WO2015169044A1 - 一种漫游场景下的会话绑定方法、裝置和系统 - Google Patents

一种漫游场景下的会话绑定方法、裝置和系统 Download PDF

Info

Publication number
WO2015169044A1
WO2015169044A1 PCT/CN2014/087982 CN2014087982W WO2015169044A1 WO 2015169044 A1 WO2015169044 A1 WO 2015169044A1 CN 2014087982 W CN2014087982 W CN 2014087982W WO 2015169044 A1 WO2015169044 A1 WO 2015169044A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
session
address
domain
network
Prior art date
Application number
PCT/CN2014/087982
Other languages
English (en)
French (fr)
Inventor
王晓燕
夏海涛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2015169044A1 publication Critical patent/WO2015169044A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, an apparatus, and a system for binding a home domain session and a visited domain session in a roaming scenario.
  • the user roams into the scenario of visiting the domain network.
  • the application function entity ApplicationFunction, or AF
  • the application function entity is specifically the home domain application function.
  • Entity H-AF After receiving the service request from the user, the H-AF sends a service guarantee request (the service guarantee request) through an Rx session between the Home Policy and Charging Rule Function (H-PCRF). It is also described as an Rx session message.
  • H-PCRF Home Policy and Charging Rule Function
  • the H-PCRF After receiving the service guarantee request of the H-AF, the H-PCRF generates a Quality of Service (QoS) policy that can guarantee the service, and bills through the visited domain policy.
  • QoS Quality of Service
  • the S9 session of the rule function entity (VisitedPolicy and ChargingRuleFunction, abbreviated as: V-PCRF), and the Gx session of the V-PCRF and the Visited Policy Policy Charging Control Function (V-PCEF) are sent to the V-PCEF.
  • V-PCRF Visited Policy Policy Charging Control Function
  • IPv4 addresses For some operators with a large number of users, the number of IPv4 addresses is not enough. For the lack of IPv6 preparation, operators usually choose to deploy Network Address Translation (NAT) devices behind the gateway devices. Solve the current situation that its IP address is not enough.
  • NAT Network Address Translation
  • IP-Domain-ID IP domain identifier
  • the V-PCRF needs to send the IP domain identifier of the visited domain and the private IP address of the user to the H-PCRF through the S9 interface.
  • the H-AF carries the user in the service data stream of the received user. The private network IP address and the IP domain identifier.
  • the H-PCRF can be based on the Rx session and the Gx session.
  • the private network IP address + IP domain identifier establishes a binding relationship.
  • the mapping between the gateway identifier of the visited domain and the IP domain identifier is stored in the V-PCRF, that is, the IP domain identifier of the corresponding visited domain can be found through the gateway identifier.
  • the home domain operator can aggregate the collected user history session to bind the gateway of the visited domain. Identifying the network topology of the visited domain, resulting in a potential security risk for the visited domain network due to topology exposure.
  • the present invention proposes a session binding method in a roaming scenario, where the first session is used in order to solve the problem of the session domain binding of the visited domain and the home domain. It belongs to the visited domain session, and the second session belongs to the home domain session, including:
  • the embodiment of the present invention provides a system for binding a home domain session and a visited domain session in a roaming scenario, including:
  • the network node of the home domain receives the first session message sent by the visited domain network node, where the first session message carries the user identifier; the network node of the home domain receives the second session message, and the second session message carries the user a public network IP address and a user private network IP address; the network node of the home domain sends a message carrying the public network IP address of the user and the private network IP address of the user to the network node of the visited domain; the network of the visited domain The node obtains the user identifier corresponding to the second session according to the user public network IP address and the user private network IP address; the network node of the home domain receives the second session corresponding to the network node sent by the visited domain Binding of the first session and the second session when the user identifier corresponding to the first session and the user identifier corresponding to the second session are the same.
  • an embodiment of the present invention provides a method for binding a home domain session and a visited domain session in a roaming scenario, including:
  • the network node of the home domain receives the first session message sent by the visited domain network node, where the first session message carries the user identifier; the second session message of the home domain is received, and the second session message carries the public network IP address of the user. And the private network IP address of the user; obtaining, according to the public network IP address and the private network IP address of the user carried in the second session message, from the visited domain network node, corresponding to the second session Binding of the first session and the second session when the user identifier corresponding to the first session and the user identifier corresponding to the second session are the same.
  • an embodiment of the present invention provides a device for binding a home domain session and a visited domain session in a roaming scenario, where the device includes a processor, a memory, and a transceiver, where:
  • the memory storing code for the processor to run the device, and for storing data that needs to be temporarily saved; the transceiver for communicating with other devices in the home domain network and the visited domain network; a processor, configured to receive, by using the foregoing transceiver, a first session message sent by a visited domain network node, where the first session message carries a user identifier, and receives a second session message of the home domain, where the second session message is carried
  • the public network IP address of the user and the private network IP address of the user; the user identifier corresponding to the second session is obtained from the visited domain network node according to the user public network IP address and the user private network IP address carried in the second session message; Binding of the first session and the second session is performed when the user identifier corresponding to the first session and the user identifier corresponding to the second session are the same.
  • the embodiment of the present invention provides a method for binding a home domain session and a visited domain session in a roaming scenario, including:
  • the network node of the visited domain sends a first session message to the home domain network node, where the first session message carries the user identifier; and receives the public network IP address and the user private network IP address of the user that carries the second session message sent by the home domain. And obtaining, according to the user public network IP address and the user private network IP address, a user identifier corresponding to the second session; and returning, to the network node of the home domain, a user identifier corresponding to the second session, so as to be in the check box
  • the binding of the first session and the second session is performed.
  • an embodiment of the present invention provides a device for binding a home domain session and a visited domain session in a roaming scenario, where the device includes a processor, a memory, and a transceiver, where:
  • the memory storing code for the processor to run the device, and for storing data that needs to be temporarily saved; the transceiver for communicating with other devices in the home domain network and the visited domain network; The processor sends a first session message to the home domain network node by using the transceiver, where the first session message carries the user identifier, and the user public network IP address and user that carries the second session message that is sent by the home domain is received.
  • the binding of the first session and the second session is performed when the user identifier of the first session and the user identifier of the second session are the same.
  • the embodiment of the present invention provides a method for acquiring session information in a cross-domain in a roaming scenario, including:
  • the network node of the home location determines the network identity of the visited domain according to the public network IP address of the user carried in the session establishment request message; the network node of the home site sends the public network IP address of the user and the private network IP address of the user to the visited domain.
  • the network node of the home domain receives the user identification information returned by the network node of the visited domain; the user identifier is the private network of the user stored in the network node of the visited domain by the public network IP address of the user and the private network IP address of the user.
  • the mapping between the IP address, IP domain identifier, and user ID is obtained.
  • the embodiment of the present invention provides an apparatus for acquiring session information in a cross-domain in a roaming scenario, where the apparatus includes a processor, a memory, and a transceiver, including:
  • the memory storing code for the processor to run the device, and for storing data that needs to be temporarily saved; the transceiver for communicating with other devices in the home domain network and the visited domain network; a processor, configured to determine a network identifier of the visited domain according to the public network IP address of the user carried in the session establishment request message, and send the public network IP address of the user and the private network IP address of the user to the network node of the visited domain; User identification information returned by the network node of the visited domain; the user identifier is a private network IP address, an IP domain identifier, and a user identifier stored in the network node of the visited domain by the user public network IP address and the user private network IP address.
  • the mapping relationship is obtained.
  • the embodiment of the present invention provides a method for acquiring session information in a cross-domain in a roaming scenario, including:
  • the network node of the visited domain receives the first session establishment request, where the first session establishment request carries the user private network IP address, the gateway identifier, and the user identifier;
  • the embodiment of the present invention provides an apparatus for acquiring session information in a cross-domain in a roaming scenario, where the apparatus includes a processor, a memory, and a transceiver, including:
  • the memory storing code for the processor to run the device, and for storing data that needs to be temporarily saved; the transceiver for communicating with other devices in the home domain network and the visited domain network;
  • the processor receives the first session establishment request, where the first session establishment request carries the user private network IP address, the gateway identifier, and the user identifier; and converts the correspondence according to the corresponding relationship between the locally preset IP address segment and the IP domain identifier.
  • the gateway identifier is the corresponding IP domain identifier, and is stored according to the correspondence between the ⁇ user private network IP address, IP domain identifier) and the user identifier ⁇ ; receiving the private network IP address and the user public network IP address sent by the home domain network node
  • the message obtains the IP domain identifier corresponding to the public network IP address of the user according to the corresponding relationship between the IP address segment and the IP domain identifier of the local preset; and the storage according to the combination of the obtained IP domain identifier and the private network IP address of the user.
  • the user identifier is obtained in the correspondence between the ⁇ user private network IP address, IP domain identifier) and user identifier ⁇ .
  • the public network IP address and user of the user can be utilized by using the interaction between the network node of the home domain and the visited domain node without exposing the topology of the visited domain network.
  • the private network IP address is converted into a user identifier that can uniquely identify the user in the visited domain PLMN domain, and the binding of the visited domain session and the home domain session is effectively completed based on the user identifier.
  • FIG. 1 is a system architecture diagram of session binding in a roaming scenario according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of signaling of a method for session binding in a roaming scenario according to an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a method for session binding in a roaming scenario according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a method for session binding in a roaming scenario according to an embodiment of the present invention
  • FIG. 5 is a system architecture diagram of session binding in a roaming scenario according to an embodiment of the present disclosure
  • FIG. 6 is a schematic diagram of signaling of a method for session binding in a roaming scenario according to an embodiment of the present disclosure
  • FIG. 7 is a structural diagram of a device for session binding in a roaming scenario according to an embodiment of the present disclosure.
  • FIG. 8 is a structural diagram of a device for session binding in a roaming scenario according to an embodiment of the present disclosure
  • FIG. 9 is a structural diagram of a device for session binding in a roaming scenario according to an embodiment of the present disclosure.
  • FIG. 10 is a structural diagram of a device for session binding in a roaming scenario according to an embodiment of the present disclosure.
  • FIG. 11 is a flowchart of a method for acquiring a user identifier stored in a visited domain network by a home domain network in a roaming scenario according to an embodiment of the present disclosure
  • FIG. 12 is a flowchart of a method for a home domain network to obtain a user identifier stored in a visited domain network in a roaming scenario according to an embodiment of the present invention.
  • the gateway identifier may be specifically represented by a PCEF ID; the network identifier may be specifically represented by a Public Land Mobile Network (PLMN) identifier or a Diameter domain identifier.
  • PLMN Public Land Mobile Network
  • Diameter domain identifier The specific expression of each name is merely an example of the above-mentioned name of the present invention in a specific application environment, and is not intended to limit the scope of the above-mentioned name of the present invention.
  • FIG. 1 is a system architecture diagram for implementing session binding in a roaming scenario according to the present invention.
  • the user terminal 18 roams to the visited domain network, and the user terminal 18 requests the data service service from the H-AF 10 through the network of the visited domain.
  • the Rx interface, the S9 interface, and the Gx interface in the system are involved. Sessions established based on the corresponding interfaces are also referred to as Rx sessions, S9 sessions, and Gx sessions, respectively.
  • two sessions are involved:
  • the first one is a Gx session attributed to the visited domain, that is, the first session proposed by the present invention is embodied in the embodiment.
  • the V-PCEF 16 applies for a control policy to the H-PCRF 12 when the user terminal 18 initiates network attachment, and the control policy includes: information about the bandwidth allocated by the H-PCRF 12 for the user terminal 18, the priority of the assignment, and the like.
  • the policy control request is sent to the V-PCRF 14 through the Gx interface, and the policy control request is forwarded to the H-PCRF 12 via the S9 interface through the V-PCRF 14, and the control strategy is generated by the H-PCRF 12 and finally returned to the V-PCEF 16 .
  • the second is the Rx session of the home domain visited domain, that is, the second session proposed by the present invention is embodied in the embodiment.
  • the H-AF10 needs to feed back the service-related information to the V-PCRF12, so that the H-PCRF12 can generate a new control policy and send the network resource to the V-PCEF16 through the Gx session of the visited domain. Adjustment.
  • the service related information is transmitted through the Rx session established between the H-AF 10 and the H-PCRF 12.
  • a V-PCEF 16 can provide a respective Gx session for a plurality of different user terminals. Therefore, in order to ensure that a new control policy generated by the service-related information fed back by the H-AF 10 can be transmitted to the V-PCEF 16, the new one can be guaranteed.
  • the control policy can be applied to the data service of the corresponding H-AF20, and the binding of the Rx session and the Gx session needs to be completed to implement corresponding signaling to the corresponding network entity.
  • the same H-PCRF 12 refers to a network entity that generates a control policy for the V-PCEF 16 when initially transmitting an IP-CAN establishment request; the same V-PCEF 16 refers to initially establishing an IP with the user terminal 18 - The network entity of the CAN session.
  • the method of binding the Rx session and the Gx session by directly using the IP domain identifier and the private network IP address of the user needs to pass the IP domain identifier and the private network IP address of the user in the Gx session and the Rx session, respectively, so that the H-PCRF
  • the Gx session and the Rx session binding are performed when it is confirmed that the IP domain identifier carried by the Gx session and the Rx session is the same as the private IP address of the user.
  • the IP domain identifier and the user private network IP address can be used to uniquely identify a Gx session in the visited domain network.
  • FIG. 2 is a system signaling diagram of implementing session binding in a roaming scenario according to an embodiment of the present invention.
  • the system architecture of the system flowchart may refer to FIG. 1.
  • the specific implementation environment is that the user terminal is roaming and is visiting.
  • the data service is initiated in the domain network to the application function entity H-AF in the home domain, and the process includes:
  • step S101 the user terminal 18 transmits an IP-CAN session establishment request to the V-PCEF 16 when accessing the visited domain network for the first time.
  • the IP-CAN session establishment request may be sent by using an initial credit control request (CCR-I) message of the Diameter protocol.
  • CCR-I initial credit control request
  • step S102 the V-PCEF 16 transmits a policy control request to the V-PCRF 14 after receiving the IP-CAN session establishment request.
  • the policy control request carries a PCEF ID, a private network IP address, and a user identifier.
  • the PCEF ID may be carried in the Origin-Host AVP field of the initial CCR message.
  • the V-PCRF 14 acquires a corresponding IP domain identifier according to the PCEF ID.
  • the V-PCRF 14 stores a storage format of a set of ⁇ user private network IP address, IP domain identifier, and user identity ⁇ .
  • the PCEF ID stores the domain name of the PCEF, and in the IP address segment corresponding to an IP domain identifier, the private network IP address assigned to the user is unique. Therefore, the IP domain identifier and the private network IP address of the user can be obtained. The only one that determines a Gx session.
  • the storage mode of the ⁇ user private network IP address, the IP domain identifier, and the user identifier ⁇ is optimal; and optionally, the user's private network IP address, PCEF ID, and user identifier can be directly used. Relational storage.
  • the V-PCRF 14 confirms that the user terminal is a roaming user, and searches for a Diameter domain or a PLMN network to which the H-PCRF 12 belongs by using a user identifier (ie, domain information in a User Access Identifier (UAI)). Step S103.
  • a user identifier ie, domain information in a User Access Identifier (UAI)
  • step S103 the V-PCRF 14 forwards the policy control request to the H-PCRF 12, where the request further carries the sub-session identifier, the user private network IP address, and the user identifier.
  • the sub-session identifier is used for S9 interface transmission between the V-PCRF 14 and the H-PCRF 12, and is used to correspond to an IP-CAN session initiated by the user terminal 18.
  • steps S104-S105 the policy control response carrying the control policy generated by the H-PCRF is forwarded to the V-PCEF 16 via the forwarding of the V-PCRF 14.
  • the V-PCRF 14 forwards an Initial Credit Control Response (CCA-I) message from the H-PCRF 12 to the V-PCEF 16.
  • CCA-I Initial Credit Control Response
  • steps S106-S107 the V-PCEF 16 transmits a data service service request to the H-AF 10.
  • the data service request sent by the V-PCEF 16 is forwarded by the V-NAT 20 and carries the private IP address of the user and the public IP address of the user.
  • the application layer data of the user terminal 18 is forwarded to the H-AF 10 via the V-PCEF 16 and the V-NAT 20 in the form of an IP packet.
  • the H-AF 10 obtains the public IP address of the user from the IP header, and obtains the private IP address of the user from the application layer data (IP packet content) of the IP packet.
  • step S108 the H-AF 10 provides a data service service to the user terminal 18 through the above-mentioned channel with the V-PCEF 16.
  • step S109 the H-AF 10 needs to establish an Rx session with the H-PCRF 14 when starting to provide data service services for the user.
  • the R-session is set up.
  • the H-AF 10 sends an Authentication-Authorization-Request (AAR) message to the H-PCRF 12 through the Rx interface, where the AAR message carries the public IP address and the user of the user.
  • AAR message carries the public IP address and the user of the user.
  • the message of the private network IP address is sent to H-PCRF12.
  • the authentication-authentication-request (AAA) message returned by the H-PCRF 12 is received to the H-AF 10 to complete the establishment of the Rx session.
  • AAR Authentication-Authorization-Request
  • the H-PCRF12 can obtain the network identifier of the visited domain through the public IP address of the user.
  • the network identifier is represented by the PLMN identifier or the Diameter domain identifier.
  • one PLMN identifier contains one or more Diameter domains.
  • step S110 the H-PCRF 12 sends a message carrying the user private network IP address and the user public network IP address to the V-PCRF 14 according to the network identifier.
  • step S111 the V-PCRF 14 obtains an IP domain identifier according to the public network IP address of the user. Then, the user private network IP address and the IP domain identifier are matched with one or more groups stored in the V-PCRF 14: ⁇ user private network IP address, IP domain identifier, and user identifier ⁇ to obtain a user identifier.
  • the combination object of the private network IP address and the IP domain identifier of the user can uniquely identify a user identifier.
  • step S112 the H-PCRF 12 acquires a message carrying the user identity returned by the V-PCRF 14.
  • the H-PCRF 12 obtains the user identifier for the corresponding Rx session.
  • step S113 the H-PCRF 12 completes the binding of the two sessions when it is confirmed that the user ID corresponding to the Gx session and the Rx session are the same.
  • the specific binding mode can be freely determined by the operator.
  • An optional method is to establish a binding relationship between the Gx session and the Rx session according to the IP-CAN session identifier, the Rx session identifier, and the user identifier.
  • the Rx session establishment of the steps S109-S113 and the binding process of the Rx session and the Gx session may be performed at the same time as the S108 data service is sent, or before the data service is performed in S108, which may be specifically set according to the operator. It is to be implemented, and is not specifically limited herein.
  • FIG. 1 The system embodiment, based on the simplest system architecture (shown in FIG. 1), provides a brief introduction to the inventive aspects of the present invention and how the invention is implemented in a specific implementation, so that those skilled in the art can It will be easier to understand when reading other embodiments of the invention that follow. The important inventions of the present invention will be refined below for a comprehensive introduction.
  • the user's private network IP address and the user's public network IP address are used for session binding.
  • the user's private network IP address and the user's public IP address may be reconnected after the user disconnects from the network. Changes will occur and, therefore, the method of the present invention is not stable.
  • the user does not carry the public network IP address of the user when the user sends the policy control request to the network node of the home domain for the first time, because the user has not obtained the public network IP address of the user. Therefore, the manner in which the present invention uses binding according to user identification is optimal in several ways.
  • FIG. 3 is a schematic diagram of a method for implementing session binding in a roaming scenario according to an embodiment of the present invention.
  • the network node in the home domain may be the H-PCRF 12 in FIG. 1 or the home domain Diameter route in FIG. 5 .
  • the method of the present invention can be applied not only to the system architecture of FIG. 1, but also to the system architecture of FIG. Specifically include:
  • step 120 the network node of the home domain receives the first session message sent by the visited domain network node, where the first session message carries the user identifier.
  • the first session may specifically be the Gx session in FIG. 2 or FIG. 6, and the first session message may specifically be represented as a policy control request sent through the Gx session.
  • the network node of the home domain receives the second session message of the home domain, where the second session message carries the user public network IP address and the user private network IP address.
  • the second session may specifically be the Rx session in FIG. 2 or FIG. 6, and the second session message Specifically, it may be expressed as a message sent through an Rx session, for example, an Rx session establishment request or a service guarantee request that is described as being delivered through an Rx session.
  • the network node of the home domain obtains the user identifier corresponding to the second session from the visited domain network node according to the user public network IP address and the user private network IP address carried in the second session message.
  • the obtaining the user identifier corresponding to the second session from the visited domain network node is specifically: the network node of the visited domain searches for the corresponding IP domain identifier according to the public network IP address of the user; the IP domain identifier is specifically a gateway.
  • the identification (embodied as PCEF ID in the embodiment of Figure 2).
  • the network node of the visited domain obtains the user identifier corresponding to the second session according to the user's private network IP address and the found gateway identifier; when it is shown in FIG. 2, specifically, step S111.
  • the meaning of the user identifier corresponding to the second session described herein is that the second session is established for the terminal corresponding to the user identifier, and therefore, the user identifier can be used as a second session to distinguish attributes from other sessions. use.
  • step 126 when the user identifier corresponding to the first session and the user identifier corresponding to the second session are the same, the binding of the first session and the second session is performed.
  • network nodes of the home domain can be different network entities, optional:
  • the step 126 is specifically: the H-PCRF confirms that the user identifier corresponding to the first session is the same as the user identifier corresponding to the second session, and the binding is performed.
  • the first session and the second session (see step S113 for details).
  • the step 126 is specifically: the H-DRA confirms that the user identifier corresponding to the first session is the same as the user identifier corresponding to the second session, and then sends a confirmation.
  • the same result of the user identifier corresponding to the first session and the user identifier corresponding to the second session is sent to the H-PCRF, so that the H-PCRF binds the first session and the second session (see step S213 for details); or And sending the binding request to the H-PCRF, so that the H-PCRF binds the first session and the second session after confirming that the user identifier corresponding to the first session is the same as the user identifier corresponding to the second session.
  • the embodiment of the present invention overcomes the existing method by using the first session message that sends the private network IP address + IP domain identifier of the carrying user to the network node of the home domain to complete the binding.
  • the embodiment of the invention combines the private network IP address and the user of the user
  • the IP address of the public network is based on the network identifier configured by the network node of the home domain and the IP domain identifier stored by the network node of the visited domain, and the session of the visited domain and the session of the home domain are bound according to the user identifier. .
  • the visited domain network node sends the first session message to the network node of the home domain
  • the method further includes: the network node of the visited domain receives the first session establishment request, and saves the first session establishment request.
  • the first session establishment request is specifically represented by the Gx session establishment request (not shown in FIG. 2) in the embodiment corresponding to FIG. 2.
  • the gateway identifier may be specifically represented as a PCEF ID in the PCC architecture.
  • the gateway identifier is an identifier of a specific gateway device, and the IP domain identifier is used to distinguish user terminals having the same private network IP address that may exist in a PLMN or Diameter domain, and is used to logically divide the network into different networks.
  • User private network IP address The combination of the user private network IP address and the IP domain identifier can uniquely find a user terminal in the PLMN.
  • an IP domain identifier corresponds to one or more gateway identifiers.
  • the first session message is specifically a policy control request
  • the first session establishment request is specifically a Gx session establishment request.
  • the Gx session establishment request is established when the user terminal initiates the network attachment (for example, the user terminal connects to the visited domain network for the first time. For details, see step S104, where the Gx session establishment process is included when the policy control request is sent to the V-PCRF 14. Or the policy control request is sent on the Gx session established by the Gx session establishment request.
  • the user terminal has a data service service request
  • the Gx session is shared, and the Gx session is used to obtain the V-PCRF control. Strategy.
  • the network node of the home domain obtains the user identifier corresponding to the second session from the visited domain network node according to the user public network IP address and the user private network IP address carried in the second session message. Specifically, including:
  • the home network node stores the corresponding relationship between the public network IP address and the network identifier; the home network node searches for the network identifier of the visited domain of the user according to the public network IP address of the user (in the embodiment corresponding to FIG. 2, specifically The PLMN identifier or the Diameter domain identifier is sent; and the message carrying the user public network IP address and the user private network IP address is sent to the visited domain network according to the network identifier.
  • the home domain network node is specifically a Diameter routing agent of the home domain. H-DRA, or the policy control rule function entity H-PCRF of the home domain.
  • the home network node is specifically the home domain Diameter router H-DRA
  • the user identifier corresponding to the first session and the user identifier corresponding to the second session are the same, the first The binding of the session and the second session specifically includes:
  • the H-DRA Upon receiving the first session message, the H-DRA determines an H-PCRF for the first session. The H-PCRF determined at this time is used to generate a control policy (eg, QoS) for the first session.
  • a control policy eg, QoS
  • the H-DRA forwards the second session message to the H-PCRF, so that the H-PCRF performs the Binding of the first session and the second session.
  • the embodiment of the present invention provides a session binding method in the roaming scenario for the invention center from the network node side of the visited domain. As shown in FIG. 4, the method includes:
  • step 140 the network node of the visited domain sends a first session message to the home domain network node, where the first session message carries the user identifier.
  • step 142 the message of the public network IP address and the private network IP address of the user corresponding to the second session message sent by the home domain is received.
  • step 144 the user identifier corresponding to the second session is obtained according to the user public network IP address and the user private network IP address corresponding to the second session message.
  • step 146 the user identifier corresponding to the second session is returned to the network node of the home domain, so that when the user identifier of the first session and the user identifier of the second session are the same, the first The binding of the session and the second session.
  • the embodiment and the embodiment corresponding to FIG. 3 are in the same system, based on the method steps of protecting different execution subjects; therefore, the related specific refinement and extension can be referred to the description in the embodiment corresponding to FIG. 3.
  • FIG. 3 and FIG. 4 the specific implementation manner corresponding to the embodiment of FIG. 3 and FIG. 4 includes the embodiment shown in the signaling flowchart of FIG. 2, and therefore, is also applicable to the figure.
  • the embodiment corresponding to FIG. 3 and FIG. 4 can also be applied to a more complicated system block diagram as shown in FIG. 5, and the corresponding step flow can be referred to FIG. 6, which is specifically described as follows:
  • the layout of the H-DRA 22 is added to the network of the home domain,
  • the role of the H-DRA 22 is to have one or more H-PCRFs in the home domain network (as shown in Figures 12 and 26), and to send other network nodes in the home domain or the visited domain according to the forwarding policy.
  • the message to the H-PCRF 12 is forwarded.
  • the home domain network node corresponding to the embodiment of FIG. 3 and FIG. 4 is specifically represented by H-DRA 22.
  • the V-DRA 24 may also be introduced in the visited domain network, and the difference is that the network node of the visited domain is specifically V-PCRF14 (in the invention point of the present invention).
  • step S201 the V-PCEF 16 receives the IP-CAN session establishment request when the user attaches to the network.
  • the IP-CAN session establishment request may be specifically sent by using an initial CCR message of the Diameter protocol.
  • step S202 after receiving the IP-CAN session establishment request, the V-PCEF 16 first sends a policy control request to the V-PCRF 14 to obtain the user's control policy.
  • the V-PCRF 14 stores a mapping relationship between the private network IP address, the IP domain identifier, and the user identifier carried in the policy control request.
  • the IP domain identifier and the PCEF ID have a certain configuration relationship and can be obtained by the PCEF ID.
  • step S203 the V-PCRF 14 confirms that the user terminal belongs to the user roaming to the local, and then transmits a policy control request to the H-DRA 22 of the network domain to which the user terminal belongs.
  • step S204 after receiving the policy control request of the V-PCRF 14, the H-DRA 22 forwards the request to the H-PCRF 12 via the policy control request according to the forwarding policy.
  • the H-DRA22 manager has a plurality of H-PCRF12, including H-PCRF12 and ⁇ H-PCRF(1)...H-PCRF(n) ⁇ 28 shown in FIG.
  • the forwarding policy is determined by the operator, and may be: according to the load balancing situation of the H-PCRF 12, the policy control request is forwarded to the H-PCRF 12 with a lower load for processing; or according to the number segment, etc., This is not a special limitation.
  • step S205 the H-PCRF 12 generates a control policy and forwards it to the V-PCEF 16 via the H-DRA 22 and the V-PCRF 14.
  • step S206 the V-PCEF receives a data service service request initiated by the user terminal, and the service service request points to the H-AF 10.
  • step 207 the V-NAT 20 re-encapsulates the data service service request and sends it to the H-AF 10.
  • the re-encapsulation includes modifying the source address, source port number, and the like.
  • the H-AF 10 obtains the user private network IP address and the user public network IP address from the data service service request.
  • the H-AF can also obtain the private network IP address of the user from the signaling message of the application layer; for the case where the application layer itself does not carry the private IP address of the user, the V-PCEF You can insert the private network IP address of the user by inserting it in the HTTP header.
  • step 208 the H-AF 10 provides data service services to the user terminals via the V-NAT 20 and the V-PCEF 16.
  • step 209 Before step 208 is performed or after step 208 is performed, there is step 209,
  • the H-AF 10 sends an Rx session establishment request to the H-DRA 22 to provide data related to the data service to the H-PCRF 12 to ensure that the H-PCRF 12 can adjust the control policy in time to ensure that the data service is normal. provide.
  • the Rx session establishment request carries the user private network IP address and the user public network IP address.
  • step 210 the H-DRA 22 sends a message carrying the user's private network IP address and the user's public network IP address to the V-PCRF 12.
  • the message carries the private network IP address of the user and the public IP address of the user.
  • the H-DRA 22 stores the correspondence between the public network IP address and the network identifier of the user. Therefore, the H-DRA 22 can find the visited domain network of the corresponding user according to the public IP address of the user.
  • the network identifier also referred to as a PLMN identifier, is used to distinguish the identifiers of different networks or operators.
  • the V-PCRF 12 obtains the corresponding IP domain identifier according to the user's public network IP address, and matches the user private network IP address, IP domain identifier, and user acquired in step S203 through the user private network IP address and the IP domain identifier. Identify and get the corresponding user ID.
  • the V-PCRF 14 may store one or more sets of user private network IP addresses, IP domain identifiers, and user identifiers for different user terminals.
  • the H-DRA 22 obtains the message carrying the user identifier returned by the V-PCRF 14, and uses the user identifier as the user identifier corresponding to the Rx session to be established.
  • step 213 the H-DRA 22 confirms the Rx session to be established corresponding to the user identity and The user ID corresponding to the Gx session is the same, and the Rx session establishment request is sent to the H-PCRF 12 selected in step S204.
  • step 214 the H-PCRF 12 completes the Rx session establishment and binds the Rx session and the Gx session.
  • This embodiment describes in detail how to implement the session binding method proposed by the present invention when the network node of the home domain is H-DRA, by combining the system architecture FIG. 5 and the signaling diagram 6. And for the Rx session establishment request caused by adding H-DRA in the visited domain network, the problem of H-PCRF cannot be directly found.
  • the session binding method of the present invention is implemented in various application environments, and the feasibility thereof is confirmed.
  • the implementation of the Diameter protocol may be referred to the corresponding embodiment in FIG. 2, and details are not described herein. .
  • V-DRA when the V-DRA is also set in the visited domain network, depending on whether the V-DRA is a proxy type (Proxy DRA) or a redirect type (Redirect DRA), the processing method of the related visited network node is There are differences, the specific performance is:
  • V-DRA is a proxy type, that is, the V-DRA can be used to find the user identifier in addition to the routing V-PCRF function, and return the found user identifier to the H-DRA.
  • the S211 and S212 of the V-PCRF execution are completed by the V-DRA;
  • the V-DRA can only implement the routing function of the V-PCRF. Specifically, after receiving the message carrying the private IP address of the user and the IP address of the public network of the user (see S210) The message is directly routed to the destination V-PCRF, and the contents of S211 and S212 are performed by the destination V-PCRF. For V-DRA, it can find the V-PCRF allocated for the Gx session when the user terminal creates an IP-CAN session through the user's public network IP address and the user's private network IP address, that is, the destination V mentioned here. - PCRF.
  • the device 12 is configured to bind a session in a roaming scenario, and includes a processor 121, a memory 123, and a transceiver 125.
  • the memory 123 stores code for the processor to run the device, and is also used to store data that needs to be saved temporarily;
  • the transceiver 125 is configured to communicate with other devices in the home domain network and the visited domain network;
  • the processor 121 is configured to receive, by using the foregoing transceiver, a first session message sent by a visited domain network node, where the first session message carries a user identifier, and receives a second session message of the home domain,
  • the second session message carries the user's public network IP address and the user's private network IP address; and the user's public network IP address and the user's private network IP address carried in the second session message are obtained from the visited domain network node. Binding of the first session and the second session when the user identifier corresponding to the first session and the user identifier corresponding to the second session are the same.
  • the processor 121 is configured to: send, by using the transceiver, a message carrying a user public network IP address and a user private network IP address to the visited domain network node; wherein the user public network IP address is used for The visited domain network node obtains the corresponding gateway identifier, and receives the message returned by the visited domain network node, where the message carries the user identifier obtained by the visited domain network node based on the user private network IP address and the gateway identifier.
  • the memory 123 stores the correspondence between the public network IP address and the network identifier
  • the processor is specifically configured to: search for the network identifier of the visited domain of the user according to the public network IP address of the user;
  • the network identifier sends a message carrying the user public network IP address and the user private network IP address to the visited domain network.
  • the processor 121 is configured to determine an H-PCRF for the first session when receiving the first session message by using the transceiver, and a user identifier and a location corresponding to the first session.
  • the processor 121 determines an H-PCRF for the first session when receiving the first session message by using the transceiver, and a user identifier and a location corresponding to the first session.
  • the user identifier corresponding to the second session is the same, the second session message is forwarded to the H-PCRF, so that the H-PCRF performs binding of the first session and the second session.
  • the device 14 is configured to bind a session in a roaming scenario, and includes a processor 141, a memory 143, and a transceiver 145.
  • the memory 143 stores code for the processor to run the device, and is also used to store data that needs to be saved temporarily;
  • the transceiver 145 is configured to communicate with other devices in the home domain network and the visited domain network;
  • the processor 141 sends a first session message to the home network node through the transceiver 145, where the first session message carries a user identifier, and the user network that receives the second session message that is sent by the home domain is received.
  • the user identifier of the second session is used to perform binding of the first session and the second session when the user identifier of the first session is the same.
  • the processor 141 is specifically configured to: search for an IP domain identifier to which the user belongs according to the public network IP address of the user; and according to the private network IP address of the user corresponding to the second session and the discovered IP domain identifier, Obtaining a user identifier used to correspond to the second session.
  • the processor 141 is further configured to:
  • the mapping relationship between the user identifier, the user private network IP address, and the IP domain identifier carried in the first session establishment request is saved in the storage device 143, so as to be followed by the The user's private network IP address and IP domain identifier obtain the corresponding user ID.
  • the IP domain identifier may be a gateway identifier (for example, a PCEF ID) or an IP domain identifier (for example, IP_Doman_ID).
  • the apparatus of the present invention further provides an apparatus for implementing the method of the present invention, which is divided into modules according to the function of the module, and includes a device 16 for implementing session binding in a roaming scenario as shown in FIG.
  • the at least the sending module 165, the processing module 163, and the receiving module 161 include:
  • the receiving module 161 is configured to receive a first session message sent by the visited domain network node, where the first session message carries a user identifier;
  • the receiving module 161 is further configured to receive a second session message of the home domain, where the second session message carries the public network IP address of the user and the private network IP address of the user;
  • the processing module 163 is configured to obtain, according to the user public network IP address and the user private network IP address carried in the second session message, the user identifier corresponding to the second session from the visited domain network node; in the first session Binding of the first session and the second session is performed when the corresponding user identifier and the user identifier corresponding to the second session are the same.
  • the processing module 163 is specifically configured to obtain the user identifier corresponding to the second session from the visited domain network node, according to the user public network IP address and the user private network IP address carried in the second session message. ,
  • the sending module 165 is configured to send a message carrying the user's public network IP address and the user's private network IP address to the visited domain network node; wherein the user public network IP address is used to visit the domain network node to obtain the corresponding IP domain identifier;
  • the device further includes: sending a message carrying the public network IP address of the user and the private network IP address of the user to the visited domain network node, where the device further includes:
  • the storage module 169 is configured to store a correspondence between a public network IP address and a network identifier.
  • the processing module further includes a search sub-module 167, configured to search for a network identifier of the visited domain of the user according to the public network IP address of the user;
  • the processing module 163 invokes the sending module 165 according to the network identifier, and sends a message carrying the user public network IP address and the user private network IP address to the visited domain network.
  • FIG. 9 The function that can be implemented by the device corresponding to FIG. 9 is referred to in FIG. 2 corresponding to the H-PCRF, or corresponds to the related step method corresponding to the home domain network node in FIG. 3 and FIG. 4, and is disclosed by those skilled in the art.
  • FIG. 2 corresponding to the H-PCRF
  • FIG. 3 and FIG. 4 The function that can be implemented by the device corresponding to FIG. 9 is referred to in FIG. 2 corresponding to the H-PCRF, or corresponds to the related step method corresponding to the home domain network node in FIG. 3 and FIG. 4, and is disclosed by those skilled in the art.
  • FIG. 2 corresponding to the H-PCRF
  • the device 18 shown in FIG. 10 is used to correspond to the visited domain network node in FIG. 3 or FIG.
  • the implementation includes at least a sending module 185, a processing module 183, and a receiving module 181, specifically:
  • the sending module 185 is configured to send a first session message to the home domain network node, where the first session message carries a user identifier.
  • the receiving module 181 is configured to receive a message that is sent by the home domain and that carries the user public network IP address and the user private network IP address of the second session message.
  • the processing module 183 is configured to obtain a user identifier corresponding to the second session according to the public network IP address of the user and the private network IP address of the user.
  • the sending module 185 is further configured to: return, to the network node of the home domain, a user identifier corresponding to the second session, so that when the user identifier of the first session and the user identifier of the second session are the same, Binding of the first session and the second session.
  • the device 18 further includes a storage module 189, in order to implement the function that the processing module 183 acquires the user identifier corresponding to the second session according to the user public network IP address and the user private network IP address.
  • the storage module 189 is configured to store a correspondence between a public network IP address and an IP domain identifier.
  • the processing module 183 is specifically configured to search for an IP domain to which the user belongs according to the public IP address of the user. And identifying, according to the user private network IP address and the IP domain identifier, a user identifier corresponding to the second session.
  • the processing module 183 is further configured to: when the receiving module 181 receives the first session establishment request, the mapping of the user identifier, the user private network IP address, and the IP domain identifier carried in the first session establishment request The relationship is saved in the storage module 189, so that the corresponding user identifier is obtained according to the private network IP address and the IP domain identifier of the user.
  • the functions corresponding to the apparatus of FIG. 10 may be implemented by referring to the V-PCRF in FIG. 2 or the related step method corresponding to the visited domain network node in FIG. 3 and FIG. 4, which is disclosed by those skilled in the art. On the basis of the above functional modules, other implemented method functions can be easily implemented in the corresponding modules, and thus will not be described herein.
  • the system for implementing user session binding (such as the embodiment corresponding to FIG. 2 and FIG. 6), the method (such as the embodiment corresponding to FIG. 3 and FIG. 4), and the device (such as In addition to the embodiment of FIG. 7-10, a method for the home domain node to obtain the user identification information in the visited domain is provided in the roaming scenario, as shown in FIG.
  • the network node at the home of the S302 determines the network identifier of the visited domain according to the public network IP address of the user carried in the session establishment request message.
  • the session establishment request message is specifically a second session message.
  • the network node at the home of S304 sends the public network IP address of the user and the private network IP address of the user to the network node of the visited domain.
  • the network node of the S305 home domain receives the user identifier information returned by the network node of the visited domain; the user identifier is the private network IP address of the user stored in the network node of the visited domain by the user public network IP address and the user private network IP address, The mapping between the IP domain identifier and the user ID is obtained.
  • This embodiment provides a method for obtaining a user identifier in a roaming scenario.
  • the entire signaling process does not send other content delivery related to information security, but is based on the existing user IP.
  • Address information (including the private network IP address of the user and the public IP address of the user), and the correspondence between the IP address segment stored by each network node and the network identifier and the IP domain identifier, so that the network node pair of the home domain is in the visited domain.
  • the user ID corresponding to the user terminal is obtained.
  • the embodiment of the present invention further provides a method for acquiring session information in a cross-domain scenario in a roaming scenario, as shown in FIG. 12, which includes:
  • the network node of the S402 visited domain receives the first session establishment request, where the first session establishment request carries the user private network IP address, the gateway identifier, and the user identifier;
  • the S404 converts the gateway identifier to a corresponding IP domain identifier according to the corresponding relationship between the locally preset IP address segment and the IP domain identifier, and stores the correspondence according to the ⁇ (user private network IP address, IP domain identifier) and user identifier ⁇ correspondence relationship. ;
  • S406 Receive a message that is sent by the home network node and that carries the user's private network IP address and the user's public network IP address, and obtains the IP address corresponding to the user's public network IP address according to the corresponding relationship between the locally preset IP address segment and the IP domain identifier.
  • the user identifier is obtained from the correspondence between the stored ⁇ (user private network IP address, IP domain identifier) and user identifier ⁇ according to the combination of the obtained IP domain identifier and the user private network IP address.
  • the network node of the visited domain determines the IP domain identifier corresponding to the received public network IP address of the user according to the local pre-configured correspondence between the public network IP address segment and the IP domain identifier.
  • the IP domain identifier may also be a Packet Data Network Gateway (PAN).
  • the network node of the visited domain locally has a pre-configured association between a ⁇ user private network IP address, an IP domain identifier ⁇ combination and a user identifier.
  • a user identifier can be uniquely determined by a set of "user private network IP address + IP domain identifier". In the embodiment corresponding to FIG. 3, it is specifically described as a ⁇ user private network IP address, an IP domain identifier, and a user identifier ⁇ relationship group.
  • the network node of the visited domain according to the corresponding relationship between the local pre-configured ⁇ user private network IP address, IP domain identifier ⁇ combination and the user identification information, when the network node of the visited domain receives the first session establishment request.
  • the correspondence between the ⁇ user private network IP address, IP domain identifier ⁇ combination and the user identification information is obtained, and the corresponding relationship is stored.
  • the network node of the home domain maps the public network IP address of the user carried in the session establishment request message to the visited domain network identifier according to the corresponding relationship between the local public network IP address segment and the network identifier.
  • the present embodiment and its preferred embodiments are all based on the foregoing embodiments, in order to implement the steps necessary for session binding in the various roaming scenarios described above; therefore, the method of the present invention is equally applicable to Related implementations of the various embodiments described above; the method of the present invention may also be implemented in the apparatus corresponding to FIGS. 7-10, and no further details are provided herein.
  • RAM random access memory
  • ROM read only memory
  • EEPROM electrically programmable ROM
  • EEPly erasable programmable ROM registers
  • hard disk removable disk
  • CD-ROM computer-readable media

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提出了一种漫游场景下的会话绑定方法，装置和系统。具体包括：归属域的网络节点接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；接收归属域的第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识；在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。实现了能够在不暴露拜访域网络拓扑结构的前提下，基于所述用户标识有效地完成拜访域会话和归属域会话的绑定。

Description

一种漫游场景下的会话绑定方法、裝置和系统
本申请要求于2014年05月05日提交中国专利局、申请号为201410189172.8、发明名称为"一种漫游场景下的会话绑定方法、装置和系统"的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域，尤其涉及一种漫游场景下归属域会话和拜访域会话绑定的方法、装置和系统。
 背景技术
在3GPP的策略计费控制（PolicyandChargingControl,简写为：PCC)架构中，用户漫游到拜访域网络的场景下。当用户在拜访域网络中发起业务请求，并且所述业务请求所对应的应用功能实体（ApplicationFunction,简写为：AF)在用户的归属域中时，即所述应用功能实体具体为归属域应用功能实体H-AF。其中，H-AF在接收到用户的业务请求后，会通过自身与归属域策略计费规则功能实体（HomePolicyandChargingRuleFunction,简写为：H-PCRF)间的Rx会话发送业务保障请求（所述业务保障请求也被描述为Rx会话消息),H-PCRF在接收到H-AF的业务保障请求后，生成能够保障该业务的服务质量(QualityofService,简写为：QoS)策略，并通过与拜访域策略计费规则功能实体（VisitedPolicyandChargingRuleFunction,简写为：V-PCRF)的S9会话，以及V-PCRF与拜访域策略计费控制执行实体（Visitedpolicyandchargingenforcementfunction,简写为：V-PCEF)的Gx会话下发给V-PCEF,从而实现了对H-AF业务的保障。为了找到与用户的业务请求对应的网络资源，需要将归属域的Rx会话与拜访域的Gx会话进行绑定。
对于一些拥有大量用户的运营商，IPv4地址个数已经不够用，而对于IPv6的准备度还不足情况下，运营商会通常选择在网关设备后面部署网络地址转换(NetworkAddressTranslation,简写：NAT)设备，以解决其IP地址不够用的现状。现有标准中对于这类NAT部署场景，釆用用户IP地址和IP域标识(IP—Domain—ID)进行Rx会话以及Gx会话的绑定。但是在漫游场景下，需要V-PCRF通过S9接口发送拜访域的IP域标识和用户私网IP地址给H-PCRF,另一方面H-AF会在收到用户的业务数据流中携带用户的私网IP地址和IP域标识，于是在H-AF向H-PCRF发送携带用户的私网IP地址和IP域标识业务保障请求后，H-PCRF能基于Rx会话和Gx会话中的“用户的私网IP地址+IP域标识”建立绑定关系。其中，V-PCRF中存储有拜访域的网关标识和所述IP域标识的对应关系，即通过网关标识能够找到相应的拜访域的IP域标识。
然而，现有技术中拜访域的网络节点通过S9接口将拜访域的网关标识传递给归属域运营商时，归属域运营商能够通过累计搜集的用户历史会话绑定数据所涉及的拜访域的网关标识，获取到拜访域的网络拓扑结构，从而导致拜访域网络因拓扑暴露而引起的潜在安全性风险。
发明内容
为了解决现有技术中为了实现拜访域的会话和归属域的会话绑定时，存在拜访域网络拓扑暴露的风险，本发明提出了一种漫游场景下的会话绑定方法，其中，第一会话属于拜访域会话，第二会话属于归属域会话，具体包括：
一方面，本发明实施例提供了一种漫游场景下归属域会话和拜访域会话绑定的系统，包括：
归属域的网络节点接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；所述归属域的网络节点接收第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；所述归属域的网络节点发送携带所述用户公网IP地址和用户私网IP地址的消息给所述拜访域的网络节点；所述拜访域的网络节点根据所述用户公网IP地址和用户私网IP地址获取与所述第二会话对应的用户标识；所述归属域的网络节点接收所述拜访域的网络节点发送的所述第二会话对应的用户标识，在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
另一方面，本发明实施例提供了一种漫游场景下归属域会话和拜访域会话绑定的方法，包括：
归属域的网络节点接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；接收归属域的第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的 用户标识；在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
再一方面，本发明实施例提供了一种漫游场景下归属域会话和拜访域会话绑定的装置，所述装置包括处理器、存储器和收发器，其中：
所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；所述处理器，用于在通过上述收发器接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；接收归属域的第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识；在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
再一方面，本发明实施例提供了一种漫游场景下归属域会话和拜访域会话绑定的方法，包括：
拜访域的网络节点向归属域网络节点发送第一会话消息，所述第一会话消息中携带用户标识；接收归属域发送的携带对应第二会话消息的用户公网IP地址和用户私网IP地址的消息；根据所述用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识；向归属域的网络节点返回对应所述第二会话的用户标识，以便在核对所述第一会话的用户标识和所述第二会话的用户标识相同时，进行所述第一会话和第二会话的绑定。
再一方面，本发明实施例提供了一种漫游场景下归属域会话和拜访域会话绑定的装置，所述装置包括处理器、存储器和收发器，其中：
所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；所述处理器，通过所述收发器向归属域网络节点发送第一会话消息，所述第一会话消息中携带用户标识；接收归属域的发送的携带对应第二会话消息的用户公网IP地址和用户私网IP地址的消息；根据对应所述第二会话消息的用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识；向归属域的网络节点返回对应所述第二会话的用户标识，所述第二会话的用户标 识用于在核对所述第一会话的用户标识和所述第二会话的用户标识相同时，进行所述第一会话和第二会话的绑定。
再一方面，本发明实施例提供了一种漫游场景下跨域获取会话信息的方法，包括：
归属地的网络节点根据会话建立请求消息中携带的用户公网IP地址确定拜访域的网络标识；归属地的网络节点将所述用户公网IP地址和所述用户私网IP地址发送到拜访域的网络节点；归属域的网络节点接收拜访域的网络节点返回的用户标识信息；所述用户标识是由用户公网IP地址和用户私网IP地址查询拜访域的网络节点中存储的用户私网IP地址、IP域标识和用户标识的映射关系得到的。
再一方面，本发明实施例提供了一种漫游场景下跨域获取会话信息的装置，所述装置包括处理器、存储器和收发器，包括：
所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；所述处理器，用于根据会话建立请求消息中携带的用户公网IP地址确定拜访域的网络标识；将所述用户公网IP地址和所述用户私网IP地址发送到拜访域的网络节点；接收拜访域的网络节点返回的用户标识信息；所述用户标识是由用户公网IP地址和用户私网IP地址查询拜访域的网络节点中存储的用户私网IP地址、IP域标识和用户标识的映射关系得到的。
再一方面，本发明实施例提供了一种漫游场景下跨域获取会话信息的方法，包括：
拜访域的网络节点接收第一会话建立请求，所述第一会话建立请求中携带用户私网IP地址、网关标识和用户标识；
根据本地预置的IP地址段和IP域标识的对应关系，转换所述网关标识为对应的IP域标识，并按照{(用户私网IP地址、IP域标识)和用户标识}对应关系存储；
接收归属域网络节点发送的携带用户私网IP地址和用户公网IP地址的消息，根据本地预置的IP地址段和IP域标识的对应关系，获取所述用户公网IP地址对应的IP域标识；根据获取的IP域标识和用户私网IP地址的组合，从 存储的{(用户私网IP地址、IP域标识)和用户标识}对应关系中获取用户标识。
再一方面，本发明实施例提供了一种漫游场景下跨域获取会话信息的装置，所述装置包括处理器、存储器和收发器，包括：
所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；所述处理器，接收第一会话建立请求，所述第一会话建立请求中携带用户私网IP地址、网关标识和用户标识；根据本地预置的IP地址段和IP域标识的对应关系，转换所述网关标识为对应的IP域标识，并按照{(用户私网IP地址、IP域标识)和用户标识}对应关系存储；接收归属域网络节点发送的携带用户私网IP地址和用户公网IP地址的消息，根据本地预置的IP地址段和IP域标识的对应关系，获取所述用户公网IP地址对应的IP域标识；根据获取的IP域标识和用户私网IP地址的组合，从存储的{(用户私网IP地址、IP域标识)和用户标识}对应关系中获取用户标识。
在拜访域网络运营商PLMN域内IP地址空间紧缺的情况下，能够在不暴露拜访域网络拓扑结构的前提下，利用归属域的网络节点和拜访域节点的交互将用户的公网IP地址和用户的私网IP地址转换为拜访域PLMN域中可以唯一标识用户的用户标识，并基于所述用户标识有效地完成拜访域会话和归属域会话的绑定。
附图说明
图1是本发明实施例提供的一种漫游场景下的会话绑定的系统架构图；
图2是本发明实施例提供的一种漫游场景下的会话绑定的方法信令示意图；
图3是本发明实施例提供的一种漫游场景下的会话绑定的方法流程图；
图4是本发明实施例提供的一种漫游场景下的会话绑定的方法流程图；
图5是本发明实施例提供的一种漫游场景下的会话绑定的系统架构图；
图6是本发明实施例提供的一种漫游场景下的会话绑定的方法信令示意图；
图7是本发明实施例提供的一种漫游场景下的会话绑定的装置结构图；
图8是本发明实施例提供的一种漫游场景下的会话绑定的装置结构图；
图9是本发明实施例提供的一种漫游场景下的会话绑定的装置结构图；
图10是本发明实施例提供的一种漫游场景下的会话绑定的装置结构图；
图11是本发明实施例提供的一种漫游场景下的归属域网络获取拜访域网络中存储的用户标识的方法流程图；
图12是本发明实施例提供的一种漫游场景下的归属域网络获取拜访域网络中存储的用户标识的方法流程图。
具体实施方式
本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚地描述，显然，所描述的实施例是本发明的一部分实施例，而不是全部实施例。
在本发明中因为用户所在的拜访域网络中使用了V-NAT，因此，用户终端漫游到拜访域后会被分配一个用户私网IP地址，用于在拜访域网络内部寻址；还分配有一个用户公网IP地址，用于其他网络寻址所述拜访域的用户。为了更清楚和简洁的描述本发明的具体方案，其中网关标识具体表现为PCEF ID；网络标识可以具体表现为公共陆地移动网络(Public Land Mobile Network，简写为：PLMN)标识或Diameter域标识。其中，各名称具体表现的对象仅仅是对上述本发明涉及的名称在具体应用环境中的举例，而不是对上述本发明涉及的名称所能涵盖的范围的限定。
图1是本发明提供的一种用于在漫游场景下实现会话绑定的系统架构图。其中，用户终端18漫游到拜访域网络，用户终端18通过拜访域的网络向H-AF10请求数据业务服务。为了向所述数据业务服务提供服务保障，会涉及系统中的Rx接口、S9接口和Gx接口。基于相应接口建立的会话，也分别被称为Rx会话、S9会话和Gx会话。在请求该数据业务服务过程中，会涉及两个会话：
第一个是归属于拜访域的Gx会话，即本发明所提出的第一会话在实施例中具体表现。V-PCEF16会在用户终端18发起网络附着时，向H-PCRF12申请控制策略，所述控制策略包括：H-PCRF12决策的为所述用户终端18分配的带宽、分配的优先级等信息，通常情况下是通过Gx接口将策略控制请求发送V-PCRF14，并通过V-PCRF14经由S9接口将所述策略控制请求转发给H-PCRF12，并由H-PCRF12生成控制策略并最终返回给V-PCEF16。
第二个是归属域拜访域的Rx会话，即本发明所提出的第二会话在实施例中具体表现。在H-AF10提供数据业务服务的过程中，需要向V-PCRF12反馈业务相关信息，以便H-PCRF12能够生成新的控制策略，并通过拜访域的Gx会话下发给V-PCEF16进行网络资源的调整。其中，业务相关信息是通过H-AF10与H-PCRF12间建立的Rx会话完成传输的。
在提供数据业务服务过程中，为了能够将业务相关信息通过Rx会话发送到同一个H-PCRF12，并生成新的控制策略发送到同一个V-PCEF16中，则需要绑定所述Rx会话和Gx会话。一个V-PCEF16可以为多个不同用户终端提供各自的Gx会话，因此，为了确保后续由H-AF10反馈的业务相关信息生成的新的控制策略能够发送到V-PCEF16，并能保证该新的控制策略能够被应用到对应的H-AF20的数据业务服务上，就需要完成Rx会话和Gx会话的绑定，来实现相应信令寻址到对应的网络实体。其中，所述同一个H-PCRF12是指在初始发送IP-CAN建立请求时，为V-PCEF16生成控制策略的网络实体；所述同一个V-PCEF16是指初始时与用户终端18建立IP-CAN会话的网络实体。
现有技术中，直接利用IP域标识和用户私网IP地址绑定Rx会话和Gx会话的方式，需要分别在Gx会话和Rx会话中传递IP域标识和用户私网IP地址，以便H-PCRF在确认Gx会话和Rx会话携带的IP域标识和用户私网IP地址相同时进行Gx会话和Rx会话绑定。其中，IP域标识和用户私网IP地址能够用来唯一的标识拜访域网络中的一个Gx会话。现有方式虽然简便，但是造成了如背景技术中描述的安全性问题。
下面就将提出本发明的会话绑定方式，以便本领域技术人员能够依据公开的实施例实现本发明的方案，并对照现有技术的绑定方式，清楚的了解本发明所解决的技术问题和带来的有益效果。
图2是本发明实施例提供一种在漫游场景下实现会话绑定的系统信令图，该系统流程图的系统架构可以参考图1，具体的实现环境是用户终端处于漫游状态，并在拜访域网络中向处于归属域的应用功能实体H-AF发起数据业务服务，其过程具体包括：
在步骤S101中，用户终端18在第一次接入拜访域网络时，向V-PCEF16发送IP-CAN会话建立请求。
其中，所述IP-CAN会话建立请求，具体可以是利用Diameter协议的初始信用控制请求(Initial Credit Control Request，简写为：CCR-I)消息发送的。
在步骤S102中，V-PCEF16在接收到IP-CAN会话建立请求后，向V-PCRF14发送策略控制请求。
所述策略控制请求中携带PCEF ID、用户私网IP地址和用户标识。所述PCEF ID可以携带在初始CCR消息的Origin-Host AVP字段中。
所述V-PCRF14根据所述PCEF ID获取对应的IP域标识。V-PCRF14按照{用户私网IP地址、IP域标识和用户标识}为一组的存储格式进行存储。通常PCEF ID中存储的是PCEF的域名，而在一个IP域标识所对应的IP地址段中，分配给用户的私网IP地址是唯一的，因此，可以通过IP域标识和用户私网IP地址唯一的确定一个Gx会话。
因此，本实施例中{用户私网IP地址、IP域标识与用户标识}的存储方式是最优的；而可选的还可以直接按照{用户私网IP地址、PCEF ID和用户标识}的关系式存储。
V-PCRF14确认所述用户终端为漫游用户，则通过用户标识(即用户接入标识(User Access Identifier，简写：UAI)中的域信息)查找H-PCRF12归属的Diameter域或PLMN网络，并执行步骤S103。
在步骤S103中，V-PCRF14向H-PCRF12转发策略控制请求，该请求中还携带子会话标识、用户私网IP地址和用户标识。所述子会话标识用于V-PCRF14与H-PCRF12之间的S9接口传输，并用来对应用户终端18发起的IP-CAN会话。
在步骤S104-S105中，经由V-PCRF14的转发，将H-PCRF生成的携带控制策略的策略控制响应转发给V-PCEF16。
具体实现时，所述V-PCRF14转发来自H-PCRF12的初始信用控制响应(Initial Credit Control Answer，简写为：CCA-I)消息给V-PCEF16。
在步骤S106-S107中，V-PCEF16向H-AF10发送数据业务服务请求。
在拥有V-NAT20的情况下，V-PCEF16发送的数据业务服务请求会经过V-NAT20的转发，并携带上用户的私网IP地址和用户的公网IP地址。
具体实现时，用户终端18的应用层数据以IP包形式经过V-PCEF16和V-NAT20转发至H-AF10。H-AF10从IP包头中获取用户公网IP地址，从IP包的应用层数据(IP包内容)中获取用户私网IP地址。
在步骤S108中，H-AF10通过上述与V-PCEF16间的通道，向用户终端18提供数据业务服务。
在步骤S109中，H-AF10在开始为用户提供数据业务服务时，需要与H-PCRF14间建立Rx会话。
所述建立R会话，具体的，H-AF10通过该Rx接口发送认证请求(Authentication-Authorization-Request，简写为：AAR)消息至H-PCRF12，所述AAR消息中携带用户公网IP地址和用户私网IP地址的消息给H-PCRF12。接收H-PCRF12返回的认证相应(Authentication-Authorization-Request，简写为：AAA)消息给H-AF10，完成Rx会话的建立。
H-PCRF12在获取到用户公网IP地址时，便能通过该用户公网IP地址获取拜访域的网络标识，这里网络标识具体表现为：PLMN标识或Diameter域标识。
其中，不同的运营商可能会在自己网络中布局一个或多个Diameter域，通常情况下，一个PLMN标识包含一个或多个Diameter域。
在步骤S110中，H-PCRF12根据所述网络标识向V-PCRF14发送携带用户私网IP地址和用户公网IP地址的消息。
在步骤S111中，V-PCRF14根据用户公网IP地址获得IP域标识。再通过用户私网IP地址和IP域标识匹配V-PCRF14中存储的一组或多组：{用户私网IP地址、IP域标识和用户标识}，得到用户标识。其中，用户私网IP地址和IP域标识的组合对象能够唯一的确认一个用户标识。
在步骤S112中，H-PCRF12获取V-PCRF14返回的携带用户标识的消息。
此时H-PCRF12便得到了用于对应Rx会话的用户标识。
在步骤S113中，H-PCRF12在确认Gx会话和Rx会话所对应的用户标识相同时，完成两个会话的绑定。
具体的绑定方式可以由运营商自由决定，可选的一种方式是依据IP-CAN会话标识，Rx会话标识，以及用户标识建立Gx会话和Rx会话间的绑定关系。
具体实现时，步骤S109-S113的Rx会话建立以及Rx会话和Gx会话的绑定过程可以是在S108数据业务发送的同时进行，或者是在S108进行数据业务服务之前完成，具体可以根据运营商设定来实现，在此不作特殊限定。
本系统实施例，基于最较为简单系统架构(如图1所示)对于本发明所涉及的发明点，以及该发明点在具体实现方式中如何实现做了简单的介绍，以便本领域技术人员在阅读后续的本发明的其他实施例时能够更容易的理解。下面将提炼本发明的重要发明点做全面的介绍。
现有技术中也有采用用户私网IP地址+用户公网IP地址进行会话绑定的方式，但是，由于用户的私网IP地址以及用户的公网IP地址在用户断开网络后重新连接时可能会发生改变，因此，没有本发明的方法稳定。尤其是，在用户附着到拜访域网络后，用户首次发送策略控制请求给归属域的网络节点时，是不携带用户公网IP地址的，因为此时用户还未获取到用户公网IP地址。因此，本发明使用的根据用户标识绑定的方式是几种方式中最优的。
图3是本发明实施例提供的一种在漫游场景下实现会话绑定的方法，所述归属域的网络节点可以是图1中的H-PCRF12，也可以是图5中的归属域Diameter路由代理(Home Diameter Routing Agent H-DRA)H-DRA22。本发明的方法不仅可以适用于图1的系统架构，也适用于图5的系统架构。具体包括：
在步骤120中，归属域的网络节点接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识。
所述第一会话具体可以是图2或图6中的Gx会话，而所述第一会话消息具体可以表现为通过Gx会话发送的策略控制请求。
在步骤122中，归属域的网络节点接收归属域的第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址。
所述第二会话具体可以是图2或图6中的Rx会话，而所述第二会话消息 具体可以表现为通过Rx会话发送的消息，例如：Rx会话建立请求或者是被描述为通过Rx会话下发的业务保障请求。
在步骤124中，归属域的网络节点根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识。
其中，从拜访域网络节点中获取与所述第二会话对应的用户标识具体为：所述拜访域的网络节点根据用户公网IP地址查找到相应的IP域标识；该IP域标识具体为网关标识(在图2实施例中体现为PCEF ID)。
所述拜访域的网络节点根据用户私网IP地址和所述查找到的网关标识，获取用来对应所述第二会话的用户标识；表现在图2中时，具体为步骤S111。这里描述的对应所述第二会话的用户标识含义是，该第二会话是为所述用户标识对应的终端所建立，因此，所述用户标识可以用来作为第二会话区别于其他会话的属性使用。
在步骤126中，在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
由于归属域的网络节点可以是不同的网络实体，所以，可选的：
在所述归属域的网络节点就是H-PCRF时，所述步骤126具体为：H-PCRF确认所述第一会话对应的用户标识和所述第二会话对应的用户标识相同，绑定所述第一会话和第二会话(详见步骤S113)。
在所述归属域的网络节点就是H-DRA时，所述步骤126具体为：H-DRA确认所述第一会话对应的用户标识和所述第二会话对应的用户标识相同，则：发送确认所述第一会话对应的用户标识和所述第二会话对应的用户标识相同的结果给H-PCRF，以便H-PCRF绑定所述第一会话和第二会话(详见步骤S213)；或者发送绑定请求给H-PCRF以便H-PCRF在确认所述第一会话对应的用户标识和所述第二会话对应的用户标识相同后，绑定所述第一会话和第二会话。
本发明实施例，与现有技术中利用发送携带用户的私网IP地址+IP域标识的第一会话消息给归属域的网络节点才能完成绑定的方式比较，克服了现有方式所带来的拓扑信息暴露的问题。本发明实施例结合用户私网IP地址和用户 公网IP地址，并基于归属域的网络节点自身配置有的网络标识和拜访域的网络节点存储有的IP域标识等信息，完成了依据用户标识来绑定拜访域的会话和归属域的会话。
在本实施中，所述拜访域网络节点向归属域的网络节点发送第一会话消息，之前还包括：拜访域的网络节点接收到第一会话建立请求，并保存所述第一会话建立请求中携带的{用户标识、用户私网IP地址和网关标识}对应关系。其中，所述第一会话建立请求在对应图2的实施例中，具体表现为Gx会话建立请求(在图2中没有画出)。其中，网关标识在PCC架构中具体的可以表现为PCEF ID。拜访域的网络节点在存储所述对应关系时，将其中的网关标识转换为相应的IP域标识。其中，网关标识是具体的网关设备的标识；而所述IP域标识则是为了区分一个PLMN或Diameter域中可能存在的拥有相同私网IP地址的用户终端，用于逻辑层面划分网络中的不同用户私网IP地址。其中，通过用户私网IP地址+IP域标识的组合方式能够唯一的找到PLMN中的一个用户终端。通常情况下一个IP域标识会对应一个或多个网关标识。
其中，当所述第一会话具体为Gx会话时，则所述第一会话消息具体为策略控制请求，所述第一会话建立请求具体为Gx会话建立请求。其中，Gx会话建立请求在用户终端发起网络附着时建立(例如：用户终端第一次连接拜访域网络，详见步骤S104，其中向V-PCRF14发送策略控制请求时即包含了Gx会话建立过程，或者说策略控制请求是基于Gx会话建立请求所建立的Gx会话上发送的)，后续该用户终端有数据业务服务请求时，会共享该Gx会话，并利用所述Gx会话获取V-PCRF的控制策略。
在本实施例中，所述归属域的网络节点根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识，具体包括：
归属域网络节点存储有公网IP地址和网络标识的对应关系；归属域网络节点根据所述用户公网IP地址查找所述用户所在拜访域的网络标识(在对应图2的实施例中具体为PLMN标识或者Diameter域标识)；根据所述网络标识向拜访域网络发送携带用户公网IP地址和用户私网IP地址的消息。
在本实施例中，所述归属域网络节点具体为归属域的Diameter路由代理 H-DRA，或者归属域的策略控制规则功能实体H-PCRF。其中，当所述归属域网络节点具体为归属域Diameter路由器H-DRA时，所述在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定，具体包括：
H-DRA在接收到第一会话消息时，为所述第一会话确定了H-PCRF。此时确定的H-PCRF是用于为所述第一会话生成控制策略(例如：QoS)。在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，H-DRA将所述第二会话消息转发给所述H-PCRF，以便所述H-PCRF进行所述第一会话和第二会话的绑定。
为了更明确本发明的保护对象，本发明实施例还从拜访域的网络节点侧为发明中心提供了一种在漫游场景下的会话绑定方法，如图4所示，包括：
在步骤140中，拜访域的网络节点向归属域网络节点发送第一会话消息，所述第一会话消息中携带用户标识。
在步骤142中，接收归属域发送的携带对应第二会话消息的用户公网IP地址和用户私网IP地址的消息。
在步骤144中，根据对应所述第二会话消息的用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识。
在步骤146中，向归属域的网络节点返回对应所述第二会话的用户标识，以便在核对所述第一会话的用户标识和所述第二会话的用户标识相同时，进行所述第一会话和第二会话的绑定。
本实施例和对应图3的实施例是在同一个系统中，基于保护不同的执行主体撰写的方法步骤；因此，相关的具体细化和扩展可以参考对应图3的实施例中描述。
通过上述对应图3和图4的实施例的阐述可知，对应图3和图4的实施例的具体实现方式包含了如图2信令流程图所示的实施例，因此，也适用于如图1所示的系统框架图。在实际应用中，上述对应图3和图4的实施例还可以适用于如图5所示更为复杂的系统框图，而相应的步骤流程可以参照图6所示，具体阐述如下：
如图5所示的系统中，在归属域的网络中新增了H-DRA22的布局，所述 H-DRA22的作用是在归属域的网络中拥有一个或多个H-PCRF时(如图5中12和26所示)，能够根据转发策略将归属域中或拜访域中的其他网络节点发往H-PCRF12的消息进行转发。此时，对应图3和图4实施例中的归属域网络节点则具体表现为H-DRA22。可选的，如图5所示，拜访域网络中也可以引入V-DRA24，而这种改变对于本发明的发明点来说，其区别就在于拜访域的网络节点具体是V-PCRF14(在没有V-DRA24的情况下)或者是V-DRA24(存在V-DRA24的情况下)，相应的区别点将在实施例最后做介绍，在如图6所示的信令图中，为了清楚并更简洁的描述增设DRA后，给本发明带来的改变，则仅以归属域网络布局H-DRA22为例来进行说明，具体如下：
在步骤S201中，V-PCEF16接收到用户附着网络时的IP-CAN会话建立请求。
其中，所述IP-CAN会话建立请求，具体可以是利用Diameter协议的初始CCR消息发送的。
在步骤S202中，V-PCEF16在接收到IP-CAN会话建立请求后，首先会向V-PCRF14发送策略控制请求，以获得用户的控制策略。
V-PCRF14存储所述策略控制请求中携带的用户私网IP地址、IP域标识与用户标识之间的映射关系。其中的IP域标识和PCEF ID有确定的配置关系，可以由PCEF ID获取。
在步骤S203中，V-PCRF14确认用户终端属于漫游到本地的用户，于是向所述用户终端所属的网络域的H-DRA22发送策略控制请求。
在步骤S204中，H-DRA22接收到V-PCRF14的策略控制请求后，根据转发策略，经所述策略控制请求转发到H-PCRF12中。其中，所述H-DRA22管理者多个H-PCRF12，包括图5中所示的H-PCRF12和{H-PCRF(1)…H-PCRF(n)}28。
所述转发策略由运营商确定，可以是：根据个H-PCRF12的负载均衡情况，将是所述策略控制请求转发给负载较低的H-PCRF12来处理；或者按照号段划分等等，在此不做特殊限定。
在步骤S205中，H-PCRF12生成控制策略，并经过H-DRA22和V-PCRF14转发给V-PCEF16。
在步骤S206中，V-PCEF接收到用户终端发起的一个数据业务服务请求，所述业务服务请求指向H-AF10。
在步骤207中，V-NAT20将所述数据业务服务请求重新封装后发送给H-AF10。所述重新封装包括修改发送源地址、源端口号等等。H-AF10从该数据业务服务请求中获取用户私网IP地址和用户公网IP地址。
这里除了可以使用对应图2实施例中步骤107中基于Diameter协议的方式外。具体的，在H-AF属于IMS应用的时候，H-AF还可以从应用层的信令消息中获取用户私网IP地址；对于应用层本身不携带用户私网IP地址的情况，V-PCEF可以通过在HTTP头插入的方式插入用户私网IP地址；
在步骤208中，H-AF10经由V-NAT20和V-PCEF16向用户终端提供数据业务服务。
在执行步骤208之前或者在执行步骤208之后有步骤209，
在步骤209中H-AF10会向H-DRA22发送Rx会话建立请求，以便向H-PCRF12提供数据业务的相关数据，以保证所述H-PCRF12能够及时调整控制策略，以保证数据业务服务的正常提供。所述Rx会话建立请求中携带用户私网IP地址和用户公网IP地址。
在步骤210中，H-DRA22发送携带用户私网IP地址和用户公网IP地址的消息给V-PCRF12。所述消息中携带用户私网IP地址和用户公网IP地址。
其中，H-DRA22中存储有用户公网IP地址和网络标识的对应关系，因此，H-DRA22能够根据所述用户公网IP地址查找到相应用户所在的拜访域网络。所述网络标识也被称为PLMN标识，是用来区别不同网络或者运营商的标识。
在步骤211中，V-PCRF12根据用户公网IP地址获取相应的IP域标识，并通过用户私网IP地址和IP域标识匹配在步骤S203中获取的用户私网IP地址、IP域标识和用户标识，并得到相应的用户标识。
其中，V-PCRF14中可能针对不同的用户终端，存储有一组或者多组用户私网IP地址、IP域标识和用户标识。
在步骤212中，H-DRA22获取V-PCRF14返回的携带用户标识的消息，并将所述用户标识作为将要建立的Rx会话所对应的用户标识。
在步骤213中，H-DRA22确认对应所述用户标识的将要建立的Rx会话和 Gx会话所对应的用户标识相同，并把Rx会话建立请求发送给在步骤S204中所选择的H-PCRF12。
在步骤214中，H-PCRF12完成所述Rx会话建立，并绑定所述Rx会话和Gx会话。
本实施通过结合系统架构图5和信令图6，详尽的介绍了在归属域的网络节点是H-DRA时，如何实现本发明所提出的会话绑定方法。并针对在拜访域网络中增加H-DRA后，造成的Rx会话建立请求无法直接找到H-PCRF的问题。将本发明的会话绑定方式在多种应用环境下加以实现，证实了其可行性。本实施例相关消息的具体如何在Diameter协议中实现可以参考图2对应的实施例，在此不作赘述。。
需要补充说明的是，当拜访域网络也设置有V-DRA时，根据V-DRA是代理型(Proxy DRA)的或者是重定向型(Redirect DRA)的不同，相关拜访域网络节点的处理方式存在差别，具体表现为：
1)当V-DRA为代理型，即V-DRA可以用来实现除了路由V-PCRF功能外还能用于查找用户标识，并将查找到的用户标识返回给H-DRA，具体的本实施例中V-PCRF执行完成的S211和S212会由V-DRA来完成；
2)当V-DRA为重定向型，即V-DRA仅可以实现V-PCRF的路由功能，具体的，在接收到携带用户私网IP地址和用户公网IP地址的消息后(见S210)，直接将该消息路由至目的V-PCRF，并由目的V-PCRF执行所述S211和S212内容。对于V-DRA来说，它可以通过用户公网IP地址和用户私网IP地址找到事先在用户终端创建IP-CAN会话时为Gx会话所分配过的V-PCRF，即这里所说的目的V-PCRF。
如图7所示，是本发明实施例提供的一种在漫游场景下绑定会话的装置12，包括处理器121、存储器123和收发器125，具体的：
所述存储器123，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；
所述收发器125，用于与归属域网络和拜访域网络中的其他装置进行通信；
所述处理器121，用于在通过上述收发器接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；接收归属域的第二会话消息， 所述第二会话消息中携带用户公网IP地址和用户私网IP地址；根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识；在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
优选的，所述处理器121，具体用于：通过所述收发器发送携带用户公网IP地址和用户私网IP地址的消息给拜访域网络节点；其中，所述用户公网IP地址用于拜访域网络节点获取对应的网关标识；接收拜访域网络节点返回的消息，所述消息中携带拜访域网络节点基于所述用户私网IP地址和所述网关标识获取到的用户标识。
优选的，所述存储器123中存储公网IP地址和网络标识的对应关系，则所述处理器，具体用于：根据所述用户公网IP地址查找所述用户所在拜访域的网络标识；根据所述网络标识向拜访域网络发送携带用户公网IP地址和用户私网IP地址的消息。
优选的，所述处理器121，具体用于：在通过所述收发器接收到第一会话消息时，为所述第一会话确定H-PCRF；在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，将所述第二会话消息转发给所述H-PCRF，以便所述H-PCRF进行所述第一会话和第二会话的绑定。
如图8所示，是本发明实施例提供的一种在漫游场景下绑定会话的装置14，包括处理器141、存储器143和收发器145，具体的：
所述存储器143，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；
所述收发器145，用于与归属域网络和拜访域网络中的其他装置进行通信；
所述处理器141，通过所述收发器145向归属域网络节点发送第一会话消息，所述第一会话消息中携带用户标识；接收归属域的发送的携带对应第二会话消息的用户公网IP地址和用户私网IP地址的消息；根据对应所述第二会话消息的用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识；向归属域的网络节点返回对应所述第二会话的用户标识，所述第二会话的用户标识用于在核对与所述第一会话的用户标识相同时，进行所述第一会话和第二会话的绑定。
优选的，所述处理器141，具体用于：根据所述用户公网IP地址查找其所属的IP域标识；根据对应第二会话的用户私网IP地址和所述查找到的IP域标识，获取用来对应所述第二会话的用户标识。
优选的，所述装置接收所述拜访域网络节点发送的第一会话消息之前，所述处理器141还用于：
在接收到第一会话建立请求时，在所述存储装置143中保存所述第一会话建立请求中携带的用户标识、用户私网IP地址和IP域标识三者的映射关系，以便后续根据所述用户私网IP地址和IP域标识获取到相应的用户标识。
其中IP域标识具体可以是网关标识(例如：PCEF ID)，还可以是IP域标识(例如：IP_Doman_ID)。
对应图7和图8的实施例，给出了通用的物理实体结构图。而从另一个角度分析，本发明实施例还给出了按照模块功能划分的用于实现本发明方法的装置，包括如图9所示的一种在漫游场景下实现会话绑定的装置16，至少包括发送模块165、处理模块163和接收模块161，包括：
接收模块161，用于接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；
所示接收模块161，还用于接收归属域的第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；
处理模块163，用于根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识；在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
其中，为了实现根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识，所述处理模块163具体用于，
调用发送模块165，发送携带用户公网IP地址和用户私网IP地址的消息给拜访域网络节点；其中，所述用户公网IP地址用于拜访域网络节点获取对应的IP域标识；
在所述接收模块163，接收拜访域网络节点返回的消息，从所述消息中获 取用户标识。
其中，为了实现调用所述发送模块，发送携带用户公网IP地址和用户私网IP地址的消息给拜访域网络节点，所述装置还包括：
存储模块169，用于存储有公网IP地址和网络标识的对应关系；
所述处理模块中还包括查找子模块167，用于根据所述用户公网IP地址查找所述用户所在拜访域的网络标识；
所述处理模块163根据所述网络标识调用所述发送模块165，向拜访域网络发送携带用户公网IP地址和用户私网IP地址的消息。
所述对应图9的装置还可以实现的功能，参考图2中对应于H-PCRF，或者对应于图3、图4中对应于归属域网络节点的相关的步骤方法，本领域技术人员在公开了上述功能模块的基础上，能够很容易的将其他实现的方法功能在相应的模块中实现，因此在此不再赘述。
若图9的装置所对应的是图3或图4中的归属域网络节点的实现，则接下来的图10所示的装置18则是用来对应图3或图4中的拜访域网络节点的实现，至少包括发送模块185、处理模块183和接收模块181，具体的：
发送模块185，用于向归属域网络节点发送第一会话消息，所述第一会话消息中携带用户标识。
接收模块181，用于接收归属域发送的携带对应第二会话消息的用户公网IP地址和用户私网IP地址的消息。
处理模块183，用于根据对应所述用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识。
所述发送模块185，还用于向归属域的网络节点返回对应所述第二会话的用户标识，以便在核对所述第一会话的用户标识和所述第二会话的用户标识相同时，进行所述第一会话和第二会话的绑定。
其中，为了实现处理模块183根据对应所述用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识的功能，装置18还包括存储模块189。
所述存储模块189，用于存储用户公网IP地址和IP域标识的对应关系。
则所述处理模块183具体用于，根据用户公网IP地址查找其所属的IP域 标识；根据所述用户私网IP地址和所述IP域标识，获取对应所述第二会话的用户标识。
其中，所述处理模块183，还用在接收模块181接收到第一会话建立请求时，将所述第一会话建立请求中携带的用户标识、用户私网IP地址和IP域标识三者的映射关系保存到所述存储模块189中，以便后续根据所述用户私网IP地址和IP域标识获取到相应的用户标识。
所述对应图10的装置还可以实现的功能，参考图2中对应于V-PCRF，或者对应于图3、图4中对应于拜访域网络节点的相关的步骤方法，本领域技术人员在公开了上述功能模块的基础上，能够很容易的将其他实现的方法功能在相应的模块中实现，因此在此不再赘述。
本发明实施例除了提供了上述在漫游场景下，实现用户会话绑定的系统(如对应图2和图6的实施例)、方法(如对应图3和图4的实施例)和装置(如对应图7-10的实施例)以外，还提供了一种漫游场景下归属域网络节点获取拜访域中用户标识信息的方法，如图11所示，包括：
S302归属地的网络节点根据会话建立请求消息中携带的用户公网IP地址确定拜访域的网络标识。
在对应图3的实施例中，所述会话建立请求消息具体为第二会话消息。
S304归属地的网络节点将所述用户公网IP地址和所述用户私网IP地址发送到拜访域的网络节点。
S305归属域的网络节点接收拜访域的网络节点返回的用户标识信息；所述用户标识是由用户公网IP地址和用户私网IP地址查询拜访域的网络节点中存储的用户私网IP地址、IP域标识和用户标识的映射关系得到的。
本实施例给出了一种如何在漫游场景下获取用户标识的方法，整个信令过程中除了传递的用户标识外，并没有发送其他涉及信息安全的内容传递，而是基于现有的用户IP地址信息(包括用户私网IP地址和用户公网IP地址)，以及各网络节点自身存储有的IP地址段与网络标识和IP域标识的对应关系，实现了归属域的网络节点对处于拜访域的用户终端对应的用户标识的获取。
对应拜访域网络侧，本发明实施例还提供了本发明实施例提供了一种漫游场景下跨域获取会话信息的方法，如图12所示，包括：
S402拜访域的网络节点接收第一会话建立请求，所述第一会话建立请求中携带用户私网IP地址、网关标识和用户标识；
S404根据本地预置的IP地址段和IP域标识的对应关系，转换所述网关标识为对应的IP域标识，并按照{(用户私网IP地址、IP域标识)和用户标识}对应关系存储；
S406接收归属域网络节点发送的携带用户私网IP地址和用户公网IP地址的消息，根据本地预置的IP地址段和IP域标识的对应关系，获取所述用户公网IP地址对应的IP域标识；根据获取的IP域标识和用户私网IP地址的组合，从存储的{(用户私网IP地址、IP域标识)和用户标识}对应关系中获取用户标识。
优选的，所述的拜访域的网络节点根据本地预先配置的用户公网IP地址段和IP域标识对应关系，确定所接收的用户公网IP地址对应的IP域标识。其中，所述IP域标识还可以是分组数据网网关(Public Data Network Gateway，简写：PDN Gateway)。
优选的，所述的拜访域的网络节点本地预先配置的{用户私网IP地址，IP域标识}组合和用户标识的关联关系。具体的，一个用户标识可以唯一的被一组“用户私网IP地址+IP域标识”确定。在对应图3的实施例中具体被描述为{用户私网IP地址、IP域标识和用户标识}关系组。
优选的，所述的拜访域的网络节点根据本地预先配置的{用户私网IP地址，IP域标识}组合和用户标识信息的对应关系，拜访域的网络节点在接收到第一会话建立请求时，获得{用户私网IP地址，IP域标识}组合和用户标识信息的对应关系，并存储这种对应关系。
优选的，所述归属域的网络节点根据本地预先配置的用户公网IP地址段和网络标识的对应关系，将会话建立请求消息中携带的用户公网IP地址映射为拜访域网络标识。
本实施例及其优选方案都是在前面所描述的各实施例基础上提炼出来的，是为了实现之前所述各漫游场景下会话绑定所必要的步骤；因此，本发明的方法同样适用于之前描述的各实施例的相关扩展方案；本发明的方法也可以在对应图7-10的装置中实现，在此不作赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在所述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
结合本文中所公开的实施例描述的方法或步骤可以用硬件、处理器执行的软件程序，或者二者的结合来实施。软件程序可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
尽管通过参考附图并结合优选实施例的方式对本发明进行了详细描述，但本发明并不限于此。在不脱离本发明的精神和实质的前提下，本领域普通技术人员可以对本发明的实施例进行各种等效的修改或替换，而这些修改或替换都应在本发明的涵盖范围内。

Claims (25)

  1. 一种漫游场景下归属域会话和拜访域会话绑定的系统，包含归属域的网络节点和拜访域的网络节点，其中，第一会话属于拜访域会话，第二会话属于归属域会话，其特征在于，包括：
    所述归属域的网络节点接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；
    所述归属域的网络节点接收第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；
    所述归属域的网络节点发送携带所述用户公网IP地址和用户私网IP地址的消息给所述拜访域的网络节点；
    所述拜访域的网络节点根据所述用户公网IP地址和用户私网IP地址获取与所述第二会话对应的用户标识；
    所述归属域的网络节点接收所述拜访域的网络节点发送的所述第二会话对应的用户标识，在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
  2. 如权利要求1任一所述的系统，其特征在于，所述归属域的网络节点发送携带所述用户公网IP地址和用户私网IP地址的消息给所述拜访域的网络节点，具体包括：
    归属域网络节点根据所述用户公网IP地址查找所述用户所在拜访域的网络标识；其中，归属域网络节点存储有公网IP地址段和网络标识的对应关系；
    归属域网络节点根据所述网络标识向拜访域网络发送携带用户公网IP地址和用户私网IP地址的消息。
  3. 如权利要求1或2所述的系统，其特征在于，所述拜访域的网络节点根据所述用户公网IP地址和用户私网IP地址获取与所述第二会话对应的用户标识，具体包括：
    所述拜访域的网络节点查找所述用户公网IP地址所属的IP域标识；
    所述拜访域的网络节点根据所述用户私网IP地址和所述查找得到的IP域标识，其中，拜访域网络节点预先存储有公网IP地址段和IP域标识的对应关系；
    从存储的一组或多组{用户标识、用户私网IP地址和IP域标识}中获取用于对应所述第二会话的用户标识。
  4. 如权利要求1-3任一所述的系统，其特征在于，所述归属域的网络节点接收所述拜访域网络节点发送的第一会话消息之前，还包括：
    拜访域的网络节点接收到第一会话建立请求，所述第一会话建立请求中携带用户标识、用户私网IP地址和网关标识；
    将所述网关标识转换为IP域标识，保存所述用户标识、用户私网IP地址和IP域标识。
  5. 如权利要求2-4任一所述的系统，其特征在于，
    所述网络标识，具体包括：陆上公用移动通信网PLMN标识或Diameter域标识。
  6. 如权利要求1-5任一所述的系统，其特征在于，所述归属域的网络节点具体为归属域的Diameter路由代理H-DRA，或者归属域的策略控制规则功能实体H-PCRF，其中，在所述归属域网络节点具体为归属域Diameter路由器H-DRA时，所述在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定，具体包括：
    在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，H-DRA将所述第二会话消息转发给H-PCRF，以便所述H-PCRF进行所述第一会话和第二会话的绑定；其中，所述H-PCRF，是H-DRA在接收到第一会话消息时，为所述第一会话确定的PCRF。
  7. 一种漫游场景下归属域会话和拜访域会话绑定的方法，其特征在于，包括：
    归属域的网络节点接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；
    接收归属域的第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；
    根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识；
    在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
  8. 如权利要求7所述的方法，其特征在于，所述发送携带用户公网IP地址和用户私网IP地址的消息给拜访域网络节点，具体包括：
    归属域网络节点存储有公网IP地址和网络标识的对应关系；
    归属域网络节点根据所述用户公网IP地址查找所述用户所在拜访域的网络标识；
    根据所述网络标识向拜访域网络发送携带用户公网IP地址和用户私网IP地址的消息。
  9. 如权利要求7或8所述的方法，其特征在于，所述根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识，具体包括：
    发送携带用户公网IP地址和用户私网IP地址的消息给拜访域网络节点；其中，所述用户公网IP地址用于拜访域网络节点获取对应的IP域标识；
    接收拜访域网络节点返回的消息，所述消息中携带拜访域网络节点基于所述用户私网IP地址和所述IP域标识获取到的用户标识。
  10. 如权利要求7-9任一所述的方法，其特征在于，所述归属域的网络节点具体为归属域的Diameter路由代理H-DRA，或者归属域的策略控制规则功能实体H-PCRF，其中，在所述归属域网络节点具体为归属域Diameter路由器H-DRA时，所述在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定，具体包括：
    在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，H-DRA将所述第二会话消息转发给H-PCRF，以便所述H-PCRF进行所述第一会话和第二会话的绑定；
    其中，所述H-PCRF是H-DRA在接收到第一会话消息时，为所述第一会话确定的PCRF。
  11. 一种漫游场景下归属域会话和拜访域会话绑定的装置，所述装置包括处理器、存储器和收发器，其特征在于，
    所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；
    所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；
    所述处理器，用于在通过上述收发器接收拜访域网络节点发送的第一会话消息，所述第一会话消息中携带用户标识；
    接收归属域的第二会话消息，所述第二会话消息中携带用户公网IP地址和用户私网IP地址；
    根据第二会话消息中携带的用户公网IP地址和用户私网IP地址，从拜访域网络节点中获取与所述第二会话对应的用户标识；
    在所述第一会话对应的用户标识和所述第二会话对应的用户标识相同时，进行所述第一会话和第二会话的绑定。
  12. 如权利要求11所述的装置，其特征在于，所述存储器中存储公网IP地址和网络标识的对应关系，则所述处理器，具体用于：
    根据所述用户公网IP地址查找所述用户所在拜访域的网络标识；
    根据所述网络标识向拜访域网络发送携带用户公网IP地址和用户私网IP地址的消息。
  13. 如权利要求11或12所述的装置，其特征在于，所述处理器，具体用于：
    通过所述收发器发送携带用户公网IP地址和用户私网IP地址的消息给拜访域网络节点；其中，所述用户公网IP地址用于拜访域网络节点获取对应的IP域标识；
    接收拜访域网络节点返回的消息，所述消息中携带拜访域网络节点基于所述用户私网IP地址和所述IP域标识获取到的用户标识。
  14. 如权利要求11-13任一所述的装置，其特征在于，所述处理器，具体用于：
    通过所述收发器接收到第一会话消息，为所述第一会话确定H-PCRF；
    确认所述第一会话对应的用户标识和所述第二会话对应的用户标识相同，则将所述第二会话消息转发给所述H-PCRF，以便所述H-PCRF进行所述第一会话和第二会话的绑定。
  15. 一种漫游场景下归属域会话和拜访域会话绑定的方法，其特征在于，包括：
    拜访域的网络节点向归属域网络节点发送第一会话消息，所述第一会话消息中携带用户标识；
    接收归属域发送的携带对应第二会话消息的用户公网IP地址和用户私网IP地址的消息；
    根据所述用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识；
    向归属域的网络节点返回对应所述第二会话的用户标识，以便在核对所述第一会话的用户标识和所述第二会话的用户标识相同时，进行所述第一会话和第二会话的绑定。
  16. 如权利要求15所述的方法，其特征在于，所述根据所述用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识，具体包括：
    所述拜访域的网络节点根据接收到的用户公网IP地址查找到相应的IP域标识；其中，用户公网IP地址和相应的IP域标识的映射关系预先配置在拜访域的网络节点中；
    所述拜访域的网络节点根据所述用户私网IP地址和所述IP域标识，获取对应所述第二会话的用户标识。
  17. 如权利要求15或16所述的方法，其特征在于，所述归属域的网络节点接收所述拜访域网络节点发送的第一会话消息，之前还包括：
    拜访域的网络节点接收到第一会话建立请求，保存所述第一会话建立请求中携带的用户标识、用户私网IP地址和IP域标识三者的映射关系。
  18. 如权利要求15-17任一所述的方法，其特征在于，所述拜访域的网络节点具体为拜访域的Diameter路由代理V-DRA，或者拜访域的策略控制规则功能实体V-PCRF，其中，当所述拜访域的网络节点具体为拜访域的Diameter路由代理V-DRA时，所述方法还包括：
    当所述V-DRA为代理模式时，所述根据所述用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识的步骤由V-DRA执行；或者，
    当所述V-DRA为重定向模式时，所述根据所述用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识的步骤由V-PCRF执行。
  19. 一种漫游场景下归属域会话和拜访域会话绑定的装置，所述装置包括处理器、存储器和收发器，其特征在于，
    所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；
    所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；
    所述处理器，通过所述收发器向归属域网络节点发送第一会话消息，所述第一会话消息中携带用户标识；
    接收归属域的发送的携带对应第二会话消息的用户公网IP地址和用户私网IP地址的消息；
    根据对应所述第二会话消息的用户公网IP地址和用户私网IP地址，获取对应所述第二会话的用户标识；
    向归属域的网络节点返回对应所述第二会话的用户标识，所述第二会话的用户标识用于在核对所述第一会话的用户标识和所述第二会话的用户标识相同时，进行所述第一会话和第二会话的绑定。
  20. 如权利要求19所述的装置，其特征在于，所述处理器，具体用于：
    根据接收到的对应第二会话的用户公网IP地址查找到相应的IP域标识；其中，用户公网IP地址和相应的IP域标识的映射关系预先配置在拜访域的网络节点中；
    根据对应第二会话的用户私网IP地址和所述IP域标识，获取用来对应所述第二会话的用户标识。
  21. 如权利要求19或20所述的装置，其特征在于，所述装置接收所述拜访域网络节点发送的第一会话消息之前，所述处理器还用于：
    接收到第一会话建立请求，在所述存储装置中保存所述第一会话建立请求中携带的用户标识、用户私网IP地址和IP域标识三者的映射关系。
  22. 一种漫游场景下跨域获取会话信息的方法，其特征在于，包括：
    归属地的网络节点根据会话建立请求消息中携带的用户公网IP地址确定拜访域的网络标识；
    归属地的网络节点将所述用户公网IP地址和所述用户私网IP地址发送到拜访域的网络节点；
    归属域的网络节点接收拜访域的网络节点返回的用户标识信息；所述用户标识是由用户公网IP地址和用户私网IP地址查询拜访域的网络节点中存储的用户私网IP地址、IP域标识和用户标识的映射关系得到的。
  23. 一种漫游场景下跨域获取会话信息的装置，所述装置包括处理器、存储器和收发器，其特征在于，
    所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；
    所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；
    所述处理器，用于根据会话建立请求消息中携带的用户公网IP地址确定拜访域的网络标识；将所述用户公网IP地址和所述用户私网IP地址发送到拜访域的网络节点；接收拜访域的网络节点返回的用户标识信息；所述用户标识是由用户公网IP地址和用户私网IP地址查询拜访域的网络节点中存储的用户私网IP地址、IP域标识和用户标识的映射关系得到的。
  24. 一种漫游场景下跨域获取会话信息的方法，其特征在于，包括：
    拜访域的网络节点接收第一会话建立请求，所述第一会话建立请求中携带用户私网IP地址、网关标识和用户标识；
    根据本地预置的IP地址段和IP域标识的对应关系，转换所述网关标识为对应的IP域标识，并按照{(用户私网IP地址、IP域标识)和用户标识}对应关系存储；
    接收归属域网络节点发送的携带用户私网IP地址和用户公网IP地址的消息，根据本地预置的IP地址段和IP域标识的对应关系，获取所述用户公网IP地址对应的IP域标识；根据获取的IP域标识和用户私网IP地址的组合，从存储的{(用户私网IP地址、IP域标识)和用户标识}对应关系中获取用户标识。
  25. 一种漫游场景下跨域获取会话信息的装置，所述装置包括处理器、存储器和收发器，其特征在于，
    所述存储器，存储用于处理器运行所述装置的代码，还用于存储临时需要保存的数据；
    所述收发器，用于与归属域网络和拜访域网络中的其他装置进行通信；
    所述处理器，接收第一会话建立请求，所述第一会话建立请求中携带用户私网IP地址、网关标识和用户标识；根据本地预置的IP地址段和IP域标识的对应关系，转换所述网关标识为对应的IP域标识，并按照{(用户私网IP地址、IP域标识)和用户标识}对应关系存储；接收归属域网络节点发送的携带用户私网IP地址和用户公网IP地址的消息，根据本地预置的IP地址段 和IP域标识的对应关系，获取所述用户公网IP地址对应的IP域标识；根据获取的IP域标识和用户私网IP地址的组合，从存储的{(用户私网IP地址、IP域标识)和用户标识}对应关系中获取用户标识。
PCT/CN2014/087982 2014-05-05 2014-09-30 一种漫游场景下的会话绑定方法、裝置和系统 WO2015169044A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410189172.8 2014-05-05
CN201410189172.8A CN105101176B (zh) 2014-05-05 2014-05-05 一种漫游场景下的会话绑定方法、装置和系统

Publications (1)

Publication Number Publication Date
WO2015169044A1 true WO2015169044A1 (zh) 2015-11-12

Family

ID=54392077

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/087982 WO2015169044A1 (zh) 2014-05-05 2014-09-30 一种漫游场景下的会话绑定方法、裝置和系统

Country Status (2)

Country Link
CN (1) CN105101176B (zh)
WO (1) WO2015169044A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115086895A (zh) * 2021-03-11 2022-09-20 中国电信股份有限公司 区分异常本省话单和异常漫游话单的方法和系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106792613B (zh) * 2015-11-25 2020-01-14 中国电信股份有限公司 会话绑定方法和系统
CN106804033A (zh) * 2015-11-26 2017-06-06 中国电信股份有限公司 会话绑定方法和系统及能力开放网关
CN106817434B (zh) * 2015-11-30 2020-02-18 中国移动通信集团公司 一种会话绑定方法、路由代理及pcrf
CN106998542B (zh) * 2016-01-22 2020-08-07 中国电信股份有限公司 用于配置pcc策略的方法和系统
CN108234186A (zh) * 2016-12-22 2018-06-29 中国移动通信有限公司研究院 一种确定业务链策略的方法及设备
CN111328035B (zh) * 2018-12-14 2021-08-10 中国移动通信集团北京有限公司 一种业务处理方法、装置和可读介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101420674A (zh) * 2007-10-25 2009-04-29 华为技术有限公司 Nat技术在pcc架构中的实现方法、pcrf及af
CN102158514A (zh) * 2010-02-11 2011-08-17 中兴通讯股份有限公司 一种通信系统以及关联业务策略信息的方法
CN102905390A (zh) * 2011-07-26 2013-01-30 中兴通讯股份有限公司 会话关联方法、装置和系统
WO2013056366A1 (en) * 2011-10-18 2013-04-25 Alcatel Lucent Lte subscriber identity correlation service
CN103200151A (zh) * 2012-01-04 2013-07-10 中国移动通信集团公司 一种nat部署环境下的pcc会话绑定的方法、系统和pcrf

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8913585B2 (en) * 2007-06-28 2014-12-16 Motorola Mobility Llc Method and system for providing IMS session continuity to a user equipment across a plurality of communication networks
CN101959257B (zh) * 2009-07-20 2013-06-12 中兴通讯股份有限公司 一种承载绑定和事件报告功能的重选方法
CN103685582B (zh) * 2012-09-05 2017-02-22 中国移动通信集团公司 Pcrf寻址方法和系统、终端、服务器、pa设备以及dra设备
CN103686654B (zh) * 2012-09-05 2017-11-24 中国移动通信集团公司 Pcc会话关联方法、以及pcef单元和pa单元
CN103731812B (zh) * 2012-10-15 2017-09-15 中国移动通信集团公司 会话关联方法、装置、网关、业务侧接入设备和服务器

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101420674A (zh) * 2007-10-25 2009-04-29 华为技术有限公司 Nat技术在pcc架构中的实现方法、pcrf及af
CN102158514A (zh) * 2010-02-11 2011-08-17 中兴通讯股份有限公司 一种通信系统以及关联业务策略信息的方法
CN102905390A (zh) * 2011-07-26 2013-01-30 中兴通讯股份有限公司 会话关联方法、装置和系统
WO2013056366A1 (en) * 2011-10-18 2013-04-25 Alcatel Lucent Lte subscriber identity correlation service
CN103200151A (zh) * 2012-01-04 2013-07-10 中国移动通信集团公司 一种nat部署环境下的pcc会话绑定的方法、系统和pcrf

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115086895A (zh) * 2021-03-11 2022-09-20 中国电信股份有限公司 区分异常本省话单和异常漫游话单的方法和系统
CN115086895B (zh) * 2021-03-11 2023-11-21 中国电信股份有限公司 区分异常本省话单和异常漫游话单的方法和系统

Also Published As

Publication number Publication date
CN105101176A (zh) 2015-11-25
CN105101176B (zh) 2019-06-11

Similar Documents

Publication Publication Date Title
WO2015169044A1 (zh) 一种漫游场景下的会话绑定方法、裝置和系统
CN107409068B (zh) 在网络环境中分发策略计费和执行功能连接信息的系统和方法
EP2932745B1 (en) Method and system for hub breakout roaming
JP5298203B2 (ja) Ｎａｔ経由のデータセッションのポリシー及び課金制御のための制御セッションのトークンベースの相関
US8824340B2 (en) Handling of policy and charging information and user profiles in a multisite communication's network
JP5575928B2 (ja) 多様なソースメッセージの関連付け
CN103430487B (zh) 用于检测分组数据连接的服务数据的方法、设备和系统
US9967148B2 (en) Methods, systems, and computer readable media for selective diameter topology hiding
US20090327112A1 (en) Method, device and control system for online charging on roaming
EP2738982A1 (en) Session association method, device and system
WO2009092304A1 (zh) 选择策略和计费规则功能实体的方法和装置
US10554661B2 (en) Methods, systems, and computer readable media for providing access network session correlation for policy control
US8018847B2 (en) System and method for redirecting requests
US20160142294A1 (en) Gx-Rx BINDING WITH AN ALTERNATE TO APN
WO2009056052A1 (fr) Procédé de réalisation, pcrf et af de technologie nat dans une infrastructure pcc
WO2011134327A1 (zh) 确定策略和计费规则功能的方法及系统
JP2016506109A (ja) デバイス固有のトラフィックフローステアリングのためのネットワークアドレス変換されたデバイスの特定
WO2011079782A1 (zh) 一种实现策略与计费控制的方法、网关和移动终端
JP5746442B2 (ja) ローミングパートナーの領域の１次および２次への編成
JP5855261B2 (ja) サポートされる特徴のオーバーライド
CN106507382B (zh) 一种Diameter消息路由方法和路由代理节点
US20160227394A1 (en) Hiding Diameter Network Topology
US11196666B2 (en) Receiver directed anonymization of identifier flows in identity enabled networks
US9641425B2 (en) DRA destination mapping based on diameter answer message
US10104604B2 (en) S9 roaming session destination selection

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14891330

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14891330

Country of ref document: EP

Kind code of ref document: A1