WO2016177223A1 - 核心网的接入控制方法及装置 - Google Patents

核心网的接入控制方法及装置 Download PDF

Info

Publication number
WO2016177223A1
WO2016177223A1 PCT/CN2016/078132 CN2016078132W WO2016177223A1 WO 2016177223 A1 WO2016177223 A1 WO 2016177223A1 CN 2016078132 W CN2016078132 W CN 2016078132W WO 2016177223 A1 WO2016177223 A1 WO 2016177223A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
core network
network
information
terminal
Prior art date
Application number
PCT/CN2016/078132
Other languages
English (en)
French (fr)
Inventor
周俊超
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016177223A1 publication Critical patent/WO2016177223A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/04—Access restriction performed under specific conditions based on user or terminal location or mobility data, e.g. moving direction, speed

Definitions

  • the present application relates to the field of mobile communications, for example, to an access control method and apparatus for a core network.
  • the access network is responsible for the access of the terminal, and the core network is responsible for the processing of the service, and the terminal can access the core network for service interaction through the access network.
  • the 3GPP (3rd Generation Partnership Project) standard organization defines that the terminal can access the core network of the 4G mobile communication network in a trusted or untrusted manner through the non-3GPP network.
  • the non-3GPP network includes a WLAN (Wireless Local Area Network), an eHRPD (Evolved High Rate Packet Data), and the like.
  • the core network server can authenticate the terminal through the subscription information to control whether the terminal is allowed to access the core network.
  • the core network server cannot limit the terminal. Therefore, when accessing the core network through the non-3GPP access network, the core network server cannot perform regional restrictions on the terminal requesting access, and the problem in this aspect needs to be solved urgently.
  • the embodiment of the invention solves the problem that the core network server cannot perform regional restrictions on the terminal that requests access when accessing the core network through the non-3GPP access network.
  • An embodiment of the present invention provides a method for controlling access of a core network, including:
  • the core network server receives terminal access from the non-3rd Generation Partnership Project 3GPP access network. begging;
  • the terminal is not allowed to access the core network.
  • the access network information is address information of the non-3GPP access network; and the core network server acquires access network information of the non-3GPP access network according to the access request, and Verifying the access network information according to a preset control policy, including:
  • the core network server parses the access request, and obtains address information of the non-3GPP access network
  • the core network server determines, according to the control policy, whether to allow access to the core network from the obtained address information
  • the access network information is name information of the non-3GPP access network; and the core network server acquires access network information of the non-3GPP access network according to the access request, and Verifying the access network information according to a preset control policy, including:
  • the core network server parses the access request, and obtains name information of the non-3GPP access network
  • the core network server determines, according to the control policy, whether to allow access to the core network by using the obtained name information
  • the step of obtaining, by the core network server, the access network information of the non-3GPP access network according to the access request, and verifying the access network information according to a preset control policy Also includes:
  • the terminal If the verification is passed, the terminal is authenticated, and the terminal is allowed to access the core network according to the identity authentication result.
  • the method before the core network server receives the terminal access request from the non-3GPP access network, the method further includes:
  • the core network server configures a preset control policy to verify the access network information according to the control policy.
  • an embodiment of the present invention further provides an access control apparatus for a core network, including:
  • a receiving module configured to receive a terminal access request from a non-3GPP access network
  • the verification module is configured to acquire the access network information of the non-3GPP access network according to the access request, and verify the access network information according to a preset control policy;
  • the authorization module is configured to not allow the terminal to access the core network if the verification fails.
  • the access network information is address information of the non-3GPP access network; and the verification module includes: a first parsing unit, a first judging unit, and a first determining unit;
  • the first parsing unit is configured to parse the access request, and obtain address information of the non-3GPP access network
  • the first determining unit is configured to determine, according to the control policy, whether to allow access to the core network from the acquired address information;
  • the first determining unit is configured to, if permitted, determine that the address information passes verification
  • the first determining unit is further configured to determine that the address information fails the verification if not allowed.
  • the access network information is name information of the non-3GPP access network; and the verification module includes: a second parsing unit, a second judging unit, and a second determining unit;
  • the second parsing unit is configured to parse the access request, and obtain name information of the non-3GPP access network
  • the second determining unit is configured to determine, according to the control policy, whether to allow access to the core network by using the obtained name information
  • the second determining unit is configured to, if permitted, determine that the name information is verified
  • the second determining unit is further configured to determine that the name information fails the verification if not allowed.
  • the authorization module is further configured to identify the terminal if the verification succeeds And determining, according to the authentication result, whether the terminal is allowed to access the core network.
  • the access control device of the core network further includes: a configuration module
  • the configuration module is configured to configure a preset control policy to verify the access network information according to the control policy before the core network server receives the terminal access request from the non-3GPP access network.
  • an embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions for performing the above method.
  • embodiments of the present invention also provide an apparatus including one or more processors, a memory, and one or more programs, the one or more programs being stored in a memory when being processed by one or more processors When executed, perform the above method.
  • the core network server verifies the access network information of the terminal according to the preset control policy, to determine whether the non-3GPP access network of the terminal is in the If the non-3GPP access network of the terminal is in the restricted access area of the core network, the core network server does not allow the terminal to pass the non-3GPP connection in the allowed access area of the core network.
  • the access network accesses the core network, so that the terminal cannot access the core network by restricting the non-3GPP access network in the access area, thereby effectively solving the problem that the core network server cannot perform regional restrictions on the terminal that requests access.
  • FIG. 1 is a schematic flowchart of a first embodiment of an access control method of a core network according to the present invention
  • FIG. 2 is a schematic flowchart of a second embodiment of an access control method of a core network according to the present invention
  • FIG. 3 is a schematic flowchart of a third embodiment of an access control method of a core network according to the present invention.
  • FIG. 4 is a schematic diagram of functional modules of a first embodiment of an access control apparatus of a core network according to the present invention
  • FIG. 5 is a schematic diagram of functional modules of a second embodiment of an access control apparatus of a core network according to the present invention.
  • FIG. 6 is a schematic diagram of functional modules of a third embodiment of an access control apparatus of a core network according to the present invention.
  • FIG. 7 is a schematic structural diagram of hardware of a device according to an embodiment of the present invention.
  • the area that the terminal requests to access the 4G core network may be the home area, or the roaming area that is restricted by the 4G core network.
  • the 4G core network server allows The terminal accesses the 4G core network through the WLAN or the eHRPD network.
  • the terminal accesses the 4G core network through the WLAN or the eHRPD in the home area, the terminal is allowed to access the 4G core network through the WLAN or the eHRPD in the roaming area where the access is restricted.
  • the 4G network core server lacks effective control over the access of the terminal. .
  • an embodiment of the present invention provides an access control method for a core network.
  • FIG. 1 is a schematic flowchart diagram of a first embodiment of a method for controlling a core network server according to an embodiment of the present invention.
  • the method for controlling the core network server includes:
  • Step S10 The core network server receives a terminal access request from a non-3rd Generation Partnership Project 3GPP access network;
  • the core network server receives the terminal access request from the non-3GPP access network.
  • the terminal may be, but is not limited to, any one of the following: a mobile phone, a smart phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet), a PMP (Portable Multimedia Player), and a navigation device.
  • the core network server may be an authentication and authorization accounting server in the core network.
  • the 3GPP AAA server authentication authorization charging server
  • the 4G core network receives the terminal access request from the non-3GPP access network.
  • Step S20 The core network server acquires access network information of the non-3GPP access network according to the access request, and verifies the access network information according to a preset control policy.
  • the terminal When the terminal accesses the core network through the non-3GPP access network, the terminal sends an access request to the core network server through the non-3GPP access network, where the access request carries the access network information of the non-3GPP access network.
  • the core network server acquires the access request according to the access request. Assessing the access network information of the non-3GPP access network carried in the request, and verifying the access network information according to a preset control policy, to determine whether the non-3GPP access network is in the corresponding allowed access area .
  • the 4G core network server obtains the access network information of the non-3GPP access network according to the received terminal access request sent by the non-3GPP access network, and performs the connection according to the control policy in the 4G core network server.
  • the network access information is verified to determine whether the terminal is allowed to access the 4G core network through the non-3GPP access network.
  • the access network information may be the identification information of the non-3GPP access network, for example, when accessing the 4G core network through the non-3GPP access network, the access network information may be an WLAN IP address, an eHRPD network.
  • the access identifier the SSID (Service Set Identifier) of the WLAN, or the APN (Access Point Name) of the eHRPD network.
  • the control policy may be an address-based roaming control policy, such as allowing or denying access to the core from the address based on address information of the non-3GPP access network (eg, an IP address of the WLAN or an access indication of the eHRPD network).
  • the roaming control policy of the network; or the control policy may also be a name-based roaming control policy, such as allowing or denying the configuration based on the name information of the non-3GPP access network (such as the SSID of the WLAN or the APN of the eHRPD network)
  • the non-3GPP access network name is used to access the roaming control policy of the core network.
  • the preset control policy may be configured by the core network server to verify the access network information of the non-3GPP access network according to the control policy.
  • the preset control policy may be saved in the roaming policy configuration table of the core network server, and the saved control policy is maintained and updated through the roaming configuration policy table.
  • Step S30 If the verification fails, the terminal is not allowed to access the core network.
  • the terminal If the core network server fails to verify the access network information of the non-3GPP access network, and determines that the non-3GPP access network is in the restricted access area of the core network, the terminal is not allowed to pass the The non-3GPP access network accesses the corresponding core network. For example, if the 4G core network server fails to verify the access network information of the non-3GPP access network, that is, the non-3GPP access network is in the restricted access area of the 4G core network, the core network server does not allow the The terminal accesses the 4G core network through the non-3GPP access network in the restricted access area, and returns a response to the terminal.
  • the core network server performs identity authentication on the terminal, and determines, according to the identity authentication result, whether the terminal is allowed to access the core network.
  • the core network server verifies the access network information sent by the non-3GPP access network, and determines that the non-3GPP access network is within the allowed access area of the core network
  • the core network server pairs the terminal Performing identity authentication, and determining, according to the identity authentication result, whether the terminal is allowed to access the core network; if the identity authentication is passed, allowing the terminal to access the core network; if the identity authentication fails, the The terminal accesses the core network.
  • the 4G core network server verifies the access network information sent by the non-3GPP access network, and determines that the terminal that sends the access request through the non-3GPP access network is within the allowed access area of the 4G core network.
  • the terminal is authenticated by the HSS (Home Subscriber Server) of the 4G core network, and the terminal is allowed to access the 4G core network according to the identity authentication result; if the identity authentication is passed, the permission is allowed.
  • the terminal accesses the 4G core network; if the identity authentication fails, the terminal is not allowed to access the 4G core network.
  • the core network server verifies the access network information sent by the terminal through the non-3GPP access network according to the preset control policy, to verify the non-3GPP connection. Whether the network access is in the allowed access area of the core network, and if the verification fails, the core network server determines that the non-3GPP access network is in the restricted access area of the core network, and the core network server does not allow the terminal to pass the The non-3GPP access network accesses the core network, so that the terminal cannot access the core network by restricting the non-3GPP access network in the access area, thereby effectively solving the problem that the core network server cannot perform regional restrictions on the terminal that requests access.
  • FIG. 2 is a schematic flowchart diagram of a second embodiment of an access control method for a core network according to an embodiment of the present invention. Based on the first embodiment of the foregoing access control method of the core network, the step S20 may include:
  • Step S201 the core network server parses the access request, and obtains address information of the non-3GPP access network.
  • Step S202 the core network server determines, according to the control policy, whether to allow obtaining from the obtained Address accessing the core network;
  • Step S203 if allowed, determining that the address information passes verification
  • Step S204 if not allowed, it is determined that the address information has not passed the verification.
  • the core network server parses the access request sent by the terminal through the non-3GPP access network to obtain address information of the non-3GPP access network; and the core network server determines, according to the saved control policy, whether Allowing access to the core network from the obtained address; if access to the core network is allowed from the obtained address, determining that the address information is verified; if accessing the core network from the acquired address is not allowed And determining that the address information has not passed the verification.
  • the 4G core network server receives the terminal access request from the non-3GPP access network, and parses the access request to obtain the address information of the non-3GPP access network carried by the access request (for example, WLAN).
  • the IP address or the access indication of the eHRPD network, and the like; the 4G core network server reads the roaming control policy through the local roaming policy configuration table, and determines whether the terminal is allowed to access the 4G from the obtained address according to the roaming control policy.
  • the core network if the address information (such as an IP address or an access indication) is in the allowed access area of the 4G core network, allows the terminal to access the 4G core network from the obtained address, and the 4G core network server determines the address information. If the address (such as an IP address or an access indication) is in the restricted access area of the 4G core network, the terminal is not allowed to access the 4G core network from the obtained address, and the 4G core network server determines the address information. Did not pass verification.
  • the core network server when the terminal accesses the core network through the non-3GPP access network, the core network server obtains the address information of the non-3GPP access network according to the received access request, and verifies whether the terminal is allowed according to the preset control policy. Accessing the core network by using the obtained address, if the verification fails, the core network server determines that the non-3GPP access network is in the restricted access area of the core network, and does not allow the terminal to pass the non-3GPP access network. The access to the core network prevents the terminal from accessing the core network through the non-3GPP access network in the access area, which effectively solves the problem that the core network server cannot perform regional restrictions on the terminal that requests access.
  • FIG. 3 is a schematic flowchart diagram of a third embodiment of an access control method for a core network according to an embodiment of the present invention.
  • the step S20 may include include:
  • Step S211 the core network server parses the access request, and obtains name information of the non-3GPP access network
  • Step S212 the core network server determines, according to the control policy, whether to allow access to the core network by using the obtained name
  • Step S214 if not allowed, it is determined that the name information has not passed the verification.
  • the core network server parses the access request sent by the terminal through the non-3GPP access network to obtain the name information of the non-3GPP access network; the core network server determines, according to the saved control policy, whether Allowing access to the core network using the obtained name; if the obtained core name is allowed to access the core network, determining that the name information is verified; if the obtained name is not allowed to access the core network , it is determined that the name information has not passed the verification.
  • the 4G core network server receives the terminal access request from the non-3GPP access network, and parses the access request to obtain the name information of the non-3GPP access network carried in the access request (for example, the SSID of the WLAN). Or the information of the APN and the like of the eHRPD network; the 4G core network server reads the roaming control policy through the local roaming policy configuration table, and determines, according to the roaming control policy, whether the terminal is allowed to access the 4G core network by using the obtained name, if The name information (such as the SSID of the WLAN or the APN of the eHRPD network) is allowed in the allowed access area of the 4G core network, and the name information is allowed to pass the verification; if the name information (such as the SSID of the WLAN or the APN of the eHRPD network) In the restricted access area of the 4G core network, it is not allowed, and it is determined that the name information has not passed the verification.
  • the name information such as the SSID of the WLAN or the A
  • the core network server when the terminal accesses the core network through the non-3GPP access network, the core network server obtains the name information of the non-3GPP access network according to the received access request (transmitted by the terminal through the 3GPP access network), and Verifying, according to the preset roaming control policy, whether to allow access to the core network by using the obtained name. If the verification fails, the core network server determines that the non-3GPP access network is in the restricted access area of the core network, The terminal is allowed to access the core network through the non-3GPP access network, so that the terminal cannot access the core network by restricting the non-3GPP access network in the access area, thereby effectively solving the problem that the core network server cannot perform the request to access the terminal. Regional restrictions.
  • the execution entities of the access control method of the core network of the foregoing first to third embodiments may each be a control device in a core network server or a core network server.
  • the access control method of the core network may be implemented by a control program installed on a control device in a core network server or a core network server.
  • FIG. 4 is a schematic diagram of functional modules of a first embodiment of an access control apparatus for a core network according to an embodiment of the present invention.
  • the access control device of the core network includes: a receiving module 10, a verification module 20, and an authorization module 30.
  • the receiving module 10 is configured to receive a terminal access request from a non-3GPP access network
  • the core network server receives the terminal access request from the non-3GPP access network.
  • the terminal may be, but is not limited to, any one of the following: a mobile phone, a smart phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet), a PMP (Portable Multimedia Player), and a navigation device.
  • the core network server may be an authentication and authorization accounting server in the core network.
  • the 3GPP AAA server authentication authorization charging server
  • the 4G core network receives the terminal access request from the non-3GPP access network.
  • the verification module 20 is configured to acquire access network information of the non-3GPP access network according to the access request, and verify the access network information according to a preset control policy;
  • the terminal When the terminal accesses the core network through the non-3GPP access network, the terminal sends an access request to the core network server through the non-3GPP access network, where the access request carries the access network information of the non-3GPP access network.
  • the core network server acquires access network information of the non-3GPP access network carried in the access request according to the access request, and performs the foregoing according to a preset control policy.
  • the access network information is verified to determine whether the non-3GPP access network is in the corresponding allowed access area.
  • the 4G core network server obtains the access network information of the non-3GPP access network according to the received terminal access request sent by the non-3GPP access network, and performs the connection according to the control policy in the 4G core network server.
  • the network access information is verified to determine whether the terminal is allowed to access the 4G core network through the non-3GPP access network.
  • the access network information may be the identification information of the non-3GPP access network, for example, when accessing the 4G core network through the non-3GPP access network, the access network information may be an WLAN IP address, an eHRPD network.
  • the access identifier the SSID (Service Set Identifier) of the WLAN, or the APN (Access Point Name) of the eHRPD network.
  • the control policy may be an address-based roaming control policy, such as allowing or denying access from the address based on address information of the non-3GPP access network (eg, an IP address of the WLAN network or an access indication of the eHRPD network).
  • the roaming control policy of the core network; or the control policy may also be a name-based roaming control policy, for example, based on the name information of the non-3GPP access network (such as the SSID of the WLAN or the APN of the eHRPD network), or The roaming control policy of accessing the core network by using the non-3GPP access network name is refused.
  • the access control device of the core network may further include a configuration module, where the configuration module is configured to configure a preset before the core network server receives the terminal access request from the non-3GPP access network. Controlling a policy to verify access network information according to the control policy.
  • the preset control policy may be saved in the roaming policy configuration table of the core network server, and the saved control policy is maintained and updated through the roaming configuration policy table.
  • the authorization module 30 is configured to not allow the terminal to access the core network if the verification fails.
  • the terminal If the core network server fails to verify the access network information of the non-3GPP access network, and determines that the non-3GPP access network is in the restricted access area of the core network, the terminal is not allowed to pass the The non-3GPP access network accesses the corresponding core network. For example, the verification of the access network information of the non-3GPP access network by the 4G core network server fails, that is, the non-3GPP access network is not allowed in the restricted access area of the 4G core network, and the 4G core network server is not allowed. The terminal accesses the 4G core network through the non-3GPP access network in the restricted access area, and returns a response to the terminal.
  • the authorization module 30 is further configured to: if the verification succeeds, the core network server performs identity authentication on the terminal, and determines, according to the identity authentication result, whether the terminal is allowed to access the core network.
  • the core network server If the core network server verifies the access network information sent by the non-3GPP access network, and determines that the non-3GPP access network is within the allowed access area of the core network, the core network server performs identity on the terminal. Authenticating, and determining, according to the identity authentication result, whether the terminal is allowed to access the core network; if the identity authentication is passed, allowing the terminal to access the core network; if the identity authentication fails, the terminal is not allowed to connect Enter the core network.
  • the 4G core network server verifies the access network information sent by the non-3GPP access network, and determines that the terminal that is sent by the non-3GPP access network is in the allowed access area of the 4G core network.
  • the terminal is authenticated by the HSS (Home Subscriber Server) of the 4G core network, and the terminal is allowed to access the 4G core network according to the identity authentication result; if the identity authentication is passed, The terminal is allowed to access the 4G core network; if the identity authentication fails, the terminal is not allowed to access the 4G core network.
  • HSS Home Subscriber Server
  • the core network server verifies the access network information sent by the terminal through the non-3GPP access network according to the preset control policy, to verify the non-3GPP connection. Whether the network access is in the allowed access area of the core network, and if the verification fails, the core network server determines that the non-3GPP access network is in the restricted access area of the core network, and the core network server does not allow the terminal to pass the The non-3GPP access network accesses the core network, so that the terminal cannot access the core network by restricting the non-3GPP access network in the access area, thereby effectively solving the problem that the core network server cannot perform regional restrictions on the terminal that requests access.
  • FIG. 5 is a schematic diagram of functional modules of a second embodiment of an access control apparatus for a core network according to an embodiment of the present invention.
  • the first parsing unit 201 is configured to parse the access request, and obtain address information of the non-3GPP access network;
  • the first determining unit 202 is configured to determine, according to the control policy, whether to allow access to the core network from the acquired address;
  • the first determining unit 203 is configured to, if permitted, determine that the address information passes verification
  • the first determining unit 203 is further configured to determine that the address information fails the verification if not allowed.
  • the core network server parses the access request sent by the terminal through the non-3GPP access network to obtain address information of the non-3GPP access network; and the core network server determines, according to the saved control policy, whether Allowing access to the core network from the obtained address; if access to the core network is allowed from the obtained address, determining that the address information is verified; if accessing the core network from the acquired address is not allowed And determining that the address information has not passed the verification.
  • the 4G core network server receives the terminal access request from the non-3GPP access network, and parses the access request to obtain the address information of the non-3GPP access network carried by the access request (for example, WLAN).
  • the 4G core network server reads the roaming control policy through the local roaming policy configuration table, and determines whether the terminal is allowed to access the 4G from the obtained address according to the roaming control policy.
  • the core network if the address information (such as an IP address or an access indication) is in the allowed access area of the 4G core network, allows the terminal to access the 4G core network from the obtained address, and the 4G core network server determines the address information.
  • the terminal If the address information (such as an IP address or an access indication) is in the restricted access area of the 4G core network, the terminal is not allowed to access the 4G core network from the obtained address, and the 4G core network server determines the address. The information has not been verified.
  • the address information such as an IP address or an access indication
  • the core network server when the terminal accesses the core network through the non-3GPP access network, the core network server obtains the address information of the non-3GPP access network according to the received access request, and verifies whether the terminal is allowed according to the preset control policy. Accessing the core network by using the obtained address, if the verification fails, the core network server determines that the non-3GPP access network is in the restricted access area of the core network, and does not allow the terminal to pass the non-3GPP access network. The access to the core network prevents the terminal from accessing the core network through the non-3GPP access network in the access area, which effectively solves the problem that the core network server cannot perform regional restrictions on the terminal that requests access.
  • FIG. 6 is a schematic diagram of functional modules of a third embodiment of an access control apparatus for a core network according to an embodiment of the present invention.
  • the access network information is name information of the non-3GPP access network; and the verification module 20 may include a second resolution. a unit 211, a second determining unit 212, and a second determining unit 213;
  • the second parsing unit 211 is configured to parse the access request, and obtain name information of the non-3GPP access network;
  • the second determining unit 212 is configured to determine, according to the control policy, whether to allow access to the core network by using the obtained name;
  • the second determining unit 213 is configured to, if permitted, determine that the name information is verified
  • the second determining unit 213 is further configured to determine that the name information fails the verification if not allowed.
  • the core network server parses the access request sent by the terminal through the non-3GPP access network to obtain the name information of the non-3GPP access network; the core network server determines, according to the saved control policy, whether Allowing access to the core network using the obtained name; if the obtained core name is allowed to access the core network, determining that the name information is verified; if the obtained name is not allowed to access the core network , it is determined that the name information has not passed the verification.
  • the 4G core network server receives the terminal access request from the non-3GPP access network, and parses the access request to obtain the name information of the non-3GPP access network carried in the access request (for example, the SSID of the WLAN). Or the information of the APN and the like of the eHRPD network; the 4G core network server reads the roaming control policy through the local roaming policy configuration table, and determines, according to the roaming control policy, whether the terminal is allowed to access the 4G core network by using the obtained name, if The name information (such as the SSID of the WLAN network or the APN of the eHRPD network) is allowed in the allowed access area of the 4G core network, and the name information is allowed to pass the verification; if the name information (such as the SSID of the WLAN network or the eHRPD network) APN) is not allowed in the restricted access area of the 4G core network, and it is determined that the name information has not passed the verification.
  • the name information such as the SSID of the WLAN network or the A
  • the core network server when the terminal accesses the core network through the non-3GPP access network, the core network server obtains the name information of the non-3GPP access network according to the received access request (transmitted by the terminal through the 3GPP access network), and Verifying, according to the preset roaming control policy, whether to allow access to the core network by using the obtained name. If the verification fails, the core network server determines that the non-3GPP access network is in the restricted access area of the core network, Allowing the terminal to access the core network through the non-3GPP access network, so that the terminal has no By restricting access to the core network by the non-3GPP access network in the access area, the method effectively solves the problem that the core network server cannot perform regional restrictions on the terminal that requests access.
  • the foregoing embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware.
  • the technical solution of the embodiment of the present invention may be embodied in the form of a software product stored in a storage medium (such as a ROM/RAM, a magnetic disk, an optical disk), including instructions for making one
  • the terminal device (which may be a cell phone, a computer, a server, an air conditioner, or a network device, etc.) performs the method described in one embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a hardware of a device according to an embodiment of the present invention. As shown in FIG. 7, the device includes:
  • One or more processors 410, one processor 410 is taken as an example in FIG. 7;
  • the device may also include an input device 430 and an output device 440.
  • the processor 410, the memory 420, the input device 430, and the output device 440 in the device may be connected by a bus or other means, and the bus connection is taken as an example in FIG.
  • the memory 420 is used as a computer readable storage medium for storing software programs, computer executable programs, and modules, such as program instructions/modules corresponding to the access control method of the core network in the embodiment of the present invention.
  • the processor 410 runs the software programs, instructions, and modules stored in the memory 420. The block, thereby performing various functional applications of the server and data processing, that is, the access control method of the core network implementing the above method embodiment.
  • the memory 420 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to usage of the terminal device, and the like.
  • memory 420 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.
  • memory 420 can optionally include memory remotely located relative to processor 410, which can be connected to the terminal device over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Input device 430 can be used to receive input digital or character information and to generate key signal inputs related to user settings and function control of the terminal.
  • Output device 440 can include a display device such as a display screen.
  • the one or more modules are stored in the memory 420, and when executed by the one or more processors 410, perform the following operations:
  • the core network server receives a terminal access request from a non-3rd Generation Partnership Project 3GPP access network;
  • the terminal is not allowed to access the core network.
  • the embodiment of the invention solves the problem that the core network server cannot perform regional restriction on the terminal that requests access in the related art.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种核心网的接入控制方法，所述核心网的接入控制方法包括以下步骤：核心网服务器接收来自非3GPP接入网的终端接入请求；所述核心网服务器根据所述接入请求获取对应的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；若验证未通过，则不允许所述终端接入核心网。本发明还公开了核心网的接入控制装置。本发明使得终端无法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。

Description

核心网的接入控制方法及装置 技术领域
本申请涉及移动通信领域，例如涉及一种核心网的接入控制方法及装置。
背景技术
在移动通信网络中，接入网负责终端的接入，核心网负责业务的处理，终端可以通过接入网接入到核心网进行业务交互。例如：在4G移动通讯网络中，3GPP(3rd Generation Partnership Project，第三代合作伙伴计划)标准组织定义了终端可以通过非3GPP网络以信任或者非信任的方式接入到4G移动通讯网络的核心网中，所述非3GPP网络包含WLAN(Wireless Local Area Network，无线局域网)、eHRPD(Evolved High Rate Packet Data，演进的高速分组数据网)等。
终端通过非3GPP接入网接入核心网时，核心网服务器可以通过签约信息对终端进行身份认证，以控制该终端是否被允许接入核心网。但是，当终端通过限制接入地的非3GPP接入网接入核心网时，核心网服务器无法对该终端进行限制。因此，在通过非3GPP接入网接入核心网时，核心网服务器无法对请求接入的终端进行地区限制的问题，此方面的问题亟待解决。
上述内容仅用于辅助理解本发明的技术方案，并不代表承认上述内容是现有技术。
发明内容
本发明实施例解决在通过非3GPP接入网接入核心网时，核心网服务器无法对请求接入的终端进行地区限制的问题。
本发明实施例提供一种核心网的接入控制方法，包括：
核心网服务器接收来自非第三代合作伙伴计划3GPP接入网的终端接入请 求；
所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；
若验证未通过，则不允许所述终端接入核心网。
可选地，所述接入网信息为所述非3GPP接入网的地址信息；以及，所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证，包括：
所述核心网服务器解析所述接入请求，并获取所述非3GPP接入网的地址信息；
所述核心网服务器按照所述控制策略，判断是否允许从所获取的地址信息接入所述核心网；
若允许，则判定所述地址信息通过验证；
若不允许，则判定所述地址信息未通过验证。
可选地，所述接入网信息为所述非3GPP接入网的名称信息；以及，所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证，包括：
所述核心网服务器解析所述接入请求，并获取所述非3GPP接入网的名称信息；
所述核心网服务器按照所述控制策略，判断是否允许使用所获取的名称信息接入所述核心网；
若允许，则判定所述名称信息通过验证；
若不允许，则判定所述名称信息未通过验证。
可选地，在所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证的步骤之后，还包括：
若验证通过，则对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述核心网。
可选地，在所述核心网服务器接收来自非3GPP接入网的终端接入请求，之前，还包括：
所述核心网服务器配置预设的控制策略，以根据所述控制策略对接入网信息进行验证。
此外，本发明实施例还提供一种核心网的接入控制装置，包括：
接收模块，设置为接收来自非3GPP接入网的终端接入请求；
验证模块，设置为根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；
授权模块，设置为若验证未通过，则不允许所述终端接入核心网。
可选地，所述接入网信息为所述非3GPP接入网的地址信息；以及，所述验证模块包括：第一解析单元、第一判断单元和第一确定单元；
所述第一解析单元，设置为解析所述接入请求，并获取所述非3GPP接入网的地址信息；
所述第一判断单元，设置为按照所述控制策略判断是否允许从所获取的地址信息接入所述核心网；
所述第一确定单元，设置为若允许，则判定所述地址信息通过验证；
所述第一确定单元，还设置为若不允许，则判定所述地址信息未通过验证。
可选地，所述接入网信息为所述非3GPP接入网的名称信息；以及，所述验证模块包括：第二解析单元、第二判断单元和第二确定单元；
所述第二解析单元，设置为解析所述接入请求，并获取所述非3GPP接入网的名称信息；
所述第二判断单元，设置为按照所述控制策略判断是否允许使用所获取的名称信息接入所述核心网；
所述第二确定单元，设置为若允许，则判定所述名称信息通过验证；
所述第二确定单元，还设置为若不允许，则判定所述名称信息未通过验证。
可选地，所述授权模块，还设置为若验证通过，则对所述终端进行身份认 证，并根据认证结果确定是否允许所述终端接入所述核心网。
可选地，所述核心网的接入控制装置还包括：配置模块；
所述配置模块，设置为在所述核心网服务器接收来自非3GPP接入网的终端接入请求之前，配置预设的控制策略，以根据所述控制策略对接入网信息进行验证。
此外，本发明实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述方法。
此外，本发明实施例还提供一种设备，该设备包括一个或多个处理器、存储器以及一个或多个程序，所述一个或多个程序存储在存储器中，当被一个或多个处理器执行时，执行上述方法。
本发明实施例在终端通过非3GPP接入网接入核心网时，核心网服务器根据预设的控制策略对终端的接入网信息进行验证，以判断所述终端的非3GPP接入网是否在所述核心网的允许接入区域内，若验证未通过，则确定所述终端的非3GPP接入网在核心网限制接入区域内，则核心网服务器不允许所述终端通过该非3GPP接入网接入核心网络，从而终端无法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。
附图说明
图1为本发明核心网的接入控制方法的第一实施例的流程示意图；
图2为本发明核心网的接入控制方法的第二实施例的流程示意图；
图3为本发明核心网的接入控制方法的第三实施例的流程示意图；
图4为本发明核心网的接入控制装置的第一实施例的功能模块示意图；
图5为本发明核心网的接入控制装置的第二实施例的功能模块示意图；
图6为本发明核心网的接入控制装置的第三实施例的功能模块示意图；
图7是根据本发明实施例提供的一种设备的硬件结构示意图。
实施方式
应当理解，此处所描述的实施例仅仅用以解释本发明，并不用于限定本发明。
相关技术中，终端请求接入4G核心网的区域可以为归属地区，也可以为4G核心网限定接入的漫游区域，当终端在归属地区已经在4G核心网服务器中签约，4G核心网服务器允许该终端通过WLAN或者eHRPD网络接入4G核心网，当终端在归属地区通过WLAN或者eHRPD接入4G核心网时被允许，但当终端在限制接入的漫游地区通过WLAN或者eHRPD接入4G核心网时，4G网络核心服务器对该终端的接入缺乏有效的控制。。
基于上述问题，本发明实施例提供一种核心网的接入控制方法。
参照图1，图1为本发明实施例核心网服务器的控制方法的第一实施例的流程示意图。
在本实施例中，所述核心网服务器的控制方法包括：
步骤S10，核心网服务器接收来自非第三代合作伙伴计划3GPP接入网的终端接入请求；
在终端通过非3GPP接入网接入核心网时，核心网服务器接收来自非3GPP接入网的终端接入请求。所述终端可以但不限于为以下任意一种：移动电话、智能电话、笔记本电脑、数字广播接收器、PDA(个人数字助理)、PAD(平板电脑)、PMP(便携式多媒体播放器)和导航装置等，所述核心网服务器可以为核心网内的认证授权计费服务器。例如：在终端通过非3GPP接入网接入4G核心网时，4G核心网内的3GPP AAA server(认证授权计费服务器)接收来自非3GPP接入网的终端接入请求。
步骤S20，所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；
在终端通过非3GPP接入网接入核心网时，终端通过非3GPP接入网发出接入请求至核心网服务器，所述接入请求携带所述非3GPP接入网的接入网信息。所述核心网服务器在接收到所述接入请求时，根据所述接入请求获取该接入请 求中携带的非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证，以判断所述非3GPP接入网是否在对应的允许接入区域内。例如：4G核心网服务器根据接收到的非3GPP接入网发送的终端接入请求，获取该非3GPP接入网的接入网信息，并按照所述4G核心网服务器内的控制策略对该接入网信息进行验证，以判断是否允许终端通过所述非3GPP接入网接入4G核心网。
所述接入网信息可以为所述非3GPP接入网的标识信息，例如：在通过非3GPP接入网接入4G核心网时，所述接入网信息可以是WLAN的IP地址、eHRPD网络的接入标示、WLAN的SSID(Service Set Identifier，服务集标示)或者eHRPD网络的APN(Access Point Name，接入点名)等等。
所述控制策略可以为基于地址的漫游控制策略，例如基于非3GPP接入网的地址信息(例如WLAN的IP地址或者eHRPD网络的接入标示等信息)配置的允许或者拒绝从该地址接入核心网的漫游控制策略；或者，所述控制策略也可以为基于名称的漫游控制策略，例如基于非3GPP接入网的名称信息(例如WLAN的SSID或者eHRPD网络的APN等信息)配置的允许或者拒绝使用该非3GPP接入网名称接入核心网的漫游控制策略。
可选地，在所述步骤S10之前，可以通过所述核心网服务器配置预设的控制策略，以根据所述控制策略对非3GPP接入网的接入网信息进行验证。所述预设的控制策略可以保存在所述核心网服务器的漫游策略配置表中，并通过所述漫游配置策略表对保存的所述控制策略进行维护更新。
步骤S30，若验证未通过，则不允许所述终端接入核心网。
若所述核心网服务器对该非3GPP接入网的接入网信息的验证未通过，确定所述非3GPP接入网在核心网的限制接入区域内，则不允许所述终端通过所述非3GPP接入网接入对应的核心网。例如：4G核心网服务器对非3GPP接入网的接入网信息的验证未通过，即所述非3GPP接入网在该4G核心网的限制接入区域内，则该核心网服务器不允许所述终端通过所述限制接入区域内的非3GPP接入网接入4G核心网，并返回响应至所述终端。
可选地，若验证通过，则核心网服务器对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述核心网。
若所述核心网服务器对所述该非3GPP接入网发送的接入网信息的验证通过，确定所述非3GPP接入网在核心网允许接入区域内，则核心网服务器对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述核心网；若身份认证通过，则允许所述终端接入所述核心网；若身份认证未通过，则不允许所述终端接入所述核心网。例如：4G核心网服务器对所述非3GPP接入网发送的接入网信息的验证通过，确定所述通过该非3GPP接入网发送接入请求的终端在4G核心网允许接入区域内，则通过4G核心网的HSS(Home Subscriber Server，归属用户服务器)对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述4G核心网；若身份认证通过，则允许所述终端接入所述4G核心网；若身份认证未通过，则不允许所述终端接入所述4G核心网。
本实施例在终端通过非3GPP接入网接入核心网时，核心网服务器根据预设的控制策略对终端通过非3GPP接入网发送的接入网信息进行验证，以验证所述非3GPP接入网是否在所述核心网的允许接入区域内，若验证未通过，核心网服务器确定所述非3GPP接入网在核心网限制接入区域内，则核心网服务器不允许所述终端通过该非3GPP接入网接入核心网络，使得终端无法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。
参照图2，图2为本发明实施例核心网的接入控制方法的第二实施例的流程示意图。基于上述核心网的接入控制方法的第一实施例，所述步骤S20可以包括：
步骤S201，所述核心网服务器解析所述接入请求，并获取所述非3GPP接入网的地址信息；
步骤S202，所述核心网服务器按照所述控制策略，判断是否允许从所获取 的地址接入所述核心网；
步骤S203，若允许，则判定所述地址信息通过验证；
步骤S204，若不允许，则判定所述地址信息未通过验证。
所述核心网服务器对终端通过非3GPP接入网发送的所述接入请求进行解析，以获取所述非3GPP接入网的地址信息；所述核心网服务器按照所保存的控制策略，判断是否允许从所获取的地址接入所述核心网；若允许从所获取的地址接入所述核心网，则判定所述地址信息通过验证；若不允许从所获取的地址接入所述核心网，则判定所述地址信息未通过验证。
例如：4G核心网服务器接收到来自非3GPP接入网的终端接入请求，并对所述接入请求进行解析，以获取接入请求携带的所述非3GPP接入网的地址信息(例如WLAN的IP地址或者eHRPD网络的接入标示等信息)；所述4G核心网服务器通过本地漫游策略配置表读取漫游控制策略，按照所述漫游控制策略判断是否允许终端从所获取的地址接入4G核心网，若所述地址信息(如IP地址或者接入标示)在4G核心网的允许接入区域内，则允许终端从获取的地址接入4G核心网，4G核心网服务器判定所述地址信息通过验证；若所述地址(如IP地址或者接入标示)在4G核心网的限制接入区域内，则不允许终端从获取的地址接入4G核心网，4G核心网服务器判定所述地址信息未通过验证。
本实施例在终端通过非3GPP接入网接入核心网时，核心网服务器根据接收到的接入请求获取所述非3GPP接入网的地址信息，并按照预设的控制策略验证是否允许终端通过所获取的地址接入所述核心网，若验证未通过，核心网服务器确定所述非3GPP接入网在核心网限制接入区域内，则不允许所述终端通过该非3GPP接入网接入核心网络，使得终端无法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。
参照图3，图3为本发明实施例核心网的接入控制方法的第三实施例的流程示意图。基于上述核心网的接入控制方法的第一实施例，所述步骤S20可以包 括：
步骤S211，所述核心网服务器解析所述接入请求，并获取所述非3GPP接入网的名称信息；
步骤S212，所述核心网服务器按照所述控制策略，判断是否允许使用所获取的名称接入所述核心网；
步骤S213，若允许，则判定所述名称信息通过验证；
步骤S214，若不允许，则判定所述名称信息未通过验证。
所述核心网服务器对终端通过非3GPP接入网发送的所述接入请求进行解析，以获取所述非3GPP接入网的名称信息；所述核心网服务器按照所保存的控制策略，判断是否允许使用所获取的名称接入所述核心网；若允许使用所获取的名称接入所述核心网，则判定所述名称信息通过验证；若不允许使用所获取的名称接入所述核心网，则判定所述名称信息未通过验证。
例如：4G核心网服务器接收到来自非3GPP接入网的终端接入请求，对所述接入请求进行解析，以获取接入请求中携带的非3GPP接入网的名称信息(例如WLAN的SSID或者eHRPD网络的APN等信息)；所述4G核心网服务器通过本地漫游策略配置表读取漫游控制策略，按照所述漫游控制策略判断是否允许终端使用所获取的名称接入4G核心网，若该名称信息(如WLAN的SSID或者eHRPD网络的APN)在4G核心网的允许接入区域内，则允许，判定所述名称信息通过验证；若该名称信息(如WLAN的SSID或者eHRPD网络的APN)在4G核心网的限制接入区域内，则不允许，判定所述名称信息未通过验证。
本实施例在终端通过非3GPP接入网接入核心网时，核心网服务器根据接收到的接入请求(由终端通过3GPP接入网发送)获取所述非3GPP接入网的名称信息，并按照预设的漫游控制策略验证是否允许使用所获取的名称接入所述核心网，若验证未通过，核心网服务器确定所述非3GPP接入网在核心网的限制接入区域内，则不允许所述终端通过该非3GPP接入网接入核心网络，使得终端无法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。
上述第一至第三实施例的核心网的接入控制方法的执行主体均可以为核心网服务器或核心网络服务器内的控制设备。可选地，所述核心网的接入控制方法可以由安装在核心网服务器或核心网络服务器内的控制设备上的控制程序实现。
参照图4，图4为本发明实施例核心网的接入控制装置的第一实施例的功能模块示意图。
在本实施例中，所述核心网的接入控制装置包括：接收模块10、验证模块20及授权模块30。
所述接收模块10，设置为接收来自非3GPP接入网的终端接入请求；
在终端通过非3GPP接入网接入核心网时，核心网服务器接收来自非3GPP接入网的终端接入请求。所述终端可以但不限于为以下任意一种：移动电话、智能电话、笔记本电脑、数字广播接收器、PDA(个人数字助理)、PAD(平板电脑)、PMP(便携式多媒体播放器)和导航装置等，所述核心网服务器可以为核心网内的认证授权计费服务器。例如：在终端通过非3GPP接入网接入4G核心网时，4G核心网内的3GPP AAA server(认证授权计费服务器)接收来自非3GPP接入网的终端接入请求。
所述验证模块20，设置为根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；
在终端通过非3GPP接入网接入核心网时，终端通过非3GPP接入网发出接入请求至核心网服务器，所述接入请求携带所述非3GPP接入网的接入网信息。所述核心网服务器在接收到所述接入请求时，根据所述接入请求获取该接入请求中携带的非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证，以判断所述非3GPP接入网是否在对应的允许接入区域内。例如：4G核心网服务器根据接收到的非3GPP接入网发送的终端接入请求，获取该非3GPP接入网的接入网信息，并按照所述4G核心网服务器内的控制策略对该接 入网信息进行验证，以判断是否允许终端通过所述非3GPP接入网接入4G核心网。
所述接入网信息可以为所述非3GPP接入网的标识信息，例如：在通过非3GPP接入网接入4G核心网时，所述接入网信息可以是WLAN的IP地址、eHRPD网络的接入标示、WLAN的SSID(Service Set Identifier，服务集标示)或者eHRPD网络的APN(Access Point Name，接入点名)等等。
所述控制策略可以为基于地址的漫游控制策略，例如基于非3GPP接入网的地址信息(例如WLAN网络的IP地址或者eHRPD网络的接入标示等信息)配置的允许或者拒绝从该地址接入核心网的漫游控制策略；或者，所述控制策略也可以为基于名称的漫游控制策略，例如基于非3GPP接入网的名称信息(例如WLAN的SSID或者eHRPD网络的APN等信息)配置的允许或者拒绝使用该非3GPP接入网名称接入核心网的漫游控制策略。
可选地，所述核心网的接入控制装置还可以包括配置模块；所述配置模块，设置为在所述核心网服务器接收来自非3GPP接入网的终端接入请求之前，配置预设的控制策略，以根据所述控制策略对接入网信息进行验证。所述预设的控制策略可以保存在所述核心网服务器的漫游策略配置表中，并通过所述漫游配置策略表对保存的所述控制策略进行维护更新。
所述授权模块30，设置为若验证未通过，则不允许所述终端接入核心网。
若所述核心网服务器对该非3GPP接入网的接入网信息的验证未通过，确定所述非3GPP接入网在核心网的限制接入区域内，则不允许所述终端通过所述非3GPP接入网接入对应的核心网。例如：4G核心网服务器对非3GPP接入网的接入网信息的验证未通过，即所述非3GPP接入网在该4G核心网的限制接入区域内，则该4G核心网服务器不允许所述终端通过所述限制接入区域内的非3GPP接入网接入4G核心网，并返回响应至所述终端。
可选地，所述授权模块30，还设置为若验证通过，则核心网服务器对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述核心网。
若所述核心网服务器对该非3GPP接入网发送的接入网信息的验证通过，确定所述非3GPP接入网在核心网允许接入区域内，则核心网服务器对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述核心网；若身份认证通过，则允许所述终端接入所述核心网；若身份认证未通过，则不允许所述终端接入所述核心网。例如：4G核心网服务器对所述非3GPP接入网发送的接入网信息的验证通过，确定所述通过该非3GPP接入网发送的接入请求的终端在4G核心网允许接入区域内，则通过4G核心网的HSS(Home Subscriber Server，归属用户服务器)对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述4G核心网；若身份认证通过，则允许所述终端接入所述4G核心网；若身份认证未通过，则不允许所述终端接入所述4G核心网。
本实施例在终端通过非3GPP接入网接入核心网时，核心网服务器根据预设的控制策略对终端通过非3GPP接入网发送的接入网信息进行验证，以验证所述非3GPP接入网是否在所述核心网的允许接入区域内，若验证未通过，核心网服务器确定所述非3GPP接入网在核心网限制接入区域内，则核心网服务器不允许所述终端通过该非3GPP接入网接入核心网络，使得终端无法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。
参照图5，图5为本发明实施例核心网的接入控制装置的第二实施例的功能模块示意图。基于上述核心网的接入控制装置的第一实施例，所述接入网信息为所述非3GPP接入网的位置信息；以及，所述验证模块20可以包括第一解析单元201、第一判断单元202和第一确定单元203；
所述第一解析单元201，设置为解析所述接入请求，并获取所述非3GPP接入网的地址信息；
所述第一判断单元202，设置为按照所述控制策略，判断是否允许从所获取的地址接入所述核心网；
所述第一确定单元203，设置为若允许，则判定所述地址信息通过验证；
所述第一确定单元203，还设置为若不允许，则判定所述地址信息未通过验证。
所述核心网服务器对终端通过非3GPP接入网发送的所述接入请求进行解析，以获取所述非3GPP接入网的地址信息；所述核心网服务器按照所保存的控制策略，判断是否允许从所获取的地址接入所述核心网；若允许从所获取的地址接入所述核心网，则判定所述地址信息通过验证；若不允许从所获取的地址接入所述核心网，则判定所述地址信息未通过验证。
例如：4G核心网服务器接收到来自非3GPP接入网的终端接入请求，并对所述接入请求进行解析，以获取接入请求携带的所述非3GPP接入网的地址信息(例如WLAN的IP地址或者eHRPD网络的接入标示等信息)；所述4G核心网服务器通过本地漫游策略配置表读取漫游控制策略，按照所述漫游控制策略判断是否允许终端从所获取的地址接入4G核心网，若所述地址信息(如IP地址或者接入标示)在4G核心网的允许接入区域内，则允许终端从获取的地址接入4G核心网，4G核心网服务器判定所述地址信息通过验证；若所述地址信息(如IP地址或者接入标示)在4G核心网的限制接入区域内，则不允许终端从获取的地址接入4G核心网，4G核心网服务器判定所述地址信息未通过验证。
本实施例在终端通过非3GPP接入网接入核心网时，核心网服务器根据接收到的接入请求获取所述非3GPP接入网的地址信息，并按照预设的控制策略验证是否允许终端通过所获取的地址接入所述核心网，若验证未通过，核心网服务器确定所述非3GPP接入网在核心网限制接入区域内，则不允许所述终端通过该非3GPP接入网接入核心网络，使得终端无法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。
参照图6，图6为本发明实施例核心网的接入控制装置的第三实施例的功能模块示意图。基于上述核心网的接入控制装置的第一实施例，所述接入网信息为所述非3GPP接入网的名称信息；以及，所述验证模块20可以包括第二解析 单元211、第二判断单元212和第二确定单元213；
所述第二解析单元211，设置为解析所述接入请求，并获取所述非3GPP接入网的名称信息；
所述第二判断单元212，设置为按照所述控制策略，判断是否允许使用所获取的名称接入所述核心网；
所述第二确定单元213，设置为若允许，则判定所述名称信息通过验证；
所述第二确定单元213，还设置为若不允许，则判定所述名称信息未通过验证。
所述核心网服务器对终端通过非3GPP接入网发送的所述接入请求进行解析，以获取所述非3GPP接入网的名称信息；所述核心网服务器按照所保存的控制策略，判断是否允许使用所获取的名称接入所述核心网；若允许使用所获取的名称接入所述核心网，则判定所述名称信息通过验证；若不允许使用所获取的名称接入所述核心网，则判定所述名称信息未通过验证。
例如：4G核心网服务器接收到来自非3GPP接入网的终端接入请求，对所述接入请求进行解析，以获取接入请求中携带的非3GPP接入网的名称信息(例如WLAN的SSID或者eHRPD网络的APN等信息)；所述4G核心网服务器通过本地漫游策略配置表读取漫游控制策略，按照所述漫游控制策略判断是否允许终端使用所获取的名称接入4G核心网，若该名称信息(如WLAN网络的SSID或者eHRPD网络的APN)在4G核心网的允许接入区域内，则允许，判定所述名称信息通过验证；若该名称信息(如WLAN网络的SSID或者eHRPD网络的APN)在4G核心网的限制接入区域内，则不允许，判定所述名称信息未通过验证。
本实施例在终端通过非3GPP接入网接入核心网时，核心网服务器根据接收到的接入请求(由终端通过3GPP接入网发送)获取所述非3GPP接入网的名称信息，并按照预设的漫游控制策略验证是否允许使用所获取的名称接入所述核心网，若验证未通过，核心网服务器确定所述非3GPP接入网在核心网的限制接入区域内，则不允许所述终端通过该非3GPP接入网接入核心网络，使得终端无 法通过限制接入区域内的非3GPP接入网接入核心网络，有效解决了核心网服务器无法对请求接入的终端进行地区限制的问题。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个......”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件。基于这样的理解，本发明实施例的技术方案可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括指令用以使得一台终端设备(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本发明个实施例所述的方法。
图7是根据本发明实施例的一种设备的硬件结构示意图，如图7所示，该设备包括：
一个或多个处理器410，图7中以一个处理器410为例；
存储器420；
所述设备还可以包括：输入装置430和输出装置440。
所述设备中的处理器410、存储器420、输入装置430和输出装置440可以通过总线或者其他方式连接，图4中以通过总线连接为例。
存储器420作为一种计算机可读存储介质，可用于存储软件程序、计算机可执行程序以及模块，如本发明实施例中的核心网的接入控制方法对应的程序指令/模块。处理器410通过运行存储在存储器420中的软件程序、指令以及模 块，从而执行服务器的各种功能应用以及数据处理，即实现上述方法实施例的核心网的接入控制方法。
存储器420可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储根据终端设备的使用所创建的数据等。此外，存储器420可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实施例中，存储器420可选包括相对于处理器410远程设置的存储器，这些远程存储器可以通过网络连接至终端设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
输入装置430可用于接收输入的数字或字符信息，以及产生与终端的用户设置以及功能控制有关的键信号输入。输出装置440可包括显示屏等显示设备。
所述一个或者多个模块存储在所述存储器420中，当被所述一个或者多个处理器410执行时，执行如下操作：
核心网服务器接收来自非第三代合作伙伴计划3GPP接入网的终端接入请求；
所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；
若验证未通过，则不允许所述终端接入核心网。
工业实用性
本发明实施例解决了相关技术中核心网服务器无法对请求接入的终端进行地区限制的问题。

Claims (11)

  1. 一种核心网的接入控制方法，包括：
    核心网服务器接收来自非第三代合作伙伴计划3GPP接入网的终端接入请求；
    所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；
    若验证未通过，则所述核心网服务器不允许所述终端接入核心网。
  2. 如权利要求1所述的核心网的接入控制方法，其中，所述接入网信息为所述非3GPP接入网的地址信息；以及，
    所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证，包括：
    所述核心网服务器解析所述接入请求，并获取所述非3GPP接入网的地址信息；
    所述核心网服务器按照所述控制策略，判断是否允许从所获取的地址接入所述核心网；
    若允许，则判定所述地址信息通过验证；
    若不允许，则判定所述地址信息未通过验证。
  3. 如权利要求1所述的核心网的接入控制方法，其中，所述接入网信息为所述非3GPP接入网的名称信息；以及，
    所述核心网服务器根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证，包括：
    所述核心网服务器解析所述接入请求，并获取所述非3GPP接入网的名称信息；
    所述核心网服务器按照所述控制策略，判断是否允许使用所获取的名称接入所述核心网；
    若允许，则判定所述名称信息通过验证；
    若不允许，则判定所述名称信息未通过验证。
  4. 如权利要求1所述的核心网的接入控制方法，在所述核心网服务器根据 所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证之后，还包括：
    若验证通过，则对所述终端进行身份认证，并根据身份认证结果确定是否允许所述终端接入所述核心网。
  5. 如权利要求1至4任一项所述的核心网的接入控制方法，在所述核心网服务器接收来自非3GPP接入网的终端接入请求之前，还包括：
    所述核心网服务器配置预设的控制策略，以根据所述控制策略对接入网信息进行验证。
  6. 一种核心网的接入控制装置，包括：
    接收模块，设置为接收来自非3GPP接入网的终端接入请求；
    验证模块，设置为根据所述接入请求获取所述非3GPP接入网的接入网信息，并按照预设的控制策略对所述接入网信息进行验证；
    授权模块，设置为若验证未通过，则不允许所述终端接入核心网。
  7. 如权利要求6所述的核心网的接入控制装置，其中，所述接入网信息为所述非3GPP接入网的位置信息；以及，
    所述验证模块包括：第一解析单元、第一判断单元和第一确定单元；
    所述第一解析单元，设置为解析所述接入请求，并获取所述非3GPP接入网的地址信息；
    所述第一判断单元，设置为按照所述控制策略，判断是否允许从所获取的地址接入所述核心网；
    所述第一确定单元，设置为若允许，则判定所述地址信息通过验证；
    所述第一确定单元，还设置为若不允许，则判定所述地址信息未通过验证。
  8. 如权利要求6所述的核心网的接入控制装置，其中，所述接入网信息为所述非3GPP接入网的名称信息；以及，
    所述验证模块包括：第二解析单元、第二判断单元和第二确定单元；
    所述第二解析单元，设置为解析所述接入请求，并获取所述非3GPP接入网的名称信息；
    所述第二判断单元，设置为按照所述控制策略判断是否允许使用所获取的名称接入所述核心网；
    所述第二确定单元，设置为若允许，则判定所述名称信息通过验证；
    所述第二确定单元，还设置为若不允许，则判定所述名称信息未通过验证。
  9. 如权利要求6所述的核心网的接入控制装置，其特征在于，所述授权模块，还设置为若验证通过，则对所述终端进行身份认证，并根据认证结果确定是否允许所述终端接入所述核心网。
  10. 如权利要求6至9任一项所述的核心网的接入控制装置，还包括：配置模块；
    所述配置模块，设置为在所述核心网服务器接收来自非3GPP接入网的终端接入请求之前，配置预设的控制策略，以根据所述控制策略对接入网信息进行验证。
  11. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行权利要求1-5任一项的核心网络的接入控制方法。
PCT/CN2016/078132 2015-09-02 2016-03-31 核心网的接入控制方法及装置 WO2016177223A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510557162.XA CN106488527A (zh) 2015-09-02 2015-09-02 核心网的接入控制方法及装置
CN201510557162.X 2015-09-02

Publications (1)

Publication Number Publication Date
WO2016177223A1 true WO2016177223A1 (zh) 2016-11-10

Family

ID=57217506

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/078132 WO2016177223A1 (zh) 2015-09-02 2016-03-31 核心网的接入控制方法及装置

Country Status (2)

Country Link
CN (1) CN106488527A (zh)
WO (1) WO2016177223A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190320381A1 (en) * 2018-04-17 2019-10-17 Mediatek Singapore Pte. Ltd. Apparatuses and methods for handling access type restriction information

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109982362B (zh) * 2017-12-28 2021-11-23 成都鼎桥通信技术有限公司 移动通信系统的组网方法及服务器

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101577909A (zh) * 2008-05-05 2009-11-11 大唐移动通信设备有限公司 非3gpp接入系统信任类型的获取方法、系统及装置
CN102833718A (zh) * 2011-06-16 2012-12-19 中兴通讯股份有限公司 支持非3gpp接入的演进分组核心网计费方法及系统
CN103313344A (zh) * 2012-03-07 2013-09-18 中兴通讯股份有限公司 融合的核心网及其接入方法
US20140269551A1 (en) * 2011-06-22 2014-09-18 Alcatel Lucent Support of ip connections over trusted non-3gpp access

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101577909A (zh) * 2008-05-05 2009-11-11 大唐移动通信设备有限公司 非3gpp接入系统信任类型的获取方法、系统及装置
CN102833718A (zh) * 2011-06-16 2012-12-19 中兴通讯股份有限公司 支持非3gpp接入的演进分组核心网计费方法及系统
US20140269551A1 (en) * 2011-06-22 2014-09-18 Alcatel Lucent Support of ip connections over trusted non-3gpp access
CN103313344A (zh) * 2012-03-07 2013-09-18 中兴通讯股份有限公司 融合的核心网及其接入方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190320381A1 (en) * 2018-04-17 2019-10-17 Mediatek Singapore Pte. Ltd. Apparatuses and methods for handling access type restriction information
US11968614B2 (en) * 2018-04-17 2024-04-23 Mediatek Singapore Pte. Ltd. Apparatuses and methods for handling access type restriction information

Also Published As

Publication number Publication date
CN106488527A (zh) 2017-03-08

Similar Documents

Publication Publication Date Title
US9961088B2 (en) Systems and methods for geolocation-based authentication and authorization
JP6385589B2 (ja) アプリケーション固有ネットワークアクセス資格情報を使用する、ワイヤレスネットワークへのスポンサー付き接続性のための装置および方法
US9763094B2 (en) Methods, devices and systems for dynamic network access administration
JP6400228B2 (ja) アプリケーション固有ネットワークアクセス資格情報を使用する、ワイヤレスネットワークへのスポンサー付き接続性のための装置および方法
CN108989263B (zh) 短信验证码攻击防护方法、服务器和计算机可读存储介质
US9166965B2 (en) Method and system for automated user authentication for a priority communication session
US10419431B2 (en) Preventing cross-site request forgery using environment fingerprints of a client device
EP3308499B1 (en) Service provider certificate management
US9980142B2 (en) Methods and apparatus for SIM-based authentication of non-SIM devices
CN111064756B (zh) 终端接入3gpp网络的处理方法及装置
CN108632329A (zh) 一种第三方插件的访问方法和装置
WO2013185709A1 (zh) 一种呼叫认证方法、设备和系统
US9621546B2 (en) Method of generating one-time password and apparatus for performing the same
WO2017092385A1 (zh) 一种 portal 认证方法、 portal 服务器及终端
WO2020025056A1 (zh) 安全认证方法、装置和系统，移动终端
WO2016177223A1 (zh) 核心网的接入控制方法及装置
CN111355583B (zh) 一种业务提供系统、方法、装置、电子设备及存储介质
KR102558821B1 (ko) 사용자 및 디바이스 통합 인증 시스템 및 그 방법
WO2017107745A1 (zh) 终端认证方法、装置及系统
CN107846410B (zh) 一种入网验证的方法和装置
WO2018103527A1 (zh) 认证方法和认证装置
WO2016179860A1 (zh) 一种多操作系统终端中位置信息的保护方法、装置及终端
KR20140023085A (ko) 사용자 인증 방법, 인증 서버 및 사용자 인증 시스템
CN113079505B (zh) 用户认证方法、核心网侧设备及计算机可读存储介质
WO2020147509A1 (zh) 能力上报、密钥协商方法及装置、终端、通信设备及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16789217

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16789217

Country of ref document: EP

Kind code of ref document: A1