WO2016183745A1 - 用于建立连接的方法和设备 - Google Patents

用于建立连接的方法和设备 Download PDF

Info

Publication number
WO2016183745A1
WO2016183745A1 PCT/CN2015/079105 CN2015079105W WO2016183745A1 WO 2016183745 A1 WO2016183745 A1 WO 2016183745A1 CN 2015079105 W CN2015079105 W CN 2015079105W WO 2016183745 A1 WO2016183745 A1 WO 2016183745A1
Authority
WO
WIPO (PCT)
Prior art keywords
vplmn
authentication
information
network
land mobile
Prior art date
Application number
PCT/CN2015/079105
Other languages
English (en)
French (fr)
Inventor
于游洋
李欢
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2015/079105 priority Critical patent/WO2016183745A1/zh
Priority to CN201580030579.9A priority patent/CN106664558B/zh
Publication of WO2016183745A1 publication Critical patent/WO2016183745A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • Embodiments of the present invention relate to the field of communications and, more particularly, to a method and apparatus for establishing a connection.
  • 3GPP 3rd Generation Partnership Project
  • LTE Long Term Evolution
  • PS Packet Switching
  • EPS Evolved Packet System
  • the new 3GPP core network supports not only 3GPP access technologies, such as the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and the terrestrial radio access network (Evolved Universal Terrestrial Radio Access Network (E-UTRAN)).
  • Terrestrial Radio Access Network (UTRAN) and GSM/EDGE Radio Access Network (GERAN) supporting non-3GPP access technologies, such as CDMA2000 (Code Division Multiple Access 2000), global interconnection Worldwide Interoperability for Microwave Access (WiMAX), Wireless LAN (WLAN).
  • the WLAN access network can be further divided into a trusted WLAN and an untrusted WLAN.
  • the 3GPP Authentication, Authorization, and Accounting Proxy (3GPP AAA proxy) will access the public land mobile network (Public Land Mobile Network).
  • the (PLMN) identification information (PLMN ID) is sent to the Home Subscriber System (HSS) of the User Equipment (UE) for authentication authentication.
  • HSS Home Subscriber System
  • the 3GPP AAA Proxy needs to go through two visited locations.
  • the home domain HSS can only be used for a single visited public land mobile network (VPLMN). Perform authentication and therefore cannot The authentication and authorization requirements of the multiple visited sites (for example, two visited places, the visited place on the 3GPP side and the visited place on the WLAN side) are satisfied.
  • An embodiment of the present invention provides a method and a device for establishing a connection, which can implement authentication of a UE in a scenario where multiple visited locations exist.
  • a method for establishing a connection comprising: a home domain server HSS receiving an authentication request message, the authentication request message including a WLAN service provider WLAN SP parameter information and a visited network identifier parameter information
  • the WLAN SP parameter information includes information of the first visited public land mobile network VPLMN
  • the visited network identification parameter information includes information of the second VPLMN
  • the first VPLMN deploys a non-3rd generation partnership plan 3GPP network
  • the second VPLMN is a public land mobile network PLMN currently registered by the UE on the 3GPP side
  • the HSS performs the UE according to the information of the first VPLMN and/or the information of the second VPLMN.
  • the authentication request message further includes indication information, where the indication information is used to indicate that the first VPLMN is equal to the second VPLMN.
  • the HSS authenticates the UE according to the information of the first VPLMN and/or the information of the second VPLMN, including: The HSS determines whether the UE can access the 3GPP network from the second VPLMN based on the subscription. If the UE can access the 3GPP network from the second VPLMN, the authentication succeeds if the UE cannot access from the second VPLMN. In the 3GPP network, the authentication fails, or the HSS determines whether the UE can access the 3GPP network from the first VPLMN based on the subscription. If the UE can access the 3GPP network from the first VPLMN, the authentication succeeds.
  • the UE may not access the 3GPP network from the first VPLMN, and the authentication fails, or the HSS determines, based on the subscription, that the UE can access from the second VPLMN and the first VPLMN is equivalent to the second VPLMN B. Whether the PLMN is established, if all are established, the authentication is successful, if any is not established, the authentication fails, or the HSS determines that the UE can access from the first VPLMN and the UE can be from the second VPLMN based on the subscription. Whether access is established, if all are established, Authentication is successful, if there is either not true, the authentication fails.
  • the method further includes: the HSS sending an access registration request reply message, where the access registration request reply message includes an equivalent public land.
  • Mobile network local access indication information wherein the equivalent public land mobile network local access indication information is used to indicate that the access point name APN is served by a data gateway PGW deployed by a second PLMN equivalent to the first VPLMN
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the local public land mobile network local access indication information is located in a configuration parameter of the APN.
  • a second aspect provides a method for establishing a connection, where a home domain server HSS receives an authentication request message, where the authentication request message includes visited network identification parameter information, where the visited network identification parameter information includes a first visited place Information of the public land mobile network VPLMN or information of the second VPLMN, wherein the non-third generation partnership plan 3GPP network deployed by the first VPLMN is the access network of the user equipment UE, and the second VPLMN is the UE currently in the 3GPP a publicly-registered public land mobile network (PLMN); the HSS authenticates the UE according to the information of the first VPLMN or the information of the second VPLMN; after the HSS successfully authenticates the UE, the HSS sends an access registration request response.
  • the authentication request message includes visited network identification parameter information, where the visited network identification parameter information includes a first visited place Information of the public land mobile network VPLMN or information of the second VPLMN, wherein the non-third generation partnership plan 3GPP network deployed by
  • the access registration request reply message includes an equivalent public land mobile network local access indication information, wherein the equivalent public land mobile network local access indication information is used to indicate that the access point name APN is associated with the first VPLMN
  • the data gateway PGW deployed by the equivalent second PLMN provides the service; or, the equivalent public land mobile network local access indication information includes the information of the target PLMN, A PGW for indicating that the APN is deployed by the target PLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • a third aspect provides a method for establishing a connection, comprising: receiving, by a second proxy server, a first authentication and authorization request message sent by a first proxy server, where the first authentication and authorization request message includes a first wireless
  • the local area network service provider WLAN SP parameter information and/or the first visited network identification parameter information, the first WLAN SP parameter information and the first visited network identification parameter information are both the first visited public land mobile network VPLMN
  • the second proxy server generates a second authentication and authorization request message according to the first authentication and authorization request message, where the second authentication and authorization request message includes the second WLAN SP parameter information and the second visited network identifier.
  • the second WLAN SP parameter information is information of the first VPLMN
  • the second visited network identity parameter information is information of the second VPLMN
  • the first VPLMN deploys a non-3rd generation partnership plan 3GPP
  • the network is an access network of the user equipment UE
  • the second VPLMN is a public land mobile network PLMN currently registered by the UE on the 3GPP side
  • the second proxy server sends the second authentication and authorization request message, so that the HSS is configured according to the The information of a VPLMN and/or the information of the second VPLMN authenticates the UE.
  • the second proxy server generates a second authentication and authorization request message according to the first authentication and authorization request message, where the second proxy server detects the first Whether the first authentication and authorization request message includes the first visited network identification parameter information, and if the first authentication and authorization request message does not include the first visited network identification parameter information, the second proxy server
  • the information of the second VPLMN is used as the second visited network identification parameter information, and the second WLAN SP parameter information is set to be the same as the first WLAN SP parameter information; or, if the first authentication and authorization request message includes the first visit
  • the second network server sets the second WLAN SP parameter information and the first visited network identifier parameter, where the first network authentication parameter request information does not include the first WLAN SP parameter information.
  • the information is the same, the information of the second VPLMN is used as the second visited network identification parameter information; or, if the first authentication and authorization request message is included
  • the second WLAN SP parameter information and the first WLAN SP parameter information are set by the second proxy server, where the first WLAN SP parameter information is included in the first WLAN SP parameter information.
  • the information of the second VPLMN is used as the second visited network identification parameter information.
  • the second authentication and authorization request message further includes indication information, where the indication information is used to indicate the first VPLMN and the first The second VPLMN is an equivalent PLMN.
  • the method includes: the second proxy server receives an authentication and authorization reply message sent by the 3GPP authentication and accounting server 3GPP AAA Server, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information;
  • the second proxy server sends the authentication and authorization reply message to the first proxy server, and the authentication and authorization reply message is forwarded by the first proxy server to the non-3rd generation partner program N3G access network device, so that the N3G
  • the access network device selects a data gateway for the access point name APN according to the local public access indication information of the equivalent public land mobile network a PGW and establishing a packet data network PDN connection, wherein the equivalent public land mobile network local access indication information is used to indicate that the APN is served by a PGW deployed by a second PLMN equivalent to the first VPLMN; or
  • the equivalent public land mobile network local access indication information includes
  • the local public land mobile network local access indication information is located in a configuration parameter of the APN.
  • a fourth aspect provides a method for establishing a connection, comprising: after the user equipment UE is successfully authenticated, the second proxy server sends according to the received third generation partnership plan authentication authorization and charging server 3GPP AAA Server
  • the authentication and authorization reply message generates an authentication and authorization reply message, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information; or the second proxy server receives the 3GPP AAA Server And an authorization reply message, the authentication and authorization reply message includes an equivalent public land mobile network local access indication information;
  • the second proxy server sends the authentication and authorization reply message to the first proxy server, the authentication and the The authorization reply message is forwarded by the first proxy server to the non-3rd Generation Partnership Project N3G access network device, so that the N3G access network device uses the equivalent public land mobile network local access indication information as the access point name.
  • the APN selects the data gateway PGW and establishes a packet data network PDN connection, wherein the first visited public land mobile network VPLM
  • the N-deployed non-third-generation partner program 3GPP network is the access network of the UE, and the second VPLMN is the public land mobile network PLMN currently registered by the UE on the 3GPP side, the equivalent public land mobile network local access indication information Means for indicating that the APN is served by a data gateway PGW deployed by a second PLMN equivalent to the first VPLMN; or the equivalent public land mobile network local access indication information includes information of the target PLMN, for indicating the The APN is served by the PGW deployed by the target PLMN.
  • the local public land mobile network local access indication information is located in a configuration parameter of the APN.
  • a fifth aspect provides a method for establishing a connection, including: after the user equipment UE is successfully authenticated, the first proxy server receives an authentication and authorization reply message sent by the second proxy server, and the authentication and authorization reply
  • the message includes an equivalent public land mobile network local access indication information; or the first proxy server generates an authentication and authorization reply message according to the initial authentication and authorization reply message sent by the second proxy server, the authentication and authorization reply
  • the message includes the first agent service Equivalent public land mobile network local access indication information generated by the server; the first proxy server sends the authentication and authorization reply message to the non-3rd generation partner program N3G access network device, the authentication and authorization reply message Include the equivalent public land mobile network local access indication information, so that the N3G access network device selects a data gateway PGW and establishes a packet data network for the access point name APN according to the equivalent public land mobile network local access indication information.
  • the non-third generation partnership plan 3GPP network deployed by the first visited public land mobile network VPLMN is the access network of the UE
  • the second VPLMN is the public land mobile network PLMN currently registered by the UE on the 3GPP side
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by a data gateway PGW deployed by the second PLMN equivalent to the first VPLMN; or the equivalent public land mobile network is locally connected
  • the incoming indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • the method further includes: determining, by the first proxy server, the 3GPP deployed by the HPLMN according to the home domain public land mobile network HPLMN information included in the network access identifier NAI of the UE
  • the AAA Server can directly reach the first authentication and authorization request message sent to the 3GPP AAA server, so that the home domain server HSS authenticates the UE, where the first authentication and authorization request message includes the first visit.
  • Information on the public land mobile network VPLMN is not limited to the public land mobile network VPLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • the sixth aspect provides a home domain server HSS, including: a receiving unit, configured to receive an authentication request message, where the authentication request message includes a WLAN SP parameter information of the WLAN service provider and a network identifier parameter information of the visited place,
  • the WLAN SP parameter information includes information of a first visited public land mobile network VPLMN, where the visited network identification parameter information includes information of a second VPLMN, wherein the non-third generation partner plan 3GPP network deployed by the first VPLMN is An access network of the user equipment UE, the second VPLMN is a public land mobile network PLMN currently registered by the UE on the 3GPP side; an authentication unit, configured to use information according to the first VPLMN and/or information of the second VPLMN The UE performs authentication.
  • the authentication request message further includes indication information, where the indication information is used to indicate that the first VPLMN is the same as the second VPLMN.
  • the authentication unit determines, according to the subscription, whether the UE can access the 3GPP network from the second VPLMN, if The UE may access the 3GPP network from the second VPLMN, and the authentication succeeds. If the UE cannot access the 3GPP network from the second VPLMN, the authentication fails, or the authentication unit determines whether the UE can be based on the subscription.
  • the authentication succeeds, if the UE cannot access the 3GPP network from the first VPLMN, the authentication fails, or And determining, by the authentication unit, whether the UE can access from the second VPLMN and whether the first VPLMN is an equivalent PLMN of the second VPLMN B, if all are established, the authentication succeeds, if any If not, the authentication fails, or the authentication unit determines whether the UE can access from the first VPLMN and whether the UE can access from the second VPLMN based on the subscription, and if yes, the authentication succeeds. If any one does not hold The authentication fails.
  • the sending unit is further configured to be used in the UE After the right is successful, sending an access registration request reply message, where the access registration request reply message includes an equivalent public land mobile network local access indication information, where the equivalent public land mobile network local access indication information is used to indicate The in-point name APN is served by a data gateway PGW deployed by the second PLMN equivalent to the first VPLMN; or the equivalent public land mobile network local access indication information includes information of the target PLMN for indicating the APN by The PGW deployed by the target PLMN provides services.
  • the local public land mobile network local access indication information is located in a configuration parameter of the APN.
  • the seventh aspect provides a home domain server HSS, including: a receiving unit, configured to receive an authentication request message, where the authentication request message includes the visited network identifier parameter information, where the visited network identifier parameter information includes the first visit The information of the public land mobile network VPLMN or the information of the second VPLMN, wherein the non-third generation partner program 3GPP network deployed by the first VPLMN is the access network of the user equipment UE, and the second VPLMN is currently the UE a public land mobile network (PLMN) registered by the 3GPP side; an authentication unit, configured to authenticate the UE according to the information of the first VPLMN or the information of the second VPLMN; and the sending unit, configured to send after the UE successfully authenticates Accessing a registration request reply message, the access registration request reply message including an equivalent public land mobile network local access indication information, wherein the equivalent public land mobile network local access The indication information is used to indicate that the access point name APN is served by a data gateway PGW deployed by the second P
  • the local public land mobile network local access indication information is located in a configuration parameter of the APN.
  • the eighth aspect provides a proxy server, where the first receiving unit is configured to receive a first authentication and authorization request message sent by the first proxy server, where the first authentication and authorization request message includes the first wireless local area network service.
  • Provider WLAN SP parameter information and/or first visited network identification parameter information, the first WLAN SP parameter information and the first visited network identification parameter information are information of the first visited public land mobile network VPLMN; generating a unit, configured to generate a second authentication and authorization request message according to the first authentication and authorization request message, where the second authentication and authorization request message includes second WLAN SP parameter information and second visited network identification parameter information,
  • the second WLAN SP parameter information is information of the first VPLMN
  • the second visited network identification parameter information is information of the second VPLMN, wherein the non-third generation partner plan 3GPP network deployed by the first VPLMN is a user
  • An access network of the device UE, the second VPLMN is a public land mobile network PLMN currently registered by the UE on the 3GPP side, and the first sending unit is configured
  • the generating unit detects whether the first authentication and authorization request message includes the first visited network identifier parameter information, if the first authentication and authorization request message is If the first visited network identifier parameter information is not included, the information of the second VPLMN is used as the second visited network identifier parameter information, and the second WLAN SP parameter information is set to be the same as the first WLAN SP parameter information; or If the first authentication and authorization request message includes the first visited network identification parameter information, and the first authentication and authorization request message does not include the first WLAN SP parameter information, the second WLAN SP is set.
  • the parameter information is the same as the first visited network identification parameter information, and the information of the second VPLMN is used as the second visited network identification parameter information; or, if the first authentication and authorization request message includes the first visited network identifier Parameter information, and the first authentication and authorization request message further includes first WLAN SP parameter information, and the second WLAN SP parameter information and the first WLA are set.
  • the N SP parameter information is the same, and the information of the second VPLMN is used as the second visited network identification parameter information.
  • the second authentication and authorization request message further includes indication information, where the indication information is used to indicate the first VPLMN and the first The second VPLMN is an equivalent PLMN.
  • the proxy server further includes: a second receiving unit, configured to receive an authentication and authorization reply message sent by the 3GPP AAA Server, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information, and a second sending unit, configured to: Sending the authentication and authorization reply message to the first proxy server, the authentication and authorization reply message being forwarded by the first proxy server to the non-3rd generation partner program N3G access network device, so that the N3G access network
  • the device selects a data gateway PGW for the access point name APN and establishes a packet data network PDN connection according to the equivalent public land mobile network local access indication information, where the equivalent public land mobile network local access indication information is used to indicate the The APN is served by a PGW deployed by the second PLMN equivalent to the first VPLMN; or the local public mobile network local access indication information includes the destination The information of the
  • the local public land mobile network local access indication information is located in a configuration parameter of the APN.
  • a ninth aspect provides a proxy server for establishing a connection, comprising: a receiving unit, configured to: after the user equipment UE is successfully authenticated, according to the received third generation partnership plan authentication authorization and charging server 3GPP AAA An authentication and authorization reply message sent by the server, generating an authentication and authorization reply message, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information; or, for receiving the 3GPP AAA Server And an authorization reply message, the authentication and authorization reply message includes an equivalent public land mobile network local access indication information, and a sending unit, configured to send the authentication and authorization reply message to the first proxy server, the authentication and the The authorization reply message is forwarded by the first proxy server to the non-3rd Generation Partnership Project N3G access network device, so that the N3G access network device uses the equivalent public land mobile network local access indication information as the access point name.
  • a receiving unit configured to: after the user equipment UE is successfully authenticated, according to the received third generation partnership plan authentication authorization and charging server 3GPP AAA An authentication and authorization reply message sent by the server,
  • the APN selects the data gateway PGW and establishes a packet data network PDN connection, wherein the first visited public land mobile network VPLMN deployment
  • the non-3rd Generation Partnership Project 3GPP network is the access network of the UE, and the second VPLMN is the public land mobile network PLMN currently registered by the UE on the 3GPP side, and the equivalent public land mobile network local access indication information is used to indicate
  • the APN is a data gateway PGW deployed by a second PLMN equivalent to the first VPLMN Providing the service; or, the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the local public land mobile network local access indication information is located in a configuration parameter of the APN.
  • a tenth aspect provides a proxy server for establishing a connection, comprising: a receiving unit, configured to receive an authentication and authorization reply message sent by the second proxy server after the UE successfully authenticates, the authentication and authorization
  • the reply message includes an equivalent public land mobile network local access indication information, or is used to generate an authentication and authorization reply message according to the initial authentication and authorization reply message sent by the second proxy server after the UE is successfully authenticated
  • the authentication and authorization reply message includes an equivalent public land mobile network local access indication information generated by the first proxy server, and a first sending unit, configured to send the non-third generation partner program N3G access network device
  • An authentication and authorization reply message, the authentication and authorization reply message includes the equivalent public land mobile network local access indication information, so that the N3G access network device according to the equivalent public land mobile network local access indication information is
  • the access point name APN selects the data gateway PGW and establishes a packet data network PDN connection, wherein the first visited public land mobile network VPL
  • the method further includes: a second sending unit, configured to determine, according to the home domain public land mobile network HPLMN information included in the network access identifier NAI of the UE, the HPLMN deployment
  • the 3GPP AAA Server can directly reach and send the first authentication and authorization request message to the 3GPP AAA server, so that the home domain server HSS authenticates the UE, where the first authentication and authorization request message includes A visit to the public land mobile network VPLMN information.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the access point name APN.
  • the HSS may obtain information of each VPLMN, and perform authentication and authorization judgment based on the foregoing. No; realize the authentication of the UE in the scenario of multiple visits.
  • FIG. 1 is a schematic diagram of a communication network scenario applicable to an embodiment of the present invention.
  • FIG. 2 is a schematic flow diagram of a method for establishing a connection, in accordance with one embodiment of the present invention.
  • FIG. 3 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 4 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 5 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 6 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 7 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 8 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 9 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 10 is a schematic flowchart of a method for establishing a connection according to another embodiment of the present invention.
  • FIG. 11 is a schematic block diagram of an HSS in accordance with one embodiment of the present invention.
  • FIG. 12 is a schematic block diagram of an HSS in accordance with another embodiment of the present invention.
  • Figure 13 is a schematic block diagram of a proxy server in accordance with one embodiment of the present invention.
  • Figure 14 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention.
  • FIG. 15 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention.
  • FIG. 16 is a schematic block diagram of an HSS in accordance with another embodiment of the present invention.
  • FIG. 17 is a schematic block diagram of an HSS in accordance with another embodiment of the present invention.
  • Figure 18 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention.
  • FIG. 19 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention.
  • 20 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention.
  • GSM Global System of Mobile communication
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • FDD Frequency Division Duplex
  • TDD Time Division Duplex
  • UMTS Universal Mobile Telecommunication System
  • WiMAX Worldwide Interoperability for Microwave Access
  • a user equipment may be referred to as a terminal (Mobile), a mobile station (Mobile Station, MS), a mobile terminal (Mobile Terminal), etc.
  • the user equipment may be A radio access network (Radio Access Network, referred to as "RAN") communicates with one or more core networks.
  • the user equipment may be a mobile phone (or "cellular" phone), a computer with a mobile terminal, or the like.
  • the user equipment can also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that exchanges voice and/or data with the wireless access network.
  • FIG. 1 is a schematic diagram of a communication network scenario applicable to an embodiment of the present invention.
  • the logical architecture of the mobile communication network as shown in Figure 1 includes:
  • Non-3GPP Non-3GPP, N3G
  • the UE 101 accesses the first VPLMN through the N3G access network device 102 (also referred to as VPLMN A, for example, the first VPLMN is a WLAN network), and then accesses the roaming 3GPP AAA Proxy through the 3GPP AAA Proxy A 103 of the WLAN network.
  • N3G access network device 102 also referred to as VPLMN A, for example, the first VPLMN is a WLAN network
  • the roaming 3GPP AAA Proxy through the 3GPP AAA Proxy A 103 of the WLAN network.
  • the B 104 deployed VPLMN B (which may also be referred to as a second VPLMN) is then authenticated and authenticated by the 3GPP AAA Server 105 and the HSS 106.
  • the N3G access network device 102 may be a WLAN network device.
  • the N3G access network device 102 may be a Trusted WLAN Access Network (TWAN).
  • TWAN Trusted WLAN Access Network
  • the N3G access network device 102 can be an evolved packet data network. (Evolved Packet Data Gateway, ePDG).
  • non-3GPP access network may include CDMA2000, WIMAX or WLAN, etc., which is not limited by the embodiment of the present invention.
  • the non-3GPP access network is used as the WLAN network, but the embodiment of the present invention is not limited thereto. this.
  • FIG. 2 is a schematic flow diagram of a method for establishing a connection, in accordance with one embodiment of the present invention.
  • the method as shown in FIG. 2 can be performed by the HSS, for example, by the HSS 106 of FIG.
  • the method shown in FIG. 2 includes:
  • the HSS receives the authentication request message, and the authentication request message includes a WLAN service provider (WLAN SP) parameter information and a Visited Network Identifier (Visited Network ID) parameter information, and the WLAN SP parameter
  • the information includes information of the first VPLMN
  • the visited network identification parameter information includes information of the second VPLMN, where the non-3GPP network deployed by the first VPLMN is the access network of the user equipment UE, and the second VPLMN is the UE currently registered on the 3GPP side.
  • the HSS may receive an authentication request message sent by the 3GPP AAA Server, where the authentication request message is used by the HSS to authenticate the UE.
  • the HSS authenticates the UE according to the information of the first VPLMN and/or the information of the second VPLMN.
  • the UE accesses the 3GPP network from the non-3GPP network (WLAN network) deployed by the first VPLMN (VPLMN A), and the first proxy server (3GPP AAA Proxy A) of the first VPLMN transmits the information of the first VPLMN (for example, The information of VPLMN A is sent to the second proxy server (3GPP AAA Proxy B) deployed by VPLMN B through the first authentication and authorization request message.
  • the 3GPP AAA Proxy B generates a second authentication and authorization request message according to the first authentication and authorization request message, where the second authentication and authorization request message includes information of the second VPLMN (VPLMN B information) and information of the first VPLMN (VPLMN) A message) is sent to the user's home domain 3GPP AAA Server and sent to the HSS.
  • the HSS performs authentication on the UE according to the second authentication and authorization request message.
  • the HSS can obtain information of each visited VPLMN, and perform authentication and authorization determination based on this; and implement authentication of the UE in a scenario of multiple visited locations. .
  • the information of the PLMN in this document may also be referred to as PLMN information, which may refer to the identifier (ID) information of the PLMN, and the information of the VPLMN may also be referred to as VPLMN information, which may refer to VPLMNID.
  • PLMN information may also be referred to as the identifier (ID) information of the PLMN
  • VPLMN information which may refer to VPLMNID
  • the information of VPLMN A may also be referred to as VPLMN A information, which may be referred to as VPLMN A ID
  • the information of VPLMN B may also be referred to as VPLMN B information, and may refer to VPLMN B ID.
  • the non-3GPP network deployed by the first VPLMN may also be referred to as the target access network of the user equipment UE.
  • the authentication request message further includes indication information, where the indication information is used to indicate that the first VPLMN and the second VPLMN are equivalent PLMNs.
  • the first VPLMN and the second VPLMN are equivalent PLMNs, in other words, the second VPLMN is an equivalent VPLM of the first VPLMN, or the first VPLMN is an equivalent VPLM of the second VPLMN, for the UE
  • the equivalent VPLMN can be regarded as a network of the UE home domain, and the UE can perform a Packet Data Network (PDN) connection through the PGW deployed by the equivalent PLMN; or can represent the operator of the first VPLMN and the second VPLMN.
  • PDN Packet Data Network
  • the definition of the equivalent PLMN can refer to the definition of the existing standard, which is not limited by the embodiment of the present invention.
  • the HSS determines whether the UE can access the 3GPP network from the second VPLMN. If the UE can access the 3GPP network from the second VPLMN, the authentication succeeds, if the UE cannot connect from the second VPLMN. If the 3GPP network enters the 3GPP network, the authentication fails. Alternatively, the HSS determines whether the UE can access the 3GPP network from the first VPLMN. If the UE can access the 3GPP network from the first VPLMN, the authentication succeeds if the UE cannot be from the first VPLMN.
  • the authentication fails; or the HSS determines whether the UE can access from the second VPLMN and whether the first VPLMN is the equivalent of the second VPLMN B, and if yes, the authentication succeeds if If any does not hold, the authentication fails; or, the HSS determines whether the UE can access from the first VPLMN and whether the UE can access from the second VPLMN, if all are established, the authentication succeeds, if any does not hold, Then the authentication failed.
  • the HSS may perform authentication on the UE based on the subscription. In other words, the HSS determines whether the UE can access the 3GPP network from the second VPLMN based on the subscription. If the UE can access the 3GPP network from the second VPLMN, the authentication succeeds.
  • the authentication fails; or the HSS determines whether the UE can access the 3GPP network from the first VPLMN based on the subscription, if the UE can access the 3GPP network from the first VPLMN, If the right is successful, if the UE cannot access the 3GPP network from the first VPLMN, the authentication fails; or, the HSS determines whether the UE can access from the second VPLMN based on the subscription and whether the first VPLMN is the equivalent PLMN of the second VPLMN B.
  • the HSS determines whether the UE can access from the first VPLMN and the UE can access from the second VPLMN based on the subscription, and if all are established, the authentication succeeds, if any If it is not established, the authentication fails.
  • the method of the embodiment of the present invention may further include:
  • the HSS sends an access registration request reply message, and the access registration request reply message includes an equivalent public land mobile network local access indication (ePLMN local-break out) indication information,
  • ePLMN local-break out equivalent public land mobile network local access indication
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of an Access Point Name (APN).
  • API Access Point Name
  • the HSS sends an authentication vector to the 3GPP AAA Server.
  • the 3GPP AAAServer authenticates the UE based on the authentication vector.
  • the authentication process is the same as the existing one, and the detailed description is omitted here as appropriate.
  • the 3GPP AAA Server sends an N3G IP Access Registration Request message to the HSS.
  • the HSS registers the 3GPP AAA Server ID to the HSS and delivers the UE subscription data.
  • the above UE subscription data includes an APN configuration parameter (APN-configuration).
  • the APN-Configuration contains the APN information allowed by the UE subscription.
  • a local access indication (local-breakout indication) is set in the APN-configuration corresponding to the APN. If the HSS receives the PLMN information to which the WLAN belongs, and the PLMN does not have a roaming relationship with the home domain HPLMN. If the WLAN SP information indicates the VPLMN A, but the VPLMN A does not have a roaming relationship with the HPLMN, the HSS sets the equivalent PLMN in the APN configuration parameter (APN-Configuration) (for example, the equivalent PLMN of the VPLMN A, that is, the VPLMN B).
  • APN configuration parameter for example, the equivalent PLMN of the VPLMN A, that is, the VPLMN B.
  • An access indication that is, an equivalent public land mobile network local access indication.
  • the indication indicates that this APN is served by a PGW deployed by an equivalent PLMN.
  • the indication contains a PLMN ID (eg, VPLMN B ID) information indicating that the APN is served by the PGW deployed by the PLMN (PLMN corresponding to the PLMN ID, eg, VPLMN B).
  • PLMN ID eg, VPLMN B ID
  • PLMN corresponding to the PLMN ID, eg, VPLMN B
  • the HSS sends an Access Registration Request Reply message (N3G IP Access Registration Response) to the 3GPP AAA Server.
  • N3G IP Access Registration Response N3G IP Access Registration Response
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA Proxy B, and then arrives at the 3GPP AAA Proxy A, and the authentication and authorization reply message includes the UE subscription data.
  • the above-mentioned UE subscription data includes an equivalent public land mobile network local access indication.
  • the 3GPP AAA Proxy A then sends an authentication and authorization reply message to the N3G access network (TWAN or ePDG), and the authentication and authorization reply message includes the UE subscription data.
  • the UE subscription data includes an equivalent public land mobile network local access indication.
  • the foregoing message may further include a visited network identifier.
  • the visited network identifier includes the roaming VPLMN ID of the 3GPP side currently accessed by the UE, such as VPLMN B.
  • the N3G access network selects a PGW for the APN according to the local public access indication of the equivalent public land mobile network. Specifically, when the equivalent public land mobile network local access includes the PLMN ID, the N3G access network selects the PGW deployed by the PLMN (for example, VPLMN B) for the APN. If the equivalent public land mobile network local access does not contain the PLMN ID, the N3G access network selects the PGW deployed by the PLMN (eg, VPLMN B) corresponding to the visited network identifier for this APN. The N3G access network establishes a PDN connection with the selected target PGW.
  • the PLMN for example, VPLMN B
  • the HSS sends the local public access indication information of the equivalent public land mobile network, so that the N3G access network deploys the data according to the PLMN indicated by the local public access indication information of the equivalent public land mobile network.
  • the gateway PGW provides services for the APN and establishes a PDN connection. Therefore, for some APNs, for example, the PDN connection of the VPLMN A when the VPLMN A and the HPLMN do not have a roaming relationship, the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention The embodiment can ensure that the service can be performed normally and improve the user experience.
  • a specific PLMN for example, VPLMN B
  • FIG. 3 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • the method as shown in FIG. 3 may be performed by the HSS, for example, by the HSS 106 of FIG.
  • the method shown in FIG. 3 includes:
  • the HSS receives an authentication request message, where the authentication request message includes the visited network identification parameter information, where the visited network identification parameter information includes the information of the first VPLMN or the information of the second VPLMN, where the non-3GPP network deployed by the first VPLMN For the access network of the UE, the second VPLMN is the PLMN currently registered by the UE on the 3GPP side;
  • the HSS may receive an authentication request message sent by the 3GPP AAA Server, where the authentication request message is used by the HSS to authenticate the UE.
  • the HSS authenticates the UE according to the information of the first VPLMN or the information of the second VPLMN.
  • the HSS After the UE is successfully authenticated, the HSS sends an access registration request reply message, where the access registration request reply message includes an equivalent public land mobile network local access indication information.
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the UE accesses the first proxy server from the WLAN network (VPLMN A) to which the first proxy server (3GPP AAA proxy A) belongs, and sends the information (VPLMN A information) of the first VPLMN through the first authentication and authorization request message.
  • the 3GPP AAA Proxy B generates a second authentication and authorization request message according to the first authentication and authorization request message, where the second authentication and authorization request message includes information of the first VPLMN (VPLMN A information) or information of the second VPLMN (VPLMN)
  • the B information is sent to the user's home domain 3GPP AAA Server and sent to the HSS.
  • the HSS performs authentication on the UE according to the second authentication and authorization request message. After the UE is successfully authenticated, the HSS may send an access registration request reply message to the 3GPP AAA Server, and then send the local public access indication information of the equivalent public land mobile network to the N3G after passing through the second proxy server and the first proxy server.
  • the N3G access network selects the data gateway PGW deployed by the PLMN indicated by the local public access indication information of the equivalent public land mobile network to provide services for the APN, and establishes a PDN connection.
  • the HSS sends the local public access indication information of the equivalent public land mobile network, so that the N3G access network selects the data deployed by the PLMN indicated by the local public access indication information of the equivalent public land mobile network.
  • the gateway PGW provides services for the APN and establishes a PDN connection. Therefore, for some APNs, for example, the PDN connection of the VPLMN A when the VPLMN A and the HPLMN do not have a roaming relationship, the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention The embodiment can ensure that the service can be performed normally and improve the user experience.
  • a specific PLMN for example, VPLMN B
  • the HSS determines, according to the subscription, whether the UE can access the 3GPP network from the first VPLMN, if the UE can A VPLMN accesses the 3GPP network, and the authentication succeeds. If the UE cannot access the 3GPP network from the first VPLMN, the authentication fails.
  • the HSS determines, according to the subscription, whether the UE can access the 3GPP network from the second VPLMN, if The UE may access the 3GPP network from the second VPLMN, and the authentication succeeds. If the UE cannot access the 3GPP network from the second VPLMN, the authentication fails.
  • the equivalent public land mobile network local access indication information is located in the configuration parameter of the APN.
  • the HSS sets an equivalent PLMN local access indication in the APN configuration parameter (APN-Configuration), that is, an equivalent public land mobile network local access indication.
  • APN-Configuration an equivalent public land mobile network local access indication.
  • the indication indicates that this APN is served by a PGW deployed by an equivalent PLMN (second VPLMN) of the first VPLMN.
  • the indication contains the target PLMN ID (ie, the second VPLMN), indicating that the APN is served by the PGW deployed by the target PLMN.
  • the N3G access network select the data gateway PGW deployed by the PLMN indicated by the equivalent public land mobile network local access indication information to provide services for the APN, and establish a PDN connection.
  • a method for establishing a connection according to an embodiment of the present invention is described below from the second proxy server side in conjunction with FIGS. 4 and 5.
  • FIG. 4 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • the method as shown in FIG. 4 can be performed by a 3GPP AAA proxy, for example, by a second proxy server (3GPP AAA Proxy B 104) shown in FIG. 1.
  • the method as shown in FIG. 4 includes:
  • the second proxy server 3GPP AAA proxy receives the first authentication and authorization request message sent by the first proxy server, where the first authentication and authorization request message includes the first WLAN SP parameter information and/or the first visited network identifier parameter.
  • Information, the first WLAN SP parameter information and the first visited network identifier parameter information are information of the first VPLMN;
  • the second proxy server generates a second authentication and authorization request message according to the first authentication and authorization request message, where the second authentication and authorization request message includes the second WLAN SP parameter information and the second visited network identifier parameter information.
  • the second WLAN SP parameter information is the information of the first VPLMN
  • the second visited network identification parameter information is the information of the second VPLMN.
  • the non-3GPP network deployed by the first VPLMN is the access network of the user equipment, and the second VPLMN is a PLMN currently registered by the UE on the 3GPP side;
  • the second proxy server sends a second authentication and authorization request message, so that the HSS authenticates the UE according to the information of the first VPLMN and/or the information of the second VPLMN.
  • the UE accesses the 3GPP network from the non-3GPP network (WLAN network) deployed by the first VPLMN (VPLMN A), and the first proxy server (3GPP AAA Proxy A) of the first VPLMN uses the information of the first VPLMN (VPLMN A)
  • the information is sent to the second proxy server (3GPP AAA Proxy B) deployed by the VPLMN B through the first authentication and authorization request message.
  • the 3GPP AAA Proxy B generates a second authentication and authorization request message according to the first authentication and authorization request message, where the second authentication and authorization request message includes information of the second VPLMN (VPLMN B information) and information of the first VPLMN (VPLMN) A message) is sent to the user's home domain 3GPP AAA Server and sent to the HSS.
  • the HSS performs authentication on the UE according to the second authentication and authorization request message.
  • the HSS can obtain information of each visited VPLMN, and perform authentication and authorization determination based on this; and implement authentication of the UE in a scenario of multiple visited locations. .
  • the second proxy server in 410, the second proxy server generates a second authentication and authorization request message according to the first authentication and authorization request message, including:
  • the second proxy server detects whether the first authentication and authorization request message includes the first visited network identifier parameter information
  • the second proxy server uses the information of the second VPLMN as the second visited network identification parameter information, and sets the second WLAN SP parameter information and The first WLAN SP parameter information is the same;
  • the second proxy server sets the second WLAN SP.
  • the parameter information is the same as the first visited network identifier parameter information, and the second VPLMN information is used as the second visited network identifier parameter information;
  • the second proxy server sets the second WLAN SP.
  • the parameter information is the same as the first WLAN SP parameter information, and the information of the second VPLMN is used as the second visited network identification parameter information.
  • the 3GPP AAA Proxy B After receiving the authentication and authorization request message sent by the 3GPP AAA Proxy A, the 3GPP AAA Proxy B detects whether the PLMN information (also referred to as a second VPLMN or VPLMN B information) is included in the message, that is, whether the packet is detected. Contains the visited network identification parameters. If not, the visited network identification parameter is added in the above authentication and authorization request message, and is set as the PLMN ID (this PLMN information).
  • PLMN information also referred to as a second VPLMN or VPLMN B information
  • the 3GPP AAA Proxy detects whether the above parameter is VPLMN B,
  • the 3GPP AAA Proxy will add the WLAN SP parameter and set the WLAN SP parameter to the VPLMN A contained in the visited network identifier. Replace the original VPLMN A with VPLMN B.
  • the new parameter indicates that the VPLMN A is an equivalent PLMN.
  • the 3GPP AAA Proxy B determines that the VPLMN A is an equivalent PLMN, the new parameter indicates that the VPLMN A is an equivalent PLMN.
  • the second authentication and authorization request message further includes indication information, where the indication information is used to indicate that the first VPLMN and the second VPLMN are equivalent PLMNs.
  • the second proxy server determines that the first proxy server is its equivalent PLMN
  • the 3GPP AAA Proxy B determines that the VPLMN A is its equivalent PLMN
  • a new parameter is added in the second authentication and authorization request message.
  • the VPLMN A is instructed to be an equivalent PLMN and sent to the 3GPP AAA Proxy Server for transmission to the HSS.
  • the method further includes:
  • the second proxy server receives the authentication and authorization reply message sent by the 3GPP AAA Server, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information;
  • the second proxy server sends an authentication and authorization reply message to the first proxy server, so that the first proxy server sends an authentication and authorization reply message to the N3G access network device, and the N3G access network device is configured according to the equivalent public land mobile network.
  • the local access indication information selects a data gateway PGW for the access point name APN and establishes a PDN connection.
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the HSS may send an access registration request reply message to the 3GPP AAA Server, and then pass the equivalent public land mobile network local access indication information after the second proxy server and the first proxy server.
  • the data gateway PGW deployed by the PLMN (eg, VPLMN B) indicated by the equivalent public land mobile network local access indication information is selected to provide services for the APN and establish a PDN connection.
  • the equivalent public land mobile network local access indication information is located in the configuration parameter of the APN.
  • the HSS sets an equivalent PLMN local access indication in the APN configuration parameter (APN-Configuration), that is, an equivalent public land mobile network local access indication.
  • APN-Configuration an equivalent public land mobile network local access indication.
  • the indication indicates that this APN is served by a PGW deployed by an equivalent PLMN (second VPLMN) of the first VPLMN.
  • the indication contains the target PLMN ID (ie, the second VPLMN), indicating that the APN is served by the PGW deployed by the target PLMN.
  • the N3G access network select the data gateway PGW deployed by the PLMN indicated by the equivalent public land mobile network local access indication information to provide services for the APN, and establish a PDN connection.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • FIG. 5 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • the method as shown in FIG. 5 can be performed by a 3GPP AAA proxy, for example, by a second proxy server (3GPP AAA Proxy B 104) shown in FIG. 1.
  • the method shown in FIG. 5 includes:
  • the second proxy server After the user equipment UE is successfully authenticated, the second proxy server generates an authentication and authorization reply message according to the received authentication and authorization reply message sent by the 3GPP AAA Server, where the authentication and authorization reply message includes an equivalent public land mobile.
  • the network local access indication information, or the second proxy server receives the authentication and authorization reply message sent by the 3GPP AAA Server, where the authentication and authorization reply message includes the equivalent public land mobile network local access indication information;
  • the second proxy server sends an authentication and authorization reply message to the first proxy server, and the authentication and authorization reply message is forwarded by the first proxy server to the non-3rd generation partner program N3G access network device, so that the N3G access is performed.
  • the network device selects the data gateway PGW for the access point name APN and establishes a packet data network PDN connection according to the local public access indication information of the equivalent public land mobile network, where the non-3GPP network deployed by the first VPLMN is the access network of the user equipment.
  • the second VPLMN is a PLMN currently registered by the UE on the 3GPP side, and the equivalent public land mobile network local access indication information is used to indicate that the APN is deployed by a second PLMN equivalent to the first VPLMN.
  • the PGW provides the service; or, the equivalent public land mobile network local access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • the HSS sends an authentication vector to the 3GPP AAA Server.
  • the 3GPP AAA Server authenticates the UE based on the authentication vector.
  • the authentication process is the same as the existing one, and the detailed description is omitted here as appropriate.
  • the 3GPP AAA Server sends an N3G IP Access Registration Request message to the HSS.
  • the HSS registers the 3GPP AAA Server ID to the HSS and delivers the UE subscription data.
  • the above UE subscription data includes an APN configuration parameter (APN-configuration).
  • the APN-Configuration contains the APN information allowed by the UE subscription.
  • a local access indication (local-breakout indication) is set in the APN-configuration corresponding to the APN. If the HSS receives the PLMN information to which the WLAN belongs, and the PLMN does not have a roaming relationship with the home domain HPLMN. If the WLAN SP information indicates VPLMN A, but there is no roaming relationship between VPLMN A and HPLMN, in one case, the HSS sets an equivalent PLMN local access indication in the APN configuration parameter (APN-Configuration), that is, equivalent public land mobile. Network local access indication.
  • APN configuration parameter APN-Configuration
  • the indication indicates that this APN is served by a PGW deployed by an equivalent PLMN (e.g., an equivalent PLMN that sets VPLMN A, that is, VPLMN B).
  • the indication contains a PLMN ID (eg, VPLMN B ID) information indicating that the APN is served by the PGW deployed by the PLMN (PLMN corresponding to the PLMN ID, eg, VPLMN B).
  • PLMN ID eg, VPLMN B ID
  • the HSS sends an Access Registration Request Reply message (N3G IP Access Registration Response) to the 3GPP AAA Server.
  • the above message includes an equivalent public land mobile network local access indication.
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA Proxy B.
  • the authentication and authorization reply message includes the UE subscription data.
  • the 3GPP AAA Proxy B is set equal in the APN configuration parameter (APN-Configuration).
  • the PLMN local access indication that is, the equivalent public land mobile network local access indication.
  • the 3GPP AAA Proxy B sends an authentication and authorization reply message to the 3GPP AAA Proxy A.
  • the foregoing authentication and authorization reply message includes UE subscription data, and the foregoing UE subscription data includes an equivalent public land mobile network local access indication.
  • the 3GPP AAA Proxy sends an authentication and authorization reply message to the N3G access network (TWAN or ePDG), including UE subscription data.
  • the UE subscription data includes an equivalent public land mobile network local access indication.
  • the foregoing message may further include a visited network identifier.
  • the visited network identifier includes the roaming VPLMN ID of the 3GPP side currently accessed by the UE, such as VPLMN B.
  • N3G access network based on equivalent public land mobile network
  • the ground access indication selects a PGW for the APN.
  • the equivalent public land mobile network local access includes the PLMN ID
  • the N3G access network selects the PGW deployed by the PLMN (for example, VPLMN B) for the APN.
  • the N3G access network selects the PGW deployed by the PLMN (eg, VPLMN B) corresponding to the visited network identifier for this APN.
  • the N3G access network establishes a PDN connection with the selected target PGW.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • the equivalent public land mobile network local access indication information is located in the configuration parameter of the APN.
  • the APN configuration parameter (APN-Configuration) is set with an equivalent PLMN local access indication, that is, an equivalent public land mobile network local access indication.
  • the indication may be generated by the HSS or may be generated by a second proxy server indicating that the APN is served by a PGW deployed by an equivalent PLMN (second VPLMN) of the first VPLMN.
  • the indication contains the target PLMN ID (ie, the second VPLMN), indicating that the APN is served by the PGW deployed by the target PLMN.
  • the N3G access network select the data gateway PGW deployed by the PLMN indicated by the equivalent public land mobile network local access indication information to provide services for the APN, and establish a PDN connection.
  • FIG. 6 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • the method as shown in FIG. 6 can be performed by a 3GPP AAA proxy, for example, can be performed by the first proxy server (3GPP AAA Proxy A103) shown in FIG. 1.
  • the method shown in FIG. 6 includes:
  • the first proxy server receives the authentication and authorization reply message sent by the second proxy server, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information, or After the right is successful, the first proxy server generates an authentication and authorization reply message according to the initial authentication and authorization reply message sent by the second proxy server, and the authentication and authorization reply message includes an equivalent public land mobile network generated by the first proxy server.
  • Local access indication information
  • the first proxy server sends an authentication and authorization reply message to the N3G access network device, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information, so that the N3G access network device is based on the equivalent public.
  • the land mobile network local access indication information selects a data gateway PGW for the access point name APN and establishes a packet data network PDN connection, where the non-3GPP network deployed by the first VPLMN is the access network of the UE, and the second VPLMN is the current UE.
  • the 3GPP side registered PLMN, the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN; or, the equivalent public land mobile network is local
  • the access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • the HSS sets an equivalent PLMN local access indication in the APN configuration parameter (APN-Configuration), that is, an equivalent public land mobile network local access indication.
  • APN-Configuration an equivalent public land mobile network local access indication.
  • the indication indicates that this APN is served by a PGW deployed by an equivalent PLMN.
  • the indication contains a PLMN ID, indicating that the APN is served by the PGW deployed by the PLMN.
  • the HSS replies to the 3GPP AAA Server by replying to the N3G IP Access Registration Response message.
  • the above message includes an equivalent public land mobile network local access indication.
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA Proxy A; in another case, the 3GPP AAA Proxy A sets an equivalent PLMN local access indication in the APN configuration parameter (APN-Configuration), that is, the equivalent public land. Mobile network local access indication.
  • the foregoing authentication and authorization reply message includes UE subscription data, and the foregoing UE subscription data includes an equivalent public land mobile network local access indication.
  • the 3GPP AAA Proxy A sends an authentication and authorization reply message to the N3G access network (TWAN or ePDG), and the authentication and authorization reply message includes the UE subscription data.
  • the UE subscription data includes an equivalent public land mobile network local access indication.
  • the foregoing message may further include a visited network identifier.
  • the visited network identifier includes the roaming VPLMN ID of the 3GPP side currently accessed by the UE, such as VPLMN B.
  • the N3G access network selects a PGW for the APN according to the local public access indication of the equivalent public land mobile network. Specifically, when the equivalent public land mobile network local access includes the PLMN ID, the N3G access network selects the PGW deployed by the PLMN for the APN. If the equivalent public land mobile network local access does not contain the PLMN ID, the N3G access network selects the PGW deployed by the PLMN corresponding to the visited network identifier for this APN. The N3G access network establishes a PDN connection with the selected target PGW.
  • the embodiment of the present invention may select a specific PLMN (for example, The PGW deployed by the VPLMN B) provides services for the APN.
  • the embodiment of the present invention can ensure that the service can be performed normally and improve the user experience.
  • the method of the embodiment of the present invention further includes: determining, by the first proxy server, the 3GPP AAA Server deployed by the HPLMN according to the home domain public land mobile network HPLMN information included in the network access identifier NAI of the UE. Directly arriving and transmitting a first authentication and authorization request message to the 3GPP AAA Server, so that the home domain server HSS authenticates the UE, wherein the first authentication and authorization request message includes the first visited public land mobile network VPLMN information.
  • the first proxy server receives the initial authentication and authorization request message sent by the non-3th generation partner program N3G access network device, where the initial authentication and authorization request message includes the network access identifier NAI of the user equipment UE;
  • the first proxy server (3GPP AAA Proxy A) of the first VPLMN sends the information of the first VPLMN (VPLMN A information) to the second proxy server deployed by the VPLMN B through the first authentication and authorization request message (3GPP AAA).
  • Proxy B after 3GPP AAA Proxy B, 3GPP AAA Server, and then sent to HSS.
  • the first proxy server determines that the 3GPP AAA Server deployed by the HPLMN can directly arrive according to the home domain public land mobile network HPLMN information included in the network access identifier NAI of the UE
  • the first of the first VPLMN The proxy server (3GPP AAA Proxy) directly transmits the information (VPLMN A information) of the first VPLMN to the 3GPP AAA Server through the first authentication and authorization request message, and then sends the information to the HSS. Thereafter, the HSS performs authentication on the UE according to the second authentication and authorization request message.
  • the APN configuration parameter (APN-Configuration) is set with an equivalent PLMN local access indication, that is, an equivalent public land mobile network local access indication.
  • the indication indicates that this APN is served by a PGW deployed by an equivalent PLMN (second VPLMN) of the first VPLMN.
  • the indication contains the target PLMN ID (ie, the second VPLMN), indicating that the APN is served by the PGW deployed by the target PLMN. So that the N3G access network provides services for the APN according to the data gateway PGW deployed by the PLMN indicated by the equivalent public land mobile network local access indication information, and establishes a PDN connection.
  • FIG. 7 the existing single VPLMN authentication mode is extended to multi-VPLMN authentication.
  • Figure 8 the single VPLMN authentication mode is still adopted, but the PDN connection establishment process after the authentication and authorization is passed is restricted, and the PDN connection establishment failure is avoided.
  • Figure 9 for WLAN networks The scenario where the VPLMN and the HPLMN also have a roaming relationship implements a simplified authentication and authorization process. The details will be described below with reference to FIGS. 7 to 9.
  • FIG. 7 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention. The method shown in Figure 7 includes:
  • the UE establishes a connection with the WLAN network.
  • the N3G access network sends an authentication and authorization request message to the 3GPP AAA proxy A.
  • the N3G access network (which is a TWAN when the WLAN network is a trusted WLAN, and an ePDG when the WLAN network is a non-trusted WLAN) sends an Authentication and Authorization Request message to the 3GPP AAA proxy A,
  • the above message contains the network access identifier NAI of the UE.
  • the NAI includes the PLMN information involved in the authentication path, and the 3GPP AAA Proxy searches for the next hop routing node according to the information in the NAI.
  • the foregoing message may include a WLAN SP (WLAN Service Provider) parameter, or/and a visited network identifier parameter, indicating the PLMN information to which the WLAN network belongs, such as the N3G access network setting the WLAN SP parameter or/and the visited network identifier to the VPLMN.
  • WLAN SP WLAN Service Provider
  • visited network identifier parameter indicating the PLMN information to which the WLAN network belongs, such as the N3G access network setting the WLAN SP parameter or/and the visited network identifier to the VPLMN.
  • the 3GPP AAA proxy A sends an authentication and authorization request message to the 3GPP AAA proxy B.
  • the 3GPP AAA Proxy A detects whether the PLMN (VPLMN A) information is included in the message, that is, whether the WLAN SP (WLAN Service Provider) parameter is included or Visit the network identification parameters. If not, the WLAN SP (WLAN Service Provider) parameter and/or the visited network identifier parameter are added to the foregoing authentication and authorization request message, and set as the PLMN ID (VPLMN A ID).
  • PLMN PLMN A
  • the 3GPP AAA Proxy detects whether the above parameters are the current PLMN ID, and if not, replaces the WLAN SP parameter with the PLMN ID.
  • the 3GPP AAA Proxy A continues to send the modified authentication and authorization request message to the next hop 3GPP AAA Proxy B.
  • the NAI HPLMN@VPLMN B
  • the 3GPP AAA proxy B sends an authentication and authorization request message to the 3GPP AAA Proxy Server.
  • the 3GPP AAA Proxy B After receiving the authentication and authorization request message sent by the 3GPP AAA Proxy A, the 3GPP AAA Proxy B detects whether the PLMN information is included in the message, that is, whether the visited network identification parameter is included. If not, the visited network identification parameter is added in the above authentication and authorization request message, and is set as the PLMN ID (VPLMN B ID).
  • the 3GPP AAA Proxy detects whether the above parameter is the PLMN ID.
  • the 3GPP AAA Proxy will add the WLAN SP parameter and set the WLAN SP parameter to the VPLMN A contained in the visited network identifier ( Also known as VPLMNA information). Replace the original VPLMN A with VPLMN B.
  • the 3GPP AAA Proxy B determines that the VPLMN A is an equivalent PLMN, the new parameter indicates that the VPLMN A is an equivalent PLMN.
  • the 3GPP AAA Proxy directly replaces the original visited network identifier with the VPLMN B, that is, the visited network identifier is VPLMN B.
  • the 3GPP AAA Proxy B determines that the VPLMN A is an equivalent PLMN, the new parameter indicates that the VPLMN A is an equivalent PLMN.
  • the 3GPP AAA Proxy B continues to send the modified authentication and authorization request message to the next hop 3GPP AAA Proxy Server.
  • the 3GPP AAA Proxy Server sends an authentication request message to the HSS.
  • the 3GPP AAA Proxy Server receives the authentication and authorization request message sent by the 3GPP AAA Proxy, where the message includes the WLAN SP and the visited network identification parameter, respectively indicating the PLMN information of different visited places.
  • the foregoing message further includes an indication information (indication parameter) indicating whether the WLAN SP and the PLMN included in the visited network identifier are equivalent PLMN relationships.
  • the 3GPP AAA Server sends an authentication request message to the HSS, where the message includes the WLAN SP and the visited network identification parameter, respectively indicating different visited PLMN information.
  • the foregoing message may further include indication information (parameter indication) indicating whether the WLAN SP and the PLMN included in the visited network identifier are equivalent PLMN relationships.
  • the HSS authenticates the UE.
  • the HSS After receiving the authentication request message sent by the 3GPP AAA Server, the HSS performs authentication and authentication on the access of the UE, and the scheme is as follows:
  • the HSS determines whether the UE can access the 3GPP network from the VPLMN B according to the VPLMN B information contained in the visited network identifier. If not, the authentication fails. Otherwise, the authentication is successful.
  • the HSS determines whether the UE can access the 3GPP network from the VPLMN A and can access the 3GPP network from the VPLMN B according to the WLAN SP and the visited network identity. If the UE can access from the VPLMN A and can access the 3GPP network from the VPLMN B, the authentication is successful. Otherwise, authentication fails.
  • the HSS determines whether the UE can access the 3GPP network from the VPLMN B according to the WLAN SP and the visited network identifier and the equivalent PLMN indication. If the UE can access the 3GPP network from the VPLMN B, and the VPLMN A has an equivalent relationship with the VPLMN B, the authentication is successful. Otherwise, authentication fails.
  • the HSS determines, according to the WLAN SP, whether the UE can access the 3GPP network from the VPLMN A, and if not, the authentication fails. Otherwise, the authentication is successful.
  • the HSS sends an authentication reply message to the 3GPP AAA Server.
  • the HSS sends an authentication vector (Authentication Response) to the 3GPP AAA Server.
  • the 3GPP AAA Server authenticates the UE based on the authentication vector.
  • the authentication process is the same as the existing one and will not be detailed here.
  • the 3GPP AAA Server sends an access registration request message to the HSS.
  • the 3GPP AAA Server sends an N3G IP Access Registration Request message to the HSS.
  • the HSS performs access network authorization.
  • the HSS performs access network authorization according to the WLAN SP and the visited network identity.
  • the HSS registers the 3GPP AAA Server identifier to the HSS, and delivers the UE subscription data.
  • the above UE subscription data includes an APN configuration parameter (APN-configuration).
  • the APN-Configuration contains the APN information allowed by the UE subscription. For some APNs, if the home operator allows the UE to select a local PGW to provide services for the APN, a local access indication (local-breakout indication) is set in the APN-configuration corresponding to the APN.
  • the HSS receives the PLMN information to which the WLAN belongs, and the PLMN does not have a roaming relationship with the home domain HPLMN.
  • WLAN SP information indicates VPLMN A, but VPLMN A and HPLMN
  • the HSS sets the local access indication of the equivalent PLMN (for example, the equivalent PLMN of the VPLMN A, that is, the VPLMN B) in the APN configuration parameter (APN-Configuration), that is, the equivalent public land mobile network local connection Enter the instructions.
  • This indication indicates that this APN is served by a PGW deployed by an equivalent PLMN (VPLMN B).
  • the indication contains a PLMN ID (eg, VPLMN B ID) indicating that the APN is served by a PGW deployed by the PLMN (eg, VPLMN B).
  • the HSS sends an access registration request reply message to the 3GPP AAA Server.
  • the HSS replies to the N3G IP Access Registration Response message to the 3GPP AAA Server.
  • the above message includes an equivalent public land mobile network local access indication.
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA ProxyA.
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA Proxy, including the UE subscription data.
  • the above-mentioned UE subscription data includes an equivalent public land mobile network local access indication.
  • the 3GPP AAA Proxy A sends an authentication and authorization reply message to the N3G access network.
  • the 3GPP AAA Proxy sends an authentication and authorization reply message to the N3G access network (TWAN or ePDG), and the authentication and authorization reply message includes the UE subscription data.
  • the UE subscription data includes an equivalent public land mobile network local access indication.
  • the foregoing message may further include a visited network identifier.
  • the visited network identifier includes the roaming VPLMN ID of the 3GPP side currently accessed by the UE, such as VPLMN B.
  • the N3G access network selects a PGW for the APN according to the local public access indication of the equivalent public land mobile network. Specifically, when the equivalent public land mobile network local access includes the PLMN ID, the N3G access network selects the PGW deployed by the PLMN for the APN. If the equivalent public land mobile network local access does not contain the PLMN ID, the N3G access network selects the PGW deployed by the PLMN (ie, VPLMN B) corresponding to the visited network identifier for this APN.
  • the PLMN ie, VPLMN B
  • the N3G access network establishes a PDN connection with the selected target PGW (eg, the PGW of the VPLMN B deployment).
  • the selected target PGW eg, the PGW of the VPLMN B deployment.
  • the HSS can obtain information of each visited VPLMN, and perform authentication and authorization determination based on this; and implement authentication of the UE in a scenario of multiple visited locations. .
  • the HSS sends the local public access indication information of the equivalent public land mobile network, so that the N3G access network is in accordance with the PLMN indicated by the local public access indication information of the equivalent public land mobile network.
  • the deployed data gateway PGW provides services for the APN and establishes a PDN connection. Therefore, for some APNs, for example, the PDN connection of the VPLMN A when the VPLMN A and the HPLMN do not have a roaming relationship, the embodiment of the present invention may select a PGW deployed by a specific PLMN (VPLMN B) to provide a service for the APN.
  • the embodiment of the invention can ensure that the service can be performed normally and improve the user experience.
  • FIG. 8 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention. The method shown in Figure 8 includes:
  • the UE establishes a connection with the WLAN network.
  • the N3G access network sends an authentication and authorization request message to the 3GPP AAA proxy A.
  • the N3G access network (TWAN for the trusted WLAN access and the ePDG for the untrusted WLAN access) sends an Authentication and Authorization Request message to the 3GPP AAA proxy A, where the message includes The UE network access identifier NAI.
  • the NAI includes the PLMN information involved in the authentication path, and the 3GPP AAA Proxy A searches for the next hop routing node according to the information in the NAI.
  • the 3GPP AAA proxy A sends an authentication and authorization request message to the 3GPP AAA proxy B.
  • the 3GPP AAA Proxy A receives the authentication and authorization request message sent by the N3G access network, and determines whether the visited network identifier is included. If not, the visited network identifier (VPLMN A ID) information is added, and an authentication and authorization request message is sent to the 3GPP AAA proxy B.
  • VPN A ID visited network identifier
  • the 3GPP AAA proxy B sends an authentication and authorization request message to the 3GPP AAA Proxy Server.
  • the 3GPP AAA Proxy B receives the authentication and authorization request message sent by the 3GPP AAA Proxy A, and determines whether the visited network identifier is VPLMN B (VPLMN B information). If it is different from VPLMN B, replaces the original PLMN with the VPLMN B identifier. Information and send an authentication and authorization request message to the 3GPP AAA Proxy Server.
  • VPLMN B information VPLMN B information
  • the 3GPP AAA Proxy Server sends an authentication request message to the HSS.
  • the 3GPP AAA Server receives the authentication and authorization request message sent by the 3GPP AAA Proxy B, where the message includes the visited network identifier.
  • the 3GPP AAA Server sends an authentication request message to the HSS, which includes the following from 3GPP.
  • the network ID of the visited place received by AAA Proxy B.
  • the HSS authenticates the UE.
  • the HSS authenticates the UE according to the visited network identifier. If the UE allows the PLMN (VPLMN B) indicated by the visited network identifier to access the 3GPP network, the authentication succeeds. Otherwise, authentication fails.
  • PLMN PLMN B
  • the HSS sends an authentication reply message to the 3GPP AAA Server.
  • the HSS sends the authentication vector to the 3GPP AAA Proxy Server.
  • the 3GPP AAA Proxy Server authenticates the UE based on the existing procedures, which will not be described in detail here.
  • the 3GPP AAA Server sends an access registration request message to the HSS.
  • the 3GPP AAA Proxy Server obtains the UE subscription data from the HSS. 809 corresponds to 709 and 710. To avoid repetition, details are not described herein.
  • the HSS sends an access registration request reply message to the 3GPP AAA Server.
  • the foregoing access registration request reply message includes UE subscription data.
  • UE subscription data contains APN configuration parameters
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA ProxyB.
  • the 3GPP AAA Server replies to the authentication and authorization reply message to the 3GPP AAA Proxy B.
  • the foregoing message includes the UE subscription data acquired from the HSS, and the UE subscription data includes the APN configuration parameter.
  • the 3GPP AAA Proxy B sends an authentication and authorization reply message to the 3GPP AAA Proxy A.
  • the 3GPP AAA Proxy B sets an equivalent PLMN local access indication in the APN configuration parameter (APN-Configuration), that is, an equivalent public land mobile network local access indication.
  • the 3GPP AAA Proxy B replies to the Authentication and Authorization Reply message to the 3GPP AAA Proxy A.
  • the above message includes an equivalent public land mobile network local access indication.
  • the foregoing message may further include a visited network identifier.
  • the visited network identifier contains the VPLMN B information, that is, the VPLMN B information to which the 3GPP AAA Proxy B belongs.
  • the 3GPP AAA Proxy A sends an authentication and authorization reply message to the N3G access network.
  • the 3GPP AAA Proxy A sends an authentication and authorization reply message to the N3G access network (TWAN or ePDG), including UE subscription data.
  • the UE subscription data contains an equivalent public land mobile network local access indication. If the visited network identifier is received at 812, the above message may also be included. Visit the network logo.
  • the N3G access network selects a PGW for the APN according to the local public access indication of the equivalent public land mobile network. Specifically, when the equivalent public land mobile network local access includes the PLMN ID, the N3G access network selects the PGW deployed by the PLMN for the APN. If the equivalent public land mobile network local access does not contain the PLMN ID, the N3G access network selects the PGW deployed by the PLMN corresponding to the visited network identifier for this APN.
  • the N3G access network establishes a PDN connection with the selected target PGW.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • FIG. 9 is a schematic flow chart of a method for establishing a connection according to another embodiment of the present invention.
  • the method shown in Figure 9 includes:
  • the UE establishes a connection with the WLAN network.
  • the N3G access network sends an authentication and authorization request message to the 3GPP AAA proxy A.
  • the N3G access network (TWAN for trusted WLAN access and ePDG for non-trusted WLAN access) sends an Authentication and Authorization Request message to the 3GPP AAA proxy A.
  • the above message includes the UE network connection. Enter the identifier NAI.
  • the NAI includes the PLMN information involved in the authentication path, and the 3GPP AAA Proxy searches for the next hop routing node according to the information in the NAI.
  • the AAA Proxy A determines whether the 3GPP AAA Server deployed by the HPLMN is reachable according to the home domain HPLMN information contained in the NAI. If reachable, the authentication and authorization request message is directly sent to the 3GPP AAA Server.
  • the foregoing message includes the visited network identification parameter information, and the visited network identification parameter information may be VPLMN A information.
  • the 3GPP AAA proxy B sends an authentication and authorization request message to the 3GPP AAA Proxy Server.
  • the AAA server receives the authentication and authorization request message sent by the AAA proxy A, which is the same as the existing process.
  • the 3GPP AAA Proxy Server sends an authentication request message to the HSS.
  • the AAA Server sends an authentication request message to the HSS, where the message includes the visited network identifier. Identify parameter information.
  • the HSS authenticates the UE.
  • the HSS determines, based on the VPLMN A indicated by the visited network identity, whether the UE allows access to the 3GPP network from the VPLMN A, and if so, the authentication is successful. Otherwise, authentication fails.
  • the HSS sends an authentication reply message to the 3GPP AAA Server.
  • the HSS sends the authentication vector to the 3GPP AAA Proxy Server.
  • the 3GPP AAA Proxy Server authenticates the UE based on the existing process, which will not be described in detail here.
  • the 3GPP AAA Server sends an access registration request message to the HSS.
  • the 3GPP AAA Proxy Server obtains the UE subscription data from the HSS. 908 corresponds to 809. To avoid repetition, it will not be repeated here.
  • the HSS sends an access registration request reply message to the 3GPP AAA Server.
  • the foregoing access registration request reply message includes UE subscription data.
  • the UE subscription data includes an APN configuration parameter, and the APN configuration parameter includes an equivalent public land mobile network local access indication information.
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA ProxyA.
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA Proxy A, including the UE subscription data.
  • the above-mentioned UE subscription data includes an equivalent public land mobile network local access indication.
  • 3GPP AAA Proxy A sends an authentication and authorization reply message to the N3G access network.
  • the 3GPP AAA Proxy sends an authentication and authorization reply message to the N3G access network (TWAN or ePDG), including UE subscription data.
  • the UE subscription data includes an equivalent public land mobile network local access indication.
  • the foregoing message may further include a visited network identifier.
  • the visited network identifier includes the roaming VPLMN ID of the 3GPP side currently accessed by the UE, such as VPLMN B (or VPLMNB ID).
  • the N3G access network selects a PGW for the APN according to the local public access indication of the equivalent public land mobile network. Specifically, when the local exchange of the equivalent public land mobile network includes the PLMN ID, the N3G access network selects the PGW deployed by the PLMN (VPLMN B) for the APN. If the equivalent public land mobile network local access does not contain the PLMN ID, the N3G access network selects the PGW deployed by the PLMN (ie, VPLMN B) corresponding to the visited network identifier for this APN.
  • the PLMN ie, VPLMN B
  • the N3G access network establishes a PDN connection with the selected target PGW.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • the ePLMN local breakout indication may be set by the HSS, corresponding to steps 908-912 in FIG. 9, and steps 908-912: for the successfully authenticated UE, the HSS sets the ePLMN local breakout indication, as in the embodiment FIG. Corresponding to 709-714, please refer to the related description in 709-714 of FIG.
  • FIG. 10 is a schematic flowchart of a method for establishing a connection according to another embodiment of the present invention.
  • the method shown in Figure 10 includes:
  • the UE establishes a connection with the WLAN network.
  • the N3G access network sends an authentication and authorization request message to the 3GPP AAA proxy A.
  • the N3G access network (TWAN for trusted WLAN access and ePDG for non-trusted WLAN access) sends an Authentication and Authorization Request message to the 3GPP AAA proxy A.
  • the above message includes the UE network connection. Enter the identifier NAI.
  • the NAI includes the PLMN information involved in the authentication path, and the 3GPP AAA Proxy searches for the next hop routing node according to the information in the NAI.
  • the AAA Proxy A determines whether the 3GPP AAA Server deployed by the HPLMN is reachable according to the home domain HPLMN information contained in the NAI. If reachable, the authentication and authorization request message is directly sent to the 3GPP AAA Server.
  • the foregoing message includes the visited network identification parameter information, and the visited network identification parameter information may be VPLMN A information.
  • the 3GPP AAA proxy B sends an authentication and authorization request message to the 3GPP AAA Proxy Server.
  • the AAA server receives the authentication and authorization request message sent by the AAA proxy A, which is the same as the existing process.
  • the 3GPP AAA Proxy Server sends an authentication request message to the HSS.
  • the AAA Server sends an authentication request message to the HSS, where the message includes the visited network identification parameter information.
  • the HSS authenticates the UE.
  • the HSS determines whether the UE allows the slave based on the VPLMN A indicated by the visited network identifier.
  • VPLMN A accesses the 3GPP network and authentication is successful if allowed. Otherwise, authentication fails.
  • the HSS sends an authentication reply message to the 3GPP AAA Server.
  • the HSS sends the authentication vector to the 3GPP AAA Proxy Server.
  • the 3GPP AAA Proxy Server authenticates the UE based on the existing process, which will not be described in detail here.
  • the 3GPP AAA Server sends an access registration request message to the HSS.
  • the 3GPP AAA Proxy Server obtains the UE subscription data from the HSS. 1008 corresponds to 709 and 710, and to avoid repetition, it will not be repeated here.
  • the HSS sends an access registration request reply message to the 3GPP AAA Server.
  • the foregoing access registration request reply message includes UE subscription data.
  • UE subscription data contains APN configuration parameters
  • the 3GPP AAA Server sends an authentication and authorization reply message to the 3GPP AAA ProxyB.
  • the 3GPP AAA Server replies to the authentication and authorization reply message to the 3GPP AAA Proxy B.
  • the foregoing message includes the UE subscription data acquired from the HSS, and the UE subscription data includes the APN configuration parameter.
  • the 3GPP AAA Proxy B sends an authentication and authorization reply message to the 3GPP AAA Proxy A.
  • the 3GPP AAA Proxy B sets an equivalent PLMN local access indication in the APN configuration parameter (APN-Configuration), that is, an equivalent public land mobile network local access indication.
  • the 3GPP AAA Proxy B replies to the Authentication and Authorization Reply message to the 3GPP AAA Proxy A.
  • the above message includes an equivalent public land mobile network local access indication.
  • the foregoing message may further include a visited network identifier.
  • the visited network identifier contains the VPLMN B information, that is, the VPLMN B information to which the 3GPP AAA Proxy B belongs.
  • the 3GPP AAA Proxy A sends an authentication and authorization reply message to the N3G access network.
  • the 3GPP AAA Proxy A sends an authentication and authorization reply message to the N3G access network (TWAN or ePDG), including UE subscription data.
  • the UE subscription data contains an equivalent public land mobile network local access indication. If the visited network identifier is received at 812, the above-mentioned message further includes the visited network identifier.
  • the N3G access network selects a PGW for the APN according to the local public access indication of the equivalent public land mobile network. Specifically, when the local exchange of the equivalent public land mobile network includes the PLMN ID, the N3G access network selects the PGW deployed by the PLMN (VPLMN B) for the APN. If the equivalent is public The common land mobile network local access does not contain the PLMN ID, and the N3G access network selects the PGW deployed by the PLMN (VPLMN B) corresponding to the visited network identifier for this APN.
  • the N3G access network establishes a PDN connection with the selected target PGW.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • the 3GPP AAA Proxy A sets the ePLMN local breakout indication, and 1008 to 1013 in the embodiment of the present invention may correspond to 809-814 of FIG. 8, and correspondingly, steps 908-912 and FIG. 8 are used in the embodiment.
  • the difference of 809-814 is that the ePLMN local breakout indication is set by 3GPP AAA Proxy B in FIG. 8, and the ePLMN local breakout indication is set by 3GPP AAA Proxy A in FIG. 9, but the 3GPP AAA Proxy A of FIG. 9 sets the ePLMN local breakout indication.
  • the ePLMN local breakout indication mode is set by the 3GPP AAA Proxy B similarly to FIG. 8. To avoid repetition, the detailed description is omitted here as appropriate.
  • FIGS. 1 through 10 a method for establishing a connection according to an embodiment of the present invention is described with reference to FIGS. 1 through 10.
  • an apparatus for establishing a connection according to an embodiment of the present invention will be described with reference to FIGS. 11 through 20.
  • FIG. 11 is a schematic block diagram of an HSS in accordance with one embodiment of the present invention. It should be noted that the HSS 1100 shown in FIG. 11 corresponds to FIG. 2, and various processes involving the HSS in the embodiment of FIG. 2 can be implemented, and detailed descriptions are omitted as appropriate to avoid repetition.
  • the HSS 1100 shown in FIG. 11 includes a receiving unit 1110 and an authentication unit 1120.
  • the receiving unit 1110 is configured to receive an authentication request message, where the authentication request message includes a wireless local area network server WLAN SP parameter information and a visited network identifier visited network identification parameter information, where the WLAN SP parameter information includes the first visited public land mobile
  • the information of the network VPLMN, the visited network identification parameter information includes the information of the second VPLMN, wherein the non-3GPP network deployed by the first VPLMN is the access network of the user equipment UE, and the second VPLMN is the public land that the UE is currently registered on the 3GPP side.
  • Mobile network PLMN Mobile network PLMN;
  • the authentication unit 1120 is configured to authenticate the UE according to the information of the first VPLMN and/or the information of the second VPLMN.
  • the HSS can obtain information of each visited VPLMN, and perform authentication and authorization determination based on this; Now the authentication of the UE in the scene of multiple visits.
  • the authentication request message further includes indication information, where the indication information is used to indicate that the first VPLMN and the second VPLMN are equivalent PLMNs.
  • the authentication unit 1120 determines whether the UE can access the 3GPP network from the second VPLMN. If the UE can access the 3GPP network from the second VPLMN, the authentication succeeds, if the UE cannot If the VPLMN accesses the 3GPP network, the authentication fails. Alternatively, the authentication unit 1120 determines whether the UE can access the 3GPP network from the first VPLMN. If the UE can access the 3GPP network from the first VPLMN, the authentication succeeds.
  • the authentication fails; or, the authentication unit 1120 determines whether the UE can access from the second VPLMN and whether the first VPLMN is the second VPLMN B, whether the same PLMN is established, if all are established If the authentication succeeds, if any does not hold, the authentication fails; or, the authentication unit 1120 determines whether the UE can access from the first VPLMN and whether the UE can access from the second VPLMN, if all are established, the authentication is performed. Success, if any does not hold, the authentication fails.
  • the embodiment of the present invention may further include a sending unit.
  • the sending unit is configured to send an access registration request reply message after the UE successfully authenticates, and the access registration request reply message includes Equivalent public land mobile network access indication equivalent public land mobile network local access indication information,
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN. .
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • FIG. 12 is a schematic block diagram of an HSS in accordance with another embodiment of the present invention. It should be noted that the HSS 1200 shown in FIG. 12 corresponds to FIG. 3, and various processes involving the HSS in the embodiment of FIG. 3 can be implemented. The detailed description is omitted as appropriate to avoid repetition.
  • the HSS 1200 shown in FIG. 12 includes a receiving unit 1210, an authentication unit 1220, and a transmitting unit 1230.
  • the receiving unit 1210 is configured to receive an authentication request message, where the authentication request message includes the visited network identification parameter information, where the visited network identification parameter information includes the information of the first VPLMN. Or the information of the second VPLMN, where the non-3GPP network deployed by the first VPLMN is the access network of the UE, and the second VPLMN is the PLMN currently registered by the UE on the 3GPP side;
  • the authenticating unit 1220 is configured to authenticate the UE according to the information of the first VPLMN or the information of the second VPLMN;
  • the sending unit 1230 is configured to send an access registration request reply message after the UE is successfully authenticated, where the access registration request reply message includes an equivalent public land mobile network local access indication information,
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the HSS sends the local public access indication information of the equivalent public land mobile network, so that the N3G access network deploys the data according to the PLMN indicated by the local public access indication information of the equivalent public land mobile network.
  • the gateway PGW provides services for the APN and establishes a PDN connection. Therefore, for some APNs, for example, the PDN connection of the VPLMN A when the VPLMN A and the HPLMN do not have a roaming relationship, the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention The embodiment can ensure that the service can be performed normally and improve the user experience.
  • a specific PLMN for example, VPLMN B
  • the visited network identifier parameter information includes the information of the first VPLMN
  • the authentication unit 1220 determines whether the UE can access the 3GPP network from the first VPLMN based on the subscription. If the UE can access the 3GPP network from the first VPLMN, the authentication succeeds. If the UE cannot access the 3GPP network from the first VPLMN, the authentication is performed. Power failed,
  • the authentication unit 1220 determines, according to the subscription, whether the UE can access the 3GPP network from the second VPLMN, and if the UE can access the 3GPP network from the second VPLMN, the authentication Successfully, if the UE cannot access the 3GPP network from the second VPLMN, the authentication fails.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN, and the equivalent public land mobile network local access indication information is used to indicate that the APN is equivalent to the first VPLMN.
  • the data gateway PGW deployed by the second PLMN provides the service, or the equivalent public land mobile network local access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • FIG. 13 is a schematic block diagram of a proxy server in accordance with one embodiment of the present invention. It should be noted that the proxy server 1300 shown in FIG. 13 corresponds to FIG. 4, and various processes related to the proxy server in the embodiment of FIG. 4 can be implemented, and detailed descriptions are omitted as appropriate to avoid repetition.
  • the proxy server 1300 shown in FIG. 13 includes a first receiving unit 1310, a generating unit 1320, and a first transmitting unit 1330.
  • the first receiving unit 1310 is configured to receive a first authentication and authorization request message sent by the first proxy server, where the first authentication and authorization request message includes the first WLAN SP parameter information and/or the first visited network identifier.
  • the parameter information, the first WLAN SP parameter information and the first visited network identifier parameter information are information of the first VPLMN;
  • the generating unit 1320 is configured to generate a second authentication and authorization request message according to the first authentication and authorization request message, where the second authentication and authorization request message includes the second WLAN SP parameter information and the second visited network identifier parameter information, where The second WLAN SP parameter information is the information of the first VPLMN, and the second visited network identification parameter information is the information of the second VPLMN.
  • the non-3GPP network deployed by the first VPLMN is the access network of the user equipment, and the second VPLMN is the UE.
  • the first sending unit 1330 is configured to send a second authentication and authorization request message, so that the HSS authenticates the UE according to the information of the first VPLMN and/or the information of the second VPLMN.
  • the HSS can obtain information of each visited VPLMN, and perform authentication and authorization determination based on this; and implement authentication of the UE in a scenario of multiple visited locations. .
  • the generating unit 1320 detects whether the first authentication and authorization request message includes the first visited network identification parameter information, if the first authentication and authorization request message does not include the first visited network identifier.
  • the information of the second VPLMN is used as the second visited network identification parameter information, and the second WLAN SP parameter information is set to be the same as the first WLAN SP parameter information; or, if the first authentication and authorization request message includes the first If the first WLAN SP parameter information is not included in the first WLAN SP parameter information, the second WLAN SP parameter information is set to be the same as the first visited network identifier parameter information, and the second VPLMN is set.
  • the information is used as the second visited network identification parameter information; or, if the first authentication and authorization request message includes the first visited network identification parameter information, and the first authentication and authorization request message further includes the first WLAN SP parameter information
  • the second WLAN SP parameter information is set to be the same as the first WLAN SP parameter information, and the second VPLMN information is used as the second visited network. Know Parameter information.
  • the second authentication and authorization request message further includes indication information, where the indication information is used to indicate that the first VPLMN and the second VPLMN are equivalent PLMNs.
  • the proxy server 1300 further includes: a second receiving unit and a second sending unit.
  • the second receiving unit is configured to receive an authentication and authorization reply message sent by the 3GPP AAA Server, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information
  • the second sending unit is configured to be the first
  • the proxy server sends an authentication and authorization reply message, so that the first proxy server sends an authentication and authorization reply message to the N3G access network device, and the N3G access network device receives the local access indication information according to the equivalent public land mobile network.
  • the ingress name APN selects the data gateway PGW and establishes a PDN connection.
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • FIG. 14 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention. It should be noted that the proxy server 1400 shown in FIG. 14 corresponds to FIG. 5, and various processes related to the proxy server in the embodiment of FIG. 5 can be implemented, and detailed descriptions are omitted as appropriate to avoid repetition.
  • the proxy server 1400 shown in FIG. 14 includes a receiving unit 1410 and a transmitting unit 1420.
  • the receiving unit unit 1410 is configured to generate an authentication and authorization reply message according to the authentication and authorization reply message sent by the received 3GPP AAA Server after the user equipment UE is successfully authenticated, and the authentication and authorization reply message includes an equivalent.
  • Public land mobile network local access indication information or, for receiving an authentication and authorization reply message sent by the 3GPP AAA Server, the authentication and authorization reply message includes an equivalent public land mobile network local access indication information;
  • the sending unit 1420 is configured to send an authentication and authorization reply message to the first proxy server, where the authentication and authorization reply message is forwarded by the first proxy server to the non-3rd generation partner program N3G access network device, so that the N3G access network
  • the device selects a data gateway PGW for the access point name APN and establishes a packet data network PDN connection according to the equivalent public land mobile network local access indication information
  • the non-third generation partner program 3GPP network deployed by the first VPLMN is for the UE An access network
  • the second VPLMN is a public land mobile network PLMN currently registered by the UE on the 3GPP side
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is deployed by the second PLMN equivalent to the first VPLMN.
  • the data gateway PGW provides the service; or the equivalent public land mobile network local access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN, and the equivalent public land mobile network local access indication information is used to indicate that the APN is equivalent to the first VPLMN.
  • the data gateway PGW deployed by the second PLMN provides the service, or the equivalent public land mobile network local access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • FIG. 15 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention. It should be noted that the proxy server 1500 shown in FIG. 15 corresponds to FIG. 6 and can implement various processes related to the proxy server in the embodiment of FIG. 6. The detailed description is omitted as appropriate to avoid repetition.
  • the proxy server 1500 shown in FIG. 15 includes a receiving unit 1510 and a first transmitting unit 1520.
  • the receiving unit 1510 is configured to: after the UE is successfully authenticated, receive an authentication and authorization reply message sent by the second proxy server, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information, or And after the UE is successfully authenticated, generating an authentication and authorization reply message according to the initial authentication and authorization reply message sent by the second proxy server, where the authentication and authorization reply message includes an equivalent public land mobile generated by the first proxy server.
  • Network local access indication information
  • the first sending unit 1520 is configured to send an authentication and authorization reply message to the non-3rd generation partner program N3G access network device, where the authentication and authorization reply message includes an equivalent public land mobile network local access indication information, so as to facilitate the N3G.
  • the access network device selects a data gateway PGW for the access point name APN according to the local public access indication information of the equivalent public land mobile network and establishes a PDN connection of the packet data network,
  • the non-third generation partner program 3GPP network deployed by the first VPLMN is for the UE An access network
  • the second VPLMN is a public land mobile network PLMN currently registered by the UE on the 3GPP side
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is deployed by the second PLMN equivalent to the first VPLMN.
  • the data gateway PGW provides the service; or the equivalent public land mobile network local access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • the proxy server 1500 of the embodiment of the present invention may further include a second sending unit, specifically, a second sending unit, configured to use a home domain included in the network access identifier NAI of the UE.
  • the public land mobile network HPLMN information determines that the 3GPP AAA Server deployed by the HPLMN can directly reach and send a first authentication and authorization request message to the 3GPP AAA Server, so that the home domain server HSS authenticates the UE, where the first authentication and The authorization request message includes information of the first visited public land mobile network VPLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • FIG. 16 is a schematic block diagram of an HSS in accordance with another embodiment of the present invention. It should be noted that the HSS 1600 shown in FIG. 16 and the HSS 1100 shown in FIG. 11 can implement the processes involved in the HSS in the embodiment of FIG. 2, and the detailed description is omitted as appropriate to avoid repetition.
  • the HSS 1600 as shown in FIG. 16 includes a processor 1610, a memory 1620, a bus system 1630, and a transceiver 1640.
  • the transceiver 1640 receives an authentication request message, where the authentication request message includes a wireless local area network server WLAN SP parameter information and a visited network identifier visited network identification parameter information, where the WLAN SP parameter information includes the first visited public land mobile network VPLMN
  • the information that the visited network identifier parameter information includes the information of the second VPLMN, where the non-3GPP network deployed by the first VPLMN is the access network of the user equipment UE, and the second VPLMN is the public land mobile network that the UE is currently registered on the 3GPP side.
  • the PLMN; the processor 1610 is configured to invoke the code stored in the memory 1620 by the bus system 1630 to authenticate the UE according to the information of the first VPLMN and/or the information of the second VPLMN.
  • the HSS may Obtaining information of each visited VPLMN, and performing authentication and authorization determination based on this; realizing authentication of the UE in a scenario of multiple visited places.
  • Processor 1610 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1610 or an instruction in the form of software.
  • the processor 1610 may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Array
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read only memory or an electrically erasable programmable memory, a register, etc. In the storage medium.
  • the storage medium is located in the memory 1620.
  • the processor 1610 reads the information in the memory 1620 and completes the steps of the foregoing method in combination with hardware.
  • the bus system 1630 may include a power bus, a control bus, and a status signal bus in addition to the data bus. Wait. However, for clarity of description, various buses are labeled as bus system 1630 in the figure.
  • the authentication request message further includes indication information, where the indication information is used to indicate that the first VPLMN and the second VPLMN are equivalent PLMNs.
  • the processor 1610 determines whether the UE can access the 3GPP network from the second VPLMN. If the UE can access the 3GPP network from the second VPLMN, the authentication succeeds, if the UE cannot be from the second VPLMN. If the 3GPP network is connected to the 3GPP network, the authentication fails. Alternatively, the processor 1610 determines whether the UE can access the 3GPP network from the first VPLMN. If the UE can access the 3GPP network from the first VPLMN, the authentication succeeds.
  • a VPLMN accesses the 3GPP network, authentication fails; or, the processor 1610 determines whether the UE can access from the second VPLMN and whether the first VPLMN is the equivalent of the second VPLMN B. If all are established, the authentication is performed. Success, if any does not hold, the authentication fails; or, the processor 1610 determines whether the UE can access from the first VPLMN and whether the UE can access from the second VPLMN, If all are established, the authentication is successful, and if any one is not established, the authentication fails.
  • the transceiver 1640 is further configured to: after the UE is successfully authenticated, send an access registration request reply message, where the access registration request reply message includes an equivalent public land mobile network access indication equivalent public Land mobile network local access indication information,
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • FIG. 17 is a schematic block diagram of an HSS in accordance with another embodiment of the present invention. It should be noted that the HSS 1700 shown in FIG. 17 corresponds to FIG. 12, and various processes involving the HSS in the embodiment of FIG. 3 can be implemented, and detailed descriptions are omitted as appropriate to avoid repetition.
  • the HSS 1700 as shown in FIG. 17 includes a processor 1710, a memory 1720, a bus system 1730, and a transceiver 1740.
  • the transceiver 1740 receives an authentication request message, where the authentication request message includes the visited network identification parameter information, where the visited network identification parameter information includes the information of the first VPLMN or the information of the second VPLMN, where the first VPLMN is deployed.
  • the non-3GPP network is the access network of the UE
  • the second VPLMN is the PLMN currently registered by the UE on the 3GPP side
  • the processor 1710 is configured to invoke the code stored in the memory 1720 through the bus system 1730, according to the information of the first VPLMN or the second
  • the information of the VPLMN authenticates the UE.
  • the transceiver 1740 sends an access registration request reply message, where the access registration request reply message includes an equivalent public land mobile network local access indication information.
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN;
  • the equivalent public land mobile network local access indication information includes information of the target PLMN, and is used to indicate that the APN is served by the PGW deployed by the target PLMN.
  • the HSS sends the local public access indication information of the equivalent public land mobile network, so that the N3G access network deploys the data according to the PLMN indicated by the local public access indication information of the equivalent public land mobile network.
  • the gateway PGW provides services for the APN and establishes a PDN connection. Therefore, for some APNs, for example, VPLMN A does not have a roaming relationship with HPLMN, In the embodiment of the present invention, the PGW of the specific PLMN deployment may be selected to provide services for the APN. Ensure that the service can be carried out normally and enhance the user experience.
  • the method disclosed in the above embodiments of the present invention may be applied to the processor 1710 or implemented by the processor 1710.
  • the processor 1710 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1710 or an instruction in a form of software.
  • the processor 1710 may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read only memory or an electrically erasable programmable memory, a register, etc. In the storage medium.
  • the storage medium is located in the memory 1720.
  • the processor 1710 reads the information in the memory 1720 and completes the steps of the foregoing method in combination with hardware.
  • the bus system 1730 may include a power bus, a control bus, and a status signal bus in addition to the data bus. Wait. However, for clarity of description, various buses are labeled as bus system 1730 in the figure.
  • the visited network identifier parameter information includes the information of the first VPLMN
  • the processor 1710 determines whether the UE can access the 3GPP network from the first VPLMN based on the subscription. If the UE can access the 3GPP network from the first VPLMN, the authentication is successful, and if the UE cannot access the 3GPP network from the first VPLMN, the authentication is performed. failure,
  • the processor 1710 determines, according to the subscription, whether the UE can access the 3GPP network from the second VPLMN, and if the UE can access the 3GPP network from the second VPLMN, the authentication succeeds. If the UE cannot access the 3GPP network from the second VPLMN, the authentication fails.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • FIG. 18 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention. It should be noted that the proxy server 1800 shown in FIG. 18 corresponds to FIG. 13 and can implement various processes related to the proxy server in the embodiment of FIG. 4, and the detailed description is omitted as appropriate to avoid repetition.
  • the proxy server 1800 shown in FIG. 18 includes a processor 1810, a memory 1820, a bus system 1830, and a transceiver 1840.
  • the transceiver 1840 receives the first authentication and authorization request message sent by the first proxy server, where the first authentication and authorization request message includes the first WLAN SP parameter information and/or the first visited network identifier parameter information, where The WLAN SP parameter information and the first visited network identification parameter information are information of the first VPLMN; the processor 1810 is configured to invoke the code stored in the memory 1820 through the bus system 1830, and generate according to the first authentication and authorization request message.
  • a second authentication and authorization request message where the second authentication and authorization request message includes the second WLAN SP parameter information and the second visited network identification parameter information, where the second WLAN SP parameter information is information of the first VPLMN, and the second visit The network identification parameter information is the information of the second VPLMN.
  • the non-3GPP network deployed by the first VPLMN is the access network of the user equipment
  • the second VPLMN is the PLMN currently registered by the UE on the 3GPP side
  • the transceiver 1840 sends the second authentication.
  • the authorization request message so that the HSS authenticates the UE according to the information of the first VPLMN and/or the information of the second VPLMN.
  • the HSS can obtain information of each visited VPLMN, and perform authentication and authorization determination based on this; and implement authentication of the UE in a scenario of multiple visited locations. .
  • the method disclosed in the above embodiments of the present invention may be applied to the processor 1810 or implemented by the processor 1810.
  • the processor 1810 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 1810 or an instruction in a form of software.
  • the processor 1810 may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • Software The module can be located in a random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory or electrically erasable programmable memory, registers, etc. In the medium.
  • the storage medium is located in the memory 1820.
  • the processor 1810 reads the information in the memory 1820 and completes the steps of the foregoing method in combination with hardware.
  • the bus system 1830 may include a power bus, a control bus, and a status signal bus in addition to the data bus. Wait. However, for clarity of description, various buses are labeled as bus system 1830 in the figure.
  • the processor 1810 detects whether the first authentication and authorization request message includes the first visited network identification parameter information, if the first authentication and authorization request message does not include the first visited network identifier.
  • the information of the second VPLMN is used as the second visited network identification parameter information, and the second WLAN SP parameter information is set to be the same as the first WLAN SP parameter information; or, if the first authentication and authorization request message includes the first If the first WLAN SP parameter information is not included in the first WLAN SP parameter information, the second WLAN SP parameter information is set to be the same as the first visited network identifier parameter information, and the second VPLMN is set.
  • the information is used as the second visited network identification parameter information; or, if the first authentication and authorization request message includes the first visited network identification parameter information, and the first authentication and authorization request message further includes the first WLAN SP parameter information
  • the second WLAN SP parameter information is set to be the same as the first WLAN SP parameter information, and the second VPLMN information is used as the second visited network identifier. Parameter information.
  • the second authentication and authorization request message further includes indication information, where the indication information is used to indicate that the first VPLMN and the second VPLMN are equivalent PLMNs.
  • the transceiver 1840 is further configured to receive an authentication and authorization reply message sent by the 3GPP AAA Server, where the authentication and authorization reply message includes an equivalent public land mobile network local. Accessing the indication information; and transmitting an authentication and authorization reply message to the first proxy server, the authentication and authorization reply message being forwarded by the first proxy server to the non-3rd generation partner program N3G access network device to enable N3G access
  • the network device selects a data gateway PGW for the access point name APN and establishes a packet data network PDN connection according to the equivalent public land mobile network local access indication information, where the equivalent public land mobile network local access indication information is used to indicate the APN
  • the PGW deployed by the second PLMN equivalent to the first VPLMN provides the service; or the equivalent public land mobile network local access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • FIG. 19 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention. It should be noted that the proxy server 1900 shown in FIG. 19 corresponds to FIG. 14 and can implement various processes related to the proxy server in the embodiment of FIG. 5, and the detailed description is omitted as appropriate to avoid repetition.
  • the proxy server 1900 shown in FIG. 19 includes a processor 1910, a memory 1920, a bus system 1930, and a transceiver 1940.
  • the processor 1910 is configured to invoke the code control transceiver 1940 stored in the memory 1920 by the bus system 1930 to generate a certificate according to the authentication and authorization reply message sent by the received 3GPP AAA Server after the user equipment UE is successfully authenticated.
  • the authorization reply message includes an equivalent public land mobile network local access indication information; or receives an authentication and authorization reply message sent by the 3GPP AAA Server, and the authentication and authorization reply message includes an equivalent public land Mobile network local access indication information; sending an authentication and authorization reply message to the first proxy server, the authentication and authorization reply message being forwarded by the first proxy server to the non-3rd generation partner program N3G access network device, so that the N3G
  • the access network device selects a data gateway PGW for the access point name APN and establishes a packet data network PDN connection according to the equivalent public land mobile network local access indication information, wherein the first VPLMN deploys a non-3rd generation partnership plan 3GPP network For the access network of the UE, the second VPLMN is the
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • Processor 1910 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 1910 or an instruction in a form of software.
  • the processor 1910 may be a general-purpose processor, a digital signal processor (DSP), or an application specific integrated circuit (Application). Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.
  • DSP digital signal processor
  • Application Application specific integrated circuit
  • ASIC Application Specific Integrated Circuit
  • FPGA Field Programmable Gate Array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read only memory or an electrically erasable programmable memory, a register, etc. In the storage medium.
  • the storage medium is located in the memory 1920.
  • the processor 1910 reads the information in the memory 1920 and completes the steps of the foregoing method in combination with hardware.
  • the bus system 1930 may include a power bus, a control bus, and a status signal bus in addition to the data bus. Wait. However, for clarity of description, various buses are labeled as bus system 1930 in the figure.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • FIG. 20 is a schematic block diagram of a proxy server in accordance with another embodiment of the present invention. It should be noted that the proxy server 2000 shown in FIG. 20 corresponds to FIG. 15 and can implement various processes related to the proxy server in the embodiment of FIG. 6. The detailed description is omitted as appropriate to avoid repetition.
  • the proxy server 2000 shown in FIG. 20 includes a processor 2010, a memory 2020, a bus system 2030, and a transceiver 2040.
  • the processor 2010 is configured to invoke the code stored in the memory 2020 through the bus system 2030, and the control transceiver 2040 receives the authentication and authorization reply message sent by the second proxy server after the UE is successfully authenticated, and authenticates and authorizes.
  • the reply message includes an equivalent public land mobile network local access indication information, or is used to generate an authentication and authorization reply message according to the initial authentication and authorization reply message sent by the second proxy server after the UE is successfully authenticated, and the authentication is performed.
  • the authorization reply message includes an equivalent public land mobile network local access indication information generated by the first proxy server; the authentication and authorization reply message is sent to the N3G access network device, and the authentication and authorization reply message includes an equivalent public land mobile Network local access indication information, so that the N3G access network device selects a data gateway PGW for the access point name APN and establishes a packet data network PDN connection according to the equivalent public land mobile network local access indication information,
  • the non-3GPP network deployed by the first VPLMN is the access network of the UE, and the second VPLMN
  • the equivalent public land mobile network local access indication information is used to indicate that the APN is served by the data gateway PGW deployed by the second PLMN equivalent to the first VPLMN; or, equivalent public
  • the land mobile network local access indication information includes information of the target PLMN for indicating that the APN is served by the PGW deployed by the target PLMN.
  • the embodiment of the present invention may select a PGW deployed by a specific PLMN (for example, VPLMN B) to provide services for the APN, and the present invention
  • a PGW deployed by a specific PLMN for example, VPLMN B
  • the embodiment can ensure that the service can be performed normally and improve the user experience.
  • Processor 2010 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 2010 or an instruction in a form of software.
  • the processor 2010 may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read only memory or an electrically erasable programmable memory, a register, etc. In the storage medium.
  • the storage medium is located in the memory 2020.
  • the processor 2010 reads the information in the memory 2020, and completes the steps of the foregoing method in combination with hardware.
  • the bus system 2030 may include a power bus, a control bus, and a status signal bus in addition to the data bus. Wait. However, for clarity of description, various buses are labeled as bus system 2030 in the figure.
  • the transceiver 2040 is further configured to determine, according to the home domain public land mobile network HPLMN information included in the network access identifier NAI of the UE, that the 3GPP AAA Server deployed by the HPLMN can directly reach the 3GPP AAA Server and directly to the 3GPP.
  • the AAA Server sends a first authentication and authorization request message, so that the home domain server HSS authenticates the UE, wherein the first authentication and authorization request message includes information of the first visited public land mobile network VPLMN.
  • the equivalent public land mobile network local access indication information is located in a configuration parameter of the APN.
  • system and “network” are used interchangeably herein.
  • the term “and/or” in this context is merely an association describing the associated object, indicating that there may be three relationships, for example, A and / or B, which may indicate that A exists separately, and both A and B exist, respectively. B these three situations.
  • the character "/" in this article generally indicates that the contextual object is an "or" relationship.
  • B corresponding to A means that B is associated with A, and B can be determined according to A.
  • determining B from A does not mean that B is only determined based on A, and that B can also be determined based on A and/or other information.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another The system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a computer.
  • computer readable media may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage media or other magnetic storage device, or can be used for carrying or storing in the form of an instruction or data structure.
  • connection may suitably be a computer readable medium.
  • the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave
  • coaxial cable , fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwave are included in the fixing of the associated media.
  • a disk and a disc include a compact disc (CD), a laser disc, a compact disc, a digital versatile disc (DVD), a floppy disk, and a Blu-ray disc, wherein the disc is usually magnetically copied, and the disc is The laser is used to optically replicate the data. Combinations of the above should also be included within the scope of the computer readable media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例公开一种用于建立连接的方法和设备，该方法包括：归属域服务器HSS接收鉴权请求消息，鉴权请求消息包括无线局域网络服务提供商WLAN SP参数信息和拜访地网络标识参数信息，WLAN SP参数信息包括第一拜访地公共陆地移动网络VPLMN的信息，拜访地网络标识参数信息包括第二VPLMN的信息，其中，第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，第二VPLMN为UE当前在3GPP侧注册的公共陆地移动网络PLMN；HSS根据第一VPLMN的信息和/或第二VPLMN的信息对UE进行鉴权。本发明实施例可以对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个VPLMN的信息，并基于此进行鉴权与授权判别；实现在多拜访地的场景下UE的鉴权。

Description

用于建立连接的方法和设备 技术领域
本发明实施例涉及通信领域，并且更具体地，涉及一种用于建立连接的方法和设备。
背景技术
为了应对无线宽带技术的挑战，保持第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)网络的领先优势，3GPP在2004年底制定了移动通信网络的长期演进计划(Long Term Evolution，LTE)，在此演进计划的指导下，定义了新的移动通信网络架构。该架构比2G、3G网络更加扁平化，并且只保留了分组域(Packet Switching，PS)，因此可以称为演进的3GPP分组交换域(Evolved 3GPP Packet Switched Domain)，也可称之为演进的分组系统(Evolved Packet System，EPS)。
新的3GPP核心网络(Evolved Packet Core Network，EPC)不但支持3GPP接入技术，例如，演进的通用陆基无线接入网(Evolved Universal Terrestrial Radio Access Network,E-UTRAN)、陆地无线接入网(Terrestrial Radio Access Network，UTRAN)和GSM/EDGE无线通讯网络(GSM EDGE Radio Access Network，GERAN)，同时支持非3GPP接入技术，例如，CDMA2000(码分多址，Code Division Multiple Access 2000)、全球互联微波接入(Worldwide Interoperability for Microwave Access，WiMAX)、无线局域网(Wireless LAN,WLAN)。其中，WLAN接入网又可分为可信WLAN(trusted WLAN)与非可信WLAN(untrusted WLAN)。
现有技术中，UE从WLAN网络接入后，拜访地3GPP鉴权授权与计费代理服务器(3GPP Authentication,Authorization,and Accounting proxy，3GPP AAA proxy)会将本公共陆地移动网络(Public Land Mobile Network，PLMN)标识信息(PLMN ID)发送给用户设备(User Equipment，UE)的归属域服务器(Home Subscriber System，HSS)进行鉴权认证。
但是在一些漫游场景下，鉴权路径上需要经过两个拜访地的3GPP AAA Proxy，现有技术中，由于归属域HSS只能对单个拜访地公共陆地移动网络(Visited Public Land Mobile Network，VPLMN)进行鉴权认证，因此无法 满足多拜访地场景下(例如，两个拜访地，3GPP侧的拜访地与WLAN侧的拜访地)的鉴权与授权需求。
发明内容
本发明实施例提供了一种用于建立连接的方法和设备，该方法能够在存在多拜访地的场景下，实现UE的鉴权。
第一方面，提供了一种用于建立连接的方法，包括:归属域服务器HSS接收鉴权请求消息，该鉴权请求消息包括无线局域网络服务提供商WLAN SP参数信息和拜访地网络标识参数信息，该WLAN SP参数信息包括第一拜访地公共陆地移动网络VPLMN的信息，该拜访地网络标识参数信息包括第二VPLMN的信息，其中，该第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，该第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN；该HSS根据该第一VPLMN的信息和/或该第二VPLMN的信息对该UE进行鉴权。
结合第一方面，在第一种可能的实现方式中，该鉴权请求消息还包括指示信息，该指示信息用于指示该第一VPLMN与该第二VPLMN为等价的PLMN。
结合第一方面或第一种可能的实现方式，在第二种可能的实现方式中，该HSS根据该第一VPLMN的信息和/或该第二VPLMN的信息对该UE进行鉴权，包括：该HSS基于签约判断该UE是否可以从该第二VPLMN接入3GPP网络，如果该UE可以从该第二VPLMN接入3GPP网络，则鉴权成功，如果该UE不可以从该第二VPLMN接入3GPP网络，则鉴权失败，或者，该HSS基于签约判断该UE是否可以从该第一VPLMN接入3GPP网络，如果该UE可以从该第一VPLMN接入3GPP网络，则鉴权成功，如果该UE不可以从该第一VPLMN接入3GPP网络，则鉴权失败，或者，该HSS基于签约确定该UE可以从该第二VPLMN接入和该第一VPLMN是该第二VPLMN B的等价的PLMN是否都成立，如果都成立，鉴权成功，如果有任一不成立，则鉴权失败，或者，该HSS基于签约确定该UE可以从该第一VPLMN接入和该UE可以从该第二VPLMN接入是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败。
结合第一方面、第一至第二种可能的实现方式中的任一种可能的实现方 式，在第三种可能的实现方式中，在该HSS为该UE鉴权成功后，该方法还包括：该HSS发送接入注册请求回复消息，该接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，其中，该等价公共陆地移动网络本地接入指示信息用于指示接入点名称APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由该目标PLMN部署的PGW提供服务。
结合第三种可能的实现方式，在第四种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第二方面,提供了一种用于建立连接的方法，归属域服务器HSS接收鉴权请求消息，该鉴权请求消息包括拜访地网络标识参数信息，该拜访地网络标识参数信息包括第一拜访地公共陆地移动网络VPLMN的信息或第二VPLMN的信息，其中，该第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，该第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN；该HSS根据该第一VPLMN的信息或第二VPLMN的信息对该UE进行鉴权；在该HSS为该UE鉴权成功后，该HSS发送接入注册请求回复消息，该接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，其中，该等价公共陆地移动网络本地接入指示信息用于指示接入点名称APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由该目标PLMN部署的PGW提供服务。
结合第二方面，在第一种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第三方面，提供了一种用于建立连接的方法，包括：第二代理服务器接收第一代理服务器发送的第一鉴权与授权请求消息，该第一鉴权与授权请求消息包括第一无线局域网络服务提供商WLAN SP参数信息和/或第一拜访地网络标识参数信息，该第一WLAN SP参数信息和该第一拜访地网络标识参数信息均为第一拜访地公共陆地移动网络VPLMN的信息；该第二代理服务器根据该第一鉴权与授权请求消息生成第二鉴权与授权请求消息，该第二鉴权与授权请求消息包括第二WLAN SP参数信息和第二拜访地网络标识参 数信息，该第二WLAN SP参数信息为该第一VPLMN的信息，该第二拜访地网络标识参数信息为第二VPLMN的信息，其中，该第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，该第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN；该第二代理服务器发送该第二鉴权与授权请求消息，以便HSS根据该第一VPLMN的信息和/或该第二VPLMN的信息对该UE进行鉴权。
结合第三方面，在第一种可能的实现方式中，该第二代理服务器根据该第一鉴权与授权请求消息生成第二鉴权与授权请求消息，包括：该第二代理服务器检测该第一鉴权与授权请求消息是否包括该第一拜访地网络标识参数信息，若该第一鉴权与授权请求消息不包括该第一拜访地网络标识参数信息，则该第二代理服务器将该第二VPLMN的信息作为第二拜访地网络标识参数信息，并设置该第二WLAN SP参数信息与该第一WLAN SP参数信息相同；或者，若该第一鉴权与授权请求消息包括该第一拜访地网络标识参数信息，且该第一鉴权与授权请求消息不包括该第一WLAN SP参数信息，则该第二代理服务器将设置该第二WLAN SP参数信息与该第一拜访地网络标识参数信息相同，将该第二VPLMN的信息作为第二拜访地网络标识参数信息；或者，若该第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且该第一鉴权与授权请求消息还包括第一WLAN SP参数信息，则该第二代理服务器将设置该第二WLAN SP参数信息与该第一WLAN SP参数信息相同，将该第二VPLMN的信息作为第二拜访地网络标识参数信息。
结合第三方面的第一种可能的实现方式，在第二种可能的实现方式中，该第二鉴权与授权请求消息还包括指示信息，该指示信息用于指示该第一VPLMN与该第二VPLMN为等价的PLMN。
结合第三方面、第三方面的第一至第二种可能的实现方式中的任一种可能的实现方式，在第三种可能的实现方式中，在该UE鉴权成功后，该方法还包括：该第二代理服务器接收3GPP鉴权授权与计费服务器3GPP AAA Server发送的鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；该第二代理服务器向该第一代理服务器发送该鉴权与授权回复消息，该鉴权与授权回复消息被该第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使该N3G接入网设备根据该等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关 PGW并建立分组数据网络PDN连接，其中，该等价公共陆地移动网络本地接入指示信息用于指示该APN由与该第一VPLMN等价的第二PLMN所部署的PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示该APN由该目标PLMN部署的PGW提供服务。
结合第三方面的第三种可能的实现方式，在第四种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第四方面，提供了一种用于建立连接的方法，包括：在用户设备UE鉴权成功后，第二代理服务器根据接收的第三代合作伙伴计划鉴权授权与计费服务器3GPP AAA Server发送的鉴权与授权回复消息，生成鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；或者，该第二代理服务器接收该3GPP AAA Server发送的鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；该第二代理服务器向第一代理服务器发送该鉴权与授权回复消息，该鉴权与授权回复消息被该第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使该N3G接入网设备根据该等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴计划3GPP网络为该UE的接入网，第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN，该等价公共陆地移动网络本地接入指示信息用于指示该APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示该APN由该目标PLMN部署的PGW提供服务。
结合第四方面的第一种可能的实现方式，在第二种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第五方面，提供了一种用于建立连接的方法，包括：在用户设备UE鉴权成功后，第一代理服务器接收第二代理服务器发送的鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；或者，该第一代理服务器根据该第二代理服务器发送的初始鉴权与授权回复消息生成鉴权与授权回复消息，该鉴权与授权回复消息包括由该第一代理服 务器生成的等价公共陆地移动网络本地接入指示信息；该第一代理服务器向非第三代合作伙伴计划N3G接入网设备发送该鉴权与授权回复消息，该鉴权与授权回复消息包括该等价公共陆地移动网络本地接入指示信息，以便于该N3G接入网设备根据该等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴计划3GPP网络为该UE的接入网，第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN，该等价公共陆地移动网络本地接入指示信息用于指示该APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示该APN由该目标PLMN部署的PGW提供服务。
结合第五方面，在第一种可能的实现方式中，还包括：该第一代理服务器根据该UE的网络接入标识符NAI中含有的归属域公共陆地移动网络HPLMN信息确定HPLMN部署的该3GPP AAA Server可直接到达，并向该3GPP AAA Server发送该第一鉴权与授权请求消息，以便归属域服务器HSS对该UE进行鉴权，其中，该第一鉴权与授权请求消息包括第一拜访地公共陆地移动网络VPLMN的信息。
结合第五方面或第五方面的第一种可能的实现方式，在第二种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第六方面，提供了一种归属域服务器HSS，包括：接收单元，用于接收鉴权请求消息，该鉴权请求消息包括无线局域网络服务提供商WLAN SP参数信息和拜访地网络标识参数信息，该WLAN SP参数信息包括第一拜访地公共陆地移动网络VPLMN的信息，该拜访地网络标识参数信息包括第二VPLMN的信息，其中，该第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，该第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN；鉴权单元，用于根据该第一VPLMN的信息和/或该第二VPLMN的信息对该UE进行鉴权。
结合第六方面，在第一种可能的实现方式中，该鉴权请求消息还包括指示信息，该指示信息用于指示该第一VPLMN与该第二VPLMN为等价的PLMN。
结合第六方面或第六方面的第一种可能的实现方式，在第二种可能的实现方式中，该鉴权单元基于签约判断该UE是否可以从该第二VPLMN接入3GPP网络，如果该UE可以从该第二VPLMN接入3GPP网络，则鉴权成功，如果该UE不可以从该第二VPLMN接入3GPP网络，则鉴权失败，或者，该鉴权单元基于签约判断该UE是否可以从该第一VPLMN接入3GPP网络，如果该UE可以从该第一VPLMN接入3GPP网络，则鉴权成功，如果该UE不可以从该第一VPLMN接入3GPP网络，则鉴权失败，或者，该鉴权单元基于签约确定该UE可以从该第二VPLMN接入和该第一VPLMN是该第二VPLMN B的等价的PLMN是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败，或者，该鉴权单元基于签约确定该UE可以从该第一VPLMN接入和该UE可以从该第二VPLMN接入是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败。
结合第六方面、第六方面的第一至第二种可能的实现方式中的任一种可能的实现方式，在第三种可能的实现方式中，还包括发送单元，用于在该UE鉴权成功后，发送接入注册请求回复消息，该接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，其中，该等价公共陆地移动网络本地接入指示信息用于指示接入点名称APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由该目标PLMN部署的PGW提供服务。
结合第六方面的第三种可能的实现方式，在第四种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第七方面，提供了一种归属域服务器HSS，包括：接收单元，用于接收鉴权请求消息，该鉴权请求消息包括拜访地网络标识参数信息，该拜访地网络标识参数信息包括第一拜访地公共陆地移动网络VPLMN的信息或第二VPLMN的信息，其中，该第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，该第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN；鉴权单元，用于根据该第一VPLMN的信息或第二VPLMN的信息对该UE进行鉴权；发送单元，用于在该UE鉴权成功后，发送接入注册请求回复消息，该接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，其中，该等价公共陆地移动网络本地接入 指示信息用于指示接入点名称APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由该目标PLMN部署的PGW提供服务。
结合第七方面，在第一种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第八方面，提供了一种代理服务器，第一接收单元，用于接收第一代理服务器发送的第一鉴权与授权请求消息，该第一鉴权与授权请求消息包括第一无线局域网络服务提供商WLAN SP参数信息和/或第一拜访地网络标识参数信息，该第一WLAN SP参数信息和该第一拜访地网络标识参数信息均为第一拜访地公共陆地移动网络VPLMN的信息；生成单元，用于根据该第一鉴权与授权请求消息生成第二鉴权与授权请求消息，该第二鉴权与授权请求消息包括第二WLAN SP参数信息和第二拜访地网络标识参数信息，该第二WLAN SP参数信息为该第一VPLMN的信息，该第二拜访地网络标识参数信息为第二VPLMN的信息，其中，该第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，该第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN，第一发送单元，用于发送该第二鉴权与授权请求消息，以便HSS根据该第一VPLMN的信息和/或该第二VPLMN的信息对该UE进行鉴权。
结合第八方面，在第一种可能的实现方式中，该生成单元检测该第一鉴权与授权请求消息是否包括该第一拜访地网络标识参数信息，若该第一鉴权与授权请求消息不包括该第一拜访地网络标识参数信息，则将该第二VPLMN的信息作为第二拜访地网络标识参数信息，并设置该第二WLAN SP参数信息与该第一WLAN SP参数信息相同；或者，若该第一鉴权与授权请求消息包括该第一拜访地网络标识参数信息，且该第一鉴权与授权请求消息不包括该第一WLAN SP参数信息，则将设置该第二WLAN SP参数信息与该第一拜访地网络标识参数信息相同，将该第二VPLMN的信息作为第二拜访地网络标识参数信息；或者，若该第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且该第一鉴权与授权请求消息还包括第一WLAN SP参数信息，则将设置该第二WLAN SP参数信息与该第一WLAN SP参数信息相同，将该第二VPLMN的信息作为第二拜访地网络标识参数信息。
结合第八方面的第一种可能的实现方式，在第二种可能的实现方式中，该第二鉴权与授权请求消息还包括指示信息，该指示信息用于指示该第一VPLMN与该第二VPLMN为等价的PLMN。
结合第八方面、第八方面的第一至第二种可能的实现方式中的任一种可能的实现方式，在第三种可能的实现方式中，在该UE鉴权成功后，该代理服务器还包括：第二接收单元，用于接收3GPP AAA Server发送的鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；第二发送单元，用于向该第一代理服务器发送该鉴权与授权回复消息，该鉴权与授权回复消息被该第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使该N3G接入网设备根据该等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，该等价公共陆地移动网络本地接入指示信息用于指示该APN由与该第一VPLMN等价的第二PLMN所部署的PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示该APN由该目标PLMN部署的PGW提供服务。
结合第八方面的第三种可能的实现方式，在第四种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第九方面，提供了一种用于建立连接的代理服务器，包括：接收单元，用于在用户设备UE鉴权成功后，根据接收的第三代合作伙伴计划鉴权授权与计费服务器3GPP AAA Server发送的鉴权与授权回复消息，生成鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；或者，用于接收该3GPP AAA Server发送的鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；发送单元，用于向该第一代理服务器发送该鉴权与授权回复消息，该鉴权与授权回复消息被该第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使该N3G接入网设备根据该等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴计划3GPP网络为该UE的接入网，第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN，该等价公共陆地移动网络本地接入指示信息用于指示该APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW 提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示该APN由该目标PLMN部署的PGW提供服务。
结合第九方面的第一种可能的实现方式，在第二种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于该APN的配置参数中。
第十方面，提供了一种用于建立连接的代理服务器，包括：接收单元，用于在该UE鉴权成功后，接收第二代理服务器发送的鉴权与授权回复消息，该鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，或者，用于在该UE鉴权成功后，根据该第二代理服务器发送的初始鉴权与授权回复消息生成鉴权与授权回复消息，该鉴权与授权回复消息包括由该第一代理服务器生成的等价公共陆地移动网络本地接入指示信息；第一发送单元，用于向非第三代合作伙伴计划N3G接入网设备发送该鉴权与授权回复消息，该鉴权与授权回复消息包括该等价公共陆地移动网络本地接入指示信息，以便于该N3G接入网设备根据该等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴计划3GPP网络为该UE的接入网，第二VPLMN为该UE当前在3GPP侧注册的公共陆地移动网络PLMN，该等价公共陆地移动网络本地接入指示信息用于指示该APN由与该第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，该等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示该APN由该目标PLMN部署的PGW提供服务。
结合第十方面，在第一种可能的实现方式中，还包括：第二发送单元，用于根据该UE的网络接入标识符NAI中含有的归属域公共陆地移动网络HPLMN信息确定HPLMN部署的该3GPP AAA Server可直接到达，并向该3GPP AAA Server发送该第一鉴权与授权请求消息，以便归属域服务器HSS对该UE进行鉴权，其中，该第一鉴权与授权请求消息包括第一拜访地公共陆地移动网络VPLMN的信息。
结合第十方面或第十方面的第一种可能的实现方式，在第二种可能的实现方式中，该等价公共陆地移动网络本地接入指示信息位于接入点名称APN的配置参数中。
基于上述技术方案，本发明实施例可以对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个VPLMN的信息，并基于此进行鉴权与授权判 别；实现在多拜访地的场景下UE的鉴权。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对本发明实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面所描述的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是可应用于本发明实施例的通信网络场景的示意图。
图2是根据本发明一个实施例的用于建立连接的方法的示意性流程图。
图3是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图4是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图5是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图6是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图7是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图8是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图9是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图10是根据本发明另一实施例的用于建立连接的方法的示意性流程图。
图11是根据本发明一个实施例的HSS的示意框图。
图12是根据本发明另一实施例的HSS的示意框图。
图13是根据本发明一个实施例的代理服务器的示意框图。
图14是根据本发明另一实施例的代理服务器的示意框图。
图15是根据本发明另一实施例的代理服务器的示意框图。
图16是根据本发明另一实施例的HSS的示意框图。
图17是根据本发明另一实施例的HSS的示意框图。
图18是根据本发明另一实施例的代理服务器的示意框图。
图19是根据本发明另一实施例的代理服务器的示意框图。
图20是根据本发明另一实施例的代理服务器的示意框图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明的一部分实施例，而不 是全部实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都应属于本发明保护的范围。
应理解，本发明实施例的技术方案可以应用于各种通信系统，例如：全球移动通讯(Global System of Mobile communication，GSM)系统、码分多址(Code Division Multiple Access，CDMA)系统、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统、通用分组无线业务(General Packet Radio Service，GPRS)、长期演进(Long Term Evolution，LTE)系统、LTE频分双工(Frequency Division Duplex，FDD)系统、LTE时分双工(Time Division Duplex，TDD)、通用移动通信系统(Universal Mobile Telecommunication System，UMTS)、全球互联微波接入(Worldwide Interoperability for Microwave Access，WiMAX)通信系统等。
还应理解，在本发明实施例中，用户设备(User Equipment，UE)可称之为终端(Terminal)、移动台(Mobile Station，MS)、移动终端(Mobile Terminal)等，该用户设备可以经无线接入网(Radio Access Network，简称为“RAN”)与一个或多个核心网进行通信，例如，用户设备可以是移动电话(或称为“蜂窝”电话)、具有移动终端的计算机等，例如，用户设备还可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语音和/或数据。
图1是可应用于本发明实施例的通信网络场景的示意图。如图1所示的移动通信网络的逻辑架构包括：
用户设备UE101，非3GPP(Non-3GPP，N3G)接入网设备102，3GPP AAA Proxy A 103，3GPP AAA Proxy B 104，3GPP鉴权授权与计费服务器(3GPP Authentication,Authorization,and Accounting Server，3GPP AAA Server)105和HSS 106。其中，UE101通过N3G接入网设备102接入第一VPLMN(又可以称为VPLMN A，例如，第一VPLMN为WLAN网络)，然后通过WLAN网络的3GPP AAA Proxy A 103接入漫游的3GPP AAA Proxy B 104部署的VPLMN B(又可以称为第二VPLMN)，之后通过3GPP AAA Server 105与HSS 106进行鉴权与认证。例如，N3G接入网设备102可以为WLAN网络设备，在可信WLAN接入的场景下，N3G接入网设备102可以为可信WLAN接入网(Trusted WLAN Access Network，TWAN)，在非可信WLAN接入的场景下，N3G接入网设备102可以为演进的分组数据网络 (Evolved Packet Data Gateway，ePDG)。
应理解，非3GPP接入网络可以包括CDMA2000，WIMAX或WLAN等，本发明实施例并不对此做限定，在下文中仅以非3GPP接入网络为WLAN网络举例说明，但本发明实施例并不限于此。
图2是根据本发明一个实施例的用于建立连接的方法的示意性流程图。如图2所示的方法可以由HSS执行，例如可以由图1中的HSS106执行。具体地，如图2所示的方法包括：
210，HSS接收鉴权请求消息，鉴权请求消息包括无线局域网络服务提供商(WLAN Service provider，WLAN SP)参数信息和拜访地网络标识(Visited Network Identifier，Visited Network ID)参数信息，WLAN SP参数信息包括第一VPLMN的信息，拜访地网络标识参数信息包括第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为用户设备UE的接入网，第二VPLMN为UE当前在3GPP侧注册的公共陆地移动网络PLMN；
具体地，HSS可以接收3GPP AAA Server发送的鉴权请求消息，该鉴权请求消息用于HSS对所示UE进行鉴权。
220，HSS根据第一VPLMN的信息和/或第二VPLMN的信息对UE进行鉴权。
具体而言，UE从第一VPLMN(VPLMN A)部署的非3GPP网络(WLAN网络)接入3GPP网络，第一VPLMN的第一代理服务器(3GPP AAA Proxy A)将第一VPLMN的信息(例如，VPLMN A的信息)通过第一鉴权与授权请求消息发送给VPLMN B部署的第二代理服务器(3GPP AAA Proxy B)。3GPP AAA Proxy B根据第一鉴权与授权请求消息生成第二鉴权与授权请求消息，第二鉴权与授权请求消息包括第二VPLMN的信息(VPLMN B信息)和第一VPLMN的信息(VPLMN A信息)并发送给用户归属域3GPP AAA Server，进而发送至HSS。HSS根据第二鉴权与授权请求消息进行对UE的鉴权。
因此，本发明实施例，对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个拜访地VPLMN的信息，并基于此进行鉴权与授权判别；实现在多拜访地的场景下UE的鉴权。
应理解，本文中的PLMN的信息也可以称为PLMN信息，可以指PLMN的标识(ID)信息，VPLMN的信息也可以称为VPLMN信息，可以指 VPLMNID。同样地，VPLMN A的信息也可以称为VPLMN A信息，可以指VPLMN A ID；VPLMN B的信息也可以称为VPLMN B信息，可以指VPLMN B ID。还应理解，第一VPLMN部署的非3GPP网络也可以称为用户设备UE的目标接入网。
可选地，作为另一实施例，鉴权请求消息还包括指示信息，指示信息用于指示第一VPLMN与第二VPLMN为等价的PLMN。
应理解，第一VPLMN与第二VPLMN为等价的PLMN，换句话说，第二VPLMN为第一VPLMN的等价VPLM，或者，第一VPLMN为第二VPLMN的等价VPLM，对于UE来说，等价VPLMN可以看作UE归属域的网络，UE可以通过等价PLMN部署的PGW进行分组数据网络(Packet Data Network，PDN)连接；或者，可以表示第一VPLMN的运营商与第二VPLMN的运营商之间达成的网络共用的一定协议，应注意，对于等价PLMN的理解可以参照现有标准的定义，本发明实施例并不对此做限定。
根据本发明实施例，在220中，HSS判断UE是否可以从第二VPLMN接入3GPP网络，如果UE可以从第二VPLMN接入3GPP网络，则鉴权成功，如果UE不可以从第二VPLMN接入3GPP网络，则鉴权失败；或者，HSS判断UE是否可以从第一VPLMN接入3GPP网络，如果UE可以从第一VPLMN接入3GPP网络，则鉴权成功，如果UE不可以从第一VPLMN接入3GPP网络，则鉴权失败；或者，HSS确定UE可以从第二VPLMN接入和第一VPLMN是第二VPLMN B的等价的PLMN是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败；或者，HSS确定UE可以从第一VPLMN接入和UE可以从第二VPLMN接入是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败。
具体地，HSS可以基于签约对UE进行鉴权，换句话说，HSS基于签约判断UE是否可以从第二VPLMN接入3GPP网络，如果UE可以从第二VPLMN接入3GPP网络，则鉴权成功，如果UE不可以从第二VPLMN接入3GPP网络，则鉴权失败；或者，HSS基于签约判断UE是否可以从第一VPLMN接入3GPP网络，如果UE可以从第一VPLMN接入3GPP网络，则鉴权成功，如果UE不可以从第一VPLMN接入3GPP网络，则鉴权失败；或者，HSS基于签约确定UE可以从第二VPLMN接入和第一VPLMN是第二VPLMN B的等价的PLMN是否都成立，如果都成立，则鉴权成功，如果 有任一不成立，则鉴权失败；或者，HSS基于签约确定UE可以从第一VPLMN接入和UE可以从第二VPLMN接入是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败。
可选地，作为另一实施例，在UE鉴权成功后，本发明实施例方法还可以包括：
HSS发送接入注册请求回复消息，接入注册请求回复消息包括等价公共陆地移动网络本地接入指示(ePLMN local-break out)指示信息,
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
进一步地，等价公共陆地移动网络本地接入指示信息位于接入点名称(Access Point Name，APN)的配置参数中。
具体而言，对于HSS鉴权成功的UE，HSS向3GPP AAA Server发送鉴权向量。3GPP AAAServer基于鉴权向量对UE进行鉴权。鉴权流程同现有方案，此处适当省略详细描述。对于3GPP AAA Server鉴权成功的UE，3GPP AAA Server向HSS发送接入注册请求消息(N3G IP Access Registration Request)。HSS将3GPP AAA Server标识注册到HSS，并下发UE签约数据。上述UE签约数据中含有APN配置参数(APN-configuration)。APN-Configuration中含有UE签约允许的APN信息。对于某些APN，如果归属运营商允许UE选择本地的PGW为此APN提供服务，则在此APN对应的APN-configuration中会设置允许本地接入指示(local-breakout指示)。如果HSS收到WLAN所属的PLMN信息，且该PLMN与归属域HPLMN不存在漫游关系。如WLAN SP信息指示VPLMN A，但VPLMN A与HPLMN不存在漫游关系，则HSS在APN配置参数中(APN-Configuration)设置等价的PLMN(例如置VPLMN A的等价的PLMN即VPLMN B)本地接入指示，即等价公共陆地移动网络本地接入指示。该指示表示此APN由等价的PLMN所部署的PGW提供服务。或者，该指示含有PLMN ID(例如，VPLMN B ID)信息，表示此APN由上述PLMN(PLMN ID所对应的PLMN，例如，VPLMN B)所部署的PGW提供服务。HSS向3GPP AAA Server发送接入注册请求回复消息(N3G IP Access Registration Response)。上述消息中包括等价公共陆 地移动网络本地接入指示。3GPP AAA Server向3GPP AAA Proxy B发送鉴权与授权回复消息，之后到达3GPP AAA Proxy A，鉴权与授权回复消息中包括UE签约数据。上述UE签约数据中包括等价公共陆地移动网络本地接入指示。然后3GPP AAA Proxy A向N3G接入网(TWAN或ePDG)发送鉴权与授权回复消息，鉴权与授权回复消息包括UE签约数据。上述UE签约数据中含有等价公共陆地移动网络本地接入指示。可选的，上述消息中还可以包括拜访地网络标识。拜访地网络标识中含有UE当前接入的3GPP侧的漫游VPLMN ID，如VPLMN B。N3G接入网根据等价公共陆地移动网络本地接入指示为APN选择PGW。具体来讲，当等价公共陆地移动网络本地接入含有PLMN ID时，N3G接入网为此APN选择上述PLMN(例如VPLMN B)部署的PGW。如果等价公共陆地移动网络本地接入不含有PLMN ID，则N3G接入网为此APN选择拜访地网络标识对应的PLMN(例如，VPLMN B)部署的PGW。N3G接入网与选择的目标PGW建立PDN连接。
本发明实施例在UE鉴权成功后，HSS发送等价公共陆地移动网络本地接入指示信息，以便于N3G接入网根据等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
图3是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图3所示的方法可以由HSS执行，例如可以由图1中的HSS106执行。具体地，如图3所示的方法包括：
310，HSS接收鉴权请求消息，鉴权请求消息包括拜访地网络标识参数信息，拜访地网络标识参数信息包括第一VPLMN的信息或第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为UE的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN；
具体地，HSS可以接收3GPP AAA Server发送的鉴权请求消息，该鉴权请求消息用于HSS对所示UE进行鉴权。
320，HSS根据第一VPLMN的信息或第二VPLMN的信息对UE进行鉴权；
330，在UE鉴权成功后，HSS发送接入注册请求回复消息，接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
具体地，UE从第一代理服务器(3GPP AAA proxy A)所属的WLAN网络(VPLMN A)接入第一代理服务器将第一VPLMN的信息(VPLMN A信息)通过第一鉴权与授权请求消息发送给VPLMN B部署的第二代理服务器(3GPP AAA Proxy B)。3GPP AAA Proxy B根据第一鉴权与授权请求消息生成第二鉴权与授权请求消息，第二鉴权与授权请求消息包括第一VPLMN的信息(VPLMN A信息)或第二VPLMN的信息(VPLMN B信息)并发送给用户归属域3GPP AAA Server，进而发送到HSS。HSS根据第二鉴权与授权请求消息进行对UE的鉴权。在UE鉴权成功后，HSS可以向3GPP AAA Server发送接入注册请求回复消息，然后经过第二代理服务器、第一代理服务器后将该等价公共陆地移动网络本地接入指示信息发送到N3G接入网,以便于N3G接入网选择等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。
本发明实施例在UE鉴权成功后，HSS发送等价公共陆地移动网络本地接入指示信息，以便于N3G接入网选择等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
可选地，作为另一实施例，在拜访地网络标识参数信息包括第一VPLMN的信息时，在320中，HSS基于签约判断UE是否可以从第一VPLMN接入3GPP网络，如果UE可以从第一VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第一VPLMN接入3GPP网络，则鉴权失败，
或者，在拜访地网络标识参数信息包括第二VPLMN的信息时，在320中，HSS基于签约判断UE是否可以从第二VPLMN接入3GPP网络，如果 UE可以从第二VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第二VPLMN接入3GPP网络，则鉴权失败。
根据本发明实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
具体而言，在UE鉴权成功后，HSS在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。该指示表示此APN由第一VPLMN的等价的PLMN(第二VPLMN)所部署的PGW提供服务。或者，该指示含有目标PLMN ID(即第二VPLMN)，表示此APN由上述目标PLMN所部署的PGW提供服务。以便于N3G接入网选择等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。
上文中，结合图2和图3从从HSS侧描述本发明实施例的用于建立连接的方法。
下面结合图图4和图5从第二代理服务器侧描述本发明实施例的用于建立连接的方法。
图4是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图4所示的方法可以由3GPP AAA proxy执行，例如，可以由图1所示的第二代理服务器(3GPP AAA Proxy B104)执行。具体地，如图4所示的方法包括：
410，第二代理服务器3GPP AAA proxy接收第一代理服务器发送的第一鉴权与授权请求消息，第一鉴权与授权请求消息包括第一WLAN SP参数信息和/或第一拜访地网络标识参数信息，第一WLAN SP参数信息和第一拜访地网络标识参数信息均为第一VPLMN的信息；
420，第二代理服务器根据第一鉴权与授权请求消息生成第二鉴权与授权请求消息，第二鉴权与授权请求消息包括第二WLAN SP参数信息和第二拜访地网络标识参数信息，第二WLAN SP参数信息为第一VPLMN的信息，第二拜访地网络标识参数信息为第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为用户设备的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN；
430，第二代理服务器发送第二鉴权与授权请求消息，以便HSS根据第一VPLMN的信息和/或第二VPLMN的信息对UE进行鉴权。
具体而言，UE从第一VPLMN(VPLMN A)部署的非3GPP网络(WLAN网络)接入3GPP网络，第一VPLMN的第一代理服务器(3GPP AAA Proxy A)将第一VPLMN的信息(VPLMN A信息)通过第一鉴权与授权请求消息发送给VPLMN B部署的第二代理服务器(3GPP AAA Proxy B)。3GPP AAA Proxy B根据第一鉴权与授权请求消息生成第二鉴权与授权请求消息，第二鉴权与授权请求消息包括第二VPLMN的信息(VPLMN B信息)和第一VPLMN的信息(VPLMN A信息)并发送给用户归属域3GPP AAA Server，进而发送至HSS。HSS根据第二鉴权与授权请求消息进行对UE的鉴权。
因此，本发明实施例，对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个拜访地VPLMN的信息，并基于此进行鉴权与授权判别；实现在多拜访地的场景下UE的鉴权。
可选地，作为另一实施例，在410中，第二代理服务器根据第一鉴权与授权请求消息生成第二鉴权与授权请求消息，包括：
第二代理服务器检测第一鉴权与授权请求消息是否包括第一拜访地网络标识参数信息，
若第一鉴权与授权请求消息不包括第一拜访地网络标识参数信息，则第二代理服务器将第二VPLMN的信息作为第二拜访地网络标识参数信息，并设置第二WLAN SP参数信息与第一WLAN SP参数信息相同；
或者，若第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且第一鉴权与授权请求消息不包括第一WLAN SP参数信息，则第二代理服务器将设置第二WLAN SP参数信息与第一拜访地网络标识参数信息相同，将第二VPLMN的信息作为第二拜访地网络标识参数信息；
或者，若第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且第一鉴权与授权请求消息还包括第一WLAN SP参数信息，则第二代理服务器将设置第二WLAN SP参数信息与第一WLAN SP参数信息相同，将第二VPLMN的信息作为第二拜访地网络标识参数信息。
具体而言，3GPP AAA Proxy B收到3GPP AAA Proxy A发送的鉴权与授权请求消息后，检测上述消息中是否含有本PLMN信息(也可以称为第二VPLMN或VPLMN B信息)，即检测是否含有拜访地网络标识参数。如果没有，则在上述鉴权与授权请求消息中新增拜访地网络标识参数，并设置为本PLMN ID(本PLMN信息)。
如果上述消息中含有拜访地网络标识，则3GPP AAA Proxy检测上述参数中是否为VPLMN B，
如果不是(如拜访地网络标识＝VPLMN A)，且上述消息中不含有WLAN SP参数，则3GPP AAA Proxy将新增WLAN SP参数，将WLAN SP参数设置为拜访地网络标识中含有的VPLMN A。并用VPLMN B替换原有的VPLMN A。可选的，如果3GPP AAA Proxy B判断VPLMN A为其等价的PLMN，则新增参数(指示信息)指示VPLMN A为其等价的PLMN。
如果不是，且上述消息中含有WLAN SP＝VPLMN A参数，则3GPP AAA Proxy直接用VPLMN B替换原有的拜访地网络标识＝VPLMN A。可选的，如果3GPP AAA Proxy B判断VPLMN A为其等价的PLMN，则新增参数指示VPLMN A为其等价的PLMN。
可选地，作为另一实施例，第二鉴权与授权请求消息还包括指示信息，指示信息用于指示第一VPLMN与第二VPLMN为等价的PLMN。
换句话说，在第二代理服务器确定第一代理服务器为其等价的PLMN后，如果3GPP AAA Proxy B判断VPLMN A为其等价的PLMN，则在第二鉴权与授权请求消息新增参数指示VPLMN A为其等价的PLMN，并向3GPP AAA Proxy Server发送，进而发送至HSS。
可选地，作为另一实施例，在UE鉴权成功后，方法还包括：
第二代理服务器接收3GPP AAA Server发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
第二代理服务器向第一代理服务器发送鉴权与授权回复消息，以便第一代理服务器向N3G接入网设备发送鉴权与授权回复消息，并以便N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立PDN连接，
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
具体而言，在UE鉴权成功后，HSS可以向3GPP AAA Server发送接入注册请求回复消息，然后经过第二代理服务器、第一代理服务器后将该等价公共陆地移动网络本地接入指示信息发送到N3G接入网,以便于N3G接入网 选择等价公共陆地移动网络本地接入指示信息指示的PLMN(例如，VPLMN B)所部署的数据网关PGW为APN提供服务，并建立PDN连接。
根据本发明实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
具体而言，在UE鉴权成功后，HSS在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。该指示表示此APN由第一VPLMN的等价的PLMN(第二VPLMN)所部署的PGW提供服务。或者，该指示含有目标PLMN ID(即第二VPLMN)，表示此APN由上述目标PLMN所部署的PGW提供服务。以便于N3G接入网选择等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
图5是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图5所示的方法可以由3GPP AAA proxy执行，例如，可以由图1所示的第二代理服务器(3GPP AAA Proxy B104)执行。具体地，如图5所示的方法包括：
510，在用户设备UE鉴权成功后，第二代理服务器根据接收的3GPP AAA Server发送的鉴权与授权回复消息，生成鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，或者，第二代理服务器接收3GPP AAA Server发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
520，第二代理服务器向第一代理服务器发送鉴权与授权回复消息，鉴权与授权回复消息被第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，第一VPLMN部署的非3GPP网络为用户设备的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关 PGW提供服务；或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
具体而言，对于HSS鉴权成功的UE，HSS向3GPP AAA Server发送鉴权向量。3GPP AAA Server基于鉴权向量对UE进行鉴权。鉴权流程同现有方案，此处适当省略详细描述。对于3GPP AAA Server鉴权成功的UE，3GPP AAA Server向HSS发送接入注册请求消息(N3G IP Access Registration Request)。HSS将3GPP AAA Server标识注册到HSS，并下发UE签约数据。上述UE签约数据中含有APN配置参数(APN-configuration)。APN-Configuration中含有UE签约允许的APN信息。对于某些APN，如果归属运营商允许UE选择本地的PGW为此APN提供服务，则在此APN对应的APN-configuration中会设置允许本地接入指示(local-breakout指示)。如果HSS收到WLAN所属的PLMN信息，且该PLMN与归属域HPLMN不存在漫游关系。如WLAN SP信息指示VPLMN A，但VPLMN A与HPLMN不存在漫游关系，一种情况，则HSS在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。该指示表示此APN由等价的PLMN(例如设置VPLMN A的等价的PLMN即VPLMN B)所部署的PGW提供服务。或者，该指示含有PLMN ID(例如，VPLMN B ID)信息，表示此APN由上述PLMN(PLMN ID所对应的PLMN，例如，VPLMN B)所部署的PGW提供服务。HSS向3GPP AAA Server发送接入注册请求回复消息(N3G IP Access Registration Response)。上述消息中包括等价公共陆地移动网络本地接入指示。3GPP AAA Server向3GPP AAA Proxy B发送鉴权与授权回复消息，鉴权与授权回复消息中包括UE签约数据；另一种情况，3GPP AAA Proxy B在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。之后，3GPP AAA Proxy B向3GPP AAA Proxy A发送鉴权与授权回复消息。上述鉴权与授权回复消息包括UE签约数据，上述UE签约数据中包括等价公共陆地移动网络本地接入指示。3GPP AAA Proxy将鉴权与授权回复消息发送给N3G接入网(TWAN或ePDG)，包括UE签约数据。上述UE签约数据中含有等价公共陆地移动网络本地接入指示。可选的，上述消息中还可以包括拜访地网络标识。拜访地网络标识中含有UE当前接入的3GPP侧的漫游VPLMN ID，如VPLMN B。N3G接入网根据等价公共陆地移动网络本 地接入指示为APN选择PGW。具体来讲，当等价公共陆地移动网络本地接入含有PLMN ID时，N3G接入网为此APN选择上述PLMN(例如VPLMN B)部署的PGW。如果等价公共陆地移动网络本地接入不含有PLMN ID，则N3G接入网为此APN选择拜访地网络标识对应的PLMN(例如VPLMN B)部署的PGW。N3G接入网与选择的目标PGW建立PDN连接。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
根据本发明实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
具体而言，在UE鉴权成功后，APN配置参数中(APN-Configuration)设置有等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。该指示可以由HSS生成，也可以由第二代理服务器生成，该指示表示此APN由第一VPLMN的等价的PLMN(第二VPLMN)所部署的PGW提供服务。或者，该指示含有目标PLMN ID(即第二VPLMN)，表示此APN由上述目标PLMN所部署的PGW提供服务。以便于N3G接入网选择等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。
下面结合图6从第一代理服务器的角度描述本发明实施例的用于建立连接的方法。
图6是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图6所示的方法可以由3GPP AAA proxy执行，例如，可以由图1所示的第一代理服务器(3GPP AAA Proxy A103)执行。具体地，如图6所示的方法包括：
610，在UE鉴权成功后，第一代理服务器接收第二代理服务器发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，或者在UE鉴权成功后，第一代理服务器根据第二代理服务器发送的初始鉴权与授权回复消息生成鉴权与授权回复消息，鉴权与授权回复消息包括由第一代理服务器生成的等价公共陆地移动网络本地接入指示信息；
620，第一代理服务器向N3G接入网设备发送鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，以便于N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，第一VPLMN部署的非3GPP网络为UE的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
具体而言，在UE鉴权成功后，一种情况，HSS在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。该指示表示此APN由等价的PLMN所部署的PGW提供服务。或者，该指示含有PLMN ID，表示此APN由上述PLMN所部署的PGW提供服务。HSS回复接入注册请求回复消息(N3G IP Access Registration Response)给3GPP AAA Server。上述消息中包括等价公共陆地移动网络本地接入指示。3GPP AAA Server发送鉴权与授权回复消息给3GPP AAA Proxy A；另一种情况，3GPP AAA Proxy A在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。上述鉴权与授权回复消息包括UE签约数据上述UE签约数据中包括等价公共陆地移动网络本地接入指示。3GPP AAA Proxy A将鉴权与授权回复消息发送给N3G接入网(TWAN或ePDG)，鉴权与授权回复消息包括UE签约数据。上述UE签约数据中含有等价公共陆地移动网络本地接入指示。可选的，上述消息中还可以包括拜访地网络标识。拜访地网络标识中含有UE当前接入的3GPP侧的漫游VPLMN ID，如VPLMN B。N3G接入网根据等价公共陆地移动网络本地接入指示为APN选择PGW。具体来讲，当等价公共陆地移动网络本地接入含有PLMN ID时，N3G接入网为此APN选择上述PLMN部署的PGW。如果等价公共陆地移动网络本地接入不含有PLMN ID，则N3G接入网为此APN选择拜访地网络标识对应的PLMN部署的PGW。N3G接入网与选择的目标PGW建立PDN连接。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如， VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
可选地，作为另一实施例，本发明实施例方法还包括：第一代理服务器根据UE的网络接入标识符NAI中含有的归属域公共陆地移动网络HPLMN信息确定HPLMN部署的3GPP AAA Server可直接到达，并向3GPP AAA Server发送第一鉴权与授权请求消息，以便归属域服务器HSS对UE进行鉴权，其中，第一鉴权与授权请求消息包括第一拜访地公共陆地移动网络VPLMN的信息。
具体地，第一代理服务器接收非第三代合作伙伴计划N3G接入网设备发送的初始鉴权与授权请求消息，初始鉴权与授权请求消息包括用户设备UE的网络接入标识符NAI；一种情况，第一VPLMN的第一代理服务器(3GPP AAA Proxy A)将第一VPLMN的信息(VPLMN A信息)通过第一鉴权与授权请求消息发送给VPLMN B部署的第二代理服务器(3GPP AAA Proxy B)，经过3GPP AAA Proxy B、3GPP AAA Server，进而发送到HSS。或者，另一种情况，在第一代理服务器根据UE的网络接入标识符NAI中含有的归属域公共陆地移动网络HPLMN信息确定HPLMN部署的3GPP AAA Server可直接到达时，第一VPLMN的第一代理服务器(3GPP AAA Proxy)将第一VPLMN的信息(VPLMN A信息)通过第一鉴权与授权请求消息直接发送给3GPP AAA Server，进而发送到HSS。之后，HSS根据第二鉴权与授权请求消息进行对UE的鉴权。在UE鉴权成功后，APN配置参数中(APN-Configuration)设置有等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。该指示表示此APN由第一VPLMN的等价的PLMN(第二VPLMN)所部署的PGW提供服务。或者，该指示含有目标PLMN ID(即第二VPLMN)，表示此APN由上述目标PLMN所部署的PGW提供服务。以便于N3G接入网根据等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。
上文中结合图1至图6详细描述了本发明实施例的用于数据连接的方法，下文将结合图7至图9的具体例子描述了本发明实施例的用于数据连接的方法。其中，图7实施例中将现有的单VPLMN鉴权方式扩展为多VPLMN鉴权。图8中仍然采用单VPLMN鉴权模式，但对鉴权与授权通过后的PDN连接建立流程有所限制，避免PDN连接建立失败。图9中针对WLAN网络 的VPLMN与HPLMN也存在漫游关系的场景，实现简化的鉴权与授权流程。下面针对图7至图9一一详细说明。
图7是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图7所示的方法包括：
701，UE与WLAN网络建立连接。
702，N3G接入网向3GPP AAA proxy A发送鉴权与授权请求消息。
具体地，N3G接入网(在WLAN网络为可信WLAN时为TWAN，在WLAN网络为非可信WLAN时为ePDG)发送鉴权与授权请求(Authentication and Authorization Request)消息到3GPP AAA proxy A，上述消息中含有UE的网络接入标识符NAI。NAI中包括鉴权路径上涉及的PLMN信息，3GPP AAA Proxy根据NAI中的信息查找下一跳路由节点。上述消息中可能包括WLAN SP(WLAN Service Provider)参数，或/和拜访地网络标识参数，指示WLAN网络所属的PLMN信息，如N3G接入网将WLAN SP参数或/和拜访地网络标识设置为VPLMN A信息。
应理解，在702中，NAI可以为VPLMN B！HPLMN@VPLMN A，即NAI＝VPLMN B！HPLMN@VPLMN A，表示鉴权请求的当前跳为VPLMN A或者说当前到达VPLMN A，下一跳为VPLMN B，再下一跳为HPLMN。
703，3GPP AAA proxy A向3GPP AAA proxy B发送鉴权与授权请求消息。
具体地，3GPP AAA Proxy A接收到N3G接入网发送的鉴权与授权请求消息后，检测上述消息中是否含本PLMN(VPLMN A)信息，即检测是否含有WLAN SP(WLAN Service Provider)参数或拜访地网络标识参数。如果没有，则在上述鉴权与授权请求消息中新增WLAN SP(WLAN Service Provider)参数和/或拜访地网络标识参数，并设置为本PLMN ID(VPLMN A ID)。
如果上述消息中含有WLAN SP，则3GPP AAA Proxy检测上述参数中是否为本PLMN ID，如果不是，则将WLAN SP参数替换成本PLMN ID。3GPP AAA Proxy A将修改后的鉴权与授权请求消息继续发送给下一跳3GPP AAA Proxy B。
其中，NAI＝HPLMN@VPLMN B WLAN SP＝VPLMN A，表示当前跳为VPLMNB，下一跳为HPLMN，WLAN SP参数信息为VPLMN A信息。
704，3GPP AAA proxy B向3GPP AAA Proxy Server发送鉴权与授权请求消息。
具体地，3GPP AAA Proxy B接收到3GPP AAA Proxy A发送的鉴权与授权请求消息后，检测上述消息中是否含有本PLMN信息，即检测是否含有拜访地网络标识参数。如果没有，则在上述鉴权与授权请求消息中新增拜访地网络标识参数，并设置为本PLMN ID(VPLMN B ID)。
如果上述消息中含有拜访地网络标识，则3GPP AAA Proxy检测上述参数中是否为本PLMN ID，
如果不是(如拜访地网络标识＝VPLMN A)，且上述消息中不含有WLAN SP参数，则3GPP AAA Proxy将新增WLAN SP参数，将WLAN SP参数设置为拜访地网络标识中含有的VPLMN A(也可以称为VPLMNA信息)。并用VPLMN B替换原有的VPLMN A。可选的，如果3GPP AAA Proxy B判断VPLMN A为其等价的PLMN，则新增参数指示VPLMN A为其等价的PLMN。
如果不是，且上述消息中含有WLAN SP＝VPLMN A参数，则3GPP AAA Proxy直接用VPLMN B替换原有的拜访地网络标识,即拜访地网络标识为VPLMN B。可选的，如果3GPP AAA Proxy B判断VPLMN A为其等价的PLMN，则新增参数指示VPLMN A为其等价的PLMN。
3GPP AAA Proxy B将修改后的鉴权与授权请求消息继续发送给下一跳3GPP AAA Proxy Server。
705，3GPP AAA Proxy Server向HSS发送鉴权请求消息。
具体地，3GPP AAA Proxy Server接收到3GPP AAA Proxy发送的鉴权与授权请求消息，上述消息中含有WLAN SP与拜访地网络标识参数，分别指示不同的拜访地的PLMN信息。可选的，上述消息中还含可以含有指示信息(指示参数)，指示WLAN SP与拜访地网络标识中含有的PLMN是否为等价的PLMN关系。
3GPP AAA Server发送鉴权请求消息到HSS，上述消息中包括WLAN SP与拜访地网络标识参数，分别指示不同的拜访地PLMN信息。可选的，上述消息中还可以含有指示信息(参数指示)，指示WLAN SP与拜访地网络标识中含有的PLMN是否为等价的PLMN关系。
706，HSS对UE鉴权。
具体地，HSS收到3GPP AAA Server发送的鉴权请求消息后，对UE的接入进行鉴权判别，方案如下：
HSS根据拜访地网络标识中含有的VPLMN B信息判断UE是否可以从VPLMN B接入3GPP网络。如果不可以，则鉴权失败。否则，鉴权成功。
或者，HSS根据WLAN SP与拜访地网络标识判别UE是否可以从VPLMN A接入3GPP网络且可以从VPLMN B接入3GPP网络。如果UE可以从VPLMN A接入且可以从VPLMN B接入3GPP网络，则鉴权成功。否则，鉴权失败。
或者，HSS根据WLAN SP与拜访地网络标识及等价的PLMN指示判断UE是否可以从VPLMN B接入3GPP网络。如果UE可以从VPLMN B接入3GPP网络，且VPLMN A与VPLMN B存在等价关系，则鉴权成功。否则，鉴权失败。
或者，HSS根据WLAN SP判断UE是否可以从VPLMN A接入3GPP网络，如果不可以，则鉴权失败。否则，鉴权成功。
707，HSS向3GPP AAA Server发送鉴权回复消息。
具体地，对于HSS鉴权成功的UE，HSS发送鉴权向量(鉴权回复消息(Authentication Response))给3GPP AAA Server。3GPP AAA Server基于鉴权向量对UE进行鉴权。鉴权流程同现有方案，此处不再详述。
708，鉴权成功。
709，3GPP AAA Server向HSS发送接入注册请求消息。
具体地，对于3GPP AAA Server鉴权成功的UE，3GPP AAA Server向HSS发送接入注册请求消息(N3G IP Access Registration Request)。
710，HSS进行接入网授权。
换句话说HSS根据WLAN SP与拜访地网络标识进行接入网授权。
具体地，HSS将3GPP AAA Server标识注册到HSS，并下发UE签约数据。上述UE签约数据中含有APN配置参数(APN-configuration)。APN-Configuration中含有UE签约允许的APN信息。对于某些APN，如果归属运营商允许UE选择本地的PGW为此APN提供服务，则在此APN对应的APN-configuration中会设置允许本地接入指示(local-breakout指示)。
如果HSS收到WLAN所属的PLMN信息，且该PLMN与归属域HPLMN不存在漫游关系。如WLAN SP信息指示VPLMN A，但VPLMN A与HPLMN 不存在漫游关系，则HSS在APN配置参数中(APN-Configuration)设置等价的PLMN(例如设置VPLMN A的等价的PLMN即VPLMN B)本地接入指示，即等价公共陆地移动网络本地接入指示。该指示表示此APN由等价的PLMN(VPLMN B)所部署的PGW提供服务。或者，该指示含有PLMN ID(例如，VPLMN B ID)，表示此APN由上述PLMN(例如，VPLMN B)所部署的PGW提供服务。
711，HSS向3GPP AAA Server发送接入注册请求回复消息。
具体地，HSS回复接入注册请求回复消息(N3G IP Access Registration Response)消息给3GPP AAA Server。上述消息中包括等价公共陆地移动网络本地接入指示。
712，3GPP AAA Server向3GPP AAA ProxyA发送鉴权与授权回复消息。
具体地，3GPP AAA Server发送鉴权与授权回复消息给3GPP AAA Proxy，包括UE签约数据。上述UE签约数据中包括等价公共陆地移动网络本地接入指示。
713，3GPP AAA Proxy A向N3G接入网发送鉴权与授权回复消息。
具体地，3GPP AAA Proxy将鉴权与授权回复消息发送给N3G接入网(TWAN或ePDG)，鉴权与授权回复消息包括UE签约数据。上述UE签约数据中含有等价公共陆地移动网络本地接入指示。可选的，上述消息中还可以包括拜访地网络标识。拜访地网络标识中含有UE当前接入的3GPP侧的漫游VPLMN ID，如VPLMN B。
N3G接入网根据等价公共陆地移动网络本地接入指示为APN选择PGW。具体来讲，当等价公共陆地移动网络本地接入含有PLMN ID时，N3G接入网为此APN选择上述PLMN部署的PGW。如果等价公共陆地移动网络本地接入不含有PLMN ID，则N3G接入网为此APN选择拜访地网络标识对应的PLMN(即VPLMN B)部署的PGW。
714，建立PDN连接。
N3G接入网与选择的目标PGW(例如，VPLMN B部署的PGW)建立PDN连接。
因此，本发明实施例，对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个拜访地VPLMN的信息，并基于此进行鉴权与授权判别；实现在多拜访地的场景下UE的鉴权。
进一步地，本发明实施例在UE鉴权成功后，HSS发送等价公共陆地移动网络本地接入指示信息，以便于N3G接入网根据等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(VPLMN B)部署的PGW为此APN提供服务。本发明实施例能够保证业务可以正常进行，提升用户体验。
图8是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图8所示的方法包括：
801，UE与WLAN网络建立连接。
802，N3G接入网向3GPP AAA proxy A发送鉴权与授权请求消息。
具体地，N3G接入网(可信WLAN接入时为TWAN，非可信WLAN接入时为ePDG)发送鉴权与授权请求(Authentication and Authorization Request)消息到3GPP AAA proxy A，上述消息中含有UE网络接入标识符NAI。NAI中包括鉴权路径上涉及的PLMN信息，3GPP AAA Proxy A根据NAI中的信息查找下一跳路由节点。
803，3GPP AAA proxy A向3GPP AAA proxy B发送鉴权与授权请求消息。
3GPP AAA Proxy A收到N3G接入网发送的鉴权与授权请求消息，判断是否含有拜访地网络标识。如果没有，则新增拜访地网络标识(VPLMN A ID)信息，并向3GPP AAA proxy B发送鉴权与授权请求消息。
804，3GPP AAA proxy B向3GPP AAA Proxy Server发送鉴权与授权请求消息。
3GPP AAA Proxy B收到3GPP AAA Proxy A发送的鉴权与授权请求消息，判断拜访地网络标识是否为VPLMN B(VPLMN B信息)，如果不同于VPLMN B，则用VPLMN B标识替换原有的PLMN信息，并向3GPP AAA Proxy Server发送鉴权与授权请求消息。
805，3GPP AAA Proxy Server向HSS发送鉴权请求消息。
具体地，3GPP AAA Server收到3GPP AAA Proxy B发送的鉴权与授权请求消息，上述消息中含有拜访地网络标识。
3GPP AAA Server发送鉴权请求消息给HSS，上述消息中包括从3GPP  AAA Proxy B收到的拜访地网络标识。
806，HSS对UE鉴权。
HSS根据拜访地网络标识对UE进行鉴权，如果UE允许从拜访地网络标识表示的PLMN(VPLMN B)接入3GPP网络，则鉴权成功。否则，鉴权失败。
807，HSS向3GPP AAA Server发送鉴权回复消息。
对于鉴权成功的UE，HSS下发鉴权向量到3GPP AAA Proxy Server。3GPP AAA Proxy Server基于现有流程对UE进行鉴权此处不再详述。
808，鉴权成功。
809，3GPP AAA Server向HSS发送接入注册请求消息。
对于鉴权成功的UE，3GPP AAA Proxy Server从HSS获取UE签约数据。809与709和710相对应，为避免重复，此处不再赘述。
810，HSS向3GPP AAA Server发送接入注册请求回复消息。
上述接入注册请求回复消息包括UE签约数据。UE签约数据中含有APN配置参数
811：3GPP AAA Server向3GPP AAA ProxyB发送鉴权与授权回复消息。
具体地，3GPP AAA Server回复鉴权与授权回复消息给3GPP AAA Proxy B，上述消息中包括从HSS获取的UE签约数据，UE签约数据中含有APN配置参数。
812：3GPP AAA Proxy B向3GPP AAA Proxy A发送鉴权与授权回复消息。
3GPP AAA Proxy B在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。3GPP AAA Proxy B回复鉴权与授权回复消息给3GPP AAA Proxy A。上述消息中包括等价公共陆地移动网络本地接入指示。可选的，上述消息中还可以包括拜访地网络标识。拜访地网络标识中含有VPLMN B信息，即3GPP AAA Proxy B所属的VPLMN B信息。
813，3GPP AAA Proxy A向N3G接入网发送鉴权与授权回复消息。
3GPP AAA Proxy A将鉴权与授权回复消息发送给N3G接入网(TWAN或ePDG)，包括UE签约数据。UE签约数据中含有等价公共陆地移动网络本地接入指示。如果在812收到拜访地网络标识，则上述消息中还可以包括 拜访地网络标识。
N3G接入网根据等价公共陆地移动网络本地接入指示为APN选择PGW。具体来讲，当等价公共陆地移动网络本地接入含有PLMN ID时，N3G接入网为此APN选择上述PLMN部署的PGW。如果等价公共陆地移动网络本地接入不含有PLMN ID，则N3G接入网为此APN选择拜访地网络标识对应的PLMN部署的PGW。
814，建立PDN连接。
N3G接入网与选择的目标PGW建立PDN连接。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
图9是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图9所示的方法包括：
901：UE与WLAN网络建立连接。
902：N3G接入网向3GPP AAA proxy A发送鉴权与授权请求消息。
N3G接入网(可信WLAN接入时为TWAN，非可信WLAN接入时为ePDG)发送鉴权与授权请求(Authentication and Authorization Request)消息到3GPP AAA proxy A，上述消息中含有UE网络接入标识符NAI。NAI中包括鉴权路径上涉及的PLMN信息，3GPP AAA Proxy根据NAI中的信息查找下一跳路由节点。
AAA Proxy A根据NAI中含有的归属域HPLMN信息判断HPLMN部署的3GPP AAA Server是否可达。如果可达，则直接发送鉴权与授权请求消息给3GPP AAA Server。上述消息中含有拜访地网络标识参数信息，拜访地网络标识参数信息可以为VPLMN A信息。
903：3GPP AAA proxy B向3GPP AAA Proxy Server发送鉴权与授权请求消息。
AAA Server收到AAA proxy A发送的鉴权与授权请求消息，同现有流程。
904：3GPP AAA Proxy Server向HSS发送鉴权请求消息。
AAA Server发送鉴权请求消息给HSS，上述消息中包括拜访地网络标 识参数信息。
905，HSS对UE鉴权。
HSS基于拜访地网络标识指示的VPLMN A判断UE是否允许从VPLMN A接入3GPP网络，如果允许则鉴权成功。否则，鉴权失败。
906，HSS向3GPP AAA Server发送鉴权回复消息。
对于鉴权成功的UE，HSS下发鉴权向量到3GPP AAA Proxy Server。3GPP AAA Proxy Server基于现有流程对UE进行鉴权，此处不再详述。
907，鉴权成功。
908，3GPP AAA Server向HSS发送接入注册请求消息。
对于鉴权成功的UE，3GPP AAA Proxy Server从HSS获取UE签约数据。908与809相对应，为避免重复，此处不再赘述。
909，HSS向3GPP AAA Server发送接入注册请求回复消息。
上述接入注册请求回复消息中包括UE签约数据。UE签约数据中含有APN配置参数，APN配置参数中包括等价公共陆地移动网络本地接入指示信息。
910，3GPP AAA Server向3GPP AAA ProxyA发送鉴权与授权回复消息。
具体地，3GPP AAA Server发送鉴权与授权回复消息给3GPP AAA Proxy A，包括UE签约数据。上述UE签约数据中包括等价公共陆地移动网络本地接入指示。
911，3GPP AAA Proxy A向N3G接入网发送鉴权与授权回复消息。
具体地，3GPP AAA Proxy将鉴权与授权回复消息发送给N3G接入网(TWAN或ePDG)，包括UE签约数据。上述UE签约数据中含有等价公共陆地移动网络本地接入指示。可选的，上述消息中还可以包括拜访地网络标识。拜访地网络标识中含有UE当前接入的3GPP侧的漫游VPLMN ID，如VPLMN B(或者为VPLMNB ID)。
N3G接入网根据等价公共陆地移动网络本地接入指示为APN选择PGW。具体来讲，当等价公共陆地移动网络本地接入含有PLMN ID时，N3G接入网为此APN选择上述PLMN(VPLMN B)部署的PGW。如果等价公共陆地移动网络本地接入不含有PLMN ID，则N3G接入网为此APN选择拜访地网络标识对应的PLMN(即VPLMN B)部署的PGW。
912，建立PDN连接。
N3G接入网与选择的目标PGW建立PDN连接。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
应理解，ePLMN local breakout指示可以由HSS设置，对应图9中的步骤908-912，并且，步骤908-912：对于鉴权成功的UE，HSS设置ePLMN local breakout指示，与实施例图7中的709-714相对应，具体可参见图7的709-714中的相关描述。
图10是根据本发明另一实施例的用于建立连接的方法的示意性流程图。如图10所示的方法包括：
1001：UE与WLAN网络建立连接。
1002：N3G接入网向3GPP AAA proxy A发送鉴权与授权请求消息。
N3G接入网(可信WLAN接入时为TWAN，非可信WLAN接入时为ePDG)发送鉴权与授权请求(Authentication and Authorization Request)消息到3GPP AAA proxy A，上述消息中含有UE网络接入标识符NAI。NAI中包括鉴权路径上涉及的PLMN信息，3GPP AAA Proxy根据NAI中的信息查找下一跳路由节点。
AAA Proxy A根据NAI中含有的归属域HPLMN信息判断HPLMN部署的3GPP AAA Server是否可达。如果可达，则直接发送鉴权与授权请求消息给3GPP AAA Server。上述消息中含有拜访地网络标识参数信息，拜访地网络标识参数信息可以为VPLMN A信息。
1003：3GPP AAA proxy B向3GPP AAA Proxy Server发送鉴权与授权请求消息。
AAA Server收到AAA proxy A发送的鉴权与授权请求消息，同现有流程。
1004：3GPP AAA Proxy Server向HSS发送鉴权请求消息。
AAA Server发送鉴权请求消息给HSS，上述消息中包括拜访地网络标识参数信息。
1005，HSS对UE鉴权。
HSS基于拜访地网络标识指示的VPLMN A判断UE是否允许从 VPLMN A接入3GPP网络，如果允许则鉴权成功。否则，鉴权失败。
1006，HSS向3GPP AAA Server发送鉴权回复消息。
对于鉴权成功的UE，HSS下发鉴权向量到3GPP AAA Proxy Server。3GPP AAA Proxy Server基于现有流程对UE进行鉴权，此处不再详述。
1007，鉴权成功。
1008，3GPP AAA Server向HSS发送接入注册请求消息。
对于鉴权成功的UE，3GPP AAA Proxy Server从HSS获取UE签约数据。1008与709和710相对应，为避免重复，此处不再赘述。
1009，HSS向3GPP AAA Server发送接入注册请求回复消息。
上述接入注册请求回复消息中包括UE签约数据。UE签约数据中含有APN配置参数
1010，3GPP AAA Server向3GPP AAA ProxyB发送鉴权与授权回复消息。
具体地，3GPP AAA Server回复鉴权与授权回复消息给3GPP AAA Proxy B，上述消息中包括从HSS获取的UE签约数据，UE签约数据中含有APN配置参数。
1011，3GPP AAA Proxy B向3GPP AAA Proxy A发送鉴权与授权回复消息。
3GPP AAA Proxy B在APN配置参数中(APN-Configuration)设置等价的PLMN本地接入指示，即等价公共陆地移动网络本地接入指示。3GPP AAA Proxy B回复鉴权与授权回复消息给3GPP AAA Proxy A。上述消息中包括等价公共陆地移动网络本地接入指示。可选的，上述消息中还可以包括拜访地网络标识。拜访地网络标识中含有VPLMN B信息，即3GPP AAA Proxy B所属的VPLMN B信息。
1012，3GPP AAA Proxy A向N3G接入网发送鉴权与授权回复消息。
3GPP AAA Proxy A将鉴权与授权回复消息发送给N3G接入网(TWAN或ePDG)，包括UE签约数据。UE签约数据中含有等价公共陆地移动网络本地接入指示。如果在812收到拜访地网络标识，则上述消息中还包括拜访地网络标识。
N3G接入网根据等价公共陆地移动网络本地接入指示为APN选择PGW。具体来讲，当等价公共陆地移动网络本地接入含有PLMN ID时，N3G接入网为此APN选择上述PLMN(VPLMN B)部署的PGW。如果等价公 共陆地移动网络本地接入不含有PLMN ID，则N3G接入网为此APN选择拜访地网络标识对应的PLMN(VPLMN B)部署的PGW。
1013，建立PDN连接。
N3G接入网与选择的目标PGW建立PDN连接。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
对于鉴权成功的UE，3GPP AAA Proxy A设置ePLMN local breakout指示，本发明实施例中的1008至1013可以与图8的809-814向对应，相应地，步骤908-912与图8实施例中的809-814区别在于，在图8中由3GPP AAA Proxy B设置ePLMN local breakout指示，图9中由3GPP AAA Proxy A设置ePLMN local breakout指示，但图9的3GPP AAA Proxy A设置ePLMN local breakout指示可以采用图8类似的由3GPP AAA Proxy B设置ePLMN local breakout指示方式，为避免重复，此处适当省略详细描述。
上文中，结合图1至图10描述了本发明实施例的用于建立连接的方法，下面将结合图11至图20描述本发明实施例的用于建立连接的设备。
图11是根据本发明一个实施例的HSS的示意框图。应注意，图11所示的HSS1100与图2相对应，能够实现图2实施例中涉及HSS的各个过程，为避免重复此处适当省略详细描述。
如图11所示的HSS1100包括：接收单元1110和鉴权单元1120。
具体地，接收单元1110用于接收鉴权请求消息，鉴权请求消息包括无线局域网服务器WLAN SP参数信息和拜访地网络标识拜访地网络标识参数信息，WLAN SP参数信息包括第一拜访地公共陆地移动网络VPLMN的信息，拜访地网络标识参数信息包括第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为用户设备UE的接入网，第二VPLMN为UE当前在3GPP侧注册的公共陆地移动网络PLMN；
鉴权单元1120用于根据第一VPLMN的信息和/或第二VPLMN的信息对UE进行鉴权。
因此，本发明实施例，对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个拜访地VPLMN的信息，并基于此进行鉴权与授权判别；实 现在多拜访地的场景下UE的鉴权。
可选地，作为另一实施例，鉴权请求消息还包括指示信息，指示信息用于指示第一VPLMN与第二VPLMN为等价的PLMN。
可选地，作为另一实施例，鉴权单元1120判断UE是否可以从第二VPLMN接入3GPP网络，如果UE可以从第二VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第二VPLMN接入3GPP网络，则鉴权失败；或者，鉴权单元1120判断UE是否可以从第一VPLMN接入3GPP网络，如果UE可以从第一VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第一VPLMN接入3GPP网络，则鉴权失败；或者，鉴权单元1120确定UE可以从第二VPLMN接入和第一VPLMN是第二VPLMN B的等价的PLMN是否都成立，如果都成立，鉴权成功，如果有任一不成立，则鉴权失败；或者，鉴权单元1120确定UE可以从第一VPLMN接入和UE可以从第二VPLMN接入是否都成立，如果都成立，鉴权成功，如果有任一不成立，则鉴权失败。
可选地，作为另一实施例，本发明实施例HSS还可以包括发送单元，具体地，发送单元用于在UE鉴权成功后，发送接入注册请求回复消息，接入注册请求回复消息包括等价公共陆地移动网络接入指示等价公共陆地移动网络本地接入指示信息，
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
图12是根据本发明另一实施例的HSS的示意框图。应注意，图12所示的HSS1200与图3相对应，能够实现图3实施例中涉及HSS的各个过程，为避免重复此处适当省略详细描述。
如图12所示的HSS1200包括：接收单元1210、鉴权单元1220和发送单元1230。
具体地，接收单元1210用于接收鉴权请求消息，鉴权请求消息包括拜访地网络标识参数信息，拜访地网络标识参数信息包括第一VPLMN的信息 或第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为UE的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN；
鉴权单元1220用于根据第一VPLMN的信息或第二VPLMN的信息对UE进行鉴权；
发送单元1230用于在UE鉴权成功后，发送接入注册请求回复消息，接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
本发明实施例在UE鉴权成功后，HSS发送等价公共陆地移动网络本地接入指示信息，以便于N3G接入网根据等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
可选地，作为另一实施例，在拜访地网络标识参数信息包括第一VPLMN的信息时，
鉴权单元1220基于签约判断UE是否可以从第一VPLMN接入3GPP网络，如果UE可以从第一VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第一VPLMN接入3GPP网络，则鉴权失败，
或者，在拜访地网络标识参数信息包括第二VPLMN的信息时，鉴权单元1220基于签约判断UE是否可以从第二VPLMN接入3GPP网络，如果UE可以从第二VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第二VPLMN接入3GPP网络，则鉴权失败。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务，或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
图13是根据本发明一个实施例的代理服务器的示意框图。应注意，图13所示的代理服务器1300与图4相对应，能够实现图4实施例中涉及代理服务器的各个过程，为避免重复此处适当省略详细描述。
如图13所示的代理服务器1300包括：第一接收单元1310、生成单元1320和第一发送单元1330。
具体地，第一接收单元1310用于接收第一代理服务器发送的第一鉴权与授权请求消息，第一鉴权与授权请求消息包括第一WLAN SP参数信息和/或第一拜访地网络标识参数信息，第一WLAN SP参数信息和第一拜访地网络标识参数信息均为第一VPLMN的信息；
生成单元1320用于根据第一鉴权与授权请求消息生成第二鉴权与授权请求消息，第二鉴权与授权请求消息包括第二WLAN SP参数信息和第二拜访地网络标识参数信息，第二WLAN SP参数信息为第一VPLMN的信息，第二拜访地网络标识参数信息为第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为用户设备的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN，
第一发送单元1330用于发送第二鉴权与授权请求消息，以便HSS根据第一VPLMN的信息和/或第二VPLMN的信息对UE进行鉴权。
因此，本发明实施例，对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个拜访地VPLMN的信息，并基于此进行鉴权与授权判别；实现在多拜访地的场景下UE的鉴权。
可选地，作为另一实施例，生成单元1320检测第一鉴权与授权请求消息是否包括第一拜访地网络标识参数信息，若第一鉴权与授权请求消息不包括第一拜访地网络标识参数信息，则将第二VPLMN的信息作为第二拜访地网络标识参数信息，并设置第二WLAN SP参数信息与第一WLAN SP参数信息相同；或者，若第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且第一鉴权与授权请求消息不包括第一WLAN SP参数信息，则将设置第二WLAN SP参数信息与第一拜访地网络标识参数信息相同，将第二VPLMN的信息作为第二拜访地网络标识参数信息；或者，若第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且第一鉴权与授权请求消息还包括第一WLAN SP参数信息，则将设置第二WLAN SP参数信息与第一WLAN SP参数信息相同，将第二VPLMN的信息作为第二拜访地网络标识 参数信息。
可选地，作为另一实施例，第二鉴权与授权请求消息还包括指示信息，指示信息用于指示第一VPLMN与第二VPLMN为等价的PLMN。
可选地，作为另一实施例，在UE鉴权成功后，代理服务器1300还包括：第二接收单元和第二发送单元。
具体地，第二接收单元用于接收3GPP AAA Server发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；第二发送单元用于向第一代理服务器发送鉴权与授权回复消息，以便第一代理服务器向N3G接入网设备发送鉴权与授权回复消息，并以便N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立PDN连接，
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
图14是根据本发明另一实施例的代理服务器的示意框图。应注意，图14所示的代理服务器1400与图5相对应，能够实现图5实施例中涉及代理服务器的各个过程，为避免重复此处适当省略详细描述。
如图14所示的代理服务器1400包括：接收单元1410和发送单元1420。
具体地，接收单元单元1410用于在用户设备UE鉴权成功后，根据接收的3GPP AAA Server发送的鉴权与授权回复消息，生成鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；或者，用于接收3GPP AAA Server发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
发送单元1420用于向第一代理服务器发送鉴权与授权回复消息，鉴权与授权回复消息被第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
其中，第一VPLMN部署的非第三代合作伙伴计划3GPP网络为UE的 接入网，第二VPLMN为UE当前在3GPP侧注册的公共陆地移动网络PLMN，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务，或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
图15是根据本发明另一实施例的代理服务器的示意框图。应注意，图15所示的代理服务器1500与图6相对应，能够实现图6实施例中涉及代理服务器的各个过程，为避免重复此处适当省略详细描述。
如图15所示的代理服务器1500包括：接收单元1510和第一发送单元1520。
具体地，接收单元1510用于在UE鉴权成功后，接收第二代理服务器发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，或者，用于在UE鉴权成功后，根据第二代理服务器发送的初始鉴权与授权回复消息生成鉴权与授权回复消息，鉴权与授权回复消息包括由第一代理服务器生成的等价公共陆地移动网络本地接入指示信息；
第一发送单元1520用于向非第三代合作伙伴计划N3G接入网设备发送鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，以便于N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
其中，第一VPLMN部署的非第三代合作伙伴计划3GPP网络为UE的 接入网，第二VPLMN为UE当前在3GPP侧注册的公共陆地移动网络PLMN，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
可选地，作为另一实施例，本发明实施例的代理服务器1500还可以包括第二发送单元，具体地，第二发送单元，用于根据UE的网络接入标识符NAI中含有的归属域公共陆地移动网络HPLMN信息确定HPLMN部署的3GPP AAA Server可直接到达，并向3GPP AAA Server发送第一鉴权与授权请求消息，以便归属域服务器HSS对UE进行鉴权，其中，第一鉴权与授权请求消息包括第一拜访地公共陆地移动网络VPLMN的信息。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
图16是根据本发明另一实施例的HSS的示意框图。应注意，图16所示的HSS1600与图11所示的HSS1100，能够实现图2实施例中涉及HSS的各个过程，为避免重复此处适当省略详细描述。
如图16所示的HSS1600包括：处理器1610、存储器1620、总线系统1630和收发器1640。
具体地，收发器1640接收鉴权请求消息，鉴权请求消息包括无线局域网服务器WLAN SP参数信息和拜访地网络标识拜访地网络标识参数信息，WLAN SP参数信息包括第一拜访地公共陆地移动网络VPLMN的信息，拜访地网络标识参数信息包括第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为用户设备UE的接入网，第二VPLMN为UE当前在3GPP侧注册的公共陆地移动网络PLMN；处理器1610用于通过总线系统1630调用存储在存储器1620中的代码，根据第一VPLMN的信息和/或第二VPLMN的信息对UE进行鉴权。
因此，本发明实施例，对于漫游场景下出现多VPLMN的情况，HSS可 以获得每一个拜访地VPLMN的信息，并基于此进行鉴权与授权判别；实现在多拜访地的场景下UE的鉴权。
上述本发明实施例揭示的方法可以应用于处理器1610中，或者由处理器1610实现。处理器1610可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1610中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1610可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1620，处理器1610读取存储器1620中的信息，结合其硬件完成上述方法的步骤，该总线系统1630除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统1630。
可选地，作为另一实施例，鉴权请求消息还包括指示信息，指示信息用于指示第一VPLMN与第二VPLMN为等价的PLMN。
可选地，作为另一实施例，处理器1610判断UE是否可以从第二VPLMN接入3GPP网络，如果UE可以从第二VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第二VPLMN接入3GPP网络，则鉴权失败；或者，处理器1610判断UE是否可以从第一VPLMN接入3GPP网络，如果UE可以从第一VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第一VPLMN接入3GPP网络，则鉴权失败；或者，处理器1610确定UE可以从第二VPLMN接入和第一VPLMN是第二VPLMN B的等价的PLMN是否都成立，如果都成立，鉴权成功，如果有任一不成立，则鉴权失败；或者，处理器1610确定UE可以从第一VPLMN接入和UE可以从第二VPLMN接入是否都成立， 如果都成立，鉴权成功，如果有任一不成立，则鉴权失败。
可选地，作为另一实施例，收发器1640还用于在UE鉴权成功后，发送接入注册请求回复消息，接入注册请求回复消息包括等价公共陆地移动网络接入指示等价公共陆地移动网络本地接入指示信息，
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
图17是根据本发明另一实施例的HSS的示意框图。应注意，图17所示的HSS1700与图12相对应，能够实现图3实施例中涉及HSS的各个过程，为避免重复此处适当省略详细描述。
如图17所示的HSS1700包括：处理器1710、存储器1720、总线系统1730和收发器1740。
具体地，收发器1740接收鉴权请求消息，鉴权请求消息包括拜访地网络标识参数信息，拜访地网络标识参数信息包括第一VPLMN的信息或第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为UE的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN；处理器1710用于通过总线系统1730调用存储在存储器1720中的代码，根据第一VPLMN的信息或第二VPLMN的信息对UE进行鉴权；收发器1740在UE鉴权成功后，发送接入注册请求回复消息，接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，
其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
本发明实施例在UE鉴权成功后，HSS发送等价公共陆地移动网络本地接入指示信息，以便于N3G接入网根据等价公共陆地移动网络本地接入指示信息指示的PLMN所部署的数据网关PGW为APN提供服务，并建立PDN连接。因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系， 时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN部署的PGW为此APN提供服务。保证业务可以正常进行，提升用户体验。
上述本发明实施例揭示的方法可以应用于处理器1710中，或者由处理器1710实现。处理器1710可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1710中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1710可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1720，处理器1710读取存储器1720中的信息，结合其硬件完成上述方法的步骤，该总线系统1730除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统1730。
可选地，作为另一实施例，在拜访地网络标识参数信息包括第一VPLMN的信息时，
处理器1710基于签约判断UE是否可以从第一VPLMN接入3GPP网络，如果UE可以从第一VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第一VPLMN接入3GPP网络，则鉴权失败，
或者，在拜访地网络标识参数信息包括第二VPLMN的信息时，处理器1710基于签约判断UE是否可以从第二VPLMN接入3GPP网络，如果UE可以从第二VPLMN接入3GPP网络，鉴权成功，如果UE不可以从第二VPLMN接入3GPP网络，则鉴权失败。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
图18是根据本发明另一实施例的代理服务器的示意框图。应注意，图18所示的代理服务器1800与图13相对应，能够实现图4实施例中涉及代理服务器的各个过程，为避免重复此处适当省略详细描述。
如图18所示的代理服务器1800包括：处理器1810、存储器1820、总线系统1830和收发器1840。
具体地，收发器1840接收第一代理服务器发送的第一鉴权与授权请求消息，第一鉴权与授权请求消息包括第一WLAN SP参数信息和/或第一拜访地网络标识参数信息，第一WLAN SP参数信息和第一拜访地网络标识参数信息均为第一VPLMN的信息；处理器1810用于通过总线系统1830调用存储在存储器1820中的代码，根据第一鉴权与授权请求消息生成第二鉴权与授权请求消息，第二鉴权与授权请求消息包括第二WLAN SP参数信息和第二拜访地网络标识参数信息，第二WLAN SP参数信息为第一VPLMN的信息，第二拜访地网络标识参数信息为第二VPLMN的信息，其中，第一VPLMN部署的非3GPP网络为用户设备的接入网，第二VPLMN为UE当前在3GPP侧注册的PLMN，收发器1840发送第二鉴权与授权请求消息，以便HSS根据第一VPLMN的信息和/或第二VPLMN的信息对UE进行鉴权。
因此，本发明实施例，对于漫游场景下出现多VPLMN的情况，HSS可以获得每一个拜访地VPLMN的信息，并基于此进行鉴权与授权判别；实现在多拜访地的场景下UE的鉴权。
上述本发明实施例揭示的方法可以应用于处理器1810中，或者由处理器1810实现。处理器1810可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1810中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1810可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件 模块可以位于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1820，处理器1810读取存储器1820中的信息，结合其硬件完成上述方法的步骤，该总线系统1830除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统1830。
可选地，作为另一实施例，处理器1810检测第一鉴权与授权请求消息是否包括第一拜访地网络标识参数信息，若第一鉴权与授权请求消息不包括第一拜访地网络标识参数信息，则将第二VPLMN的信息作为第二拜访地网络标识参数信息，并设置第二WLAN SP参数信息与第一WLAN SP参数信息相同；或者，若第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且第一鉴权与授权请求消息不包括第一WLAN SP参数信息，则将设置第二WLAN SP参数信息与第一拜访地网络标识参数信息相同，将第二VPLMN的信息作为第二拜访地网络标识参数信息；或者，若第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且第一鉴权与授权请求消息还包括第一WLAN SP参数信息，则将设置第二WLAN SP参数信息与第一WLAN SP参数信息相同，将第二VPLMN的信息作为第二拜访地网络标识参数信息。
可选地，作为另一实施例，第二鉴权与授权请求消息还包括指示信息，指示信息用于指示第一VPLMN与第二VPLMN为等价的PLMN。
可选地，作为另一实施例，在UE鉴权成功后，收发器1840还用于接收3GPP AAA Server发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；以及向第一代理服务器发送鉴权与授权回复消息，鉴权与授权回复消息被第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的PGW提供服务；或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
图19是根据本发明另一实施例的代理服务器的示意框图。应注意，图19所示的代理服务器1900与图14相对应，能够实现图5实施例中涉及代理服务器的各个过程，为避免重复此处适当省略详细描述。
如图19所示的代理服务器1900包括：处理器1910、存储器1920、总线系统1930和收发器1940。
具体地，处理器1910用于通过总线系统1930调用存储在存储器1920中的代码控制收发器1940在用户设备UE鉴权成功后，根据接收的3GPP AAA Server发送的鉴权与授权回复消息，生成鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；或者接收3GPP AAA Server发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；向第一代理服务器发送鉴权与授权回复消息，鉴权与授权回复消息被第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，其中，第一VPLMN部署的非第三代合作伙伴计划3GPP网络为UE的接入网，第二VPLMN为UE当前在3GPP侧注册的公共陆地移动网络PLMN，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
上述本发明实施例揭示的方法可以应用于处理器1910中，或者由处理器1910实现。处理器1910可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器1910中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器1910可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application  Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1920，处理器1910读取存储器1920中的信息，结合其硬件完成上述方法的步骤，该总线系统1930除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统1930。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
图20是根据本发明另一实施例的代理服务器的示意框图。应注意，图20所示的代理服务器2000与图15相对应，能够实现图6实施例中涉及代理服务器的各个过程，为避免重复此处适当省略详细描述。
如图20所示的代理服务器2000包括：处理器2010、存储器2020、总线系统2030和收发器2040。
具体地，处理器2010用于通过总线系统2030调用存储在存储器2020中的代码，控制收发器2040在UE鉴权成功后，接收第二代理服务器发送的鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，或者，用于在UE鉴权成功后，根据第二代理服务器发送的初始鉴权与授权回复消息生成鉴权与授权回复消息，鉴权与授权回复消息包括由第一代理服务器生成的等价公共陆地移动网络本地接入指示信息；向N3G接入网设备发送鉴权与授权回复消息，鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，以便于N3G接入网设备根据等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
其中，第一VPLMN部署的非3GPP网络为UE的接入网，第二VPLMN 为UE当前在3GPP侧注册的PLMN，等价公共陆地移动网络本地接入指示信息用于指示APN由与第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由目标PLMN部署的PGW提供服务。
因此，对于某些APN，例如，VPLMN A与HPLMN不存在漫游关系时的VPLMN A的PDN连接，本发明实施例可以选择特定PLMN(例如，VPLMN B)部署的PGW为此APN提供服务，本发明实施例能够保证业务可以正常进行，提升用户体验。
上述本发明实施例揭示的方法可以应用于处理器2010中，或者由处理器2010实现。处理器2010可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器2010中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器2010可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器2020，处理器2010读取存储器2020中的信息，结合其硬件完成上述方法的步骤，该总线系统2030除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统2030。
可选地，作为另一实施例，收发器2040还用于根据UE的网络接入标识符NAI中含有的归属域公共陆地移动网络HPLMN信息确定HPLMN部署的3GPP AAA Server可直接到达，并向3GPP AAA Server发送第一鉴权与授权请求消息，以便归属域服务器HSS对UE进行鉴权，其中，第一鉴权与授权请求消息包括第一拜访地公共陆地移动网络VPLMN的信息。
可选地，作为另一实施例，等价公共陆地移动网络本地接入指示信息位于APN的配置参数中。
应理解，说明书通篇中提到的“一个实施例”或“一实施例”意味着与实施例有关的特定特征、结构或特性包括在本发明的至少一个实施例中。因此，在整个说明书各处出现的“在一个实施例中”或“在一实施例中”未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中。应理解，在本发明的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
另外，本文中术语“系统”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本发明实施例中，“与A相应的B”表示B与A相关联，根据A可以确定B。但还应理解，根据A确定B并不意味着仅仅根据A确定B，还可以根据A和/或其它信息确定B。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个 系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本发明实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本发明可以用硬件实现，或固件实现，或它们的组合方式来实现。当使用软件实现时，可以将上述功能存储在计算机可读介质中或作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是计算机能够存取的任何可用介质。以此为例但不限于：计算机可读介质可以包括RAM、ROM、EEPROM、CD-ROM或其他光盘存储、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质。此外。任何连接可以适当的成为计算机可读介质。例如，如果软件是使用同轴电缆、光纤光缆、双绞线、数字用户线(DSL)或者诸如红外线、无线电和微波之类的无线技术从网站、服务器或者其他远程源传输的，那么同轴电缆、光纤光缆、双绞线、DSL或者诸如红外线、无线和微波之类的无线技术包括在所属介质的定影中。如本发明所使用的，盘(Disk)和碟(disc)包括压缩光碟(CD)、激光碟、光碟、数字通用光碟(DVD)、软盘和蓝光光碟，其中盘通常磁性的复制数据，而碟则用激光来光学的复制数据。上面的组合也应当包括在计算机可读介质的保护范围之内。
总之，以上所述仅为本发明技术方案的较佳实施例而已，并非用于限定本发明的保护范围。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (34)

  1. 一种用于建立连接的方法，其特征在于，包括：
    归属域服务器HSS接收鉴权请求消息，所述鉴权请求消息包括无线局域网络服务提供商WLAN SP参数信息和拜访地网络标识参数信息，所述WLAN SP参数信息包括第一拜访地公共陆地移动网络VPLMN的信息，所述拜访地网络标识参数信息包括第二VPLMN的信息，其中，所述第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，所述第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN；
    所述HSS根据所述第一VPLMN的信息和/或所述第二VPLMN的信息对所述UE进行鉴权。
  2. 根据权利要求1所述的方法，其特征在于，
    所述鉴权请求消息还包括指示信息，所述指示信息用于指示所述第一VPLMN与所述第二VPLMN为等价的PLMN。
  3. 根据权利要求1或2所述的方法，其特征在于，所述HSS根据所述第一VPLMN的信息和/或所述第二VPLMN的信息对所述UE进行鉴权，包括：
    所述HSS判断所述UE是否可以从所述第二VPLMN接入3GPP网络，如果所述UE可以从所述第二VPLMN接入3GPP网络，则鉴权成功，如果所述UE不可以从所述第二VPLMN接入3GPP网络，则鉴权失败；
    或者，所述HSS判断所述UE是否可以从所述第一VPLMN接入3GPP网络，如果所述UE可以从所述第一VPLMN接入3GPP网络，则鉴权成功，如果所述UE不可以从所述第一VPLMN接入3GPP网络，则鉴权失败；
    或者，所述HSS确定所述UE可以从所述第二VPLMN接入和所述第一VPLMN是所述第二VPLMN B的等价的PLMN是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败；
    或者，所述HSS确定所述UE可以从所述第一VPLMN接入和所述UE可以从所述第二VPLMN接入是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，在所述HSS 为所述UE鉴权成功后，所述方法还包括：
    所述HSS发送接入注册请求回复消息，所述接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，
    其中，所述等价公共陆地移动网络本地接入指示信息用于指示接入点名称APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
    或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由所述目标PLMN部署的PGW提供服务。
  5. 根据权利要求4所述的方法，其特征在于，所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  6. 一种用于建立连接的方法，其特征在于，包括：
    归属域服务器HSS接收鉴权请求消息，所述鉴权请求消息包括拜访地网络标识参数信息，所述拜访地网络标识参数信息包括第一拜访地公共陆地移动网络VPLMN的信息或第二VPLMN的信息，其中，所述第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，所述第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN；
    所述HSS根据所述第一VPLMN的信息或第二VPLMN的信息对所述UE进行鉴权；
    在所述HSS为所述UE鉴权成功后，所述HSS发送接入注册请求回复消息，所述接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，
    其中，所述等价公共陆地移动网络本地接入指示信息用于指示接入点名称APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
    或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由所述目标PLMN部署的PGW提供服务。
  7. 根据权利要求6所述的方法，其特征在于，所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  8. 一种用于建立连接的方法，其特征在于，包括：
    第二代理服务器接收第一代理服务器发送的第一鉴权与授权请求消息，所述第一鉴权与授权请求消息包括第一无线局域网络服务提供商WLAN SP 参数信息和/或第一拜访地网络标识参数信息，所述第一WLAN SP参数信息和所述第一拜访地网络标识参数信息均为第一拜访地公共陆地移动网络VPLMN的信息；
    所述第二代理服务器根据所述第一鉴权与授权请求消息生成第二鉴权与授权请求消息，所述第二鉴权与授权请求消息包括第二WLAN SP参数信息和第二拜访地网络标识参数信息，所述第二WLAN SP参数信息为所述第一VPLMN的信息，所述第二拜访地网络标识参数信息为第二VPLMN的信息，其中，所述第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，所述第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN；
    所述第二代理服务器发送所述第二鉴权与授权请求消息，以便HSS根据所述第一VPLMN的信息和/或所述第二VPLMN的信息对所述UE进行鉴权。
  9. 根据权利要求8所述的方法，其特征在于，所述第二代理服务器根据所述第一鉴权与授权请求消息生成第二鉴权与授权请求消息，包括：
    所述第二代理服务器检测所述第一鉴权与授权请求消息是否包括所述第一拜访地网络标识参数信息，
    若所述第一鉴权与授权请求消息不包括所述第一拜访地网络标识参数信息，则所述第二代理服务器将所述第二VPLMN的信息作为第二拜访地网络标识参数信息，并设置所述第二WLAN SP参数信息与所述第一WLAN SP参数信息相同；
    或者，若所述第一鉴权与授权请求消息包括所述第一拜访地网络标识参数信息，且所述第一鉴权与授权请求消息不包括所述第一WLAN SP参数信息，则所述第二代理服务器将设置所述第二WLAN SP参数信息与所述第一拜访地网络标识参数信息相同，将所述第二VPLMN的信息作为第二拜访地网络标识参数信息；
    或者，若所述第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且所述第一鉴权与授权请求消息还包括第一WLAN SP参数信息，则所述第二代理服务器将设置所述第二WLAN SP参数信息与所述第一WLANSP参数信息相同，将所述第二VPLMN的信息作为第二拜访地网络标识参数信息。
  10. 根据权利要求9所述的方法，其特征在于，所述第二鉴权与授权请求消息还包括指示信息，所述指示信息用于指示所述第一VPLMN与所述第二VPLMN为等价的PLMN。
  11. 根据权利要求8至10中任一项所述的方法，其特征在于，在所述UE鉴权成功后，所述方法还包括：
    所述第二代理服务器接收3GPP鉴权授权与计费服务器3GPP AAA Server发送的鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
    所述第二代理服务器向所述第一代理服务器发送所述鉴权与授权回复消息，所述鉴权与授权回复消息被所述第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使所述N3G接入网设备根据所述等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
    其中，所述等价公共陆地移动网络本地接入指示信息用于指示所述APN由与所述第一VPLMN等价的第二PLMN所部署的PGW提供服务；
    或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示所述APN由所述目标PLMN部署的PGW提供服务。
  12. 根据权利要求11所述的方法，其特征在于，所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  13. 一种用于建立连接的方法，其特征在于，包括：在用户设备UE鉴权成功后，
    第二代理服务器根据接收的第三代合作伙伴计划鉴权授权与计费服务器3GPP AAA Server发送的鉴权与授权回复消息，生成鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
    或者，所述第二代理服务器接收所述3GPP AAA Server发送的鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
    所述第二代理服务器向第一代理服务器发送所述鉴权与授权回复消息，所述鉴权与授权回复消息被所述第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使所述N3G接入网设备根据所述等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组 数据网络PDN连接，
    其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴计划3GPP网络为所述UE的接入网，第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN，所述等价公共陆地移动网络本地接入指示信息用于指示所述APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示所述APN由所述目标PLMN部署的PGW提供服务。
  14. 根据权利要求13所述的方法，其特征在于，所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  15. 一种用于建立连接的方法，其特征在于，包括：在用户设备UE鉴权成功后，
    第一代理服务器接收第二代理服务器发送的鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
    或者，所述第一代理服务器根据所述第二代理服务器发送的初始鉴权与授权回复消息生成鉴权与授权回复消息，所述鉴权与授权回复消息包括由所述第一代理服务器生成的等价公共陆地移动网络本地接入指示信息；
    所述第一代理服务器向非第三代合作伙伴计划N3G接入网设备发送所述鉴权与授权回复消息，所述鉴权与授权回复消息包括所述等价公共陆地移动网络本地接入指示信息，以便于所述N3G接入网设备根据所述等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
    其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴计划3GPP网络为所述UE的接入网，第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN，所述等价公共陆地移动网络本地接入指示信息用于指示所述APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示所述APN由所述目标PLMN部署的PGW提供服务。
  16. 根据权利要求15所述的方法，其特征在于，还包括：
    所述第一代理服务器根据所述UE的网络接入标识符NAI中含有的归属 域公共陆地移动网络HPLMN信息确定HPLMN部署的所述3GPP AAA Server可直接到达，并向所述3GPP AAA Server发送所述第一鉴权与授权请求消息，以便归属域服务器HSS对所述UE进行鉴权，其中，所述第一鉴权与授权请求消息包括第一拜访地公共陆地移动网络VPLMN的信息。
  17. 根据权利要求15或16所述的方法，其特征在于，所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  18. 一种归属域服务器HSS，其特征在于，包括：
    接收单元，用于接收鉴权请求消息，所述鉴权请求消息包括无线局域网络服务提供商WLAN SP参数信息和拜访地网络标识参数信息，所述WLAN SP参数信息包括第一拜访地公共陆地移动网络VPLMN的信息，所述拜访地网络标识参数信息包括第二VPLMN的信息，其中，所述第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，所述第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN；
    鉴权单元，用于根据所述第一VPLMN的信息和/或所述第二VPLMN的信息对所述UE进行鉴权。
  19. 根据权利要求18所述的HSS，其特征在于，
    所述鉴权请求消息还包括指示信息，所述指示信息用于指示所述第一VPLMN与所述第二VPLMN为等价的PLMN。
  20. 根据权利要求18或19所述的HSS，其特征在于，
    所述鉴权单元判断所述UE是否可以从所述第二VPLMN接入3GPP网络，如果所述UE可以从所述第二VPLMN接入3GPP网络，则鉴权成功，如果所述UE不可以从所述第二VPLMN接入3GPP网络，则鉴权失败；
    或者，所述鉴权单元判断所述UE是否可以从所述第一VPLMN接入3GPP网络，如果所述UE可以从所述第一VPLMN接入3GPP网络，则鉴权成功，如果所述UE不可以从所述第一VPLMN接入3GPP网络，则鉴权失败；
    或者，所述鉴权单元确定所述UE可以从所述第二VPLMN接入和所述第一VPLMN是所述第二VPLMN B的等价的PLMN是否都成立，如果都成立，则鉴权成功，如果有任一不成立，则鉴权失败；
    或者，所述鉴权单元确定所述UE可以从所述第一VPLMN接入和所述UE可以从所述第二VPLMN接入是否都成立，如果都成立，则鉴权成功， 如果有任一不成立，则鉴权失败。
  21. 根据权利要求18至20中任一项所述的HSS，其特征在于，
    还包括发送单元，用于在所述UE鉴权成功后，发送接入注册请求回复消息，所述接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，
    其中，所述等价公共陆地移动网络本地接入指示信息用于指示接入点名称APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
    或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由所述目标PLMN部署的PGW提供服务。
  22. 根据权利要求21所述的HSS，其特征在于，
    所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  23. 一种归属域服务器HSS，其特征在于，包括：
    接收单元，用于接收鉴权请求消息，所述鉴权请求消息包括拜访地网络标识参数信息，所述拜访地网络标识参数信息包括第一拜访地公共陆地移动网络VPLMN的信息或第二VPLMN的信息，其中，所述第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，所述第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN；
    鉴权单元，用于根据所述第一VPLMN的信息或第二VPLMN的信息对所述UE进行鉴权；
    发送单元，用于在所述UE鉴权成功后，发送接入注册请求回复消息，所述接入注册请求回复消息包括等价公共陆地移动网络本地接入指示信息，
    其中，所述等价公共陆地移动网络本地接入指示信息用于指示接入点名称APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；
    或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示APN由所述目标PLMN部署的PGW提供服务。
  24. 根据权利要求23所述的HSS，其特征在于，
    所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  25. 一种代理服务器，其特征在于，包括：
    第一接收单元，用于接收第一代理服务器发送的第一鉴权与授权请求消息，所述第一鉴权与授权请求消息包括第一无线局域网络服务提供商WLAN SP参数信息和/或第一拜访地网络标识参数信息，所述第一WLAN SP参数信息和所述第一拜访地网络标识参数信息均为第一拜访地公共陆地移动网络VPLMN的信息；
    生成单元，用于根据所述第一鉴权与授权请求消息生成第二鉴权与授权请求消息，所述第二鉴权与授权请求消息包括第二WLAN SP参数信息和第二拜访地网络标识参数信息，所述第二WLAN SP参数信息为所述第一VPLMN的信息，所述第二拜访地网络标识参数信息为第二VPLMN的信息，其中，所述第一VPLMN部署的非第三代合作伙伴计划3GPP网络为用户设备UE的接入网，所述第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN，
    第一发送单元，用于发送所述第二鉴权与授权请求消息，以便HSS根据所述第一VPLMN的信息和/或所述第二VPLMN的信息对所述UE进行鉴权。
  26. 根据权利要求25所述的代理服务器，其特征在于，
    所述生成单元检测所述第一鉴权与授权请求消息是否包括所述第一拜访地网络标识参数信息，
    若所述第一鉴权与授权请求消息不包括所述第一拜访地网络标识参数信息，则将所述第二VPLMN的信息作为第二拜访地网络标识参数信息，并设置所述第二WLAN SP参数信息与所述第一WLAN SP参数信息相同；
    或者，若所述第一鉴权与授权请求消息包括所述第一拜访地网络标识参数信息，且所述第一鉴权与授权请求消息不包括所述第一WLAN SP参数信息，则将设置所述第二WLAN SP参数信息与所述第一拜访地网络标识参数信息相同，将所述第二VPLMN的信息作为第二拜访地网络标识参数信息；
    或者，若所述第一鉴权与授权请求消息包括第一拜访地网络标识参数信息，且所述第一鉴权与授权请求消息还包括第一WLAN SP参数信息，则将设置所述第二WLAN SP参数信息与所述第一WLAN SP参数信息相同，将所述第二VPLMN的信息作为第二拜访地网络标识参数信息。
  27. 根据权利要求26所述的代理服务器，其特征在于，所述第二鉴权 与授权请求消息还包括指示信息，所述指示信息用于指示所述第一VPLMN与所述第二VPLMN为等价的PLMN。
  28. 根据权利要求25至27中任一项所述的代理服务器，其特征在于，在所述UE鉴权成功后，所述代理服务器还包括：
    第二接收单元，用于接收3GPP AAA Server发送的鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
    第二发送单元，用于向所述第一代理服务器发送所述鉴权与授权回复消息，所述鉴权与授权回复消息被所述第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使所述N3G接入网设备根据所述等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
    其中，所述等价公共陆地移动网络本地接入指示信息用于指示所述APN由与所述第一VPLMN等价的第二PLMN所部署的PGW提供服务；
    或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示所述APN由所述目标PLMN部署的PGW提供服务。
  29. 根据权利要求28所述的代理服务器，其特征在于，
    所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  30. 一种代理服务器，其特征在于，包括：
    接收单元，用于在用户设备UE鉴权成功后，根据接收的第三代合作伙伴计划鉴权授权与计费服务器3GPP AAA Server发送的鉴权与授权回复消息，生成鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
    或者，用于接收所述3GPP AAA Server发送的鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息；
    发送单元，用于向第一代理服务器发送所述鉴权与授权回复消息，所述鉴权与授权回复消息被所述第一代理服务器转发至非第三代合作伙伴计划N3G接入网设备，以使所述N3G接入网设备根据所述等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
    其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴 计划3GPP网络为所述UE的接入网，第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN，所述等价公共陆地移动网络本地接入指示信息用于指示所述APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示所述APN由所述目标PLMN部署的PGW提供服务。
  31. 根据权利要求30所述的代理服务器，其特征在于，
    所述等价公共陆地移动网络本地接入指示信息位于所述APN的配置参数中。
  32. 一种代理服务器，其特征在于，包括：
    接收单元，用于在所述UE鉴权成功后，接收第二代理服务器发送的鉴权与授权回复消息，所述鉴权与授权回复消息包括等价公共陆地移动网络本地接入指示信息，
    或者，用于在所述UE鉴权成功后，根据所述第二代理服务器发送的初始鉴权与授权回复消息生成鉴权与授权回复消息，所述鉴权与授权回复消息包括由所述第一代理服务器生成的等价公共陆地移动网络本地接入指示信息；
    第一发送单元，用于向非第三代合作伙伴计划N3G接入网设备发送所述鉴权与授权回复消息，所述鉴权与授权回复消息包括所述等价公共陆地移动网络本地接入指示信息，以便于所述N3G接入网设备根据所述等价公共陆地移动网络本地接入指示信息为接入点名称APN选择数据网关PGW并建立分组数据网络PDN连接，
    其中，第一拜访地公共陆地移动网络VPLMN部署的非第三代合作伙伴计划3GPP网络为所述UE的接入网，第二VPLMN为所述UE当前在3GPP侧注册的公共陆地移动网络PLMN，所述等价公共陆地移动网络本地接入指示信息用于指示所述APN由与所述第一VPLMN等价的第二PLMN所部署的数据网关PGW提供服务；或者，所述等价公共陆地移动网络本地接入指示信息包括目标PLMN的信息，用于指示所述APN由所述目标PLMN部署的PGW提供服务。
  33. 根据权利要求32所述的代理服务器，其特征在于，还包括：
    第二发送单元，用于根据所述UE的网络接入标识符NAI中含有的归属 域公共陆地移动网络HPLMN信息确定HPLMN部署的所述3GPP AAA Server可直接到达，并向所述3GPP AAA Server发送所述第一鉴权与授权请求消息，以便归属域服务器HSS对所述UE进行鉴权，其中，所述第一鉴权与授权请求消息包括第一拜访地公共陆地移动网络VPLMN的信息。
  34. 根据权利要求32或33所述的代理服务器，其特征在于，
    所述等价公共陆地移动网络本地接入指示信息位于接入点名称APN的配置参数中。
PCT/CN2015/079105 2015-05-15 2015-05-15 用于建立连接的方法和设备 WO2016183745A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2015/079105 WO2016183745A1 (zh) 2015-05-15 2015-05-15 用于建立连接的方法和设备
CN201580030579.9A CN106664558B (zh) 2015-05-15 2015-05-15 用于建立连接的方法和设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/079105 WO2016183745A1 (zh) 2015-05-15 2015-05-15 用于建立连接的方法和设备

Publications (1)

Publication Number Publication Date
WO2016183745A1 true WO2016183745A1 (zh) 2016-11-24

Family

ID=57319118

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/079105 WO2016183745A1 (zh) 2015-05-15 2015-05-15 用于建立连接的方法和设备

Country Status (2)

Country Link
CN (1) CN106664558B (zh)
WO (1) WO2016183745A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111314908A (zh) * 2018-02-09 2020-06-19 Oppo广东移动通信有限公司 无线通信的方法、网络设备和终端设备
WO2024120352A1 (zh) * 2022-12-08 2024-06-13 维沃移动通信有限公司 通信方法、终端及核心网功能

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110945886B (zh) * 2017-07-18 2022-09-09 三星电子株式会社 无线通信网络中检测漫游活动的反引导的方法和系统
KR102425675B1 (ko) * 2017-08-14 2022-07-28 삼성전자 주식회사 5g 시스템에서 네트워크와 단말 간 제공 기능 협상 및 슬라이스 정보 맵핑 방법
JP2021510020A (ja) * 2017-11-15 2021-04-08 オッポ広東移動通信有限公司Ｇｕａｎｇｄｏｎｇ Ｏｐｐｏ Ｍｏｂｉｌｅ Ｔｅｌｅｃｏｍｍｕｎｉｃａｔｉｏｎｓ Ｃｏｒｐ．， Ｌｔｄ． 無線通信方法及び装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072230A (zh) * 2006-05-12 2007-11-14 华为技术有限公司 一种因特网协议多媒体业务子系统的鉴权方法
CN101141822A (zh) * 2007-09-30 2008-03-12 中兴通讯股份有限公司 一种无线网络的网关选择方法
CN101674580A (zh) * 2008-09-12 2010-03-17 上海顶竹通讯技术有限公司 一种藉由固网接入移动核心网的方法
CN102340766A (zh) * 2010-07-23 2012-02-01 中兴通讯股份有限公司 归属网络获取拜访网络中网元信息的方法及系统
CN104066154A (zh) * 2013-03-21 2014-09-24 华为终端有限公司 选择无线局域网wlan运营商和wlan的方法及用户设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1277368C (zh) * 2004-01-21 2006-09-27 华为技术有限公司 无线局域网用户终端重新选择运营网络的交互方法
CN1310476C (zh) * 2004-07-05 2007-04-11 华为技术有限公司 无线局域网用户建立会话连接的方法
CN102625305B (zh) * 2011-01-30 2017-05-31 中兴通讯股份有限公司 接入演进分组系统的方法及系统
CN103313344B (zh) * 2012-03-07 2017-04-05 中兴通讯股份有限公司 融合的核心网及其接入方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072230A (zh) * 2006-05-12 2007-11-14 华为技术有限公司 一种因特网协议多媒体业务子系统的鉴权方法
CN101141822A (zh) * 2007-09-30 2008-03-12 中兴通讯股份有限公司 一种无线网络的网关选择方法
CN101674580A (zh) * 2008-09-12 2010-03-17 上海顶竹通讯技术有限公司 一种藉由固网接入移动核心网的方法
CN102340766A (zh) * 2010-07-23 2012-02-01 中兴通讯股份有限公司 归属网络获取拜访网络中网元信息的方法及系统
CN104066154A (zh) * 2013-03-21 2014-09-24 华为终端有限公司 选择无线局域网wlan运营商和wlan的方法及用户设备

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111314908A (zh) * 2018-02-09 2020-06-19 Oppo广东移动通信有限公司 无线通信的方法、网络设备和终端设备
CN111314908B (zh) * 2018-02-09 2023-09-22 Oppo广东移动通信有限公司 无线通信的方法、网络设备和终端设备
WO2024120352A1 (zh) * 2022-12-08 2024-06-13 维沃移动通信有限公司 通信方法、终端及核心网功能

Also Published As

Publication number Publication date
CN106664558B (zh) 2020-01-10
CN106664558A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
US11737045B2 (en) Connection processing method and apparatus in multi-access scenario
CA2748736C (en) Trustworthiness decision making for access authentication
CN110495214B (zh) 用于处理pdu会话建立过程的方法和amf节点
US9800563B2 (en) Method and device for processing data security channel
US9526119B2 (en) Methods and apparatus for multiple data packet connections
JP2018513615A (ja) 緊急サービスをサポートするための技法
JP6140372B2 (ja) 信頼できるワイヤレスローカルエリアネットワーク（ｗｌａｎ）アクセスのシナリオ
WO2016183745A1 (zh) 用于建立连接的方法和设备
TWI627870B (zh) 通訊系統中閘道器節點之選擇
TW201141157A (en) User equipment (UE), home agent node (HA), methods, and telecommunications system for home network prefix (HNP) assignment
WO2009152676A1 (zh) Aaa服务器、p-gw、pcrf、用户设备标识的获取方法和系统
US11109219B2 (en) Mobile terminal, network node server, method and computer program
KR102215389B1 (ko) 통신 방법, 보안 노드 네트워크 엘리먼트, 및 단말
CN114071465A (zh) 接入控制方法、装置及通信设备
WO2022174729A1 (zh) 保护身份标识隐私的方法与通信装置
WO2022022739A1 (zh) 接入控制方法、装置及通信设备
WO2017011975A1 (zh) 一种无线通信网络的接入方法及相关装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15892124

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15892124

Country of ref document: EP

Kind code of ref document: A1