WO2016065847A1 - WiFi分流的方法、装置及系统 - Google Patents

WiFi分流的方法、装置及系统 Download PDF

Info

Publication number
WO2016065847A1
WO2016065847A1 PCT/CN2015/076101 CN2015076101W WO2016065847A1 WO 2016065847 A1 WO2016065847 A1 WO 2016065847A1 CN 2015076101 W CN2015076101 W CN 2015076101W WO 2016065847 A1 WO2016065847 A1 WO 2016065847A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
authentication
aaa
network
authorization
Prior art date
Application number
PCT/CN2015/076101
Other languages
English (en)
French (fr)
Inventor
周俊超
姬庆发
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016065847A1 publication Critical patent/WO2016065847A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, device, and system for WiFi offloading.
  • WiFi Offload Solution The current standard specification defines two different implementation architectures for 2/3G mobile communication networks and 4G communication networks.
  • FIG. 1 is a schematic diagram of a WiFi offload architecture of a 2/3G mobile communication network in the related art.
  • a 2/3G mobile communication network WiFi offload architecture user roaming in a mobile communication network or switching to a wireless local area network (Wireless Local Area Network)
  • the WLAN access network WLAN Access Network, WLAN AN for short
  • the authentication and authorization accounting server Authentication, Authorization, Accounting, AAA for short
  • the AAA interacts with the Home Location Register (HLR) through the D'/Gr' interface to authenticate the user.
  • HLR Home Location Register
  • the HLR authorizes the user subscription information to the AAA, which is authorized by the AAA to the user via the WLAN AN.
  • the 2/3G mobile communication network user can directly go out of the Internet (Internet) through the WLAN AN.
  • Internet Internet
  • the user is still a 2/3G mobile communication network user, it does not need to use the wireless and wired resources of the 2/3G mobile communication network for data services, thereby effectively diverting the load of the mobile communication network.
  • FIG. 2 is a schematic diagram of a WiFi shunting architecture of a 4G mobile communication network in the related art, as shown in FIG. 2, a WiFi shunting architecture of a 4G mobile communication network: in a 4G mobile communication network, a WLAN network is used as a non-3GPP access network (Non-3GPP networks The way to access the 4G mobile communication network.
  • a WLAN network is used as a non-3GPP access network (Non-3GPP networks The way to access the 4G mobile communication network.
  • the STa/SWa interface between the trusted/non-credited non-3GPP access gateway and the AAA server initiates an authentication authorization request to the AAA server.
  • the AAA interacts with the Home Subscriber Server (HSS) through the SWx interface to authenticate the user.
  • HSS Home Subscriber Server
  • the HSS authorizes the user subscription information to the AAA, and the AAA grants the user a trusted/non-credited non-3GPP access gateway.
  • the user in the 4G mobile communication network can directly go out to the Internet through the non-3GPP access gateway of the credit/non-credit.
  • the user is still a 4G mobile communication network user, it does not need to use the wireless and wired resources of the 4G mobile communication network for data services, thereby effectively diverting the load of the mobile communication network.
  • the standard specification defines the WiFi offload architecture for 2/3G and 4G mobile communication networks, but does not define 2/3G/4G convergence. (This document is referred to as the converged network for short, and the HLR of 2/3G users in the converged network.
  • the device also has a WiFi offloading architecture under the HSS device of 4G users.
  • Existing WLAN access network gateways for example, Access Control (AC) and Broadband Remote Access Server (BRAS)
  • AC Access Control
  • BRAS Broadband Remote Access Server
  • EAP Extensible Authentication Protocol
  • the invention provides a method, device and system for WiFi offloading, at least one of the above problems.
  • a method for WiFi offloading including: a WiFi Offload Gateway (WOG) receiving authentication request information of a WLAN access network gateway; and the WOG according to the authentication request information
  • the terminal identifier content or format determines the mobile communication network where the terminal is located; the WOG selects an interface corresponding to the mobile communication network and an authentication and authorization accounting server AAA for authentication according to the mobile communication network where the terminal is located.
  • Authorization wherein the AAA interacts with the corresponding home location register HLR or the home subscriber server HSS according to the interface, and authenticates the terminal; if the terminal passes the authentication and authorization, the WOG passes the The WLAN AN access network and the terminal perform data services.
  • the WOG selects an interface corresponding to the mobile communication network and an authentication and authorization accounting server AAA to perform authentication and authorization according to the mobile communication network where the terminal is located, where the AAA is based on the interface and The corresponding home location register HLR or the home subscriber server HSS interacts, and the authentication of the terminal includes: when the terminal is in the 2/3G network, the authentication is performed by using the Wa port to the AAA, and the AAA passes the D'/ The Gr' interface interacts with the HLR to authenticate the terminal; the terminal In the case of a 4G network, the authentication is authorized by using the STa/SWa interface to the AAA, and the AAA interacts with the HSS through the SWx interface to authenticate the terminal.
  • the method further includes: the method for extending the local area network-based extended authentication protocol EAP by the WOG to interact with the terminal by using a WLAN, an AAA, where the AAA and the HLR, the HSS pass the EAP method authentication, complete the certification and authorization process.
  • the method of the EAP includes: EAP-SIM, EAP-AKA, EAP-PEAP, and EAP-TTLS.
  • the terminal identifier content includes at least one of the following: a domain name part of the terminal name field, a number segment where the international mobile subscriber identity IMSI of the terminal is located, and a medium access control MAC address of the terminal.
  • a device for WiFi offloading is further provided, which is located in the WiFi offload gateway WOG, and includes:
  • the receiving module is configured to receive the authentication request information of the WLAN access network gateway of the wireless local area network; the determining module is configured to determine, according to the content or format of the terminal identifier in the authentication request information, the mobile communication network where the terminal is located; Setting, according to the mobile communication network where the terminal is located, selecting an interface corresponding to the mobile communication network and an authentication and authorization charging server AAA for performing authentication and authorization, wherein the AAA is according to the interface and a corresponding home location register HLR or The home subscriber server HSS interacts to authenticate the terminal, and the data module is configured to perform data services through the WLAN AN access network and the terminal when the terminal passes the authentication and authorization.
  • the selecting module is further configured to perform authentication and authorization by using the Wa port to the AAA when the terminal is in the 2/3G network, and the AAA interacts with the HLR through the D'/Gr' interface.
  • the terminal is authenticated by the terminal, and the selection module is further configured to perform authentication and authorization by using the STa/SWa port to the AAA in the case that the terminal is in the 4G network, and the AAA interacts with the HSS through the SWx interface.
  • the terminal performs authentication.
  • the device further includes: an EAP module, and the method for setting the local area network-based extended authentication protocol EAP to interact with the terminal by using the WLAN AN and the AAA, where the AAA and the HLR and the HSS pass The EAP method is authenticated and the authentication and authorization process is completed.
  • the method of the EAP includes: EAP-SIM, EAP-AKA, EAP-PEAP, and EAP-TTLS.
  • the terminal identifier content includes at least one of the following: a domain name part of the terminal name field, a number segment where the international mobile subscriber identity IMSI of the terminal is located, and a medium access control MAC address of the terminal.
  • a WiFi offloading system comprising: the WiFi offload gateway WOG, the WOG receiving authentication request information of a WLAN access network gateway; the WOG according to the authentication Determining the content or format of the terminal in the request information to determine a mobile communication network in which the terminal is located; the WOG selects an interface corresponding to the mobile communication network and an authentication and authorization accounting server AAA according to the mobile communication network in which the terminal is located Performing an authentication and authorization, wherein the AAA interacts with the corresponding home location register HLR or the home subscriber server HSS according to the interface, and authenticates the terminal; if the terminal passes the authentication and authorization, the WOG passes The WLAN AN access network and the terminal perform data services.
  • the WiFi shunt gateway WOG is used to receive the authentication request information of the WLAN access network gateway of the wireless local area network; the WOG determines the mobile communication network where the terminal is located according to the content or format of the terminal identifier in the authentication request information; The mobile communication network in which the terminal is located selects an interface corresponding to the mobile communication network and an authentication and authorization charging server AAA to perform authentication and authorization, wherein the AAA interacts with the corresponding home location register HLR or the home subscriber server HSS according to the interface, The terminal performs authentication; in the case that the terminal is authenticated and authorized, the WOG performs data service through the WLAN AN access network and the terminal. It solves the problem that the authentication fails frequently when the WiFi offloading method is connected to the network in the converged network, and the authentication success rate is improved.
  • FIG. 1 is a schematic diagram of a WiFi offload architecture of a 2/3G mobile communication network in the related art
  • FIG. 2 is a schematic diagram of a WiFi offload architecture of a 4G mobile communication network in the related art
  • FIG. 3 is a flowchart of a method for WiFi offloading according to an embodiment of the present invention
  • FIG. 4 is a structural block diagram of an apparatus for WiFi offloading according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a principle of a 2/3G/4G converged network WiFi offloading method according to a preferred embodiment of the present invention
  • FIG. 6 is a schematic diagram of a WOG/TWAG module message processing flow according to a preferred embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a message processing procedure for implementing WiFi offloading in a converged network according to a preferred embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for splitting WiFi according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:
  • Step S302 the WiFi offload gateway WOG receives the authentication request information of the WLAN access network gateway of the wireless local area network
  • Step S304 the WOG determines, according to the content or format of the terminal identifier in the authentication request information, the mobile communication network where the terminal is located;
  • Step S306 the WOG selects an interface corresponding to the mobile communication network and an authentication and authorization charging server AAA to perform authentication and authorization according to the mobile communication network where the terminal is located, wherein the AAA is based on the interface and the corresponding home location register HLR or home subscriber.
  • the server HSS interacts to authenticate the terminal;
  • Step S308 in the case that the terminal passes the authentication and authorization, the WOG performs data service through the WLAN AN access network and the terminal.
  • a WLAN offload gateway (MAC Offload Gateway, abbreviated as WOG) is added to the fused network WiFi offloading architecture, and the WOG receives the authentication request information of the WLAN access network gateway of the WLAN, and the WOG is based on the terminal in the authentication request information. Determining the content or format to determine the mobile communication network in which the terminal is located.
  • the WOG selects an interface corresponding to the mobile communication network and an authentication and authorization accounting server AAA to perform authentication and authorization according to the mobile communication network in which the terminal is located, wherein the AAA is based on the AAA.
  • the interface interacts with the corresponding home location register HLR or the home subscriber server HSS to authenticate the terminal.
  • the WOG passes the authentication and authorization
  • the WOG passes the WLAN access network (WLAN Access Network, hereinafter referred to as WLAN AN for short).
  • WLAN AN WLAN Access Network
  • the terminal performs data service, and solves the problem that the prior art in the converged network cannot distinguish the communication network where the terminal is located, thereby causing the interface of the interaction and the connection authentication server to be incorrect.
  • the WiFi offloading method is online, the authentication fails frequently. The problem has improved the success rate of certification.
  • the foregoing mobile communication network may be a 2/3G network or a 4G network.
  • a corresponding interface is used, and the AAA interacts with a corresponding HLR or HSS.
  • the terminal performs authentication. For example, when the terminal is in the 2/3G network, the terminal is authenticated and authorized by using the Wa port to the AAA.
  • the 4G network interacts with the HLR through the D'/Gr' interface to authenticate the terminal; the terminal is in 4G.
  • the authentication is authorized by the STa/SWa port to the AAA, and the AAA interacts with the HSS through the SWx interface to authenticate the terminal.
  • the foregoing WOG supports an Extensible Authentication Protocol (EAP) authentication architecture defined by the Internet Engineering Task Force (IETF), and the WOG can be based on
  • EAP Extensible Authentication Protocol
  • IETF Internet Engineering Task Force
  • the EAP method interacts with the WLAN through the WLAN, the AAA, and the AAA and the HLR and the HSS are authenticated by the EAP, and the authentication and authorization process is completed.
  • the EAP-based authentication and authentication method defined by the WiFi offloading architecture specification may be implemented in various situations, for example, EAP-SIM (Subscriber Identity Module), EAP-AKA (Authentication and Key Agreement). Negotiated with the key agreement protocol, EAP-PEAP (Protected Extensible Authentication Protocol), EAP-TTLS (Tunnelled Transport Layer Security). If the WiFi offloading architecture is deployed, there is no need to modify the existing WLAN access gateway of the existing network, which reduces the operation and maintenance cost of the network.
  • EAP-SIM Subscriber Identity Module
  • EAP-AKA Authentication and Key Agreement
  • EAP-PEAP Protected Extensible Authentication Protocol
  • EAP-TTLS Transport Layer Security
  • the terminal identifier content may include at least one of the following: a domain name portion of the terminal name field, and a number segment of the international mobile subscriber identity (International Mobile Subscriber Identity, IMSI) of the terminal.
  • IMSI International Mobile Subscriber Identity
  • a device for splitting the WiFi is also provided, and the device is used to implement the foregoing embodiments and preferred embodiments, and details are not described herein.
  • the term “module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 4 is a structural block diagram of an apparatus for WiFi offloading according to an embodiment of the present invention. As shown in FIG. 4, the device is located in a WiFi offload gateway WOG, and the apparatus includes:
  • the receiving module 42 is configured to receive the authentication request information of the WLAN access network gateway of the wireless local area network;
  • the determining module 44 is configured to determine, according to the content or format of the terminal identifier in the authentication request information, the mobile communication network where the terminal is located;
  • the selecting module 46 is configured to select an interface corresponding to the mobile communication network and an authentication and authorization charging server AAA to perform authentication and authorization according to the mobile communication network where the terminal is located, wherein the AAA is based on the interface and the corresponding home location register HLR or The home subscriber server HSS interacts to authenticate the terminal;
  • the data module 48 is configured to perform data services through the WLAN AN access network and the terminal when the terminal is authenticated and authorized.
  • the GW is configured to add the WLAN offload gateway (WG) to the WLAN access network gateway, and the WOG receives the authentication request information of the WLAN access network gateway.
  • the WOG is based on the terminal in the authentication request information. Determining the content or format to determine the mobile communication network in which the terminal is located.
  • the WOG selects an interface corresponding to the mobile communication network and an authentication and authorization accounting server AAA to perform authentication and authorization according to the mobile communication network in which the terminal is located, wherein the AAA is based on the AAA.
  • the interface interacts with the corresponding home location register HLR or the home subscriber server HSS to authenticate the terminal.
  • the WOG passes the WLAN access network (WLAN Access Network, hereinafter referred to as WLAN AN for short).
  • WLAN AN WLAN Access Network
  • the terminal performs data service, and solves the problem that the prior art in the converged network cannot distinguish the communication network where the terminal is located, thereby causing the interface of the interaction and the connection authentication server to be incorrect.
  • the WiFi offloading method is online, the authentication fails frequently. The problem has improved the success rate of certification.
  • the selection module 46 in the device is further configured to perform authentication authorization using the Wa port to the AAA when the terminal is in the 2/3G network, and the AAA interacts with the HLR through the D'/Gr' interface.
  • the terminal is authenticated.
  • the selection module 46 is further configured to perform authentication and authorization by using the STa/SWa port to the AAA when the terminal is in the 4G network, and the AAA interacts with the HSS through the SWx interface to authenticate the terminal.
  • the device further includes: an EAP module, and the method for setting the extended authentication protocol EAP based on the local area network to interact with the terminal by using the WLAN AN and the AAA, wherein the AAA and the HLR and the HSS pass the EAP Certification, complete the certification and authorization process.
  • a WiFi offloading system including: a WiFi offload gateway WOG, the shunt gateway WOG includes the apparatus in the foregoing embodiment, and the WOG receives the authentication request information of the WLAN access network gateway of the wireless local area network; the WOG Determining, according to the content or format of the terminal in the authentication request information, the mobile communication network where the terminal is located; the WOG selects an interface corresponding to the mobile communication network and the authentication and authorization accounting server AAA according to the mobile communication network where the terminal is located. Authentication authorization, wherein the AAA interacts with the corresponding home location register HLR or the home subscriber server HSS according to the interface, and authenticates the terminal; if the terminal passes the authentication and authorization, the WOG passes the WLAN AN access network. Perform data services with the terminal.
  • a WiFi offload gateway WOG the shunt gateway WOG includes the apparatus in the foregoing embodiment, and the WOG receives the authentication request information of the WLAN access network gateway of the wireless local area network
  • the WOG Determining, according to the content or
  • the preferred embodiment provides a 2/3G/4G converged network in the WiFi Offload scenario, which enables the user to correctly route to the corresponding HLR/HSS, and avoids modifying the existing WLAN access network gateway device to support EAP authentication and authorization. System and method.
  • the invention can ensure that the user can correctly route to the HLR or HSS that belongs to the home under the WiFi Offload scenario of the 2/3G/4G converged network, thereby avoiding the authentication failure, thereby improving the user's online experience.
  • the method provided by the embodiment reduces the complexity and difficulty of the operation and maintenance of the existing WLAN access network gateway in the existing network. Higher engineering value.
  • FIG. 5 is a schematic diagram of a principle of a WiFi offloading method for a 2/3G/4G converged network according to a preferred embodiment of the present invention, as shown in FIG. 5.
  • a new WOG logic module is added to the converged network WiFi distribution architecture.
  • the module can be deployed independently or deployed on the WLAN access gateway or AAA of the existing network. Mainly achieve the following two major functions:
  • the 2/3G user adopts the Wa port to the AAA server for authentication and authorization, that is, the WiFi offload scenario processing mode is adopted in the 2/3G mobile communication network;
  • the 4G user adopts the STa/SWa port to the AAA server for authentication and authorization, that is, adopts 4G mobile WiFi offload scenario processing mode under the communication network.
  • WOG supports the EAP authentication architecture defined by the IETF, and supports authentication methods such as EAP-SIM, EAP-AKA, EAP-PEAP, and EAP-TTLS.
  • the WOG module After the WOG module is added, when the mobile communication network user roams into the WLAN coverage area, the WOG first distinguishes whether the user is a 2/3G user or a 4G user, and then uses the Wa port or the STa/SWa port to authenticate the authorization to the AAA server respectively, and then The AAA server routes the message from the Wa port to the HLR, and routes the message from the STa/SWa port to the HSS for authentication and authorization processing.
  • the terminal where the user is located uses the EAP-based authentication method to interact with the AAA.
  • the Trusted Wlan Acess Gateway (WOG/TWAG) module is responsible for the EAP interaction process between the wireless part and the terminal.
  • the existing WLAN access network gateway only needs to transparently transmit messages.
  • the preferred embodiment further provides a 2/3G/4G converged network in a WiFi Offload scenario, which enables the user to correctly route to the corresponding HLR/HSS, and avoids modifying the existing WLAN access network gateway device to support EAP-based authentication.
  • the system and method, the beneficial effects are reflected in:
  • the method provided by the preferred embodiment does not need to modify the existing WLAN access network gateway of the existing network to support the user's EAP-based authentication and authorization, which reduces the complexity and difficulty of operation and maintenance, and has high engineering value.
  • the method provided by the preferred embodiment can ensure that the user can correctly route to the HLR or HSS to which the user belongs, even in the WiFi Offload scenario of the 2/3G/4G converged network, to avoid authentication failure, thereby improving the user's online experience. .
  • the method provided by the preferred embodiment supplements and improves the existing standard specifications in combination with actual engineering problems, and expands the scope of use and engineering value of the specifications.
  • FIG. 6 is a schematic diagram of a WOG/TWAG module message processing flow according to a preferred embodiment of the present invention, as shown in FIG. 6.
  • Step 601 The WOG receives an authentication request message from a WLAN access network gateway.
  • Step 602 The WOG distinguishes whether the user is a 2/3G user or a 4G user according to the content or format of the user identifier (user name or MAC address, etc.) in the message;
  • Step 603 The WOG authenticates and authorizes the 2/3G user by using the Wa port to the AAA server, that is, adopts the WiFi offload scenario processing mode in the 2/3G mobile communication network;
  • Step 603' the WOG uses the STa/SWa port to authenticate the authorization of the 4G user, that is, adopts the WiFi offload scenario processing mode in the 4G mobile communication network;
  • Step 604 The WOG completes the message processing based on the Wa port with the AAA server.
  • Step 604' The WOG completes the message processing with the AAA server based on the SWa/STa port.
  • FIG. 7 is a schematic diagram of a message processing procedure for implementing WiFi offload in a converged network according to a preferred embodiment of the present invention, as shown in FIG. 7.
  • Step 701 The mobile network user UE roams or switches to the WiFi network, and after establishing the association with the WLAN AN, the UE sends an EAPoL-Start to the WOG via the WLAN AN (EAPOL is the (EAP OVER LAN) LAN-based extended authentication protocol), and initiates the authentication. Right request.
  • EAPOL is the (EAP OVER LAN) LAN-based extended authentication protocol
  • Step 702 The WOG sends an EPA request or an acknowledgment (EAP-Request/Identity) message to the WLAN UE.
  • Step 703 The UE replies to the EAP-Response/Identity message, and sends the user identity information to the network.
  • the identity identifier may be a pseudo-random network access identifier (NAI) or a permanent NAI.
  • Step 704 The WOG analyzes the user as a 2/3G user according to the content of the message, and encapsulates the EAP message by using a Remote Authentication Dial In User Service (RADIUS) Access-Request message based on the Wa interface. Identity is placed in the User-Name attribute of the RADIUS and sent to the AAA Server. Flow proceeds to step 705;
  • RADIUS Remote Authentication Dial In User Service
  • Step 704 ′ The WOG analyzes the user as a 4G user according to the content of the message, and encapsulates the EAP message using the DER (Diameter-EAP-Request) message of the Diameter protocol based on the SWa/STa port, and places the Identity in the User-Name of the DER. In the attribute, it is sent to the 3GPP AAA Server. Flow proceeds to step 705';
  • Step 705 The UE interacts with the HLR via the WLAN AN, the WOG, and the 3GPP AAA Server to successfully complete the EAP-based authentication and authorization process.
  • Step 705' The UE interacts with the HSS via the WLAN AN, the WOG, and the 3GPP AAA Server to successfully complete the EAP-based authentication and authorization process.
  • Step 706 After the UE successfully obtains the authorization information, the UE starts to use the data service through the AN through the WOG.
  • the preferred embodiment provides a 2/3G/4G converged network in a WiFi Offload scenario, which enables the user to correctly route to the corresponding HLR/HSS, and avoids modifying the existing WLAN access network gateway device to support EAP-based authentication.
  • System and method The preferred embodiment provides a 2/3G/4G converged network in a WiFi Offload scenario, which enables the user to correctly route to the corresponding HLR/HSS, and avoids modifying the existing WLAN access network gateway device to support EAP-based authentication.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. Perform the steps shown or described, or separate them into individual integrated circuit modules, or Multiple of these modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.
  • the WiFi shunt gateway WOG receives the authentication request information of the WLAN access network gateway of the wireless local area network; the WOG determines the mobile terminal according to the content or format of the terminal in the authentication request information. a communication network; the WOG selects an interface corresponding to the mobile communication network and an authentication and authorization accounting server AAA to perform authentication and authorization according to the mobile communication network where the terminal is located, and solves the problem of frequent authentication when the WiFi offloading mode is connected to the Internet in the converged network. The problem of failure has improved the success rate of certification.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了WiFi分流的方法、装置及系统，其中WiFi分流的方法通过本发明，采用WiFi分流网关WOG接收无线局域网WLAN接入网网关的认证请求信息，并根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络；该WOG根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，对该终端进行认证；在该终端通过认证授权的情况下，该WOG通过该WLAN AN接入网和该终端进行数据业务。解决了在融合网络中，WiFi分流的方式上网时，经常认证失败的问题，提高了认证成功率。

Description

WiFi分流的方法、装置及系统 技术领域
本发明涉及通信领域，具体而言，涉及一种WiFi分流的方法、装置及系统。
背景技术
WiFi分流(WiFi Offload)方案目前标准规范中对2/3G移动通信网络和4G通信网络分别定义了两种不同的实现架构。
图1是相关技术中2/3G移动通信网络WiFi分流架构示意图，如图1所示，2/3G移动通信网络WiFi分流架构：移动通信网络中的用户漫游或者切换到无线局域网(Wireless Local Area Network，简称为WLAN)网络中，经WLAN接入网(WLAN Access Network，简称为WLAN AN)与认证授权计费服务器(Authentication、Authorization、Accounting，简称为AAA)服务器间的Wa接口，向AAA服务器发起认证授权请求。AAA通过D’/Gr’接口与归属位置寄存器(Home Location Register，简称为HLR)交互，对用户进行认证。
认证通过后，HLR把用户签约信息授权给AAA，由AAA经WLAN AN授权给用户。此时，该2/3G移动通信网络用户就可以通过WLAN AN直接出局上互联网(Internet)了。用户虽然还是2/3G移动通信网络用户，但不需要使用2/3G移动通信网络的无线、有线资源进行数据业务，从而有效地分流了移动通信网络的负荷。
图2是相关技术中4G移动通信网络WiFi分流架构的示意图，如图2所示，4G移动通信网络WiFi分流架构：在4G移动通信网络中，WLAN网络作为非3GPP接入网络(Non-3GPP networks)的方式接入4G移动通信网络。当4G移动通信网络中的用户漫游或者切换到WLAN网络中，经授信/非授信的非3GPP接入网关与AAA服务器间的STa/SWa接口，向AAA服务器发起认证授权请求。AAA通过SWx接口与归属用户服务器(Home Subscriber Server，简称为HSS)交互，对用户进行认证。
认证通过后，HSS把用户签约信息授权给AAA，由AAA经授信/非授信的非3GPP接入网关授权给用户。此时，该4G移动通信网络中的用户就可以通过授信/非授信的非3GPP接入网关直接出局上Internet了。用户虽然还是4G移动通信网络用户，但不需要使用4G移动通信网络的无线、有线资源进行数据业务，从而有效地分流了移动通信网络的负荷。
以上两种场景下的分流架构，在实际的工程部署中，存在一些具体的应用问题：
标准规范分别定义了2/3G以及4G移动通信网络的WiFi分流架构，但并未定义2/3G/4G融合(本文简称这种模式为融合网络，融合后网络中既有2/3G用户的HLR设备，也有4G用户的HSS设备)下的WiFi分流架构。这样，在实际的工程部署和应用中，是存在问题的。如果一个移动通信网络用户漫游到了WLAN网络，采用WiFi分流的方式上网时，网络侧无法决定这个用户是到HLR鉴权还是到HSS鉴权，从而可能会导致用户认证失败，无法上网。
现网已有的WLAN接入网网关(例如，访问控制(Access Control,简称为AC),宽带远程接入服务器BRAS(Broadband Remote Access Server，简称为BRAS))不支持WiFi分流架构规范定义的基于可扩展身份验证协议(Extensible Authentication Protocol,简称为EAP)的认证鉴权方法，如果部署WiFi分流架构，则需要大规模对现网已有WLAN接入网网关进行改造，不符合现网运维的要求。
针对相关技术中，在融合网络中，WiFi分流的方式上网时，经常认证失败的问题，还未提出有效的解决方案。
发明内容
本发明提供了一种WiFi分流的方法、装置及系统，以至少上述问题之一。
根据本发明的一个实施例，提供了一种WiFi分流的方法，包括：WiFi分流网关WOG(WiFi Offload Gateway)接收无线局域网WLAN接入网网关的认证请求信息；所述WOG根据所述认证请求信息中的终端标示内容或者格式确定所述终端所处的移动通信网络；所述WOG根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证；在所述终端通过认证授权的情况下，所述WOG通过所述WLAN AN接入网和所述终端进行数据业务。
在本实施例中，所述WOG根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证包括：所述终端处于2/3G网络的情况下，采用Wa口到AAA进行认证授权，所述AAA通过D’/Gr’接口与所述HLR交互，对所述终端进行认证；所述终端 处于4G网络的情况下，采用STa/SWa口到AAA进行认证授权，所述AAA通过SWx接口与所述HSS交互，对所述终端进行认证。
在本实施例中，该方法还包括：所述WOG基于局域网的扩展认证协议EAP的方法通过WLAN AN、AAA与所述终端交互，其中，所述AAA与所述HLR、所述HSS通过所述EAP的方法认证，完成认证授权过程。
在本实施例中，所述EAP的方法包括：EAP-SIM、EAP-AKA、EAP-PEAP、EAP-TTLS。
在本实施例中，所述终端标示内容包括以下至少之一：终端名字段的域名部分、终端的国际移动用户识别码IMSI所在的号段、终端的介质访问控制MAC地址。
根据本发明的另一个实施例，还提供了一种WiFi分流的装置，位于WiFi分流网关WOG中，包括：
接收模块，设置为接收无线局域网WLAN接入网网关的认证请求信息；确定模块，设置为根据所述认证请求信息中的终端标示内容或者格式确定所述终端所处的移动通信网络；选择模块，设置为根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证；数据模块，设置为在所述终端通过认证授权的情况下，通过所述WLAN AN接入网和所述终端进行数据业务。
在本实施例中，所述选择模块还设置为在所述终端处于2/3G网络的情况下，采用Wa口到AAA进行认证授权，所述AAA通过D’/Gr’接口与所述HLR交互，对所述终端进行认证；所述选择模块还设置为所述终端处于4G网络的情况下，采用STa/SWa口到AAA进行认证授权，所述AAA通过SWx接口与所述HSS交互，对所述终端进行认证。
在本实施例中，该装置还包括：EAP模块，设置为基于局域网的扩展认证协议EAP的方法通过WLAN AN、AAA与所述终端交互，其中，所述AAA与所述HLR、所述HSS通过所述EAP的方法认证，完成认证授权过程。
在本实施例中，所述EAP的方法包括：EAP-SIM、EAP-AKA、EAP-PEAP、EAP-TTLS。
在本实施例中，所述终端标示内容包括以下至少之一：终端名字段的域名部分、终端的国际移动用户识别码IMSI所在的号段、终端的介质访问控制MAC地址。
根据本发明的另一个实施例，还提供了一种WiFi分流的系统，包括：上述WiFi分流网关WOG，所述WOG接收无线局域网WLAN接入网网关的认证请求信息；所述WOG根据所述认证请求信息中的终端标示内容或者格式确定所述终端所处的移动通信网络；所述WOG根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证；在所述终端通过认证授权的情况下，所述WOG通过所述WLAN AN接入网和所述终端进行数据业务。
通过本发明，采用WiFi分流网关WOG接收无线局域网WLAN接入网网关的认证请求信息；该WOG根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络；该WOG根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，该AAA根据该接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对该终端进行认证；在该终端通过认证授权的情况下，该WOG通过该WLAN AN接入网和该终端进行数据业务。解决了在融合网络中，WiFi分流的方式上网时，经常认证失败的问题，提高了认证成功率。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是相关技术中2/3G移动通信网络WiFi分流架构示意图；
图2是相关技术中4G移动通信网络WiFi分流架构的示意图；
图3是根据本发明实施例的一种WiFi分流的方法的流程图；
图4是根据本发明实施例的WiFi分流的装置的结构框图；
图5是根据本发明优选实施例的2/3G/4G融合网络WiFi分流方法原理的示意图；
图6是根据本发明优选实施例的WOG/TWAG模块消息处理流程的示意图；
图7是根据本发明优选实施例的融合网络中实现WiFi分流的消息处理流程的示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
在本实施例中提供了一种WiFi分流的方法，图3是根据本发明实施例的一种WiFi分流的方法的流程图，如图3所示，该流程包括如下步骤：
步骤S302，WiFi分流网关WOG接收无线局域网WLAN接入网网关的认证请求信息；
步骤S304，WOG根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络；
步骤S306，WOG根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，该AAA根据该接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对该终端进行认证；
步骤S308，在终端通过认证授权的情况下，该WOG通过该WLAN AN接入网和该终端进行数据业务。
通过上述步骤，在融合网络WiFi分流架构中新增WLAN分流网关(WiFi Offload Gateway，简称为WOG)，WOG接收无线局域网WLAN接入网网关的认证请求信息，该WOG根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络，该WOG根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，该AAA根据该接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对该终端进行认证，在该终端通过认证授权的情况下，该WOG通过该WLAN接入网(WLAN Access Network，简称为WLAN AN)和该终端进行数据业务，解决了现有技术在融合网络中，无法区分终端所处的是什么通信网络，从而导致交互的接口和连接认证服务器错误，WiFi分流的方式上网时，经常认证失败的问题，提高了认证成功率。
在可选的实施例中，上述的移动通信网络可以是2/3G网络，也可以是4G网络，针对不同的移动通信网络架构，采用对应的接口，AAA和对应的HLR或者HSS交互，对该终端进行认证，例如，终端处于2/3G网络的情况下，采用Wa口到AAA进行认证授权，该4G网络通过D’/Gr’接口与该HLR交互，对该终端进行认证；该终端处于4G网络的情况下，采用STa/SWa口到AAA进行认证授权，该AAA通过SWx接口与该HSS交互，对该终端进行认证。
在可选的实施例中，上述WOG支持互联网工程任务组(Internet Engineering Task Force，简称为IETF)定义的可扩展身份验证协议(Extensible Authentication Protocol，简称为EAP)的鉴权架构，该WOG可以基于EAP的方法通过WLAN AN、AAA与该端交互，其中，该AAA与该HLR、该HSS通过该EAP的方法认证，完成认证授权过程。
在本实施例中，支持WiFi分流架构规范定义的基于EAP的认证鉴权方法可以有多种情况，例如，EAP-SIM(Subscriber Identity Module客户识别模块)、EAP-AKA(Authentication and Key Agreement，认证与密钥协商协议)、EAP-PEAP(Protected Extensible Authentication Protocol，受保护的可扩展的身份验证协议)、EAP-TTLS(Tunnelled transport Layer Security，基于隧道的传输层安全)。如果部署WiFi分流架构，就不需要对现网已有WLAN接入网网关进行改造，降低了网络的运维成本。
在本实施例中，该终端标示内容可以包括以下至少之一：终端名字段的域名部分、终端的国际移动用户识别码国际移动用户识别码(International Mobile Subscriber Identity，简称为IMSI)所在的号段、终端的介质访问控制地址((Media Access Control，简称为MAC)。
在本实施例中还提供了一种WiFi分流的装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图4是根据本发明实施例的WiFi分流的装置的结构框图，如图4所示，位于WiFi分流网关WOG中，该装置包括：
接收模块42，设置为接收无线局域网WLAN接入网网关的认证请求信息；
确定模块44，设置为根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络；
选择模块46，设置为根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，该AAA根据该接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对该终端进行认证；
数据模块48，设置为在该终端通过认证授权的情况下，通过该WLAN AN接入网和该终端进行数据业务。
通过上述装置，在融合网络WiFi分流架构中新增WLAN分流网关(Wlan Offload Gateway，简称为WOG)，WOG接收无线局域网WLAN接入网网关的认证请求信息，该WOG根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络，该WOG根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，该AAA根据该接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对该终端进行认证，在该终端通过认证授权的情况下，该WOG通过该WLAN接入网(WLAN Access Network，简称为WLAN AN)和该终端进行数据业务，解决了现有技术在融合网络中，无法区分终端所处的是什么通信网络，从而导致交互的接口和连接认证服务器错误，WiFi分流的方式上网时，经常认证失败的问题，提高了认证成功率。
在本实施例中，该装置中的选择模块46还设置为在该终端处于2/3G网络的情况下，采用Wa口到AAA进行认证授权，该AAA通过D’/Gr’接口与该HLR交互，对该终端进行认证；该选择模块46还设置为该终端处于4G网络的情况下，采用STa/SWa口到AAA进行认证授权，该AAA通过SWx接口与该HSS交互，对该终端进行认证。
在本实施例中，该装置还包括：EAP模块，设置为基于局域网的扩展认证协议EAP的方法通过WLAN AN、AAA与该终端交互，其中，该AAA与该HLR、该HSS通过该EAP的方法认证，完成认证授权过程。
在本实施例中，还有一种WiFi分流的系统，包括：WiFi分流网关WOG，该分流网关WOG包括上述实施例中的装置，该WOG接收无线局域网WLAN接入网网关的认证请求信息；该WOG根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络；该WOG根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，该AAA根据该接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对该终端进行认证；在该终端通过认证授权的情况下，该WOG通过该WLAN AN接入网和该终端进行数据业务。
下面结合优选实施例和实施方式对本发明进行详细说明。
本优选实施例提供一种2/3G/4G融合网络WiFi Offload场景下，实现用户正确路由到对应HLR/HSS，并避免对现网WLAN接入网网关设备进行改造就可以支持基于EAP认证授权的系统及方法。
通过本发明，能够保证用户在即使在2/3G/4G融合网络WiFi Offload场景下，也能正确路由到自己归属的HLR或者HSS，避免认证失败，从而改善了用户的上网体验。同时，通过实施例提供的方法，在WiFi Offload时，将不再需要对现网已有WLAN接入网网关进行改造才能支持用户基于EAP的认证授权，降低了运维的复杂度和难度，有较高的工程价值。
图5是根据本发明优选实施例的2/3G/4G融合网络WiFi分流方法原理的示意图，如图5所示。
融合网络WiFi分流架构中新增WOG逻辑模块，该模块可以独立部署，也可以部署在现网的WLAN接入网关或者AAA上。主要实现如下两大功能：
1)根据从WLAN接入网网关收到的消息中的用户标示内容或者格式，区分用户是2/3G用户还是4G用户,例如通过用户名字段的域名部分，或者用户的IMSI国际移动用户识别码所在号段等方式进行区分。然后对2/3G用户采用Wa口到AAA服务器进行认证授权，即采用2/3G移动通信网络下WiFi分流场景处理模式；对4G用户采用STa/SWa口到AAA服务器进行认证授权，即采用4G移动通信网络下WiFi分流场景处理模式。
2)WOG支持IETF定义的EAP的鉴权架构，支持EAP-SIM、EAP-AKA、EAP-PEAP、EAP-TTLS等鉴权方法。
增加WOG模块后，移动通信网络用户漫游到WLAN覆盖区域接入时，首先由WOG区分用户是2/3G用户还是4G用户，然后分别采用Wa口或者STa/SWa口到AAA服务器进行认证授权，然后AAA服务器对来自Wa口的消息路由到HLR，对来自STa/SWa口的消息路由到HSS进行认证授权处理。
在认证授权处理过程中，用户所在的终端采用基于EAP的鉴权方法与AAA交互，由WOG/TWAG(Trusted Wlan Acess Gateway,受信任的WLAN接入网关)模块负责无线部分与终端的EAP交互流程，现网WLAN接入网网关仅需要透传消息即可。
本优选实施例还提供一种2/3G/4G融合网络WiFi Offload场景下，实现用户正确路由到对应HLR/HSS，并避免对现网WLAN接入网网关设备进行改造就可以支持基于EAP认证授权的系统及方法，有益效果体现在：
1)本优选实施例提供的方法不需要对现网已有WLAN接入网网关进行改造才能支持用户基于EAP的认证授权，降低了运维的复杂度和难度，有较高的工程价值。
2)本优选实施例提供的方法能够保证用户在即使在2/3G/4G融合网络WiFi Offload场景下，也能正确路由到自己归属的HLR或者HSS，避免认证失败，从而改善了用户的上网体验。
3)本优选实施例提供的方法是结合实际工程问题对现有标准规范的补充和完善，扩展了规范的使用范围和工程价值。
本优选实施例提出的在2/3G/4G融合网络WiFi Offload场景下，实现用户正确路由到对应HLR/HSS，并避免对现网WLAN接入网网关设备进行改造就可以支持基于EAP认证授权的系统及方法的具体实施步骤如下：
图6是根据本发明优选实施例的WOG/TWAG模块消息处理流程的示意图，如图6所示。
步骤601：WOG接受到来自WLAN接入网网关的认证请求消息；
步骤602：WOG根据消息中的用户标示(用户名或者MAC地址等)内容或者格式，区分用户是2/3G用户还是4G用户；
步骤603：WOG对2/3G用户采用Wa口到AAA服务器进行认证授权，即采用2/3G移动通信网络下WiFi分流场景处理模式；
步骤603’：WOG对4G用户采用STa/SWa口到AAA服务器进行认证授权，即采用4G移动通信网络下WiFi分流场景处理模式；
步骤604：WOG完成后继与AAA服务器基于Wa口的消息处理；
步骤604’：WOG完成后继与AAA服务器基于SWa/STa口的消息处理。
图7是根据本发明优选实施例的融合网络中实现WiFi分流的消息处理流程的示意图，如图7所示。
步骤701：移动网络用户UE漫游或者切换到WiFi网络，和WLAN AN建立关联之后，UE向经WLAN AN向WOG发送EAPoL-Start(EAPOL就是(EAP OVER LAN)基于局域网的扩展认证协议)，发起鉴权请求。
步骤702：WOG发送EPA请求或者确认(EAP-Request/Identity)消息到WLAN UE。
步骤703：UE回复EAP-Response/Identity消息，向网络发送其用户身份标识信息，身份标识可以为伪随机网络接入标识符(Network Access Identifier，简称为NAI)或永久NAI。
步骤704：WOG根据消息内容，分析用户为2/3G用户，基于Wa口，将EAP报文使用远程用户拨号认证系统(Remote Authentication Dial In User Service，简称为RADIUS)Access-Request消息封装，并将Identity放在RADIUS的User-Name属性中，发送给AAA Server。流程转步骤705；
步骤704’：WOG根据消息内容，分析用户为4G用户，基于SWa/STa口，将EAP报文使用Diameter协议的DER(Diameter-EAP-Request)消息封装，并将Identity放在DER的User-Name属性中，发送给3GPP AAA Server。流程转步骤705’；
步骤705:UE经由WLAN AN、WOG、3GPP AAA Server与HLR交互，成功完成基于EAP的认证授权过程。
步骤705’:UE经由WLAN AN、WOG、3GPP AAA Server与HSS交互，成功完成基于EAP的认证授权过程。
步骤706:UE在认证成功获取授权信息后，通过AN经WOG直接出局开始使用数据业务。
本优选实施例，提供一种2/3G/4G融合网络WiFi Offload场景下，实现用户正确路由到对应HLR/HSS，并避免对现网WLAN接入网网关设备进行改造就可以支持基于EAP认证授权的系统及方法。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将 它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
基于本发明实施例提供的上述技术方案，通过WiFi分流网关WOG接收无线局域网WLAN接入网网关的认证请求信息；该WOG根据该认证请求信息中的终端标示内容或者格式确定该终端所处的移动通信网络；该WOG根据该终端所处的移动通信网络，选择该移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，解决了在融合网络中，WiFi分流的方式上网时，经常认证失败的问题，提高了认证成功率。

Claims (11)

  1. 一种WiFi分流的方法，包括：
    WiFi分流网关WOG接收无线局域网WLAN接入网网关的认证请求信息；
    所述WOG根据所述认证请求信息中的终端标示内容或者格式确定所述终端所处的移动通信网络；
    所述WOG根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证；
    在所述终端通过认证授权的情况下，所述WOG通过所述WLAN AN接入网和所述终端进行数据业务。
  2. 根据权利要求1所述的方法，其中，所述WOG根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证包括：
    所述终端处于2/3G网络的情况下，采用Wa口到AAA进行认证授权，所述AAA通过D’/Gr’接口与所述HLR交互，对所述终端进行认证；
    所述终端处于4G网络的情况下，采用STa/SWa口到AAA进行认证授权，所述AAA通过SWx接口与所述HSS交互，对所述终端进行认证。
  3. 根据权利要求1所述的方法，其中，该方法还包括：
    所述WOG基于局域网的扩展认证协议EAP的方法通过WLAN AN、AAA与所述终端交互，其中，所述AAA与所述HLR、所述HSS通过所述EAP的方法认证，完成认证授权过程。
  4. 根据权利要求3所述的方法，其中，所述EAP的方法包括：EAP-SIM、EAP-AKA、EAP-PEAP、EAP-TTLS。
  5. 根据权利要求1至4任一项所述的方法，其中，包括：
    所述终端标示内容包括以下至少之一：终端名字段的域名部分、终端的国际移动用户识别码IMSI所在的号段、终端的介质访问控制MAC地址。
  6. 一种WiFi分流的装置，位于WiFi分流网关WOG中，包括：
    接收模块，设置为接收无线局域网WLAN接入网网关的认证请求信息；
    确定模块，设置为根据所述认证请求信息中的终端标示内容或者格式确定所述终端所处的移动通信网络；
    选择模块，设置为根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证；
    数据模块，设置为在所述终端通过认证授权的情况下，通过所述WLANAN接入网和所述终端进行数据业务。
  7. 根据权利要求6所述的装置，其中，包括：
    所述选择模块还设置为在所述终端处于2/3G网络的情况下，采用Wa口到AAA进行认证授权，所述AAA通过D’/Gr’接口与所述HLR交互，对所述终端进行认证；
    所述选择模块还设置为所述终端处于4G网络的情况下，采用STa/SWa口到AAA进行认证授权，所述AAA通过SWx接口与所述HSS交互，对所述终端进行认证。
  8. 根据权利要求6所述的装置，其中，该装置还包括：
    EAP模块，设置为基于局域网的扩展认证协议EAP的方法通过WLAN AN、AAA与所述终端交互，其中，所述AAA与所述HLR、所述HSS通过所述EAP的方法认证，完成认证授权过程。
  9. 根据权利要求8所述的装置，其中，所述EAP的方法包括：EAP-SIM、EAP-AKA、EAP-PEAP、EAP-TTLS。
  10. 根据权利要求6至9任一项所述的装置，其中，包括：
    所述终端标示内容包括以下至少之一：终端名字段的域名部分、终端的国际移动用户识别码IMSI所在的号段、终端的介质访问控制MAC地址。
  11. 一种WiFi分流的系统，包括：
    WiFi分流网关WOG，所述分流网关WOG至少包括权利要求6至10的一个装置；
    所述WOG接收无线局域网WLAN接入网网关的认证请求信息；
    所述WOG根据所述认证请求信息中的终端标示内容或者格式确定所述终端所处的移动通信网络；
    所述WOG根据所述终端所处的移动通信网络，选择所述移动通信网络对应的接口和认证授权计费服务器AAA进行认证授权，其中，所述AAA根据所述接口和对应的归属位置寄存器HLR或者归属用户服务器HSS进行交互，对所述终端进行认证；
    在所述终端通过认证授权的情况下，所述WOG通过所述WLAN AN接入网和所述终端进行数据业务。
PCT/CN2015/076101 2014-10-30 2015-04-08 WiFi分流的方法、装置及系统 WO2016065847A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410604281.1 2014-10-30
CN201410604281.1A CN105554748A (zh) 2014-10-30 2014-10-30 WiFi分流的方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2016065847A1 true WO2016065847A1 (zh) 2016-05-06

Family

ID=55833635

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/076101 WO2016065847A1 (zh) 2014-10-30 2015-04-08 WiFi分流的方法、装置及系统

Country Status (2)

Country Link
CN (1) CN105554748A (zh)
WO (1) WO2016065847A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108934058B (zh) * 2017-05-25 2020-11-27 华为技术有限公司 一种通信方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102857971A (zh) * 2011-06-30 2013-01-02 华为技术有限公司 用于数据传输的方法、分流点设备、用户终端及其系统
CN103139754A (zh) * 2011-12-02 2013-06-05 中国移动通信集团上海有限公司 一种网络附着的方法、装置及系统
CN103338483A (zh) * 2013-07-24 2013-10-02 成都西加云杉科技有限公司 数据分流方法、数据分流设备及异构网络
US20130265985A1 (en) * 2012-04-10 2013-10-10 Motorola Mobility, Inc. Wireless communication device, communication system and method for establishing data connectivity between a wireless communicaiton device and a first access network
CN103517339A (zh) * 2012-06-15 2014-01-15 中国移动通信集团湖南有限公司 利用wlan实现数据流量分流的系统、设备和方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101730073B (zh) * 2009-06-09 2012-07-18 中兴通讯股份有限公司 一种获取用户签约数据的方法及系统
CN103796246A (zh) * 2012-10-31 2014-05-14 中兴通讯股份有限公司 数据的分流方法、装置及系统
CN103415044B (zh) * 2013-08-05 2016-04-20 南京邮电大学 一种WLAN网络中3GPP用户获取QoS签约的方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102857971A (zh) * 2011-06-30 2013-01-02 华为技术有限公司 用于数据传输的方法、分流点设备、用户终端及其系统
CN103139754A (zh) * 2011-12-02 2013-06-05 中国移动通信集团上海有限公司 一种网络附着的方法、装置及系统
US20130265985A1 (en) * 2012-04-10 2013-10-10 Motorola Mobility, Inc. Wireless communication device, communication system and method for establishing data connectivity between a wireless communicaiton device and a first access network
CN103517339A (zh) * 2012-06-15 2014-01-15 中国移动通信集团湖南有限公司 利用wlan实现数据流量分流的系统、设备和方法
CN103338483A (zh) * 2013-07-24 2013-10-02 成都西加云杉科技有限公司 数据分流方法、数据分流设备及异构网络

Also Published As

Publication number Publication date
CN105554748A (zh) 2016-05-04

Similar Documents

Publication Publication Date Title
US10904751B2 (en) System and method for using credentials of a first client station to establish a connection between a network and a second client station
US9716999B2 (en) Method of and system for utilizing a first network authentication result for a second network
EP1597866B1 (en) Fast re-authentication with dynamic credentials
US8122249B2 (en) Method and arrangement for providing a wireless mesh network
US8769647B2 (en) Method and system for accessing 3rd generation network
US10425448B2 (en) End-to-end data protection
EP1693995B1 (en) A method for implementing access authentication of wlan user
US9226153B2 (en) Integrated IP tunnel and authentication protocol based on expanded proxy mobile IP
KR101068424B1 (ko) 통신시스템을 위한 상호동작 기능
KR102390380B1 (ko) 비인증 사용자에 대한 3gpp 진화된 패킷 코어로의 wlan 액세스를 통한 긴급 서비스의 지원
US20080026724A1 (en) Method for wireless local area network user set-up session connection and authentication, authorization and accounting server
KR20210024654A (ko) 이종 액세스 네트워크를 통한 연결의 보안 실현을 위한 방법 및 장치
EP1770940A1 (en) Method and apparatus for establishing a communication between a mobile device and a network
US20070143613A1 (en) Prioritized network access for wireless access networks
JP2018523418A (ja) セルラーアクセスネットワークノードのための識別子を含むネットワークアクセス識別子
WO2009152749A1 (zh) 一种绑定认证的方法、系统和装置
US11490252B2 (en) Protecting WLCP message exchange between TWAG and UE
US20060046693A1 (en) Wireless local area network (WLAN) authentication method, WLAN client and WLAN service node (WSN)
WO2011127774A1 (zh) 一种用户终端接入互联网方式的控制方法及装置
KR20230124621A (ko) 비-3gpp 서비스 액세스를 위한 ue 인증 방법 및 시스템
WO2016065847A1 (zh) WiFi分流的方法、装置及系统
WO2017129101A1 (zh) 路由控制方法、装置及系统
WO2023193214A1 (en) Network relay security
CN106612205B (zh) 一种节点认证方法、系统及代理节点
WO2015165190A1 (zh) 用户在线状态的处理方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15855361

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15855361

Country of ref document: EP

Kind code of ref document: A1