identifying the application according to the extracted application identifier.

The mobile network operator can pre-agreed with the OTT vendor the insertion location of the application identifier in the service. For example, the URL of the HTTP request of the service packet can be inserted, or any other location predetermined in advance. After receiving the service packet, the gateway device receives the service packet. The application identifier can be extracted from the pre-determined location. It should be understood that the foregoing pre-agreed manner is only an example. In practice, the gateway device can also use the DPI to discover the application identifier, which is not specifically implemented by the embodiment of the present invention. limited. It should be noted that the gateway device may pre-store the application identifier of the subscription application, and then identify the application by matching the application identifier in the service packet with the stored application identifier.

It should be noted that the identification application in step 120 may be only a logical identification. For example, when the application identifier in the service packet matches an application identifier pre-stored by the gateway device, the gateway device can be considered to identify the application of the service packet.

130. The gateway device performs a processing policy on the service packet according to the correspondence between the pre-established application and the processing policy.

Optionally, the foregoing processing policy may be an accounting policy of the application, and the step 130 may include: charging the service text according to the charging policy of the application.

For example, the charging policies of traffic generated by different applications are different. The gateway device establishes a correspondence between the application and the charging policy. When the application is identified, the accounting is performed according to the charging policy corresponding to the application.

Of course, the foregoing processing strategy may also be other control policies. For example, data services of different applications have different priorities, and different QoS, congestion control, or bandwidth control are performed according to priorities of different data services.

In the embodiment of the present invention, the application identifier is carried in the service packet, and the application identifier is used to identify the application to which the service packet belongs, and the gateway device can identify the application according to the application identifier, thereby improving the identification of the application by the gateway device. rate.

Optionally, as an embodiment, the gateway device stores the corresponding relationship between the application identifier and the application, and the step 120 may include: corresponding to the application identifier according to the application identifier carried in the service packet, and the corresponding relationship between the application identifier and the application The application is determined to be the application to which the business "3⁄4 text belongs.

In the embodiment of the present invention, the application identifier is carried in the service packet, and the application identifier is pre-stored in the gateway device, and the gateway device can identify the application according to the matching between the application identifier carried in the service packet and the application identifier stored in the gateway device. , thereby improving the recognition rate of the gateway device to the application.

Specifically, the gateway device may pre-establish a list of application identifiers of the subscription application. For example, the first three items in the list are "Application ID 1 - Application Name 1", "Application ID 2 - Application Name 2", and "Application ID 3 - Application Name 3"; the application ID carried in the above service > 3⁄4 text is an application. The identifier 2 is determined by the gateway device to find that the second item in the application identifier list matches the application identifier 2, and the application corresponding to the application identifier 2 (that is, the application indicated by the application name 2) is determined as the application to which the service packet belongs.

In the prior art, the gateway device matches the features in the feature library based on the features in the DPI detection packet to achieve the purpose of application identification. However, such messages are easily forged and not safe enough. This will result in the loss of operators and users.

Optionally, in another embodiment, the foregoing service carries a security check code, where the security check code is used to check the security of the service packet, and the gateway device further stores the application identifier, the application, and the key. Corresponding relationship, step 120 may include: determining a key according to the application identifier carried in the service and the correspondence between the application identifier and the key stored in the gateway device; generating a reference check code according to the key; When the code matches the security check code, the application corresponding to the application identifier is determined to be the application to which the service packet belongs.

In the embodiment of the present invention, the security check code is carried in the service packet, and the gateway device checks the service packet according to the security check code, thereby avoiding the forgery of the service packet and improving the security of the service transmission. Sex.

It should be noted that the foregoing security check code may be generated by an application in the UE based on a key corresponding to the application. On the basis of this, the key used by the UE side to generate the security check code when the service message is generated by a secure application (such as a genuine application) can be ensured by means of pre-agreed or signaling. The encryption method is the same as the key used by the gateway device to generate the above-mentioned reference check code and the encryption method.

Specifically, it may be pre-arranged that the UE and the gateway device side generate the check code by using the same plaintext, key, and encryption manner, and the plaintext may be the name of the application, the URL of the application, or an arbitrary character string. Therefore, when the service packet is a secure service packet, the security check code is the same as the reference check code. When the service packet is a forged service packet, the forged message cannot obtain the plaintext of the agreement. Or a key, the security check code is different from the above reference check code.

Optionally, generating the reference check code according to the key may include: generating a reference check code based on the key, based on the MD5 (Message Digest Algorithm 5). Since the check code obtained by MD5 is unable to calculate the string based on the algorithm in reverse, it avoids the possibility of cracking the agreed string, and the Internet enterprise uses MD5 in large quantities for CP (Content Provider, Content Provider) and The SP (Service Provider) is very low in terms of technology and cost.

It should be noted that there may be multiple ways to obtain a key on the UE side and the gateway device side. Two specific ways of obtaining a key are given below.

Optionally, as an embodiment, the key is a temporary key generated by the pre-deployed key server for the application, according to the application identifier carried in the service packet, and the correspondence between the application identifier and the key stored in the gateway device. Before determining the key, the method of FIG. 1 may further include: sending the key server Sending a request message, the request message is used to request the key server to generate a temporary key for the application; receiving the response message sent by the key server, and the response message carries the temporary key.

Specifically, in order to accurately identify the application to which the service text belongs, the OTT vendor can modify the APP application and deploy the key server on the network side. When the application is started, the UE may request the temporary key of the application from the key server; the gateway device side may periodically send a request message to the key server, requesting the application identifier and the temporary key of the subscription application on the gateway device, when When the application to which the service packet belongs is one of the subscription applications, the request message is used to request the key server to generate a temporary key for the application. Of course, the key server can also set the expiration time for the temporary key, and when the expiration time is reached, a re-request is required.

The above contract application may specifically refer to an application recorded in the GGSN/PGW. For example, when an application's service provider provides a free traffic packet for an application under the mobile network, it needs to sign up with the operator of the mobile network, so that the GGSN/PGW records the application and the application's correspondence with the free traffic policy. relationship.

Optionally, the application identifier may also be a temporary application identifier. When the application or the GGSN/PGW on the UE sends a request message to the key server, the key server may also generate a temporary application identifier. Similarly, the expiration time can also be set for the temporary application identifier.

Optionally, as another embodiment, an application identifier, a version number, and a key may be built in the application, where the service packet further carries an application version number, and the gateway device further stores an application identifier, a version number, and a key. Corresponding relationship, the foregoing determining the key according to the application identifier carried in the service and the corresponding relationship between the application identifier and the key stored in the gateway device may include: according to the application identifier and version number carried in the service packet, and the gateway device Corresponding relationship between the application identifier, the version number, and the key stored in the medium, and selecting a key corresponding to the application identifier and the version number.

Specifically, when generating the service packet, the UE side extracts the application identifier, the version number, and the key built in the application from the application; the gateway device side may extract each application identifier, version number, and key from the subscription application, and Establish a correspondence list.

With reference to FIG. 1 , a method for processing a service message according to an embodiment of the present invention is described in detail from the perspective of a gateway device. Hereinafter, a processing service according to an embodiment of the present invention will be described from the perspective of a user equipment in conjunction with FIG. 2 . Methods.

It should be understood that the interaction between the UE and the gateway device described on the UE side and related features, functions, and the like correspond to the description of the gateway device side, and the duplicate description is omitted as appropriate.

FIG. 2 is a schematic flowchart of a method for processing a service message according to an embodiment of the present invention. figure 2 The method may be performed by a device that processes a service text, for example, may be an application execution on a UE or a UE, or may be an SP Server. The method of Figure 2 includes:

210. Generate a service packet, where the service packet carries an application identifier, where the application identifier is used to indicate an application to which the service packet belongs.

220. Send a service packet to a gateway device of the core network.

It should be understood that the sending of the service packet to the gateway device in step 220 may be the destination of the gateway device or the forwarding of the gateway device to other destinations.

Specifically, when the method of FIG. 2 is performed by the UE, the step 220 may include: the UE forwarding the service packet to the SP server of the application to which the service packet belongs by using the gateway device.

When the method of FIG. 2 is performed by the SP server, the step 220 may include: the SP server forwards the service packet to the UE through the gateway server.

Optionally, as an embodiment, the service packet further carries a security check code, where the security check code is used to check the security of the service packet. Before step 210, the method in FIG. 2 may further include: obtaining an application corresponding Key; generates a security check code based on the key.

Optionally, as another embodiment, the key is a temporary key generated by the pre-deployed key server for the application, and the obtaining the corresponding key of the application may include: sending a request message to the key server, and the request message is used for the request. The key server generates a temporary key for the application; receives a response message sent by the key server, and the response message carries the temporary key.

Optionally, as another embodiment, the key is a built-in key of the application to which the service text belongs, and the obtaining the key corresponding to the application may include: extracting the built-in key from the application to which the service message belongs.

Optionally, as another embodiment, the service packet further carries a version number of the application that generates the service packet.

Optionally, as another embodiment, generating a security check code according to the key includes: generating a security check code according to the key and based on the MD5.

Embodiments of the present invention are described in more detail below with reference to specific examples. It should be noted that the examples of FIG. 3 to FIG. 4 are merely for facilitating the understanding of the embodiments of the present invention, and the embodiments of the present invention are not limited to the specific numerical values or specific examples illustrated. Those skilled in the art will appreciate that various modifications or changes can be made in accordance with the examples of Figures 3 through 5, such modifications or variations. It also falls within the scope of the embodiments of the present invention.

FIG. 3 is a diagram of a networking architecture according to an embodiment of the present invention. In the embodiment of FIG. 3, the application identifier and the key applied in the UE side are obtained from a public key server deployed by the OTT vendor on the network side; the correspondence between the application identifier and the key in the gateway device is also Obtained in the key server.

In addition, the above-mentioned gateway device takes GGSN/PGW as an example, and GGSN/PGW sets different charging policies for different applications, by PCRF (Policy and Charging Rules Function) entity and OCS (online meter) Charge System, Online Charging System) Control.

Specifically, when the UE interacts with the SP server in the mobile network, the service packet may access the core network through the RAN, for example, UMTS or LTE, and sequentially pass through the SGSN/SGW in the core network.

GGSN/PGW arrives at SP Server

FIG. 4 is a flow chart of a method for processing a service packet according to the network architecture of FIG. 3 according to an embodiment of the present invention. The method may be performed by the UE or by an application on the UE.

401. Apply the domain name of the built-in key server or IP (Internet Protocol) address.

The application is located on the UE, ensuring that the temporary key is obtained from the key server each time the UE runs the application or when the key fails.

The key server is pre-established, and the key server can be located on the network side, as shown in the key server in FIG.

402. When the UE accesses the mobile network, when the application runs, send a request message to the key server, and request a temporary key.

Specifically, the application sends a request message to the key server according to the domain name or IP address of the key server, and the process may be carried on the HTTPS (Hypertext Transfer Protocol over Secure Socket Layer). The authentication and key application with the key server is completed in a confidential manner to prevent the key from being intercepted by the intermediate device.

The request message may carry an application name or an application ID, so that the key server knows the application of the request temporary key, and generates a temporary key corresponding to the application.

Further, the request message may carry a username and a password required to log in to the key server, so that the key server performs authentication according to the username and password.

403. The GGSN/PGW forwards the application request. When the GGSN/PGW forwards the request, it can configure a free-passing policy to ensure that the application of the UE can access the key server normally, and implement initial authentication and key application of the application.

404. The key server determines a temporary key of the application.

Optionally, the key server may authenticate the application, and may specifically check the validity and validity of the application. The authentication mode of the application may be that the application is authenticated according to the agreed username and password. Specifically, the application carries the username and password in the request message, and the key server authenticates the security of the application according to the username and password.

Optionally, the application identifier of the application may also be a temporary identifier provided by the key server. At this time, when the key server determines the temporary key of the application, the temporary identifier of the application is also determined. In addition, the expiration time of the application ID and the temporary key can also be determined.

405. The key server sends a response message to the application, where the response message carries the authentication result and the temporary key.

Optionally, the expiration time of the temporary application identifier and/or the temporary key may also be carried.

406. The GGSN/PGW configures the address of the key server.

The GGSN/PGW can apply for the application identifier and temporary key of each subscription application to the key server according to the address timing of the key server.

407. The GGSN/PGW requests a message from the key server based on the pre-configured key server address, and requests an application identifier and a temporary key of the subscription application.

The message may carry the application name or application ID of the subscription application, so that the key server knows which applications need to generate a temporary key, and generates a corresponding temporary key for each contract application.

The message can be negotiated with the key server, private custom interface protocol type and request message format. For example, extend the Radius message.

It should be noted that step 401, step 406 and step 407 are optional steps. Specifically, the GGSN/PGW may pre-configure the address of the key server, and periodically request the application identifier and temporary key of the subscription application from the key server.

408. The key server encapsulates the application identifier and the temporary key of the subscription application in a response message.

409. The key server replies with a response message, where the response message carries an application identifier of each application. Knowledge and temporary keys.

410. The GGSN/PGW parses the response message content, and saves the application identifier and the temporary key in the response message.

411. The application generates a security check code according to an agreed encryption algorithm based on the temporary key.

The algorithm can use the MD5 algorithm. The application and the gateway device may pre-define the character string for the encryption, for example, the name of the application, the URL of the application server, and the like, which are not specifically limited in the embodiment of the present invention.

412. When the application service is accessed, the application identifier and the security check code are added to the service packet. Specifically, the string of the agreed format is inserted in the service message. The string of the agreed format may include an application identifier and a security check code, and may also include a source string agreed by OTT and GGSN/PGW. For example, the following convention format can be used: APP ID+APP name+md5(APP name). The APP ID represents the application identifier, the APP name is the source string, and the md5 (APP name) is the security check code calculated by the source string and the key through the MD5 encryption algorithm. Insert the string of the agreed format into the convention location, for example, the location of the insertion is after the URL of the HTTP request.

413. The GGSN/PGW detects the received service packet to identify the application to which the service packet belongs.

The GGSN/PGW obtains a string from the agreed location and confirms that the string conforms to the agreed format. Specifically, when the APP ID+APP name+md5(APP name) format is adopted, if the agreed format is met, the APP ID (application identifier), the APP name (source string), and the APP name calculated by the MD5 are obtained therefrom. That is, the security check code. The GGSN/PGW finds the pre-stored key corresponding to the APP ID according to the APP ID in the message. The benchmark code is then calculated by the MD5 algorithm with the APP name and the key. If the reference check code is the same as the security check code in the service packet, the verification succeeds, and the application corresponding to the application identifier stored in advance is determined as the application to which the service packet belongs. Then, matching is performed based on the charging and control policies bound by the user, and the charging and control manner of the service data flow of the application is determined.

414. The application re-initiates the authentication request and the key application process after the key is invalid, that is, steps 402 to 405, to update the temporary key.

415. After the key is invalid, the GGSN/PGW reacquires the application identifier and the temporary key of different types of applications.

It should be noted that step 414 and step 415 are optional steps, when the key server is pre- When the expiration time of the application identifier and/or the temporary key is set first, the above two steps can be performed. Otherwise, step 414 and step 415 may be omitted.

In the embodiment of the present invention, the application identification is carried in the service packet and matched with the application identifier stored in advance by the gateway device, thereby improving the recognition rate of the application.

In addition, a key server is established on the network side, and the UE and the gateway device obtain the temporary key through the key server, and use the temporary key to complete the verification of the security of the service packet, thereby improving the security of the service transmission.

FIG. 5 is a flowchart of a method for processing a service message according to an embodiment of the present invention. In the embodiment of Figure 5, the keys are fixedly allocated based on the version of the application. In other words, a key is built into a different version of each app. Therefore, the application service carries the application identifier, application version number, and security check code. The method of Figure 5 may be performed by a UE or by an application on the UE. The specific process is as follows:

510. Apply the built-in application identifier, version number, and corresponding key.

520. The GGSN/PGW configures an application identifier, a version number, and a corresponding key.

For example, it can be applied at the time of signing, and the application ID, version number, and corresponding key of the application are >3⁄4.

It should be noted that both steps 510 and 520 can be accomplished in a pre-configured manner.

530. The application generates a security check code according to an agreed encryption algorithm based on the built-in key.

The manner of generating the security check code is similar to that of the embodiment in FIG. 4, and details are not described herein again.

540. The application inserts a string of the agreed format in the agreed position of the service message.

For example, the following format can be used: APP ID+APP version+APP name+md5(APP name). Compared with the format in the embodiment of Fig. 4, the application version number is added, that is, APP version.

550. The GGSN/PGW detects the packet to identify the application to which the service packet belongs.

Specifically, the character string may be obtained from the agreed location to confirm whether the string conforms to the agreed message format, such as the following format: APP ID+APP version +APP name+md5(APP name). If the agreed format is met, the APP ID, APP version, APP name, and the APP name calculated by MD5 are obtained, that is, the security check code. The GGSN/PGW finds a pre-stored key corresponding to the APP ID and the APP version according to the APP ID and the APP version in the message. Then, the benchmark check code is calculated by the MD5 algorithm with the APP name and the key. If the benchmark check code is the same as the security check code in the secure service packet, the checksum is successful. After the verification succeeds, the matching is based on the charging and control policies bound by the user, and the number of services of the application is determined. According to the flow of billing and control methods.

560. Update the key after applying the upgrade.

Specifically, after the application is upgraded, the UE may download the upgrade package of the application from the SP server. The upgrade package carries a new key corresponding to the new version of the application, and replaces the old old key with the new key.

570. The GGSN/PGW establishes an application identifier, an application version number, and a key correspondence relationship for the updated application or the newly added application.

Step 570 can be implemented in various manners, for example, manually configured, or the application identifier, application version number, and key of the application added or updated by the SP Server can be 艮 to GGSN/PGW, so that the GGSN/ The PGW updates a list indicating the above correspondence.

Further, the application identifier, the version number and the key of the application are built in each application, and the application and the gateway device on the UE complete the verification of the security of the service packet through the built-in key, thereby improving the service transmission. safety.

FIG. 6 is a schematic block diagram of a gateway device according to an embodiment of the present invention. The gateway device 600 of FIG. 6 includes: a first receiving unit 610, an identifying unit 620, and an executing unit 630.

The first receiving unit 610 is configured to receive a service packet, where the service packet carries an application identifier, and the application identifier is used to indicate an application to which the service belongs.

The identifying unit 620 is configured to identify, according to the application identifier carried in the service packet received by the first receiving unit 610, an application to which the service belongs;

The executing unit 630 is configured to perform a processing policy on the service packet according to the correspondence between the application and the processing policy identified by the pre-established identification unit 620.

Optionally, as an embodiment, the gateway device 600 stores the corresponding relationship between the application identifier and the application, and the identifying unit 620 is specifically configured to use the application identifier carried in the service packet and the application identifier and the application identifier and the application stored in the gateway device. The corresponding relationship is determined by the application corresponding to the application identifier as the application to which the service belongs.

Optionally, as another embodiment, the service packet further carries a security check code, and the security check is performed. The code is used to verify the security of the service packet. The gateway device 600 also stores the application identifier, the application and the key. The identification unit 620 is specifically configured to store the application identifier in the service packet and the gateway device. Corresponding relationship between the application identifier and the key, determining the key; generating a reference check code according to the key; and determining, when the benchmark check code matches the security check code, the application corresponding to the application identifier as the application to which the service text belongs.

Optionally, as another embodiment, the key is a temporary key generated by the key server for the application, and the gateway device 600 further includes: a sending unit, configured to send a request message to the key server, where the request message is used to request the key The server generates a temporary key for the application stored by the gateway device. The second receiving unit is configured to receive a response message sent by the key server, where the response message carries the temporary key.

Optionally, as another embodiment, the service text further carries the version number of the application, and the gateway device 600 further stores the corresponding relationship between the application identifier, the version number, and the key, and the identifying unit 620 is specifically configured to use the application identifier carried in the service text. Select the key corresponding to the application ID and version number, and the version number, and the correspondence between the application ID, version number, and key.

Optionally, as another embodiment, the identifying unit 620 is specifically configured to generate a reference check code based on the MD5 according to the key.

Optionally, as another embodiment, the executing unit 630 is specifically configured to charge the service packet according to the charging policy.

FIG. 7 is a schematic block diagram of an apparatus for processing a service message according to an embodiment of the present invention. The apparatus 700 for processing service messages of FIG. 7 may be a UE or an SP server. The apparatus 700 includes: a first generating unit 710 and a transmitting unit 720.

The first generating unit 710 is configured to generate a service packet, where the service packet carries an application identifier, and the application identifier is used to indicate an application to which the service belongs.

The sending unit 720 is configured to send the service packet generated by the first generating unit 710 to the gateway device of the core network.

Optionally, as an embodiment, the service packet further carries a security check code, where the security check code is used to check the security of the service packet, and the device 700 further includes: an obtaining unit 730, configured to acquire an application corresponding a second generating unit 740, configured to generate a security check code according to the key.

Optionally, as another embodiment, the key is a temporary key generated by the key server for the application. The obtaining unit 730 is specifically configured to send a request message to the key server, where the request message is used to request the key server to generate a temporary key for the application; and receive the response message sent by the key server, where the response message carries the temporary key.

Optionally, as another embodiment, the key is a built-in key of the application to which the service belongs, and the obtaining unit 730 is specifically configured to extract the built-in key.

Optionally, as another embodiment, the second generating unit 740 is specifically configured to generate a security check code according to the key and based on the MD5.

FIG. 8 is a schematic block diagram of a gateway device according to an embodiment of the present invention. The gateway device 800 of FIG. 8 includes: a receiver 810 and a processor 820.

The receiver 810 is configured to receive a service packet, where the service packet carries an application identifier, and the application identifier is used to indicate an application to which the service packet belongs.

The processor 820 is configured to: according to the application identifier carried in the service packet received by the receiver 810, identify an application to which the service belongs; and perform a processing policy on the service packet according to the correspondence between the pre-established application and the processing policy.

Optionally, as an embodiment, the gateway device 800 stores the corresponding relationship between the application identifier and the application, and the processor 820 is specifically configured to: according to the application identifier carried in the service packet and the corresponding relationship between the application identifier and the application, corresponding to the application identifier The application is determined to be the application to which the business >3⁄4 text belongs.

Optionally, as another embodiment, the service packet further carries a security check code, where the security check code is used to check the security of the service packet, and the gateway device 800 further stores the application identifier, the application, and the key. Corresponding relationship, the processor 820 is specifically configured to determine a key according to the application identifier carried in the service, and the correspondence between the application identifier and the key; generate a reference check code according to the key; and use the reference check code and the security school When the code is matched, the application corresponding to the application identifier is determined to be the application to which the service packet belongs.

Optionally, as another embodiment, the key is a temporary key generated by the key server for the application, and the gateway device 800 further includes: a sender, configured to send a request message to the key server, where the request message is used to request the key The server generates a temporary key for the application stored by the gateway device; the receiver 810 also uses Receiving a response message sent by the key server, the response message carries a temporary key.

Optionally, in another embodiment, the service text further carries a version number of the application, and the gateway device 800 further stores a correspondence between the application identifier, the version number, and the key, where the processor 820 is specifically configured to be carried according to the service_3⁄4 text. The application identifier and the version number, and the correspondence between the application identifier, the version number, and the key are selected, and the key corresponding to the application identifier and the version number is selected.

Optionally, as another embodiment, the processor 820 is specifically configured to generate a reference check code based on the MD5 according to the key.

Optionally, as another embodiment, the processor 820 is specifically configured to perform charging according to a charging policy.

FIG. 9 is a schematic block diagram of an apparatus for processing a service message according to an embodiment of the present invention. The apparatus 900 of Figure 9 may be a UE or an SP Server. The apparatus 900 includes a processor 910 and a transmitter 920.

The processor 910 is configured to generate a service packet, where the service packet carries an application identifier, where the application identifier is used to indicate an application to which the service packet belongs;

The transmitter 920 is configured to send the service text generated by the processor 910 to the gateway device of the core network. In the embodiment of the present invention, the application identifier is carried in the service packet, and the application identifier is pre-stored in the gateway device, and the gateway device can identify the application according to the matching between the application identifier carried in the service packet and the application identifier stored in the gateway device. , thereby improving the recognition rate of the gateway device to the application.

Optionally, as an embodiment, the service packet further carries a security check code, where the security check code is used to check the security of the service packet, and the processor 910 is further configured to obtain a key corresponding to the application; The key generates a security check code.

Optionally, as another embodiment, the key is a temporary key generated by the key server for the application, and the processor 910 is specifically configured to send a request message to the key server, where the request message is used to request the key server to generate a temporary application. The key receives the response message sent by the key server, and the response message carries the temporary key.

Optionally, as another embodiment, the key is a built-in key of the application to which the service text belongs, and the processor 910 is specifically configured to extract the built-in key.

Optionally, as another embodiment, the service text further carries a version number of the application that generates the service text.

Optionally, as another embodiment, the processor 910 is specifically configured to

MD5 generates a security check code. Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

It will be apparent to those skilled in the art that, for the convenience of the description and the cleaning process, the specific operation of the system, the device and the unit described above may be referred to the corresponding processes in the foregoing method embodiments, and details are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.

The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention, which is essential to the prior art or part of the technical solution, may be embodied in the form of a software product stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. . The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

1. A method for processing business documents, which is characterized by including:

The gateway device receives the service message, the service message carries an application identifier, and the application identifier is used to indicate the application to which the service message belongs;

The gateway device uses the application identifier to identify the application to which the service message belongs; the gateway device executes the processing policy on the service message according to the pre-established correspondence between the application and the processing policy.

2. The method of claim 1, wherein the gateway device stores the corresponding relationship between the application identifier and the application,

The identifying the application according to the application identifier includes:

According to the application identifier carried in the service message and the corresponding relationship between the application identifier and the application, the application corresponding to the application identifier is determined as the application to which the service message belongs.

3. The method of claim 1, wherein the service message also carries a security check code, and the security check code is used to verify the security of the service message, and the gateway The device also stores the application identification, the corresponding relationship between the application and the key,

Then identifying the application according to the application identifier includes:

Determine the key according to the application identifier carried in the service message and the corresponding relationship between the application identifier and the key;

Generate a baseline check code based on the key;

When the reference check code matches the security check code, the application corresponding to the application identifier is determined as the application to which the service document belongs.

4. The method of claim 3, wherein the key is a temporary key generated by a key server for the application,

Before determining the key based on the application identifier carried in the service document and the corresponding relationship between the application identifier and the key, the method further includes:

Send a request message to the key server, where the request message is used to request the key server to generate the temporary key for the application;

Receive a response message sent by the key server, where the response message carries the temporary key.

5. The method of claim 3, wherein the service message also carries a version number of the application, and the gateway device also stores the application identifier, the version number and the Correspondence between keys,

Determining the key based on the application identifier carried in the service message and the corresponding relationship between the application identifier and the key includes:

According to the application identification and the version number carried in the service message, and the corresponding relationship between the application identification, the version number and the key, select the application identification and the version number corresponding to of said key.

6. The method according to any one of claims 3-5, characterized in that,

Generating a reference check code based on the key includes:

According to the key, the reference check code is generated based on the message digest algorithm MD5.

7. The method according to any one of claims 1 to 6, characterized in that the processing policy is the charging policy of the application,

Executing the processing policy on the service packet according to the pre-established correspondence between the application and the processing policy includes:

The service packet is charged according to the charging policy.

8. A method for processing business documents, which is characterized by including:

Generate a service message, the service message carries an application identifier, and the application identifier is used to indicate the application to which the service message belongs;

Send the service message to the gateway device of the core network.

9. The method of claim 8, wherein the service message also carries a security check code, and the security check code is used to verify the security of the service message.

Before generating the service message, it also includes:

Obtain the key corresponding to the application;

The security check code is generated according to the key.

10. The method of claim 9, wherein the key is a temporary key generated by a key server for the application,

The obtaining the key corresponding to the application includes:

11. The method of claim 9, wherein the key is the service message The built-in key of the belonging application,

The obtaining the key corresponding to the application includes: extracting the built-in key.

12. The method of claim 11, wherein the service message also carries a version number of the application that generated the service message.

13. The method according to any one of claims 9-12, characterized in that generating the security check code according to the key includes:

The security check code is generated according to the key and based on the message digest algorithm MD5.

14. A gateway device, characterized by including:

The first receiving unit is configured to receive a service message, the service message carries an application identifier, and the application identifier is used to indicate the application to which the service message belongs;

An identification unit, configured to identify the application to which the service message belongs based on the application identifier carried in the service message received by the first receiving unit;

An execution unit, configured to execute the processing policy on the service packet according to the pre-established correspondence between the application identified by the identification unit and the processing policy.

15. The gateway device according to claim 14, characterized in that, the gateway device stores a corresponding relationship between the application identifier and the application, and the identification unit is specifically configured to identify the user according to the information carried in the service document. The application identifier and the corresponding relationship between the application identifier and the application are determined as the application to which the business document belongs.

16. The gateway device according to claim 15, wherein the service message also carries a security check code, and the security check code is used to verify the security of the service message. The gateway device also stores the application identifier and the corresponding relationship between the application and the key. The identification unit is specifically configured to identify the application identifier according to the application identifier carried in the service message and the corresponding relationship between the application identifier and the key. , determine the key; generate a reference check code based on the key; when the reference check code matches the security check code, determine the application corresponding to the application identifier as the service message The application it belongs to.

17. The gateway device according to claim 16, wherein the key is a temporary key generated by a key server for the application, and the gateway device further includes:

A sending unit, configured to send a request message to the key server, where the request message is used to request the key server to generate the temporary key for the application;

The second receiving unit is configured to receive a response message sent by the key server, where the response message carries the temporary key.

18. The gateway device according to claim 16, wherein the service message also carries the version number of the application, and the gateway device also stores the application identifier, the version number and the The corresponding relationship between the keys, the identification unit is specifically configured to identify the application identifier and the version number carried in the service document, and the corresponding relationship between the application identifier, the version number and the key. , select the key corresponding to the application identifier and the version number.

19. The gateway device according to any one of claims 16-18, wherein the identification unit is specifically configured to generate the reference check code based on the message digest algorithm MD5 according to the key.

20. The gateway device according to any one of claims 14 to 19, characterized in that the execution unit is specifically configured to charge the service packet according to the charging policy.

21. A device for processing business documents, characterized by including:

The first generation unit is used to generate a service message, the service message carries an application identifier, and the application identifier is used to indicate the application to which the service message belongs;

A sending unit, configured to send the service message generated by the first generating unit to the gateway device of the core network.

22. The device according to claim 31, wherein the service message also carries a security check code, and the security check code is used to verify the security of the service message. The UE Also includes:

An acquisition unit, used to acquire the key corresponding to the application;

The second generation unit is used to generate the security verification code according to the key.

23. The device of claim 22, wherein the key is a temporary key generated by a key server for the application,

The acquisition unit is specifically configured to send a request message to the key server. The request message is used to request the key server to generate the temporary key for the application; and to receive a response message sent by the key server. , the response message carries the temporary key.

24. The device according to claim 22, wherein the key is a built-in key of the application to which the service message belongs,

The acquisition unit is specifically used to extract the built-in key.

25. The device according to claim 24, wherein the service message also carries a version number of the application that generated the service message.

26. The device according to any one of claims 22 to 25, characterized in that the second generation The forming unit is specifically configured to generate the security check code according to the key and based on the message digest algorithm MD5.