WO2017107739A1 - 数据业务处理方法及装置 - Google Patents

数据业务处理方法及装置 Download PDF

Info

Publication number
WO2017107739A1
WO2017107739A1 PCT/CN2016/107320 CN2016107320W WO2017107739A1 WO 2017107739 A1 WO2017107739 A1 WO 2017107739A1 CN 2016107320 W CN2016107320 W CN 2016107320W WO 2017107739 A1 WO2017107739 A1 WO 2017107739A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual
request message
mobile communication
communication partner
msisdn
Prior art date
Application number
PCT/CN2016/107320
Other languages
English (en)
French (fr)
Inventor
杜铁刚
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017107739A1 publication Critical patent/WO2017107739A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Definitions

  • the present invention relates to the field of communications, and in particular to a data service processing method and apparatus.
  • wireless networks can be divided into the following two categories:
  • the 3rd Generation Partnership Project (3GPP) network namely Global System for Mobile Communication (GSM), Universal Mobile Telecommunications System (UMTS), Long Term Evolution (LTE), etc.
  • GSM Global System for Mobile Communication
  • UMTS Universal Mobile Telecommunications System
  • LTE Long Term Evolution
  • the disadvantage is that it is not easy to deploy and implement, the data rate varies with the network signal, and the terminal (corresponding to the above-mentioned user equipment) has relatively large mobility.
  • Non-3GPP networks such as Wireless Local Area Network (WLAN), Worldwide Interoperability for Microwave Access (WIMAX or WINMAX), Bluetooth, etc., such networks have small coverage and number of bearers. less. The advantages are easy to deploy coverage, low mobility, and high data transfer rate within hotspots.
  • WLAN Wireless Local Area Network
  • WIMAX Worldwide Interoperability for Microwave Access
  • WINMAX Worldwide Interoperability for Microwave Access
  • Bluetooth etc.
  • non-3GPP network and the 3GPP network have complementary advantages. If the two are integrated, the 3GPP data service can be conveniently distributed to facilitate the terminal to access the Internet.
  • a 3GPP-authorized non-3GPP network is referred to as a trusted non-3GPP network.
  • SIM Subscriber Identity Module
  • SIM-free terminals which are connected to the 3GPP network from the non-3GPP network.
  • an Extensible Authentication Protocol-Subscriber Identity Module (EAP-SIM) or an Extensible Authentication Protocol-Authentication and Key Agreement (Extensible Authentication Protocol-Authentication and Key Agreement) can be used.
  • EAP-AKA Extensible Authentication Protocol-Subscriber Identity Module
  • the terminal can read the SIM user identity information to the 3GPP authentication server for identity authentication and then enter the network.
  • the disadvantage of this method is that the terminal must have a SIM card, and the usage scenarios and fields are limited. For example, in recent years, the Internet of Things business has developed rapidly, and various Machine-to-Machine/Man (M2M) terminals have been widely used.
  • M2M Machine-to-Machine/Man
  • the mobile communication module with SIM card needs to be embedded on the M2M terminal device.
  • This method is inconvenient for the access of the smart sensor or the micro device.
  • the specific embodiment is as follows: 1) The pluggable SIM card is in the special M2M terminal. In the case of long-term use, it is easy to loose and the contact is poor; 2) the existing pluggable SIM card is difficult to replace after being installed in the M2M terminal due to the complicated installation position; 3) the existing M2M terminal is difficult to put into use after being put into use Replace the carrier.
  • Extensible Authentication Protocol-Transport Layer Security Protocol is used for terminals that do not have a SIM inserted or that are connected to the SIM but need to use the SIM-free network (hereinafter referred to as a SIM-free terminal).
  • a SIM-free terminal For example, EAP-TLS authentication, the client needs to download the mobile certificate, and the Extensible Authentication Protocol over Local Area Network (EA-POL) tunnel is established between the terminal and the 3GPP server to perform two-way identity information. After interactive authentication, Internet access is allowed.
  • EA-POL Extensible Authentication Protocol over Local Area Network
  • softSIM soft SIM
  • eSIM embedded SIM
  • UICC Universal Integrated The Circuit Card
  • the terminal can be pre-installed at the factory or download the carrier SIM information from the dedicated service network platform to the configuration chip.
  • the connection of the terminal from the trusted non-3GPP network to the 3GPP network is the same as the authentication process with the SIM.
  • This method requires the terminal to support SIM information storage, SIM information download platform, and operator open SIM information download.
  • the embedded SIM or soft SIM needs terminal memory chip and software platform support, and has requirements for the terminal, and does not solve the problem that the existing SIM-free terminal receives the 3GPP network identity verification from the trusted non-3GPP network.
  • the above content mainly describes the problems that arise from the assignment of a non-3GPP network to a 3GPP network. Similarly, the access from the non-4GPP network to the 4GPP network and the non-5GPP network access to the 5GPP network also exist. The problem.
  • the embodiment of the present invention provides a data service processing method and apparatus, to at least solve the problem that the non-SIM card terminal existing in the related art needs to be authenticated when receiving the mobile communication partner project network from the credit non-mobile communication partner project network, thereby causing The interaction is cumbersome, the access delay is large, and the user experience is low.
  • a data service processing method including: receiving a first request message sent by a user equipment UE for requesting data service; and moving to a third generation according to the first request message
  • the communication partner project mobile communication partner project network gateway sends a second request message, where the second request message carries the virtual mobile station identification number MSISDN of the UE, and the virtual access point of the access point accessed by the UE a name APN and an Internet Protocol IP address assigned to the UE, the second request message is used to request the mobile communication partner project network gateway to verify the virtual APN and the IP address, and the verification result is legal In the case of controlling the UE to use the virtual MSISDN for data business.
  • the method before sending the second request message to the mobile communication partner item network gateway according to the first request message, the method further includes: acquiring a location home register HLR or a home subscription in the mobile communication partner item network.
  • the virtual MSISDN allocated by the HLR or the HSS for the UE carries a single/multiple user identifier, where the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is for a single user.
  • the access is also for access by multiple users.
  • the virtual mobile station identification number (MSISDN) of the UE carried in the second request message is determined by: acquiring the single/multiple carried in the virtual MSISDN allocated by the HLR or the HSS for the UE a user identifier; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is an access for multiple users, using a media access control MAC address of the UE as a location carried in the second request message a virtual MSISDN of the UE; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is an access for a single user, using the obtained HLR or the virtual MSISDN allocated by the HSS for the UE as a The virtual MSISDN of the UE carried in the second request message.
  • MSISDN virtual mobile station identification number
  • the sending the second request message to the mobile communication partner item network gateway according to the first request message includes: verifying whether a media access control MAC address of the UE carried in the first request message is Legally, or verifying whether the user name, password, and media access control MAC address of the UE carried in the first request message are legal; if the verification result is legal, the mobile communication partner project network gateway is Sending the second request message.
  • determining whether the media access control MAC address of the UE that is carried in the first request message is legal includes: determining whether the MAC address of the UE is included in a locally stored MAC authentication table, where The MAC address of the UE that allows the data service is recorded in the MAC authentication table. If the result of the determination is that the MAC address of the UE is valid, the UE determines that the MAC address is legal. The MAC The address is not valid.
  • the method further includes: prompting, by the UE, the user name and password if the verification result is invalid. And verifying whether the user name, password, and the MAC address of the UE reported by the UE are correct; and if the verification result is correct, sending the second request message to the mobile communication partner project network gateway.
  • a data service processing method including: receiving a second request message sent by an access controller AC of a trusted non-mobile communication partner item network, wherein the second request message The virtual mobile station identification number MSISDN of the user equipment UE requesting the data service, the virtual access point name APN of the access point accessed by the UE, and the Internet Protocol IP address allocated by the AC to the UE; Verifying that the virtual APN and the IP address are legal; if the verification result is legal, the UE is controlled to use the virtual MSISDN for data service.
  • the method before receiving the second request message sent by the AC of the trusted non-mobile communication partner item network, the method further includes: allocating a virtual MSISDN to the UE and serving as the trusted non-mobile communication partner project network
  • the access point AP allocates a virtual APN; the assigned virtual MSISDN and the assigned virtual APN are notified to the authentication server in the trusted non-mobile communication partner project network.
  • the virtual MSISDN allocated to the UE includes a MAC address of the UE and a single/multi-user identity indicating that the allocated virtual MSISDN is access for a single user, or includes the credit non-mobile communication a MAC address of the AP of the partner project network and a single/multiple user identity indicating that the assigned virtual MSISDN is for access by a plurality of users; and/or, according to the AC of the trusted non-mobile communication partner project network
  • the number information and the authentication number information of the authentication server assign a virtual APN to the access point of the credit non-mobile communication partner item network.
  • the number information of the AC, the authentication number information of the authentication server, and the MAC address of the AP or the MAC address of the UE are obtained by: receiving a subscription account opening request of the UE, wherein the subscription account opening request is for requesting to allocate a virtual MSISDN for the UE and assigning a virtual APN to an access point of the credit non-mobile communication partner project network; collecting the credit non-mobile The number information of the AC of the communication partner item network and the number information of the authentication server, and the MAC address of the AP of the credit non-mobile communication partner item network or the MAC address of the UE.
  • controlling the UE to use the virtual MSISDN for data service comprises: using the virtual MSISDN to create a general packet radio service tunneling protocol (GTP tunnel) for the UE to perform data services.
  • GTP tunnel general packet radio service tunneling protocol
  • a data service processing apparatus including: a first receiving module, configured to receive a first request message sent by a user equipment UE for requesting data service; a sending module, setting Sending a second request message to the third generation mobile communication partner project mobile communication partner project network gateway according to the first request message; wherein the second request message carries the virtual mobile station identification number MSISDN of the UE, a virtual access point name APN of the access point accessed by the UE and an internet protocol IP address allocated to the UE, where the second request message is used to request the mobile communication partner project network gateway to the virtual APN and The IP address is verified, and if the verification result is legal, the UE is controlled to use the virtual MSISDN to perform data service.
  • the device further includes: an obtaining module, configured to acquire the mobile communication partner item network before sending the second request message to the mobile communication partner project network gateway according to the first request message
  • the location home register HLR or the home subscriber server HSS allocates a virtual MSISDN for the UE and a virtual APN assigned to the access point of the trusted non-mobile communication partner project network.
  • the virtual MSISDN allocated by the HLR or the HSS for the UE carries a single/multiple user identifier, where the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is for a single user.
  • the access is also for access by multiple users.
  • the sending module further includes a determining unit, configured to determine, by using the following manner, the virtual mobile station identification number MSISDN of the UE carried in the second request message: acquiring The HLR or the HSS is a single/multiple user identifier carried in the virtual MSISDN allocated by the UE; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is access for multiple users, use The media access control MAC address of the UE is used as the virtual MSISDN of the UE carried in the second request message; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is for access by a single user The virtual MSISDN allocated to the UE by using the obtained HLR or the HSS is used as the virtual MSISDN of the UE carried in the second request message.
  • a determining unit configured to determine, by using the following manner, the virtual mobile station identification number MSISDN of the UE carried in the second request message: acquiring The HLR or the HSS is a single/multiple user
  • the sending module includes: a first verification unit, configured to verify whether the media access control MAC address of the UE carried in the first request message is legal, or verify the first request message Whether the user name, the password, and the media access control MAC address of the carried UE are legal; the first sending unit is configured to send the second to the mobile communication partner project network gateway if the verification result is legal Request message.
  • the first verification unit includes: a determining subunit, configured to determine whether the locally stored MAC authentication table includes the MAC address of the UE, where the MAC authentication table records that data is allowed to be performed. a MAC address of the UE of the service; the first determining subunit, configured to determine that the MAC address of the UE is legal if the judgment result of the determining subunit is present; and/or, the second determining subunit And determining to determine that the MAC address of the UE is invalid when the judgment subunit determines that the result is non-existent.
  • the sending module further includes: a prompting unit, configured to: after verifying that the media access control MAC address of the UE carried in the first request message is legal, if the verification result is illegal.
  • the second sending unit is configured to verify that the user name and password reported by the UE and the MAC address of the UE are correct; and the second sending unit is configured to verify that the verification result is correct.
  • the second request message is sent to the mobile communication partner project network gateway.
  • a data service processing apparatus including: a second receiving module, configured to receive a second request message sent by an access controller AC of a trusted non-mobile communication partner item network, where The second request message carries a request for data a virtual mobile station identification number MSISDN of the user equipment UE of the service, a virtual access point name APN of the access point accessed by the UE, and an Internet Protocol IP address allocated by the AC for the UE; a verification module, set to Verifying that the virtual APN and the IP address are legal; the control module is configured to control the UE to use the virtual MSISDN to perform data service if the verification result is legal.
  • a second receiving module configured to receive a second request message sent by an access controller AC of a trusted non-mobile communication partner item network, where The second request message carries a request for data a virtual mobile station identification number MSISDN of the user equipment UE of the service, a virtual access point name APN of the access point accessed by the UE, and an Internet Protocol IP address allocated by the AC for the UE
  • the apparatus further includes: an allocating module, configured to allocate a virtual MSISDN and a virtual MSISDN to the UE before receiving the second request message sent by the AC of the trusted non-mobile communication partner item network
  • the access point AP of the non-mobile communication partner project network assigns a virtual APN; the notification module is configured to notify the assigned virtual MSISDN and the assigned virtual APN to the authentication server in the credit non-mobile communication partner project network.
  • the virtual MSISDN allocated to the UE includes a MAC address of the UE and a single/multi-user identity indicating that the allocated virtual MSISDN is access for a single user, or includes the credit non-mobile communication a MAC address of the AP of the partner project network and a single/multiple user identity indicating that the assigned virtual MSISDN is for access by a plurality of users; and/or, according to the AC of the trusted non-mobile communication partner project network
  • the number information and the authentication number information of the authentication server assign a virtual APN to the access point of the credit non-mobile communication partner item network.
  • the number information of the AC, the authentication number information of the authentication server, and the MAC address of the AP or the MAC address of the UE are obtained by: receiving a subscription account opening request of the UE, where The subscription account opening request is for requesting to allocate a virtual MSISDN for the UE and assigning a virtual APN to an access point of the trusted non-mobile communication partner project network; collecting the number of the AC of the credit non-mobile communication partner project network Information and number information of the authentication server, and a MAC address of the AP of the credit non-mobile communication partner item network or a MAC address of the UE.
  • control module includes: a creating unit, configured to use the virtual MSISDN to create a general packet radio service tunneling protocol GTP tunnel for the UE to perform data services.
  • a creating unit configured to use the virtual MSISDN to create a general packet radio service tunneling protocol GTP tunnel for the UE to perform data services.
  • the embodiment of the present invention uses the receiving user equipment UE to send data for requesting a first request message of the service; sending, according to the first request message, a second request message to the third generation mobile communication partner project mobile communication partner project network gateway; wherein the second request message carries the virtual mobile of the UE a station identification number MSISDN, a virtual access point name APN of the access point accessed by the UE, and an internet protocol IP address allocated for the UE, the second request message being used to request the mobile communication partner project network gateway And verifying the virtual APN and the IP address, and if the verification result is legal, controlling the UE to use the virtual MSISDN to perform data service.
  • the invention solves the problem that the non-SIM card terminal existing in the related art needs to be authenticated when receiving the mobile communication partner project network from the trusted non-mobile communication partner project network, thereby causing a cumbersome interaction, a large access delay, and a low user experience.
  • the invention further provides a data service processing method, which achieves the effect of reducing the complexity and delay of the non-SIM card terminal from the trusted non-mobile communication partner project network to the mobile communication partner project network, and improving the user experience.
  • the device in order to solve at least the non-SIM card terminal existing in the related technology, is required to be authenticated when receiving the mobile communication partner project network from the credit non-mobile communication partner project network, thereby causing cumbersome interaction, large access delay, and low user experience. The problem.
  • a data service processing method including: receiving a first request message sent by a user equipment UE for requesting data service; and moving to a third generation according to the first request message
  • the communication partner project mobile communication partner project network gateway sends a second request message, where the second request message carries the virtual mobile station identification number MSISDN of the UE, and the virtual access point of the access point accessed by the UE a name APN and an Internet Protocol IP address assigned to the UE, the second request message is used to request the mobile communication partner project network gateway to verify the virtual APN and the IP address, and the verification result is legal
  • the UE is controlled to perform data service by using the virtual MSISDN.
  • the method before sending the second request message to the mobile communication partner item network gateway according to the first request message, the method further includes: acquiring a location home register HLR or a home subscription in the mobile communication partner item network.
  • the virtual MSISDN allocated by the HLR or the HSS for the UE carries a single/multiple user identifier, where the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is for a single user.
  • the access is also for access by multiple users.
  • the virtual mobile station identification number (MSISDN) of the UE carried in the second request message is determined by: acquiring the single/multiple carried in the virtual MSISDN allocated by the HLR or the HSS for the UE a user identifier; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is an access for multiple users, using a media access control MAC address of the UE as a location carried in the second request message a virtual MSISDN of the UE; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is an access for a single user, using the obtained HLR or the virtual MSISDN allocated by the HSS for the UE as a The virtual MSISDN of the UE carried in the second request message.
  • MSISDN virtual mobile station identification number
  • the sending the second request message to the mobile communication partner item network gateway according to the first request message includes: verifying whether a media access control MAC address of the UE carried in the first request message is Legally, or verifying whether the user name, password, and media access control MAC address of the UE carried in the first request message are legal; if the verification result is legal, the mobile communication partner project network gateway is Sending the second request message.
  • determining whether the media access control MAC address of the UE that is carried in the first request message is legal includes: determining whether the MAC address of the UE is included in a locally stored MAC authentication table, where The MAC address of the UE that allows the data service is recorded in the MAC authentication table. If the result of the determination is that the MAC address of the UE is valid, the UE determines that the MAC address is legal. The MAC address is invalid.
  • the method further includes: prompting, by the UE, the user name and password if the verification result is invalid. Verifying that the user name, password, and MAC address of the UE reported by the UE are correct; if the verification result is correct, the mobile communication partner is The associated project network gateway sends the second request message.
  • a data service processing method including: receiving a second request message sent by an access controller AC of a trusted non-mobile communication partner item network, wherein the second request message The virtual mobile station identification number MSISDN of the user equipment UE requesting the data service, the virtual access point name APN of the access point accessed by the UE, and the Internet Protocol IP address allocated by the AC to the UE; Verifying that the virtual APN and the IP address are legal; if the verification result is legal, the UE is controlled to use the virtual MSISDN for data service.
  • the method before receiving the second request message sent by the AC of the trusted non-mobile communication partner item network, the method further includes: allocating a virtual MSISDN to the UE and serving as the trusted non-mobile communication partner project network
  • the access point AP allocates a virtual APN; the assigned virtual MSISDN and the assigned virtual APN are notified to the authentication server in the trusted non-mobile communication partner project network.
  • the virtual MSISDN allocated to the UE includes a MAC address of the UE and a single/multi-user identity indicating that the allocated virtual MSISDN is access for a single user, or includes the credit non-mobile communication a MAC address of the AP of the partner project network and a single/multiple user identity indicating that the assigned virtual MSISDN is for access by a plurality of users; and/or, according to the AC of the trusted non-mobile communication partner project network
  • the number information and the authentication number information of the authentication server assign a virtual APN to the access point of the credit non-mobile communication partner item network.
  • the number information of the AC, the authentication number information of the authentication server, and the MAC address of the AP or the MAC address of the UE are obtained by: receiving a subscription account opening request of the UE, where The subscription account opening request is for requesting to allocate a virtual MSISDN for the UE and assigning a virtual APN to an access point of the trusted non-mobile communication partner project network; collecting the number of the AC of the credit non-mobile communication partner project network Information and number information of the authentication server, and a MAC address of the AP of the credit non-mobile communication partner item network or a MAC address of the UE.
  • controlling the UE to use the virtual MSISDN for data service comprises: using the virtual MSISDN to create a general packet radio service tunneling protocol (GTP tunnel) for the UE to perform data services.
  • GTP tunnel general packet radio service tunneling protocol
  • a data service processing apparatus including: a first receiving module, configured to receive a first request message sent by a user equipment UE for requesting data service; a sending module, setting Sending a second request message to the third generation mobile communication partner project mobile communication partner project network gateway according to the first request message; wherein the second request message carries the virtual mobile station identification number MSISDN of the UE, a virtual access point name APN of the access point accessed by the UE and an internet protocol IP address allocated to the UE, where the second request message is used to request the mobile communication partner project network gateway to the virtual APN and The IP address is verified, and if the verification result is legal, the UE is controlled to use the virtual MSISDN to perform data service.
  • the device further includes: an obtaining module, configured to acquire the mobile communication partner item network before sending the second request message to the mobile communication partner project network gateway according to the first request message
  • the location home register HLR or the home subscriber server HSS allocates a virtual MSISDN for the UE and a virtual APN assigned to the access point of the trusted non-mobile communication partner project network.
  • the virtual MSISDN allocated by the HLR or the HSS for the UE carries a single/multiple user identifier, where the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is for a single user.
  • the access is also for access by multiple users.
  • the sending module further includes a determining unit, configured to determine, by using the following manner, a virtual mobile station identification number (MSISDN) of the UE carried in the second request message: acquiring the HLR or the HSS as The single/multiple user identifier carried in the virtual MSISDN allocated by the UE; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is access for multiple users, using the media access control MAC address of the UE And serving as the virtual MSISDN of the UE carried in the second request message; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is access for a single user, using the acquired HLR or the The virtual MSISDN allocated by the HSS to the UE is used as the virtual MSISDN of the UE carried in the second request message.
  • MSISDN virtual mobile station identification number
  • the sending module includes: a first verification unit, configured to verify whether the media access control MAC address of the UE carried in the first request message is legal, or verify the first request message Whether the user name, the password, and the media access control MAC address of the carried UE are legal; the first sending unit is configured to send the second to the mobile communication partner project network gateway if the verification result is legal Request message.
  • the first verification unit includes: a determining subunit, configured to determine whether the locally stored MAC authentication table includes the MAC address of the UE, where the MAC authentication table records that data is allowed to be performed. a MAC address of the UE of the service; the first determining subunit, configured to determine that the MAC address of the UE is legal if the judgment result of the determining subunit is present; and/or, the second determining subunit And determining to determine that the MAC address of the UE is invalid when the judgment subunit determines that the result is non-existent.
  • the sending module further includes: a prompting unit, configured to: after verifying that the media access control MAC address of the UE carried in the first request message is legal, if the verification result is illegal.
  • the second sending unit is configured to verify that the user name and password reported by the UE and the MAC address of the UE are correct; and the second sending unit is configured to verify that the verification result is correct.
  • the second request message is sent to the mobile communication partner project network gateway.
  • a data service processing apparatus including: a second receiving module, configured to receive a second request message sent by an access controller AC of a trusted non-mobile communication partner item network, where The second request message carries the virtual mobile station identification number MSISDN of the user equipment UE requesting the data service, the virtual access point name APN of the access point accessed by the UE, and the UE is the UE by the AC.
  • the allocated Internet Protocol IP address; the verification module is configured to verify whether the virtual APN and the IP address are legal; the control module is configured to control the UE to use the virtual MSISDN to perform data if the verification result is legal business.
  • the apparatus further includes: an allocating module, configured to allocate a virtual MSISDN and a virtual MSISDN to the UE before receiving the second request message sent by the AC of the trusted non-mobile communication partner item network
  • the access point AP of the non-mobile communication partner project network assigns a virtual APN; the notification module is configured to notify the assigned virtual MSISDN and the assigned virtual APN to the authentication server in the credit non-mobile communication partner project network.
  • the virtual MSISDN allocated to the UE includes a MAC address of the UE and a single/multi-user identity indicating that the allocated virtual MSISDN is access for a single user, or includes the credit non-mobile communication a MAC address of the AP of the partner project network and a single/multiple user identity indicating that the assigned virtual MSISDN is for access by a plurality of users; and/or, according to the AC of the trusted non-mobile communication partner project network
  • the number information and the authentication number information of the authentication server assign a virtual APN to the access point of the credit non-mobile communication partner item network.
  • the number information of the AC, the authentication number information of the authentication server, and the MAC address of the AP or the MAC address of the UE are obtained by: receiving a subscription account opening request of the UE, where The subscription account opening request is for requesting to allocate a virtual MSISDN for the UE and assigning a virtual APN to an access point of the trusted non-mobile communication partner project network; collecting the number of the AC of the credit non-mobile communication partner project network Information and number information of the authentication server, and a MAC address of the AP of the credit non-mobile communication partner item network or a MAC address of the UE.
  • control module includes: a creating unit, configured to use the virtual MSISDN to create a general packet radio service tunneling protocol GTP tunnel for the UE to perform data services.
  • a creating unit configured to use the virtual MSISDN to create a general packet radio service tunneling protocol GTP tunnel for the UE to perform data services.
  • Another embodiment of the present invention provides a computer storage medium storing execution instructions for performing one or a combination of the steps in the above embodiments.
  • a first request message for requesting data service sent by the user equipment UE is received, and a second request is sent to the third generation mobile communication partner project mobile communication partner project network gateway according to the first request message.
  • the mobile communication partner project network gateway verifies the virtual APN and the IP address, and if the verification result is legal, controls the UE to use the virtual MSISDN to perform data service.
  • the invention solves the problem that the non-SIM card terminal existing in the related art needs to be authenticated when receiving the mobile communication partner project network from the trusted non-mobile communication partner project network, thereby causing a cumbersome interaction, a large access delay, and a low user experience. Further, the effect of reducing the complexity and delay of the non-SIM card terminal from the credited non-mobile communication partner project network to the mobile communication partner project network is achieved, and the user experience is improved.
  • FIG. 1 is a flowchart of a first data service processing method according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a second data service processing method according to an embodiment of the present invention.
  • FIG. 3 is a diagram of a distributed access authentication model according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a convergence of a trusted non-3GPP network and a 3GPP network according to an embodiment of the present invention
  • FIG. 5 is a device diagram of interaction between a trusted non-3GPP network and authentication information of each module in a 3GPP network according to an embodiment of the present invention
  • FIG. 6 is a flowchart of an access authentication interaction of a WLAN network to a SIM-free terminal according to an embodiment of the present invention
  • FIG. 7 is a diagram of a user virtual identity generation according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of single-user multi-site access authentication according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of access authentication of multiple users in the same place according to an embodiment of the present invention.
  • FIG. 10 is a structural block diagram of a first data service processing apparatus according to an embodiment of the present invention.
  • FIG. 11 is a block diagram showing an optional structure of a first data service processing apparatus according to an embodiment of the present invention.
  • FIG. 12 is a structural block diagram 1 of a transmitting module 104 in a first data service processing apparatus according to an embodiment of the present invention
  • FIG. 13 is a second structural block diagram of a transmitting module 104 in a first data service processing apparatus according to an embodiment of the present invention
  • FIG. 14 is a structural block diagram of a first verification unit 132 in a first data service processing apparatus according to an embodiment of the present invention.
  • FIG. 15 is a block diagram showing an optional structure of a transmitting module 104 in a first data service processing apparatus according to an embodiment of the present invention
  • 16 is a structural block diagram of a second data service processing apparatus according to an embodiment of the present invention.
  • FIG. 17 is a block diagram showing an optional structure of a second data service processing apparatus according to an embodiment of the present invention.
  • FIG. 18 is a structural block diagram of a control module 166 in a second type of data service processing apparatus according to an embodiment of the present invention.
  • the terms “first”, “second” and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.
  • the “credit non-mobile communication partner project network” may also be simply referred to as “non-mobile communication partner project network element” or “non-mobile communication partner project domain”, the following “user equipment” and “ The terminal is equivalent.
  • FIG. 1 is a flowchart of a first data service processing method according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:
  • Step S102 Receive a first request message sent by the user equipment UE for requesting data service.
  • Step S104 Send a second request message to the mobile communication partner project network gateway according to the first request message, where the second request message carries the virtual mobile station identification number MSISDN of the UE, and the virtual access of the access point accessed by the UE Point name APN and Internet Protocol IP address assigned to the UE, the second request message is used to request the mobile communication partner project network gateway to verify the virtual APN and the IP address, and if the verification result is legal, control the UE to use the virtual MSISDN Conduct data services.
  • the second request message carries the virtual mobile station identification number MSISDN of the UE, and the virtual access of the access point accessed by the UE Point name APN and Internet Protocol IP address assigned to the UE, the second request message is used to request the mobile communication partner project network gateway to verify the virtual APN and the IP address, and if the verification result is legal, control the UE to use the virtual MSISDN Conduct data services.
  • the performing the above steps may be a module in the credit non-mobile communication partner project network.
  • the mobile communication partner project network may allow the UE to perform data services according to the received virtual APN of the UE and the IP address of the UE.
  • the verification method is simple, the verification method is simple, the frequent interaction certificate is not needed, and the softSIM or eSIM is not required to be configured for the UE, and in the case that the verification is passed, the virtual MSISDN of the UE can be used to control the UE for data service.
  • the non-SIM card user equipment existing in the related art is solved (may be a scenario in which the SIM card is not inserted in the user equipment, or a SIM card is inserted in the user equipment, but a scenario in which the SIM card is used to access the Internet is required)
  • the mobile communication partner project network is received from the credited non-mobile communication partner project network, authentication is required, which causes cumbersome interaction, large access delay, and low user experience, thereby reducing the credit-free user equipment.
  • the complexity and delay of the non-mobile communication partner project network when it receives the mobile communication partner project network improves the user experience.
  • the mobile communication partner item network in the above embodiments and the following embodiments may be a 3GPP network
  • the mobile communication partner item network in the foregoing embodiments and the following embodiments may also be a 4GPP network, or 5GPP. Network, or, subsequently, 6GPP networks that may appear.
  • the method before sending the second request message to the mobile communication partner project network gateway according to the foregoing first request message, the method further includes: acquiring a location home register HLR or a home subscription subscriber server in the mobile communication partner item network. Virtually assigned by the HSS to the UE MSISDN and virtual APNs assigned to access points of the non-mobile communication partner project network.
  • the virtual MSISDN allocated by the HLR or the HSS for the UE carries a single/multiple user identifier, where the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is for a single user.
  • Incoming access of a single user
  • multiple users access to multiple users
  • the single/multi-user identifier may be a 1-bit identifier. For example, 0 indicates access for a single user, and 1 indicates access for multiple users. Of course, other identifiers may also be used for identification.
  • the virtual mobile station identification number MSISDN and the HLR or the HSS of the UE carried in the second request message may be the same as the virtual MSISDN allocated by the UE, or may be different. In an optional embodiment, the following manner may be adopted. Determining the virtual mobile station identification number MSISDN of the UE carried in the second request message: acquiring the single/multiple user identifier carried in the virtual MSISDN allocated by the HLR or the HSS for the UE; when the single/multiple user identifier is used to indicate the allocated virtual The MSISDN is used for accessing multiple users, and uses the media access control MAC address of the UE as the virtual MSISDN of the UE carried in the second request message; when the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is directed to The virtual MSISDN allocated to the UE by the acquired HLR or the HSS is used as the virtual MSISDN of the UE carried in the second request message. In this way, the mobile communication partner project network gateway can uniquely determine the UE to
  • the sending, by the first request message, the second request message to the mobile communication partner project network gateway includes: verifying whether the media access control MAC address of the UE carried in the first request message is legal. Or verifying whether the user name, password, and media access control MAC address of the UE carried in the first request message are legal; if the verification result is legal, sending a second request message to the mobile communication partner project network gateway. .
  • verifying whether the MAC address of the UE is legal may be for a UE that is not accessed for the first time.
  • the UE without SIM card can input the user name and password when accessing the mobile communication partner project network through the credit non-mobile communication partner project network for the first time.
  • the MAC address of the UE is recorded, and the record is recorded.
  • the MAC address can be recorded in the form of a MAC table.
  • determining whether the media access control MAC address of the UE carried in the first request message is legal includes: determining whether the MAC address of the UE is included in the locally stored MAC authentication table, where the MAC authentication The MAC address of the UE that is allowed to perform the data service is recorded in the table. If the result of the determination is that the MAC address of the UE is valid, the MAC address of the UE is determined to be invalid.
  • the method further includes: prompting, by the UE, the user name and the case that the verification result is invalid.
  • the password is used to verify whether the user name, password, and MAC address of the UE reported by the UE are correct. If the verification result is correct, the second request message is sent to the mobile communication partner project network gateway. It can be seen that when the UE is authenticated in the non-mobile communication partner project network, the MAC and portal PORTAL hybrid authentication mode can be adopted.
  • the above verification method is only an example, and other feasible verification methods can also be used for verification.
  • FIG. 2 is a flowchart of a second data service processing method according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps:
  • Step S202 receiving a second request message sent by the access controller AC of the non-mobile communication partner item network, where the second request message carries the virtual mobile station identification number MSISDN, UE of the user equipment UE requesting the data service.
  • Step S204 verifying whether the virtual APN and the IP address are legal
  • step S206 if the verification result is legal, the UE is controlled to perform data service by using the virtual MSISDN.
  • the performing the above steps may be a module in the mobile communication partner project network.
  • the mobile communication partner project network may verify whether the UE is allowed to perform data services according to the received virtual APN of the UE and the IP address of the UE.
  • the verification method is simple, the frequent interaction certificate is not needed, and the softSIM or eSIM is not required to be configured for the UE, and in the case that the verification is passed, the virtual MSISDN of the UE can be used to control the UE for data service. Therefore, the non-SIM card user equipment existing in the related art needs to be authenticated when receiving the mobile communication partner project network from the trusted non-mobile communication partner project network, thereby causing cumbersome interaction, large access delay, and low user experience. The problem, in turn, achieves the effect of reducing the complexity and delay of the non-SIM card user equipment from the credited non-mobile communication partner project network to the mobile communication partner project network, and improving the user experience.
  • the method before receiving the second request message sent by the AC of the credit non-mobile communication partner item network, the method further includes: allocating the virtual MSISDN to the UE and accessing the network for the non-mobile communication partner project
  • the point AP allocates a virtual APN; the assigned virtual MSISDN and the assigned virtual APN are notified to an authentication server in the trusted non-mobile communication partner project network.
  • the authentication server may transmit the virtual MSISDN and the allocated virtual APN to the AC, and the AC may save the virtual MSISDN and the virtual APN, so that when the UE requests access to the mobile communication partner project network, the AC may save according to the save.
  • the above virtual MSISDN and virtual APN send an access request (ie, a second request message) to the mobile communication partner project.
  • the virtual MSISDN allocated for the UE includes a MAC address of the UE and a single/multiple user identifier for indicating that the allocated virtual MSISDN is access for a single user, or includes credit non-mobile communication.
  • the MAC address of the AP of the partner project network and the virtual MSISDN indicating the assignment are single/multiple user identifiers for multiple user access; and/or, according to the number of the AC of the trusted non-mobile communication partner project network Information and clinic
  • the authentication number information of the authentication server allocates a virtual APN to the access point of the credit non-mobile communication partner project network.
  • the single/multi-user identifier may be a 1-bit identifier. For example, 0 indicates access for a single user, and 1 indicates access for multiple users. Of course, other identifiers may also be used for identification.
  • the number information of the AC, the authentication number information of the authentication server, and the MAC address of the AP or the MAC address of the UE may be obtained by receiving a subscription request for the UE, where the subscription is opened. Requesting for requesting to allocate a virtual MSISDN for the UE and assigning a virtual APN to the access point of the trusted non-mobile communication partner project network; collecting the number information of the AC of the above-mentioned credit non-mobile communication partner project network and the number information of the authentication server, and the above-mentioned credit The MAC address of the AP of the non-mobile communication partner project network or the MAC address of the UE.
  • controlling the UE to use the virtual MSISDN for data services includes: using a virtual MSISDN to create a General Packet Radio Service Tunneling Protocol (GTP) tunnel for the UE to perform data services.
  • GTP General Packet Radio Service Tunneling Protocol
  • FIG. 1 and the embodiment related to FIG. 1 are mainly applied to a credit non-mobile communication partner project network
  • FIG. 2 and the embodiment related to FIG. 2 are mainly applied to a mobile communication partner project network.
  • the following describes the embodiments of the present invention by taking a credit non-3GPP network and a 3GPP network as an example:
  • FIG. 3 is a diagram of a distributed access authentication model according to an embodiment of the present invention.
  • the SIM-free terminal described in the figure accesses a 3GPP domain from a different trusted non-3GPP domain (ie, a trusted non-3GPP network). (ie, 3GPP network), the SIM-free terminal according to the embodiment of the present invention accesses the trusted non-3GPP network to the 3GPP network system, and uses the distributed access authentication model as shown in FIG. 3, where, in FIG.
  • the modules included in the A, B, C, and D modules correspond to Figure 5 below:
  • the entire system is divided into a trusted non-3GPP domain and a 3GPP domain.
  • the grant non-3GPP domain includes an access point (corresponding to the non-3GPP hotspot shown in Figure 3), the access controller (corresponding to Figure 3 The illustrated non-3GPP access controller) and the access authentication server (corresponding to the non-3GPP authentication server shown in FIG. 3).
  • the 3GPP domain includes a Gateway General Packet Radio Service Supporting Node/Packet Data Network Gateway (GGSN/PGW) (corresponding to the 3GPP gateway shown in FIG. 3), and the location belongs to Register/Home Subscriber Server (HLR/HSS for short).
  • GGSN/PGW Gateway General Packet Radio Service Supporting Node/Packet Data Network Gateway
  • FIG. 4 is a schematic diagram of a fusion of a non-3GPP network and a 3GPP network according to an embodiment of the present invention. The following describes an embodiment of the present invention with reference to FIG. 4:
  • the account opening without the SIM terminal is managed on the HLR/HSS, and the virtual mobile station identification number (MSISDN) is generated for the non-SIM terminal on the HLR/HSS, and the virtual access point name (Acess Point Name is simply referred to as APN), authorized to the non-3GPP authentication server of the credit.
  • the method includes: generating the virtual MSISDN, the virtual APN, and authorizing the virtual identity information to the non-SIM terminal to use the home WLAN and an authentication server (eg, an AAA authentication server) in the WIMAX domain.
  • the respective authentication servers of the WLAN network and the WIMAX network are connected to the HLR/HSS in the 3GPP domain, and respectively manage the SIM-free access authentication in the domain.
  • the single-user access virtual MSISDN may be generated according to the MAC of the terminal, and the single-user access virtual APN may be generated according to the trusted non-3GPP access controller location and the authentication server location information.
  • the multi-user access virtual MSISDN may be generated according to the access hotspot MAC of the non-3GPP network, and the multi-user access virtual APN may be generated according to the trusted non-3GPP access controller location and the authentication server location.
  • the authentication server delivers the virtual MSISDN and the virtual APN to the trusted non-3GPP access controller.
  • the authentication server of the WLAN and the WIMAX network sends the virtual MSISDN and APN information to the respective access controllers after the authentication of the SIM-free terminal is passed.
  • the access controller can use the MAC and PORTAL hybrid authentication mode to authenticate the terminal. After the authentication is passed, the local IP address is assigned to the terminal, and a GTP tunnel is created to the GGSN/PGW (that is, the 3GPP network is controlled to control the SIM-free terminal. Carry out data services,
  • the request to construct the GIP is taken as an example, and the virtual MSISDN, the APN, and the IP address are carried.
  • the GTP request carries a GTP request on the access controller of the WLAN and the WIMAX.
  • the GTP request carries the virtual MSISDN, the virtual APN information, and the IP address information allocated by the access controller, and requests the GGSN/PGW to establish an interworking tunnel.
  • the terminal performs IP verification on the terminal, and uses the virtual MSINDN to replace the identity information of the terminal to create a GTP/S2A tunnel.
  • the terminal uses the virtual MSINDN to replace the identity information of the terminal to create a GTP/S2A tunnel.
  • the MSISDN replaces the IMSI information and establishes a GTP/S2A service channel without a SIM terminal.
  • the access controller is connected to the GGSN and uses the GTPC V1 protocol, which is commonly referred to as a GTP tunnel.
  • the access controller is connected to the EPC and uses the GTPC V2, which is the S2A standard interface of the communication industry.
  • FIG. 5 is a diagram of an apparatus for interacting with authentication information of a module in a trusted non-3GPP network and a 3GPP network according to an embodiment of the present invention.
  • the configuration acquisition module 10, the virtual user information generation module 20, the authorization delivery module 30, the IP verification module 80, the virtual APN verification module 90, and the virtual MSISDN user tunnel module 100 are located in the 3GPP network, and the local authentication module 40,
  • the MAC authentication module 50, the IP address allocation module 60, and the tunnel creation module 70 are located in a trusted non-3GPP network, where the module A includes a configuration acquisition module 10, a virtual user information generation module 20, and an authorization delivery module 30, and the module B includes local authentication.
  • the module 40 includes a MAC authentication module 50, an IP address allocation module 60, and a tunnel creation module 70.
  • the module D includes an IP verification module 80, a virtual APN verification module 90, and a virtual MSISDN user tunnel module 100. The following description will be combined with FIG. 5:
  • the SIM-free terminal access authentication includes the following processing modules:
  • the configuration obtaining module 10 is configured to obtain information about the SIM-free terminal and the location of the network access;
  • the virtual user information generating module 20 obtains the virtual identity of the SIM-free terminal according to the configuration acquisition information.
  • the local authentication module 40 the local authentication server authenticates the initial access of the SIM-free terminal, verifies the user name and password, and the MAC address, passes the authentication, and delivers the virtual MSISDN and the APN to the access controller.
  • the MAC authentication module 50 the access controller accesses the local MAC address authentication without the SIM terminal;
  • the IP address allocation module 60 associates the SIM-free terminal with a Service Set Identifier (SSID), and the access controller allocates an IP address for the SIM-less terminal;
  • SSID Service Set Identifier
  • the tunnel creation module 70 requests the 3GPP gateway to establish a tunnel after the local authentication of the access controller is passed.
  • the IP verification module 80 checks the legality of the IP address on the 3GPP access gateway.
  • the virtual APN check module 90 checks the legality of the APN on the 3GPP;
  • a virtual MSISDN user tunnel module 100 is created, and a virtual SIM-free terminal user is identified according to the IMSI of 0.
  • the virtual MSISDN information is used on the 3GPP to create a GTP tunnel.
  • the following uses the WLAN network as an example to describe the access authentication interaction process of a SIM-free terminal:
  • FIG. 6 is a flow chart of an access authentication interaction of a WLAN network to a SIM-free terminal according to an embodiment of the present invention. As shown in Figure 6. The process includes the following steps:
  • the access process it is divided into two major processes: account opening authorization and access authentication.
  • the account opening authorization process is as follows:
  • the process is performed on the HLR/HSS.
  • the HLR/HSS can support the account opening terminal information and the access network location information collection function. After receiving the subscription request for the SIM-free terminal, the HLR/HSS performs the following operations:
  • the collected information includes:
  • the MAC information AP-MAC of the access point AP 2.
  • the virtual identity information generated on the HLR/HSS is divided into a single user mode and a multi-user mode.
  • Virtual identity information generation is shown in FIG. 7, which is a user virtual identity generation diagram according to an embodiment of the present invention. As shown in Figure 7, in single-user mode, the terminal is allowed to access uniquely.
  • the virtual identity information is as follows:
  • the virtual MSISDN is generated according to the terminal MAC (48bit) and the 1-bit single/multiple user identifier (the 1bit single/multiple user identifier is only an example, and other identifiers can also be used), a total of 49bit, and the existing GTP/S2A protocol.
  • the length of the MSISDN is consistent.
  • the virtual APN is generated by AC-ID (8 bit) and AAA-ID (8 bit).
  • the virtual identity information is as follows:
  • the virtual MSISDN is generated according to the AP-MAC (48 bit) and the 1-bit single/multiple user identifier of the access hotspot, for a total of 49 bits.
  • the virtual APN is generated by AC-ID (8 bit) and AAA-ID (8 bit).
  • the HLR/HSS generates a virtual MSISDN, APN, account name and key, and synchronizes (or authorizes) the authentication server of the non-3GPP network through the Mobile Application Part (MAP) interface (corresponding to In step S603) in Fig. 6.
  • the SIM-free terminal can choose to access from different trusted non-3GPP networks. Different credit non-3GPP domains can access different MSISDN and APN information.
  • the user name, password, and virtual MSISDN and APN information of the SIM-free terminal are registered, and the user authentication is taken over.
  • the access authentication process is as follows:
  • the SIM-free terminal is associated with the SSID of the AP in the coverage of the AP signal, and obtains an IP address (corresponding to step S604 in FIG. 6).
  • the AC After the AC fails to check the local MAC authentication table, the AC redirects the login authentication page of the PORTAL to the terminal (corresponding to step S605 in FIG. 6).
  • the AAA authentication server receives the authentication request and checks whether the username, password, and MAC address are correct. If not, reject the SIM-free terminal access (corresponding to step S607 in Fig. 6).
  • step S608 in Fig. 6 If it is correct, query whether the virtual MSISDN information associated with the username and password exists. If it exists, the user authorized by the 3GPP sends the virtual MSISDN and APN information to the AC. If it does not exist, it is an ordinary user and does not send the virtual. MSISDN and APN information (corresponding to step S608 in Fig. 6).
  • the AC After the initial login authentication of the SIM terminal, the AC records the user's MAC information, updates the MAC aging time configuration, and ages the non-SIM terminal MAC address of the ultra-long offline (corresponding to steps S609 and S610 in FIG. 6).
  • the SIM-free terminal is associated with the SS ID of the AP in the coverage of the AP signal, and obtains the IP address assigned by the AC (corresponding to step S611 in FIG. 6).
  • the authentication server delivers the virtual MSISDN and APN to the access controller.
  • the access controller receives the virtual MSISDN and APN from the authentication server, and carries the terminal.
  • End virtual identity information, requesting to establish a tunnel to the intra-3GPP intra-domain gateway may include the following operations: the non-3GPP access control AC sends a GTP/S2A request to the 3GPP gateway GGSN/PGW, and the IMSI information of the no SIM card terminal is set to 0, according to the MSISDN information.
  • the multi-user ID is used to distinguish between single-user and multi-user. If it is multi-user, the virtual MSISDN is replaced by the user MAC. If it is a single user, the MAC does not change.
  • the tunnel request message carries the AC-assigned IP address and virtual MSISDN and APN identity information. (corresponding to steps S613 and S614 in Fig. 6).
  • access gateway GGSN/PGW checks the user's IP information and APN legality. After the verification is passed, the virtual mobile subscriber identity (IMISDN) is used instead of the international mobile subscriber identity (IMSI). Information, establish a GTP/S2A tunnel of the SIM-free virtual user, and respond to the GTP request of the AC in the non-3GPP domain; after receiving the GTP/S2A response, the non-3GPP access controller AC sends an acknowledgement message to the SIM-free terminal, The authentication is successful (corresponding to steps S615-S617 in Fig. 6).
  • IMISDN virtual mobile subscriber identity
  • IMSI international mobile subscriber identity
  • FIG. 8 is a schematic diagram of single-user multi-site access authentication according to an embodiment of the present invention, as shown in FIG.
  • the UE1 and UE2 After the HLR/HSS is opened, the UE1 and UE2 generate virtual MSISDN1, APN1, UER1, PASSWORD1, and MSISDN2, APN2, UER2, and PASSWORD2, and the generated information is authorized to be stored in the non-3GPP authentication service.
  • UE1 and UE2 are respectively accessed from different APs in the same AC.
  • the first access is performed, and the user name and password are input.
  • the AC records the user's MAC information and MSISDN and APN. Correspondence information.
  • the AC directly checks the user MAC for authentication; if the MAC does not exist, the PORTAL interface is launched, and the user re-enters the user name and password to perform PORTAL authentication.
  • the AC sends a message to the 3GPP gateway to create a GTP/S2A tunnel.
  • the 3GPP gateway verifies the MSISDN, IP address, and APN information, and identifies the virtual SIM-free user according to the IMSI of 0. , using MSISDN information to establish mutual common Household tunnel.
  • FIG. 9 is a schematic diagram of access authentication of multiple users in the same place according to an embodiment of the present invention, as shown in FIG. 9 :
  • AP1 and AP2 After the HLR/HSS accounts, AP1 and AP2 generate virtual MSISDN1, UER1, PASSWORD1, and MSISDN2, UER2, and PASSWORD2, and authorize the non-3GPP intra-domain authentication service storage authentication.
  • the MAC authentication fails.
  • PORTAL is logged in.
  • the user name and password of the AP1 account are used to log in.
  • the non-3GPP sends the MSISDN1 and APN1 information of AP1 separately.
  • AC For AC, AC records MAC, MSISDN, and APN information.
  • the AC directly checks the user MAC table, and performs MAC authentication, without re-entering the user name and password.
  • the AC checks the multi-user virtual identity according to the obtained virtual MSISDN information.
  • the MAC address of the UE is used to fill the MSISDN, and the IP address and APN are carried.
  • the information is verified on the 3GPP gateway by the MSISDN, the IP address, and the APN information.
  • the MSISDN information is used to establish an interworking user tunnel.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • a data service processing device is also provided, which is used to implement the foregoing embodiments and optional implementation manners, and has not been described again.
  • the term "module” can implement a combination of software and/or hardware for a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 10 is a structural block diagram of a first data service processing apparatus according to an embodiment of the present invention. As shown in FIG. 10, the apparatus includes a first receiving module 102 (which may be located in a credit non-mobile communication partner project network). The controller AC) and the transmitting module 104 are described below.
  • the first receiving module 102 is configured to receive a first request message sent by the user equipment UE for requesting data service
  • the sending module 104 is connected to the first receiving module 102, and is configured to send the mobile communication according to the first request message.
  • the partner project network gateway sends a second request message, where the second request message carries the virtual mobile station identification number MSISDN of the UE, the virtual access point name APN of the access point accessed by the UE, and the Internet Protocol IP allocated for the UE.
  • the second request message is used to request the mobile communication partner project network gateway to verify the virtual APN and the IP address, and if the verification result is legal, control the UE to use the virtual MSISDN for data service.
  • FIG. 11 is a block diagram showing an optional structure of a first data service processing apparatus according to an embodiment of the present invention.
  • the apparatus includes an acquisition module 112 in addition to all the modules shown in FIG. Located in the authentication server in the credit non-mobile communication partner project network), the device will be described below.
  • the obtaining module 112 is connected to the sending module 104, and is configured to acquire a location home register HLR or a home subscriber server in the mobile communication partner project network before sending the second request message to the mobile communication partner project network gateway according to the first request message.
  • the virtual MSISDN allocated by the HLR or the HSS for the UE carries a single/multiple user identifier, where the single/multiple user identifier is used to indicate that the allocated virtual MSISDN is for a single user. Incoming or access to multiple users.
  • FIG. 12 is a structural block diagram 1 of a transmitting module 104 in a first data service processing apparatus according to an embodiment of the present invention.
  • the transmitting module 104 may further include a determining unit 122 (the unit may be located in a trusted non-mobile communication).
  • the determination unit 122 is described below in the access controller AC in the partner project network.
  • the determining unit 122 is configured to determine the virtual mobile station identification number MSISDN of the UE carried in the second request message by acquiring the single/multiple user identifier carried in the virtual MSISDN allocated by the HLR or the HSS for the UE; When the user identifier is used to indicate that the allocated virtual MSISDN is for access of multiple users, the media access control MAC address of the UE is used as the virtual MSISDN of the UE carried in the second request message; when the single/multiple user identifier is used to indicate When the virtual MSISDN is allocated for a single user, the virtual MSISDN allocated to the UE by using the obtained HLR or HSS is used as the virtual MSISDN of the UE carried in the second request message.
  • the transmitting module 104 includes a first verifying unit 132 (the unit may be located in a trusted non-mobile communication).
  • the access controller AC or the authentication server in the partner project network corresponding to the MAC authentication module 50 or the local authentication module 40
  • the first sending unit 134 the unit may be located in the credit non-mobile communication partner project network
  • the access controller AC corresponds to the above-described IP address allocation module 60 and tunnel creation module 70), and the transmission module 104 will be described below.
  • the first verification unit 132 is configured to verify whether the media access control MAC address of the UE carried in the first request message is legal, or verify the user name, password, and media access control of the UE carried in the first request message. Whether the MAC address is legal; the first sending unit 134 is connected to the first verification unit 132, and is configured to send a second request message to the mobile communication partner project network gateway if the verification result is legal.
  • FIG. 14 is a structural block diagram of a first verification unit 132 in a first data service processing apparatus according to an embodiment of the present invention.
  • the first verification unit 132 includes a determination subunit 142 and a first determination subunit. 144 and/or second determining subunit 146, below the first The verification unit 132 performs the description.
  • the determining sub-unit 142 is configured to determine whether the locally stored MAC authentication table includes the MAC address of the UE, where the MAC authentication table records the MAC address of the UE that is allowed to perform the data service; the first determining sub-unit 144 is connected to The determining subunit 142 is configured to determine that the MAC address of the UE is legal if the determination result of the determining subunit 142 is present; and/or, the second determining subunit 146 is connected to the determining subunit 142, and is set to When it is determined that the sub-unit 142 determines that the result is non-existent, it is determined that the MAC address of the UE is invalid.
  • the transmitting module 104 includes prompts in addition to all the units shown in FIG. Unit 152 (which may be located in the access controller AC in the credit non-mobile communication partner project network), a second verification unit 154 (which may be located in the authentication server in the credit non-mobile communication partner project network) and a second The sending unit 156 (which may be located in the access controller AC in the credit non-mobile communication partner project network) is described below.
  • the prompting unit 152 is connected to the first verification unit 132, and is configured to prompt the UE to report the user after verifying that the media access control MAC address of the UE carried in the first request message is legal, and if the verification result is invalid.
  • the second verification unit 154 is connected to the prompting unit 152, and is configured to verify whether the user name, password, and MAC address of the UE reported by the UE are correct.
  • the second sending unit 156 is connected to the second verification unit 154 and configured. In order to verify that the result is correct, a second request message is sent to the mobile communication partner project network gateway.
  • the apparatus includes a second receiving module 162 (the module may be located in a gateway in a mobile communication partner project network, for example, a GGSN or PGW), a verification module 164 (which may be located in a gateway in the mobile communication partner project network, such as a GGSN or PGW) and a control module 166 (which may be located in a gateway in the mobile communication partner project network, such as a GGSN or PGW), the device will be described below.
  • a second receiving module 162 the module may be located in a gateway in a mobile communication partner project network, for example, a GGSN or PGW
  • a verification module 164 which may be located in a gateway in the mobile communication partner project network, such as a GGSN or PGW
  • a control module 166 which may be located in a gateway in the mobile communication partner project network, such as a GGSN or PGW
  • the second receiving module 162 is configured to receive a second request message sent by the access controller AC of the non-mobile communication partner item network, where the second request message carries the virtual mobile station of the user equipment UE that requests the data service.
  • the verification module 164 connected to the second receiving module 162, configured to verify the virtual APN and the IP Whether the address is legal or not;
  • the control module 166 is connected to the verification module 164, and is configured to control the UE to use the virtual MSISDN for data service if the verification result is legal.
  • FIG. 17 is a block diagram showing an optional structure of a second data service processing apparatus according to an embodiment of the present invention.
  • the apparatus includes an allocating module 172 in addition to all the modules shown in FIG. Located in the HLR or HSS in the mobile communication partner project network) and the notification module 174 (which may be located in the HLR or HSS in the mobile communication partner project network), the device is described below.
  • the allocating module 172 is configured to allocate a virtual MSISDN for the UE and a virtual APN for the access point AP of the trusted non-mobile communication partner project network before receiving the second request message sent by the AC of the trusted non-mobile communication partner item network; 174. Connect to the foregoing allocation module 172 and the second receiving module 162, and set to notify the assigned virtual MSISDN and the allocated virtual APN to the authentication server in the trusted non-mobile communication partner project network.
  • the virtual MSISDN allocated for the UE includes a MAC address of the UE and a single/multiple user identifier indicating that the allocated virtual MSISDN is access for a single user, or includes the above-mentioned credit non-mobile
  • the MAC address of the AP of the communication partner project network and the virtual MSISDN used to indicate the assignment are single/multiple user identifiers for multiple user access; and/or, according to the numbering information and authentication of the AC of the non-mobile communication partner project network
  • the server's authentication number information assigns a virtual APN to the access point of the trusted non-mobile communication partner project network.
  • the number information of the AC, the authentication number information of the authentication server, and the MAC address of the AP or the MAC address of the UE may be obtained by receiving a subscription request for the UE, where the subscription is opened.
  • Request for request to assign virtual to UE The MSISDN and the access point for the credit non-mobile communication partner project network are assigned a virtual APN; the number information of the AC of the credit non-mobile communication partner project network and the number information of the authentication server are collected, and the AP of the non-mobile communication partner project network is trusted.
  • FIG. 18 is a structural block diagram of a control module 166 in a second data service processing apparatus according to an embodiment of the present invention. As shown in FIG. 18, the control module 166 includes a creating unit 182, which will be described below.
  • the creating unit 182 is configured to create a general packet radio service tunneling protocol GTP tunnel for the UE to perform data services using the virtual MSISDN described above.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • the processor performs the steps in the foregoing method embodiments according to the stored program code in the storage medium.
  • the information interaction in the authentication process can be reduced, and the SIM card terminal can be accessed from the credit non-mobile communication partner project network to the mobile communication partner project network authentication. And can achieve the following beneficial effects:
  • the terminal can purchase the data service package recharge card of the operator, and use the user name and password to access the network, and is not limited to whether the operator's SIM card is bound. Wireless operators can also expand their data business areas.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any particular The combination of hardware and software.
  • the mobile communication partner project network of the present invention can verify whether the UE is allowed to perform data services according to the received virtual APN of the UE and the IP address of the UE, and the verification method is simple, and no frequent interaction certificate is needed, and
  • the UE configures softSIM or eSIM, and in the case of authentication, the UE may be controlled to perform data services using the virtual MSISDN of the UE.
  • the non-SIM card user equipment existing in the related art is solved (may be a scenario in which the SIM card is not inserted in the user equipment, or a SIM card is inserted in the user equipment, but a scenario in which the SIM card is used to access the Internet is required)
  • the mobile communication partner project network is received from the credited non-mobile communication partner project network, authentication is required, which causes cumbersome interaction, large access delay, and low user experience, thereby reducing the credit-free user equipment.
  • the complexity and delay of the non-mobile communication partner project network when it receives the mobile communication partner project network improves the user experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供了一种数据业务处理方法及装置，其中，该方法包括：接收UE发送的用于请求进行数据业务的第一请求消息；根据第一请求消息向移动通信伙伴项目网络网关发送第二请求消息。解决了相关技术中存在的无客户识别卡SIM卡终端从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题。

Description

数据业务处理方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种数据业务处理方法及装置。
背景技术
当前，无线网络可分如下两类：
第三代移动通讯伙伴计划(3rd Generation partnership project，简称为3GPP)网络，即全球移动通信(Global system for Mobile Communication，简称为GSM)、通用移动通信系统(Universal Mobile Telecommunications System，简称为UMTS)、长期演进(Long Term Evolution，简称为LTE)等，该类网络覆盖范围广，承载的用户量大。缺点是不易于部署实施，数据速率随网络信号而变化，终端(对应于上述的用户设备)移动性比较大等特点。
非3GPP网络，如无线局域网(Wireless Local Area Network，简称为WLAN)、微波接入全球互通(Worldwide Interoperability for Microwave Access，简称为WIMAX或者WINMAX)、蓝牙等，该类网络覆盖范围小，承载终端数量少。优点是易于部署覆盖，低移动性，热点内数据传输速率高等特点。
由此可见，非3GPP网络与3GPP网络具有优势互补，如果二者相互融合，可方便的分流3GPP数据业务，方便终端上网。通常，把3GPP授权的非3GPP网络称为授信的非3GPP网络。
目前，智能终端逐渐普及，应用数据业务的设备越来越多。此外，在未来的物联网时代，也要求不同类型的无线网络在保证安全的情况下，需要去掉各自的一些壁垒，方便终端设备从不同类型的通信网络接入融合，互通到共享的数据中心。
因此，对终端从授信的非3GPP网络接入到3GPP网络，存在着巨大 的市场应用需求。
目前，从授信的非3GPP网络入网到3GPP网络，分有客户识别模块(Subscriber Identity Module，简称为SIM)终端和无SIM终端两类。
对有SIM终端，可以采用可扩展认证协议-客户识别模块(Extensible Authentication Protocol-Subscriber Identity Module，简称为EAP-SIM)或者可扩展认证协议-认证与密钥协商(Extensible Authentication Protocol-Authentication and Key Agreement，简称为EAP-AKA)方式，终端读取SIM用户身份信息到3GPP认证服务器进行身份鉴权后可入网。该方式的缺点是，终端必须有SIM卡，使用场景和领域受限制。如近年来，物联网业务发展迅速，各种机器到机器/人(Machine-to-Machine/Man，简称为M2M)终端开始广泛使用。为实现3GPP网络接入，M2M终端设备上需嵌入带SIM卡的移动通信模块，该方式对智能传感器或微型设备接入极不方便，具体体现为：1)可插拔SIM卡在特殊M2M终端中，长时间使用后易松动而接触不良；2)现有的可插拔式SIM卡在装入M2M终端后，由于安装位置复杂，难以更换；3)现有M2M终端在投入使用后，难以更换运营商。
对于没有插入SIM的终端或者对于插入了SIM但需采用无SIM方式进行上网的终端(以下简称为无SIM终端)，通常采用可扩展认证协议-安全传输层协议(Extensible Authentication Protocol-Transport Layer Security Protocol，简称为EAP-TLS)方式认证，需要客户端下载移动证书，终端与3GPP服务器之间建立可扩展认证局域网协议(Extensible Authentication Protocol over Local Area Network，简称为EA-POL)隧道，进行双向身份信息交互认证后，允许上网。该方式每次接入认证，都需要交互证书，校验身份，信息量比较大，过程比较繁琐，且客户端和服务端事先需要预定安装好各自身份的证书，体验不是很好。
针对上面的问题，当前终端设备厂商采用了softSIM(软SIM)或eSIM(嵌入式SIM)方式，将SIM卡中即通用集成电路卡(Universal Integrated  Circuit Card，简称为UICC)中存储用户身份识别模块做到专门的芯片中，集成到终端设备上，终端可出厂预装或从专门的服务网络平台上下载运营商SIM信息到配置芯片中。终端从受信任的非3GPP网络接到3GPP网络与有SIM的认证过程一样。该方式需要终端支持SIM信息存储、SIM信息下载平台以及运营商开放SIM信息下载。
从上面解决方案看，嵌入式SIM或软SIM需要终端存储芯片和软件平台支持，对终端有要求，没有解决现有的无SIM终端从授信的非3GPP网络接到3GPP网络身份校验的问题。上述内容主要描述的是从授信非3GPP网络接到3GPP网络所出现的问题，同样，从授信非4GPP网络接入到4GPP网络，以及从授信非5GPP网络接入到5GPP网络中也均会存在上述的问题。
针对相关技术中存在的无SIM卡终端从授信非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题，目前尚未提出有效的解决方案。
发明内容
本发明实施例提供了一种数据业务处理方法及装置，以至少解决相关技术中存在的无SIM卡终端从授信非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题。
根据本发明实施例的一个方面，提供了一种数据业务处理方法，包括：接收用户设备UE发送的用于请求进行数据业务的第一请求消息；根据所述第一请求消息向第三代移动通信伙伴项目移动通信伙伴项目网络网关发送第二请求消息；其中，所述第二请求消息中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据 业务。
可选地，在根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息之前，还包括：获取所述移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为所述UE分配的虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
可选地，所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带有单/多用户标识，其中，所述单/多用户标识用于指示所述分配的虚拟MSISDN是针对单个用户的接入还是针对多个用户的接入。
可选地，通过如下方式确定所述第二请求消息中携带的所述UE的虚拟移动台识别号码MSISDN：获取所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带的单/多用户标识；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对多个用户的接入时，使用所述UE的媒体接入控制MAC地址作为所述第二请求消息中携带的所述UE的虚拟MSISDN；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的所述HLR或所述HSS为所述UE分配的虚拟MSISDN作为所述第二请求消息中携带的所述UE的虚拟MSISDN。
可选地，根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息包括：验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法，或者，验证所述第一请求消息中携带的所述UE的用户名、密码和媒体接入控制MAC地址是否合法；在验证结果为合法的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
可选地，验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法包括：判断本地存储的MAC认证表中是否包含所述UE的所述MAC地址，其中，所述MAC认证表中记录有允许进行数据业务的UE的MAC地址；在判断结果为存在的情况下，确定所述UE的所述MAC地址合法；在判断结果为不存在情况下，确定所述UE的所述MAC 地址不合法。
可选地，在验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法之后，还包括：在验证结果为不合法的情况下，提示所述UE上报用户名和密码；验证所述UE上报的用户名、密码和所述UE的MAC地址是否正确；在验证结果为正确的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
根据本发明实施例的另一方面，提供了一种数据业务处理方法，包括：接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，所述第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和由所述AC为所述UE分配的互联网协议IP地址；验证所述虚拟APN和所述IP地址是否合法；在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
可选地，在接收所述授信非移动通信伙伴项目网络的所述AC发送的所述第二请求消息之前，还包括：为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；将分配的虚拟MSISDN和分配的所述虚拟APN告知给所述授信非移动通信伙伴项目网络中的认证服务器。
可选地，为所述UE分配的虚拟MSISDN包括所述UE的MAC地址和用于指示分配的虚拟MSISDN是针对单个用户的接入的单/多用户标识，或者，包括所述授信非移动通信伙伴项目网络的所述AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户的接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的认证编号信息为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN。
可选地，所述AC的编号信息、所述认证服务器的认证编号信息，以及所述AP的MAC地址或所述UE的MAC地址通过如下方式获取：接收 所述UE的订阅开户请求，其中，所述订阅开户请求用于请求为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN；收集所述授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的编号信息，以及所述授信非移动通信伙伴项目网络的所述AP的MAC地址或所述UE的MAC地址。
可选地，控制所述UE使用所述虚拟MSISDN进行数据业务包括：使用所述虚拟MSISDN创建用于所述UE进行数据业务的通用分组无线业务隧道协议GTP隧道。
根据本发明实施例的另一方面，提供了一种数据业务处理装置，包括：第一接收模块，设置为接收用户设备UE发送的用于请求进行数据业务的第一请求消息；发送模块，设置为根据所述第一请求消息向第三代移动通信伙伴项目移动通信伙伴项目网络网关发送第二请求消息；其中，所述第二请求消息中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
可选地，所述装置还包括：获取模块，设置为在根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息之前，获取所述移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为所述UE分配的虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
可选地，所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带有单/多用户标识，其中，所述单/多用户标识用于指示所述分配的虚拟MSISDN是针对单个用户的接入还是针对多个用户的接入。
可选地，所述发送模块还包括确定单元，设置为通过如下方式确定所述第二请求消息中携带的所述UE的虚拟移动台识别号码MSISDN：获取 所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带的单/多用户标识；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对多个用户的接入时，使用所述UE的媒体接入控制MAC地址作为所述第二请求消息中携带的所述UE的虚拟MSISDN；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的所述HLR或所述HSS为所述UE分配的虚拟MSISDN作为所述第二请求消息中携带的所述UE的虚拟MSISDN。
可选地，所述发送模块包括：第一验证单元，设置为验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法，或者，验证所述第一请求消息中携带的所述UE的用户名、密码和媒体接入控制MAC地址是否合法；第一发送单元，设置为在验证结果为合法的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
可选地，所述第一验证单元包括：判断子单元，设置为判断本地存储的MAC认证表中是否包含所述UE的所述MAC地址，其中，所述MAC认证表中记录有允许进行数据业务的UE的MAC地址；第一确定子单元，设置为在所述判断子单元的判断结果为存在的情况下，确定所述UE的所述MAC地址合法；和/或，第二确定子单元，设置为在所述判断子单元判断结果为不存在情况下，确定所述UE的所述MAC地址不合法。
可选地，所述发送模块还包括：提示单元，设置为在验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法之后，在验证结果为不合法的情况下，提示所述UE上报用户名和密码；第二验证单元，设置为验证所述UE上报的用户名、密码和所述UE的MAC地址是否正确；第二发送单元，设置为在验证结果为正确的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
根据本发明实施例的另一方面，提供了一种数据业务处理装置，包括：第二接收模块，设置为接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，所述第二请求消息中携带请求进行数据 业务的用户设备UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和由所述AC为所述UE分配的互联网协议IP地址；验证模块，设置为验证所述虚拟APN和所述IP地址是否合法；控制模块，设置为在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
可选地，所述装置还包括：分配模块，设置为在接收所述授信非移动通信伙伴项目网络的所述AC发送的所述第二请求消息之前，为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；告知模块，设置为将分配的虚拟MSISDN和分配的所述虚拟APN告知给所述授信非移动通信伙伴项目网络中的认证服务器。
可选地，为所述UE分配的虚拟MSISDN包括所述UE的MAC地址和用于指示分配的虚拟MSISDN是针对单个用户的接入的单/多用户标识，或者，包括所述授信非移动通信伙伴项目网络的所述AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户的接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的认证编号信息为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN。
可选地，所述AC的编号信息、所述认证服务器的认证编号信息，以及所述AP的MAC地址或所述UE的MAC地址通过如下方式获取：接收所述UE的订阅开户请求，其中，所述订阅开户请求用于请求为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN；收集所述授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的编号信息，以及所述授信非移动通信伙伴项目网络的所述AP的MAC地址或所述UE的MAC地址。
可选地，所述控制模块包括：创建单元，设置为使用所述虚拟MSISDN创建用于所述UE进行数据业务的通用分组无线业务隧道协议GTP隧道。
通过本发明实施例，采用接收用户设备UE发送的用于请求进行数据 业务的第一请求消息；根据所述第一请求消息向第三代移动通信伙伴项目移动通信伙伴项目网络网关发送第二请求消息；其中，所述第二请求消息中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。解决了相关技术中存在的无SIM卡终端从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题，进而达到了降低无SIM卡终端从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时的复杂度和时延，提高用户体验度的效果本发明实施例提供了一种数据业务处理方法及装置，以至少解决相关技术中存在的无SIM卡终端从授信非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题。
根据本发明实施例的一个方面，提供了一种数据业务处理方法，包括：接收用户设备UE发送的用于请求进行数据业务的第一请求消息；根据所述第一请求消息向第三代移动通信伙伴项目移动通信伙伴项目网络网关发送第二请求消息；其中，所述第二请求消息中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
可选地，在根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息之前，还包括：获取所述移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为所述UE分配的虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
可选地，所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带有单/多用户标识，其中，所述单/多用户标识用于指示所述分配的虚拟MSISDN是针对单个用户的接入还是针对多个用户的接入。
可选地，通过如下方式确定所述第二请求消息中携带的所述UE的虚拟移动台识别号码MSISDN：获取所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带的单/多用户标识；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对多个用户的接入时，使用所述UE的媒体接入控制MAC地址作为所述第二请求消息中携带的所述UE的虚拟MSISDN；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的所述HLR或所述HSS为所述UE分配的虚拟MSISDN作为所述第二请求消息中携带的所述UE的虚拟MSISDN。
可选地，根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息包括：验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法，或者，验证所述第一请求消息中携带的所述UE的用户名、密码和媒体接入控制MAC地址是否合法；在验证结果为合法的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
可选地，验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法包括：判断本地存储的MAC认证表中是否包含所述UE的所述MAC地址，其中，所述MAC认证表中记录有允许进行数据业务的UE的MAC地址；在判断结果为存在的情况下，确定所述UE的所述MAC地址合法；在判断结果为不存在情况下，确定所述UE的所述MAC地址不合法。
可选地，在验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法之后，还包括：在验证结果为不合法的情况下，提示所述UE上报用户名和密码；验证所述UE上报的用户名、密码和所述UE的MAC地址是否正确；在验证结果为正确的情况下，向所述移动通信伙 伴项目网络网关发送所述第二请求消息。
根据本发明实施例的另一方面，提供了一种数据业务处理方法，包括：接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，所述第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和由所述AC为所述UE分配的互联网协议IP地址；验证所述虚拟APN和所述IP地址是否合法；在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
可选地，在接收所述授信非移动通信伙伴项目网络的所述AC发送的所述第二请求消息之前，还包括：为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；将分配的虚拟MSISDN和分配的所述虚拟APN告知给所述授信非移动通信伙伴项目网络中的认证服务器。
可选地，为所述UE分配的虚拟MSISDN包括所述UE的MAC地址和用于指示分配的虚拟MSISDN是针对单个用户的接入的单/多用户标识，或者，包括所述授信非移动通信伙伴项目网络的所述AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户的接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的认证编号信息为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN。
可选地，所述AC的编号信息、所述认证服务器的认证编号信息，以及所述AP的MAC地址或所述UE的MAC地址通过如下方式获取：接收所述UE的订阅开户请求，其中，所述订阅开户请求用于请求为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN；收集所述授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的编号信息，以及所述授信非移动通信伙伴项目网络的所述AP的MAC地址或所述UE的MAC地址。
可选地，控制所述UE使用所述虚拟MSISDN进行数据业务包括：使用所述虚拟MSISDN创建用于所述UE进行数据业务的通用分组无线业务隧道协议GTP隧道。
根据本发明实施例的另一方面，提供了一种数据业务处理装置，包括：第一接收模块，设置为接收用户设备UE发送的用于请求进行数据业务的第一请求消息；发送模块，设置为根据所述第一请求消息向第三代移动通信伙伴项目移动通信伙伴项目网络网关发送第二请求消息；其中，所述第二请求消息中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
可选地，所述装置还包括：获取模块，设置为在根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息之前，获取所述移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为所述UE分配的虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
可选地，所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带有单/多用户标识，其中，所述单/多用户标识用于指示所述分配的虚拟MSISDN是针对单个用户的接入还是针对多个用户的接入。
可选地，所述发送模块还包括确定单元，设置为通过如下方式确定所述第二请求消息中携带的所述UE的虚拟移动台识别号码MSISDN：获取所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带的单/多用户标识；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对多个用户的接入时，使用所述UE的媒体接入控制MAC地址作为所述第二请求消息中携带的所述UE的虚拟MSISDN；当所述单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的所述HLR或所 述HSS为所述UE分配的虚拟MSISDN作为所述第二请求消息中携带的所述UE的虚拟MSISDN。
可选地，所述发送模块包括：第一验证单元，设置为验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法，或者，验证所述第一请求消息中携带的所述UE的用户名、密码和媒体接入控制MAC地址是否合法；第一发送单元，设置为在验证结果为合法的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
可选地，所述第一验证单元包括：判断子单元，设置为判断本地存储的MAC认证表中是否包含所述UE的所述MAC地址，其中，所述MAC认证表中记录有允许进行数据业务的UE的MAC地址；第一确定子单元，设置为在所述判断子单元的判断结果为存在的情况下，确定所述UE的所述MAC地址合法；和/或，第二确定子单元，设置为在所述判断子单元判断结果为不存在情况下，确定所述UE的所述MAC地址不合法。
可选地，所述发送模块还包括：提示单元，设置为在验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法之后，在验证结果为不合法的情况下，提示所述UE上报用户名和密码；第二验证单元，设置为验证所述UE上报的用户名、密码和所述UE的MAC地址是否正确；第二发送单元，设置为在验证结果为正确的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
根据本发明实施例的另一方面，提供了一种数据业务处理装置，包括：第二接收模块，设置为接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，所述第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和由所述AC为所述UE分配的互联网协议IP地址；验证模块，设置为验证所述虚拟APN和所述IP地址是否合法；控制模块，设置为在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
可选地，所述装置还包括：分配模块，设置为在接收所述授信非移动通信伙伴项目网络的所述AC发送的所述第二请求消息之前，为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；告知模块，设置为将分配的虚拟MSISDN和分配的所述虚拟APN告知给所述授信非移动通信伙伴项目网络中的认证服务器。
可选地，为所述UE分配的虚拟MSISDN包括所述UE的MAC地址和用于指示分配的虚拟MSISDN是针对单个用户的接入的单/多用户标识，或者，包括所述授信非移动通信伙伴项目网络的所述AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户的接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的认证编号信息为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN。
可选地，所述AC的编号信息、所述认证服务器的认证编号信息，以及所述AP的MAC地址或所述UE的MAC地址通过如下方式获取：接收所述UE的订阅开户请求，其中，所述订阅开户请求用于请求为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN；收集所述授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的编号信息，以及所述授信非移动通信伙伴项目网络的所述AP的MAC地址或所述UE的MAC地址。
可选地，所述控制模块包括：创建单元，设置为使用所述虚拟MSISDN创建用于所述UE进行数据业务的通用分组无线业务隧道协议GTP隧道。
本发明另一实施例提供了一种计算机存储介质，所述计算机存储介质存储有执行指令，所述执行指令用于执行上述实施例中的步骤之一或其组合。
通过本发明实施例，采用接收用户设备UE发送的用于请求进行数据业务的第一请求消息；根据所述第一请求消息向第三代移动通信伙伴项目移动通信伙伴项目网络网关发送第二请求消息；其中，所述第二请求消息 中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。解决了相关技术中存在的无SIM卡终端从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题，进而达到了降低无SIM卡终端从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时的复杂度和时延，提高用户体验度的效果。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的第一种数据业务处理方法的流程图；
图2是根据本发明实施例的第二种数据业务处理方法的流程图；
图3是根据本发明实施例的分布式接入认证模型图；
图4是根据本发明实施例的授信非3GPP网络与3GPP网络融合示意图；
图5是根据本发明实施例的授信非3GPP网络与3GPP网络中的各模块的认证信息交互的装置图；
图6是根据本发明实施例的WLAN网络对无SIM终端的接入认证交互流程图；
图7是根据本发明实施例的用户虚拟身份生成图；
图8是根据本发明实施例的单用户多场所接入认证示意图；
图9是根据本发明实施例的多用户同一个场所接入认证示意图；
图10是根据本发明实施例的第一种数据业务处理装置的结构框图；
图11是根据本发明实施例的第一种数据业务处理装置的可选结构框图；
图12是根据本发明实施例的第一种数据业务处理装置中发送模块104的结构框图一；
图13是根据本发明实施例的第一种数据业务处理装置中发送模块104的结构框图二；
图14是根据本发明实施例的第一种数据业务处理装置中第一验证单元132的结构框图；
图15是根据本发明实施例的第一种数据业务处理装置中发送模块104的可选结构框图；
图16是根据本发明实施例的第二种数据业务处理装置的结构框图；
图17是根据本发明实施例的第二种数据业务处理装置的可选结构框图；
图18是根据本发明实施例的第二种数据业务处理装置中控制模块166的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。需要说明的是，在下述描述中“授信非移动通信伙伴项目网络”也可以简称为“非移动通信伙伴项目网元”或“非移动通信伙伴项目域”，下述的“用户设备”和“终端”相当。
在本实施例中提供了一种数据业务处理方法，图1是根据本发明实施例的第一种数据业务处理方法的流程图，如图1所示，该流程包括如下步骤：
步骤S102，接收用户设备UE发送的用于请求进行数据业务的第一请求消息；
步骤S104，根据第一请求消息向移动通信伙伴项目网络网关发送第二请求消息；其中，该第二请求消息中携带UE的虚拟移动台识别号码MSISDN、UE接入的接入点的虚拟接入点名称APN和为UE分配的互联网协议IP地址，第二请求消息用于请求移动通信伙伴项目网络网关对虚拟APN和IP地址进行验证，并在验证结果为合法的情况下，控制UE使用虚拟MSISDN进行数据业务。
其中，执行上述步骤的可以是授信非移动通信伙伴项目网络中的模块，通过上述步骤，移动通信伙伴项目网络可以根据接收的UE接入的虚拟APN和UE的IP地址对是否允许UE进行数据业务进行验证，验证方法简单，无需频繁的交互证书，也无需为UE配置softSIM或eSIM，并且，在验证通过的情况下，可以使用UE的虚拟MSISDN控制UE进行数据业务。从而解决了相关技术中存在的无SIM卡用户设备(可以是用户设备中没有插入SIM卡的场景，也可以是用户设备中插入了SIM卡，但是需要采用无SIM卡的模式进行上网的场景)从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题，进而达到了降低无SIM卡用户设备从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时的复杂度和时延，提高用户体验度的效果。
需要说明的是，上述以及下述的实施例中的移动通信伙伴项目网络可以是3GPP网络，上述实施例以及下述的各实施例中的移动通信伙伴项目网络也可以是4GPP网络，或者，5GPP网络，或者，后续可能出现的6GPP网络等。
在一个可选的实施例中，在根据上述第一请求消息向移动通信伙伴项目网络网关发送第二请求消息之前，还包括：获取移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为UE分配的虚拟 MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
在一个可选的实施例中，上述HLR或HSS为UE分配的虚拟MSISDN中携带有单/多用户标识，其中，该单/多用户标识用于指示上述分配的虚拟MSISDN是针对单个用户的接入(“单个用户的接入”可以简称为“单用户”)还是针对多个用户的接入(“多个用户的接入”可以简称为“多用户”)。其中，该单/多用户标识可以采用1bit标识，例如，0表示为单个用户的接入、1表示为多个用户的接入，当然，也可以采用其他的标识符进行标识。
其中，第二请求消息中携带的UE的虚拟移动台识别号码MSISDN和HLR或HSS为UE分配的虚拟MSISDN可以是一样的，也可以不一样，在一个可选的实施例中，可以通过如下方式确定第二请求消息中携带的UE的虚拟移动台识别号码MSISDN：获取上述HLR或HSS为UE分配的虚拟MSISDN中携带的单/多用户标识；当上述单/多用户标识用于指示分配的虚拟MSISDN是针对多个用户的接入时，使用上述UE的媒体接入控制MAC地址作为第二请求消息中携带的UE的虚拟MSISDN；当上述单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的HLR或所述HSS为UE分配的虚拟MSISDN作为所述第二请求消息中携带的UE的虚拟MSISDN。通过该方式可以使得移动通信伙伴项目网络网关唯一的确定待接入的UE，从而控制请求接入的UE进行数据业务。
在一个可选的实施例中，根据上述第一请求消息向移动通信伙伴项目网络网关发送第二请求消息包括：验证上述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法，或者，验证上述第一请求消息中携带的UE的用户名、密码和媒体接入控制MAC地址是否合法；在验证结果为合法的情况下，向上述移动通信伙伴项目网络网关发送第二请求消息。
其中，验证UE的MAC地址是否合法可以针对非第一次接入的UE 进行验证，无SIM卡的UE在第一次通过授信非移动通信伙伴项目网络接入移动通信伙伴项目网络时，可以输入用户名和密码，当验证通过后，会记录该UE的MAC地址，记录的MAC地址可以以MAC表的形式进行记录。当UE请求接入移动通信伙伴项目网络时，可以通过对比MAC表格中有没有请求接入的UE的MAC地址来判断该UE是否成功接入过移动通信伙伴项目网络，从而可以无需输入用户名和密码，仅验证用户设备的MAC地址是否合法即可。当然，也可以配置UE每次请求接入移动通信伙伴项目网络时，都需要数据用户名和密码。在一个可选的实施例中，验证上述第一请求消息中携带的UE的媒体接入控制MAC地址是否合法包括：判断本地存储的MAC认证表中是否包含UE的MAC地址，其中，该MAC认证表中记录有允许进行数据业务的UE的MAC地址；在判断结果为存在的情况下，确定上述UE的MAC地址合法；在判断结果为不存在情况下，确定UE的MAC地址不合法。
在一个可选的实施例中，在验证上述第一请求消息中携带的UE的媒体接入控制MAC地址是否合法之后，还包括：在验证结果为不合法的情况下，提示上述UE上报用户名和密码；验证上述UE上报的用户名、密码和UE的MAC地址是否正确；在验证结果为正确的情况下，向移动通信伙伴项目网络网关发送第二请求消息。由此可知，授信非移动通信伙伴项目网络中验证UE是否合法时，可以采用MAC和门户PORTAL混合认证方式。上述的验证方式仅是示例，也可以采用其他的可行的验证方式进行验证。
图2是根据本发明实施例的第二种数据业务处理方法的流程图，如图2所示，该流程包括如下步骤：
步骤S202，接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，该第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、UE接入的接入点的虚拟接入点名称APN和由AC为UE分配的互联网协议IP地址；
步骤S204，验证上述虚拟APN和IP地址是否合法；
步骤S206，在验证结果为合法的情况下，控制上述UE使用虚拟MSISDN进行数据业务。
其中，执行上述步骤的可以是移动通信伙伴项目网络中的模块，通过上述步骤，移动通信伙伴项目网络可以根据接收的UE接入的虚拟APN和UE的IP地址对是否允许UE进行数据业务进行验证，验证方法简单，无需频繁的交互证书，也无需为UE配置softSIM或eSIM，并且，在验证通过的情况下，可以使用UE的虚拟MSISDN控制UE进行数据业务。从而解决了相关技术中存在的无SIM卡用户设备从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题，进而达到了降低无SIM卡用户设备从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时的复杂度和时延，提高用户体验度的效果。
在一个可选的实施例中，在接收上述授信非移动通信伙伴项目网络的AC发送的第二请求消息之前，还包括：为上述UE分配虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；将分配的虚拟MSISDN和分配的虚拟APN告知给授信非移动通信伙伴项目网络中的认证服务器。其中，认证服务器在获取分配的虚拟MSISDN和分配的虚拟APN之后，可以传递给AC，AC可以保存上述的虚拟MSISDN和虚拟APN，从而当UE请求接入移动通信伙伴项目网络时，AC可以根据保存的上述虚拟MSISDN和虚拟APN向移动通信伙伴项目发送接入请求(即，第二请求消息)。
在一个可选的实施例中，为上述UE分配的虚拟MSISDN包括UE的MAC地址和用于指示分配的虚拟MSISDN是针对单个用户的接入的单/多用户标识，或者，包括授信非移动通信伙伴项目网络的所述AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的所述AC的编号信息和所 述认证服务器的认证编号信息为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN。其中，上述单/多用户标识可以采用1bit标识，例如，0表示为单个用户的接入、1表示为多个用户的接入，当然，也可以采用其他的标识符进行标识。
在一个可选的实施例中，上述AC的编号信息、认证服务器的认证编号信息，以及AP的MAC地址或UE的MAC地址可以通过如下方式获取：接收UE的订阅开户请求，其中，该订阅开户请求用于请求为UE分配虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配虚拟APN；收集上述授信非移动通信伙伴项目网络的AC的编号信息和认证服务器的编号信息，以及上述授信非移动通信伙伴项目网络的AP的MAC地址或UE的MAC地址。
在一个可选的实施例中，控制上述UE使用虚拟MSISDN进行数据业务包括：使用虚拟MSISDN创建用于UE进行数据业务的通用分组无线业务隧道协议(General Packet Radio Service Tunnelling Protocol，简称为GTP)隧道。
上述的图1及与图1相关的实施例主要应用于授信非移动通信伙伴项目网络中，图2及与图2相关的实施例主要应用于移动通信伙伴项目网络中。下面以授信非3GPP网络和3GPP网络为例对本发明实施例进行整体说明：
图3是根据本发明实施例的分布式接入认证模型图，如图3所示，该图描述的无SIM终端从不同的授信非3GPP域(即，授信非3GPP网络)接入到3GPP域(即，3GPP网络)的示意图，本发明实施例所述的无SIM终端从授信的非3GPP网络接入到3GPP网络系统，采用分布式接入认证模型如图3所示，其中，图3中的A、B、C、D模块中所包含的模块与下述的图5相对应：
整个系统分为授信非3GPP域和3GPP域。授信非3GPP域包含接入点(对应于图3中所示的非3GPP热点)，接入控制器(对应于图3中所 示的非3GPP接入控制器)和接入认证服务器(对应于图3中所示的非3GPP认证服务器)。3GPP域包含网关通用分组无线业务支持节点/分组数据网网关(Gateway General Packet Radio Service Supporting Node/Packet Data Network Gateway，简称为GGSN/PGW)(对应于图3中所示的3GPP网关)，位置归属寄存器/归属签约用户服务器(Home Location Register/Home Subscriber Server，简称为HLR/HSS)。
图4是根据本发明实施例的授信非3GPP网络与3GPP网络融合示意图，下面结合图4对本发明实施例进行说明：
3GPP域内，HLR/HSS上管理无SIM终端的开户，HLR/HSS上为无SIM终端生成虚拟移动台识别号码(Mobile Station International Subscriber Directory Number简称MSISDN)、虚拟接入点名称(Acess Point Name简称为APN)，授权给授信的非3GPP认证服务器。包括：将生成的虚拟MSISDN、虚拟APN并授权虚拟身份信息给无SIM终端使用归属的WLAN与WIMAX域内的认证服务器(如，AAA认证服务器)。WLAN网络与WIMAX网络各自的认证服务器都与3GPP域内HLR/HSS对接，分别管理本域内无SIM终端接入认证。其中，单用户接入虚拟MSISDN可以是根据终端的MAC生成的，单用户接入虚拟APN可以是根据授信非3GPP接入控制器位置和认证服务器位置信息生成。多用户接入虚拟MSISDN可以是根据授信非3GPP网络的接入热点MAC生成的，多用户接入虚拟APN可以是根据授信非3GPP接入控制器位置和认证服务器位置生成。
授信非3GPP域内，终端在授信非3GPP认证服务器通过后，认证服务器下发虚拟MSISDN、虚拟APN给授信非3GPP接入控制器。包括：WLAN与WIMAX网络各自的认证服务器对无SIM终端认证通过后，下发虚拟的MSISDN、APN信息给各自的接入控制器。
授信非3GPP域内，接入控制器可以采用MAC和PORTAL混合认证方式对终端进行认证，认证通过后，本地分IP地址给终端，向GGSN/PGW创建GTP隧道(即，请求3GPP网络控制无SIM终端进行数据业务，该 实施例中以请求构建GIP为例进行说明)，携带虚拟MSISDN、APN和IP地址。包括：WLAN与WIMAX各自的接入控制器上构建GTP请求，该GTP请求中携带虚拟MSISDN、虚拟APN信息和接入控制器分配的IP地址信息，向GGSN/PGW请求建立互通的隧道。
3GPP域内，网关上对终端IP校验，使用虚拟MSINDN替代终端的身份信息，创建GTP/S2A隧道。包括：3GPP域内，在GGSN/PGW网关上，检验IP地址合法性，APN的合法性，识别出无SIM终端用户(例如，可以根据终端的IMSI为0来识别该终端无SIM)，使用虚拟的MSISDN替代IMSI信息，建立无SIM终端的GTP/S2A业务通道。其中，接入控制器与GGSN对接，使用GTPC V1协议，就是通常所说的GTP隧道；接入控制器与EPC对接，使用GTPC V2，是通信行业的S2A标准接口。
图5是根据本发明实施例的授信非3GPP网络与3GPP网络中的各模块的认证信息交互的装置图。其中，配置获取模块10、虚拟用户信息生成模块20、授权下发模块30、IP校验模块80、虚拟APN校验模块90和创建虚拟MSISDN用户隧道模块100位于3GPP网络中，本地认证模块40、MAC认证模块50、IP地址分配模块60和隧道创建模块70位于授信非3GPP网络中，其中，模块A包括配置获取模块10、虚拟用户信息生成模块20和授权下发模块30，模块B包括本地认证模块40，模块C包括MAC认证模块50、IP地址分配模块60和隧道创建模块70，模块D包括IP校验模块80、虚拟APN校验模块90和创建虚拟MSISDN用户隧道模块100。下面对结合图5进行说明：
无SIM终端接入认证包括如下处理模块：
配置获取模块10，设置为获取无SIM终端信息与入网位置信息；
虚拟用户信息生成模块20，根据配置获取信息，生成无SIM终端的虚拟身份；
授权下发模块30，将生成的虚拟身份信息，下发给授信非3GPP网络的本地认证服务器；
本地认证模块40，本地认证服务器对无SIM终端初始接入认证，校验用户名和密码和MAC，认证通过，下发虚拟MSISDN和APN给接入控制器；
MAC认证模块50，接入控制器对接入无SIM终端本地MAC认证；
IP地址分配模块60，将无SIM终端与服务集标识(Service Set Identifier，简称为SSID)进行关联，接入控制器为无SIM终端分配IP地址；
隧道创建模块70，接入控制器本地认证通过后，向3GPP网关请求建立隧道；
IP校验模块80，3GPP接入网关上校验IP地址合法性；
虚拟APN校验模块90，3GPP上校验APN合法性；
创建虚拟MSISDN用户隧道模块100，根据IMSI为0识别出虚拟无SIM卡终端用户，3GPP上使用虚拟MSISDN信息创建GTP隧道。
下面以WLAN网络为例，对无SIM终端的接入认证交互流程进行说明：
图6是根据本发明实施例的WLAN网络对无SIM终端的接入认证交互流程图。如图6所示。该流程包括如下步骤：
根据接入过程分为开户授权和接入认证两大流程。
开户授权过程如下：
该过程在HLR/HSS上执行，HLR/HSS可以支持开户终端信息与接入网络位置信息收集功能，HLR/HSS接收到无SIM终端的订阅开户请求后，执行如下操作：
(1)收集无SIM终端配置和网络位置信息(对应于图6中的步骤S601)，收集的信息包括：
1、无SIM终端MAC信息UE-MAC；
2、接入点AP的MAC信息AP-MAC；
3、WLAN接入控制器AC的网络标识编号AC-ID；
4、WLAN认证服务器AAA的网络标识编号AAA-ID。
(2)用户虚拟身份生成(对应于图6中的步骤S602)。
根据无SIM终端开户要求允许接入终端的数目，HLR/HSS上生成的虚拟身份信息，分单用户模式与多用户模式。虚拟身份信息生成如图7所示，图7是根据本发明实施例的用户虚拟身份生成图。如图7所示，在单用户模式下，允许本终端唯一接入，虚拟身份信息如下：
1、虚拟MSISDN根据终端MAC(48bit)和1bit单/多用户标识(1bit单/多用户标识仅是一种示例，还可以采用其他的标识)生成，共49bit，与现有的GTP/S2A协议中MSISDN长度保持一致。
2、虚拟APN由AC-ID(8bit)和AAA-ID(8bit)生成。
3、用户名和密码口令。
在多用户模式下，允许接入点下所有用户使用同一个虚拟身份接入，虚拟身份信息如下：
1、虚拟MSISDN根据接入热点的AP-MAC(48bit)和1bit单/多用户标识生成，共49bit。
2、虚拟APN由AC-ID(8bit)和AAA-ID(8bit)生成。
3、用户名和密码口令。
(3)HLR/HSS生成虚拟的MSISDN、APN，开户名和密钥，通过移动通信应用部分(Mobile Application Part，简称为MAP)接口，同步到(或授权给)授信非3GPP网络的认证服务器(对应于图6中的步骤S603)。无SIM终端可以选择从不同的授信非3GPP网络接入，不同的授信非3GPP域接入MSISDN、APN信息可以不一样。授信非3GPP网络的认证服务器上，会寄存无SIM终端的用户名、密码和虚拟MSISDN、APN信息，接管用户认证。
接入认证过程如下：
(1)初始登录认证
1、无SIM终端在AP信号覆盖范围内，关联AP的SSID，获取到IP地址(对应于图6中的步骤S604)。
2、AC对初始接入的无SIM终端，查本地MAC认证表失败后，给终端重定向推PORTAL的登录认证页面(对应于图6中的步骤S605)。
3、无SIM终端用户，输入用户名和密码登录(对应于图6中的步骤S606)。
4、AAA认证服务器上收到认证请求，校验用户名、密码和MAC地址是否正确。如果不正确，拒绝无SIM终端接入(对应于图6中的步骤S607)。
5、如果正确，查询该用户名和密码关联的虚拟MSISDN信息是否存在，如果存在，是3GPP授权的用户，将虚拟的MSISDN、APN信息下发给AC；如果不存在，是普通用户，不下发虚拟MSISDN和APN信息(对应于图6中的步骤S608)。
6、无SIM终端初始登陆认证后，AC上记录用户的MAC信息，更新MAC老化时间配置，对超长离线的无SIM终端MAC地址老化(对应于图6中的步骤S609和S610)。
(2)自动登陆认证
在初始登陆认证通过后的有效时间内，无SIM终端重新接入：
1、无SIM终端在AP信号覆盖范围内，关联AP的SSID，获取到AC分配的IP地址(对应于图6中的步骤S611)。
2、AC上对无SIM终端直接本地MAC认证接入(对应于图6中的步骤S612)。非3GPP域内认证完后，认证服务器下发虚拟MSISDN、APN给接入控制器。
(3)创建互通隧道
1、接入控制器接收到认证服务器下发虚拟MSISDN、APN，携带终 端虚拟身份信息，向3GPP域内网关请求建立隧道，可以包括如下操作：非3GPP接入控制AC向3GPP网关GGSN/PGW发送GTP/S2A请求，无SIM卡终端IMSI信息设置为0标识，根据MSISDN信息中多用户标识，区分出单用户还是多用，如果是多用户，虚拟MSISDN使用用户MAC替代，如果是单用户，MAC不变，隧道请求消息中携带AC分配的IP地址和虚拟MSISDN、APN身份信息(对应于图6中的步骤S613和S614)。
2、3GPP域内接入网关GGSN/PGW校验用户的IP信息和APN合法性，校验通过后，根据IMSI为0，使用虚拟MSISDN替代国际移动用户识别码(International Mobile Subscriber Identification Number，简称为IMSI)信息，建立无SIM终端虚拟用户的GTP/S2A隧道，并响应非3GPP域内AC的GTP请求；非3GPP接入控制器AC收到GTP/S2A响应成功后，向无SIM终端发送确认消息，接入认证成功(对应于图6中的步骤S615-S617)。
图8是根据本发明实施例的单用户多场所接入认证示意图，如图8所示：
(1)无SIM卡终端UE1和UE2在HLR/HSS开户后，生成虚拟的MSISDN1、APN1、UER1、PASSWORD1和MSISDN2、APN2、UER2、PASSWORD2，生成的信息，授权给非3GPP认证服务存储。
(2)UE1和UE2分别从同一个AC下的不同AP的位置接入，第一次接入，输入用户名和密码，到非3GPP进行认证通过后，AC上记录用户的MAC信息和MSISDN、APN对应信息。
(3)第二次接入，AC上直接查用户MAC，进行认证；如果MAC不存在，推出PORTAL界面，用户重新输入用户名和密码，进行PORTAL认证。
(4)UE1和UE2在非3GPP域内认证完成后，AC向3GPP网关发消息创建GTP/S2A隧道，3GPP网关上校验MSISDN、IP地址和APN信息,根据IMSI为0识别出虚拟无SIM用户后,使用MSISDN信息建立互通用 户隧道。
图9是根据本发明实施例的多用户同一个场所接入认证示意图，如图9所示：
(1)AP1和AP2在HLR/HSS开户后，生成虚拟的MSISDN1、UER1、PASSWORD1和MSISDN2、UER2、PASSWORD2，授权给非3GPP域内认证服务存储认证。
(2)UE1-UE5在同一个AP1下接入，第一次接入认证时，MAC认证失败，PORTAL登陆，采用AP1开户的用户名和密码登录，非3GPP将AP1的MSISDN1、APN1信息分别下发给AC，AC记录MAC、MSISDN和APN信息。
(3)在第一次认证通过后有效期内，第二次接入，AC上直接查用户MAC表，进行MAC认证通过，不需要重新输入用户名和密码。
(4)UE1-UE5在非3GPP域内认证完成后，AC上根据获取到的虚拟MSISDN信息，检查出多用户虚拟身份，创建隧道请求时，使用UE的MAC填充到MSISDN，并携带IP地址、APN信息，3GPP网关上校验MSISDN、IP地址和APN信息，根据IMSI为0识别出虚拟无SIM用户后，使用MSISDN信息建立互通用户隧道。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
在本实施例中还提供了一种数据业务处理装置，该装置用于实现上述实施例及可选实施方式，已经进行过说明的不再赘述。如以下所使用的， 术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图10是根据本发明实施例的第一种数据业务处理装置的结构框图，如图10所示，该装置包括第一接收模块102(该模块可以位于授信非移动通信伙伴项目网络中的接入控制器AC中)和发送模块104，下面对该装置进行说明。
第一接收模块102，设置为接收用户设备UE发送的用于请求进行数据业务的第一请求消息；发送模块104，连接至上述第一接收模块102，设置为根据上述第一请求消息向移动通信伙伴项目网络网关发送第二请求消息；其中，该第二请求消息中携带UE的虚拟移动台识别号码MSISDN、UE接入的接入点的虚拟接入点名称APN和为UE分配的互联网协议IP地址，第二请求消息用于请求移动通信伙伴项目网络网关对虚拟APN和IP地址进行验证，并在验证结果为合法的情况下，控制UE使用虚拟MSISDN进行数据业务。
图11是根据本发明实施例的第一种数据业务处理装置的可选结构框图，如图11所示，该装置除包括图10所示的所有模块外，还包括获取模块112(该模块可以位于授信非移动通信伙伴项目网络中的认证服务器中)，下面对该装置进行说明。
获取模块112，连接至上述发送模块104，设置为在根据第一请求消息向移动通信伙伴项目网络网关发送第二请求消息之前，获取移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为UE分配的虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
在一个可选的实施例中，上述HLR或HSS为UE分配的虚拟MSISDN中携带有单/多用户标识，其中，该单/多用户标识用于指示上述分配的虚拟MSISDN是针对单个用户的接入还是针对多个用户的接入。
图12是根据本发明实施例的第一种数据业务处理装置中发送模块104的结构框图一，如图12所示，该发送模块104还可以包括确定单元122(该单元可以位于授信非移动通信伙伴项目网络中的接入控制器AC中)，下面对该确定单元122进行说明。
确定单元122，设置为通过如下方式确定第二请求消息中携带的UE的虚拟移动台识别号码MSISDN：获取HLR或HSS为UE分配的虚拟MSISDN中携带的单/多用户标识；当该单/多用户标识用于指示分配的虚拟MSISDN是针对多个用户的接入时，使用UE的媒体接入控制MAC地址作为第二请求消息中携带的UE的虚拟MSISDN；当单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的HLR或HSS为UE分配的虚拟MSISDN作为第二请求消息中携带的UE的虚拟MSISDN。
图13是根据本发明实施例的第一种数据业务处理装置中发送模块104的结构框图二，如图13所示，该发送模块104包括第一验证单元132(该单元可以位于授信非移动通信伙伴项目网络中的接入控制器AC中或认证服务器中，对应于上述的MAC认证模块50或本地认证模块40)和第一发送单元134(该单元可以位于授信非移动通信伙伴项目网络中的接入控制器AC中，对应于上述的IP地址分配模块60和隧道创建模块70)，下面对该发送模块104进行说明。
第一验证单元132，设置为验证上述第一请求消息中携带的UE的媒体接入控制MAC地址是否合法，或者，验证上述第一请求消息中携带的UE的用户名、密码和媒体接入控制MAC地址是否合法；第一发送单元134，连接至上述第一验证单元132，设置为在验证结果为合法的情况下，向移动通信伙伴项目网络网关发送第二请求消息。
图14是根据本发明实施例的第一种数据业务处理装置中第一验证单元132的结构框图，如图14所示，该第一验证单元132包括判断子单元142以及，第一确定子单元144和/或第二确定子单元146，下面对该第一 验证单元132进行说明。
判断子单元142，设置为判断本地存储的MAC认证表中是否包含UE的MAC地址，其中，该MAC认证表中记录有允许进行数据业务的UE的MAC地址；第一确定子单元144，连接至上述判断子单元142，设置为在判断子单元142的判断结果为存在的情况下，确定UE的MAC地址合法；和/或，第二确定子单元146，连接至上述判断子单元142，设置为在判断子单元142判断结果为不存在情况下，确定UE的MAC地址不合法。
图15是根据本发明实施例的第一种数据业务处理装置中发送模块104的可选结构框图，如图15所示，该发送模块104除包括图13所示的所有单元外，还包括提示单元152(该单元可以位于授信非移动通信伙伴项目网络中的接入控制器AC中)、第二验证单元154(该单元可以位于授信非移动通信伙伴项目网络中的认证服务器中)和第二发送单元156(该单元可以位于授信非移动通信伙伴项目网络中的接入控制器AC中)，下面对该发送模块104进行说明。
提示单元152，连接至上述第一验证单元132，设置为在验证第一请求消息中携带的UE的媒体接入控制MAC地址是否合法之后，在验证结果为不合法的情况下，提示UE上报用户名和密码；第二验证单元154，连接至上述提示单元152，设置为验证UE上报的用户名、密码和UE的MAC地址是否正确；第二发送单元156，连接至上述第二验证单元154，设置为在验证结果为正确的情况下，向移动通信伙伴项目网络网关发送第二请求消息。
图16是根据本发明实施例的第二种数据业务处理装置的结构框图，如图16所示，该装置包括第二接收模块162(该模块可以位于移动通信伙伴项目网络中的网关中，例如GGSN或者PGW)、验证模块164(该模块可以位于移动通信伙伴项目网络中的网关中，例如GGSN或者PGW)和控制模块166(该模块可以位于移动通信伙伴项目网络中的网关中，例如GGSN或者PGW)，下面对该装置进行说明。
第二接收模块162，设置为接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，该第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、UE接入的接入点的虚拟接入点名称APN和由AC为UE分配的互联网协议IP地址；验证模块164，连接至上述第二接收模块162，设置为验证虚拟APN和IP地址是否合法；控制模块166，连接至上述验证模块164，设置为在验证结果为合法的情况下，控制UE使用虚拟MSISDN进行数据业务。
图17是根据本发明实施例的第二种数据业务处理装置的可选结构框图，如图17所示，该装置除包括图16所示的所有模块外，还包括分配模块172(该模块可以位于移动通信伙伴项目网络中的HLR或HSS中)和告知模块174(该模块可以位于移动通信伙伴项目网络中的HLR或HSS中)，下面对该装置进行说明。
分配模块172，设置为在接收授信非移动通信伙伴项目网络的AC发送的第二请求消息之前，为UE分配虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；告知模块174，连接至上述分配模块172和第二接收模块162，设置为将分配的虚拟MSISDN和分配的所述虚拟APN告知给授信非移动通信伙伴项目网络中的认证服务器。
在一个可选的实施例中，为上述UE分配的虚拟MSISDN包括UE的MAC地址和用于指示分配的虚拟MSISDN是针对单个用户的接入的单/多用户标识，或者，包括上述授信非移动通信伙伴项目网络的AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的AC的编号信息和认证服务器的认证编号信息为授信非移动通信伙伴项目网络的接入点分配虚拟APN。
在一个可选的实施例中，上述AC的编号信息、认证服务器的认证编号信息，以及AP的MAC地址或UE的MAC地址可以通过如下方式获取：接收UE的订阅开户请求，其中，该订阅开户请求用于请求为UE分配虚 拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配虚拟APN；收集上述授信非移动通信伙伴项目网络的AC的编号信息和认证服务器的编号信息，以及授信非移动通信伙伴项目网络的AP的MAC地址或UE的MAC地址。
图18是根据本发明实施例的第二种数据业务处理装置中控制模块166的结构框图，如图18所示，该控制模块166包括创建单元182，下面对该创建单元182进行说明。
创建单元182，设置为使用上述虚拟MSISDN创建用于UE进行数据业务的通用分组无线业务隧道协议GTP隧道。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述模块分别位于多个处理器中。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1，接收用户设备UE发送的用于请求进行数据业务的第一请求消息；
S2，根据第一请求消息向移动通信伙伴项目网络网关发送第二请求消息；其中，该第二请求消息中携带UE的虚拟移动台识别号码MSISDN、UE接入的接入点的虚拟接入点名称APN和为UE分配的互联网协议IP地址，第二请求消息用于请求移动通信伙伴项目网络网关对虚拟APN和IP地址进行验证，并在验证结果为合法的情况下，控制UE使用虚拟MSISDN进行数据业务。
可选地，存储介质还被设置为存储用于执行以下步骤的程序代码：
S1，接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，该第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、UE接入的接入点的虚拟接入点名称APN和由AC为UE分配的互联网协议IP地址；
S2，验证上述虚拟APN和IP地址是否合法；
S3，在验证结果为合法的情况下，控制上述UE使用虚拟MSISDN进行数据业务。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，在本实施例中，处理器根据存储介质中已存储的程序代码执行上述各个方法实施例中的步骤。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
采用本发明上述各实施例中的方案，与现有技术相比，能够减少了认证过程中的信息交互，方便无SIM卡终端从授信非移动通信伙伴项目网络接入到移动通信伙伴项目网络认证，并能够达到如下有益效果：
1、方便以后的物联网设备从授信的非移动通信伙伴项目网络与移动通信伙伴项目网络融合，接入到数据中心。
2、方便用户随时随地的上网冲浪，对现有的移动通信伙伴项目网络数据业务进行分流。
3、跨运营商分享用户数据业务。终端可以购买运营商的数据业务套餐充值卡，使用用户名和密码方式入网，不限制于是否有运营商的SIM卡绑定。无线运营商也可扩展自己的数据业务领域。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特 定的硬件和软件结合。
以上所述仅为本发明的可选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
通过上述描述可知，本发明移动通信伙伴项目网络可以根据接收的UE接入的虚拟APN和UE的IP地址对是否允许UE进行数据业务进行验证，验证方法简单，无需频繁的交互证书，也无需为UE配置softSIM或eSIM，并且，在验证通过的情况下，可以使用UE的虚拟MSISDN控制UE进行数据业务。从而解决了相关技术中存在的无SIM卡用户设备(可以是用户设备中没有插入SIM卡的场景，也可以是用户设备中插入了SIM卡，但是需要采用无SIM卡的模式进行上网的场景)从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时，需要身份验证，从而造成交互繁琐，接入延迟大，用户体验度低的问题，进而达到了降低无SIM卡用户设备从授信的非移动通信伙伴项目网络接到移动通信伙伴项目网络时的复杂度和时延，提高用户体验度的效果。

Claims (24)

  1. 一种数据业务处理方法，包括：
    接收用户设备UE发送的用于请求进行数据业务的第一请求消息；
    根据所述第一请求消息向移动通信伙伴项目网络网关发送第二请求消息；
    其中，所述第二请求消息中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
  2. 根据权利要求1所述的方法，其中，在根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息之前，还包括：
    获取所述移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为所述UE分配的虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
  3. 根据权利要求2所述的方法，其中，所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带有单/多用户标识，其中，所述单/多用户标识用于指示所述分配的虚拟MSISDN是针对单个用户的接入还是针对多个用户的接入。
  4. 根据权利要求3所述的方法，其中，通过如下方式确定所述第二请求消息中携带的所述UE的虚拟移动台识别号码MSISDN：
    获取所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带的单/多用户标识；
    当所述单/多用户标识用于指示分配的虚拟MSISDN是针对多个 用户的接入时，使用所述UE的媒体接入控制MAC地址作为所述第二请求消息中携带的所述UE的虚拟MSISDN；
    当所述单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的所述HLR或所述HSS为所述UE分配的虚拟MSISDN作为所述第二请求消息中携带的所述UE的虚拟MSISDN。
  5. 根据权利要求1所述的方法，其中，根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息包括：
    验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法，或者，验证所述第一请求消息中携带的所述UE的用户名、密码和媒体接入控制MAC地址是否合法；
    在验证结果为合法的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
  6. 根据权利要求5所述的方法，其中，验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法包括：
    判断本地存储的MAC认证表中是否包含所述UE的所述MAC地址，其中，所述MAC认证表中记录有允许进行数据业务的UE的MAC地址；
    在判断结果为存在的情况下，确定所述UE的所述MAC地址合法；
    在判断结果为不存在情况下，确定所述UE的所述MAC地址不合法。
  7. 根据权利要求5所述的方法，其中，在验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法之后，还包括：
    在验证结果为不合法的情况下，提示所述UE上报用户名和密码；
    验证所述UE上报的用户名、密码和所述UE的MAC地址是否正 确；
    在验证结果为正确的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
  8. 一种数据业务处理方法，包括：
    接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，所述第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和由所述AC为所述UE分配的互联网协议IP地址；
    验证所述虚拟APN和所述IP地址是否合法；
    在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
  9. 根据权利要求8所述的方法，其中，在接收所述授信非移动通信伙伴项目网络的所述AC发送的所述第二请求消息之前，还包括：
    为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；
    将分配的虚拟MSISDN和分配的所述虚拟APN告知给所述授信非移动通信伙伴项目网络中的认证服务器。
  10. 根据权利要求9所述的方法，其中：
    为所述UE分配的虚拟MSISDN包括所述UE的媒体接入控制MAC地址和用于指示分配的虚拟MSISDN是针对单个用户接入的单/多用户标识，或者，包括所述授信非移动通信伙伴项目网络的所述AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户的接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的认证编号信息为所述授信非移动 通信伙伴项目网络的接入点分配虚拟APN。
  11. 根据权利要求10所述的方法，其中，所述AC的编号信息、所述认证服务器的认证编号信息，以及所述AP的MAC地址或所述UE的MAC地址通过如下方式获取：
    接收所述UE的订阅开户请求，其中，所述订阅开户请求用于请求为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN；
    收集所述授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的编号信息，以及所述授信非移动通信伙伴项目网络的所述AP的MAC地址或所述UE的MAC地址。
  12. 根据权利要求8所述的方法，其中，控制所述UE使用所述虚拟MSISDN进行数据业务包括：
    使用所述虚拟MSISDN创建用于所述UE进行数据业务的通用分组无线业务隧道协议GTP隧道。
  13. 一种数据业务处理装置，包括：
    第一接收模块，设置为接收用户设备UE发送的用于请求进行数据业务的第一请求消息；
    发送模块，设置为根据所述第一请求消息向移动通信伙伴项目网络网关发送第二请求消息；
    其中，所述第二请求消息中携带所述UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和为所述UE分配的互联网协议IP地址，所述第二请求消息用于请求所述移动通信伙伴项目网络网关对所述虚拟APN和所述IP地址进行验证，并在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
  14. 根据权利要求13所述的装置，其中，所述装置还包括：
    获取模块，设置为在根据所述第一请求消息向所述移动通信伙伴项目网络网关发送所述第二请求消息之前，获取所述移动通信伙伴项目网络中的位置归属寄存器HLR或归属签约用户服务器HSS为所述UE分配的虚拟MSISDN和为授信非移动通信伙伴项目网络的接入点分配的虚拟APN。
  15. 根据权利要求14所述的装置，其中，所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带有单/多用户标识，其中，所述单/多用户标识用于指示所述分配的虚拟MSISDN是针对单个用户的接入还是针对多个用户的接入。
  16. 根据权利要求15所述的装置，其中，所述发送模块还包括确定单元，设置为通过如下方式确定所述第二请求消息中携带的所述UE的虚拟移动台识别号码MSISDN：
    获取所述HLR或所述HSS为所述UE分配的虚拟MSISDN中携带的单/多用户标识；
    当所述单/多用户标识用于指示分配的虚拟MSISDN是针对多个用户的接入时，使用所述UE的媒体接入控制MAC地址作为所述第二请求消息中携带的所述UE的虚拟MSISDN；
    当所述单/多用户标识用于指示分配的虚拟MSISDN是针对单个用户的接入时，使用获取的所述HLR或所述HSS为所述UE分配的虚拟MSISDN作为所述第二请求消息中携带的所述UE的虚拟MSISDN。
  17. 根据权利要求13所述的装置，其中，所述发送模块包括：
    第一验证单元，设置为验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法，或者，验证所述第一请求消息中携带的所述UE的用户名、密码和媒体接入控制MAC地址是否合法；
    第一发送单元，设置为在验证结果为合法的情况下，向所述移动 通信伙伴项目网络网关发送所述第二请求消息。
  18. 根据权利要求17所述的装置，其中，所述第一验证单元包括：
    判断子单元，设置为判断本地存储的MAC认证表中是否包含所述UE的所述MAC地址，其中，所述MAC认证表中记录有允许进行数据业务的UE的MAC地址；
    第一确定子单元，设置为在所述判断子单元的判断结果为存在的情况下，确定所述UE的所述MAC地址合法；和/或，
    第二确定子单元，设置为在所述判断子单元判断结果为不存在情况下，确定所述UE的所述MAC地址不合法。
  19. 根据权利要求17所述的装置，其中，所述发送模块还包括：
    提示单元，设置为在验证所述第一请求消息中携带的所述UE的媒体接入控制MAC地址是否合法之后，在验证结果为不合法的情况下，提示所述UE上报用户名和密码；
    第二验证单元，设置为验证所述UE上报的用户名、密码和所述UE的MAC地址是否正确；
    第二发送单元，设置为在验证结果为正确的情况下，向所述移动通信伙伴项目网络网关发送所述第二请求消息。
  20. 一种数据业务处理装置，包括：
    第二接收模块，设置为接收授信非移动通信伙伴项目网络的接入控制器AC发送的第二请求消息，其中，所述第二请求消息中携带请求进行数据业务的用户设备UE的虚拟移动台识别号码MSISDN、所述UE接入的接入点的虚拟接入点名称APN和由所述AC为所述UE分配的互联网协议IP地址；
    验证模块，设置为验证所述虚拟APN和所述IP地址是否合法；
    控制模块，设置为在验证结果为合法的情况下，控制所述UE使用所述虚拟MSISDN进行数据业务。
  21. 根据权利要求20所述的装置，其中，所述装置还包括：
    分配模块，设置为在接收所述授信非移动通信伙伴项目网络的所述AC发送的所述第二请求消息之前，为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点AP分配虚拟APN；
    告知模块，设置为将分配的虚拟MSISDN和分配的所述虚拟APN告知给所述授信非移动通信伙伴项目网络中的认证服务器。
  22. 根据权利要求21所述的装置，其中：
    为所述UE分配的虚拟MSISDN包括所述UE的MAC地址和用于指示分配的虚拟MSISDN是针对单个用户的接入的单/多用户标识，或者，包括所述授信非移动通信伙伴项目网络的所述AP的MAC地址和用于指示分配的虚拟MSISDN是针对多个用户的接入的单/多用户标识；和/或，根据授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的认证编号信息为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN。
  23. 根据权利要求22所述的装置，其中，所述AC的编号信息、所述认证服务器的认证编号信息，以及所述AP的MAC地址或所述UE的MAC地址通过如下方式获取：
    接收所述UE的订阅开户请求，其中，所述订阅开户请求用于请求为所述UE分配虚拟MSISDN和为所述授信非移动通信伙伴项目网络的接入点分配虚拟APN；
    收集所述授信非移动通信伙伴项目网络的所述AC的编号信息和所述认证服务器的编号信息，以及所述授信非移动通信伙伴项目网络的所述AP的MAC地址或所述UE的MAC地址。
  24. 根据权利要求20所述的装置，其中，所述控制模块包括：
    创建单元，设置为使用所述虚拟MSISDN创建用于所述UE进行数据业务的通用分组无线业务隧道协议GTP隧道。
PCT/CN2016/107320 2015-12-25 2016-11-25 数据业务处理方法及装置 WO2017107739A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510992580.1A CN106921967A (zh) 2015-12-25 2015-12-25 数据业务处理方法及装置
CN201510992580.1 2015-12-25

Publications (1)

Publication Number Publication Date
WO2017107739A1 true WO2017107739A1 (zh) 2017-06-29

Family

ID=59088980

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/107320 WO2017107739A1 (zh) 2015-12-25 2016-11-25 数据业务处理方法及装置

Country Status (2)

Country Link
CN (1) CN106921967A (zh)
WO (1) WO2017107739A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113746864A (zh) * 2021-09-22 2021-12-03 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质
CN114760195A (zh) * 2020-12-29 2022-07-15 中国移动通信集团北京有限公司 一种网络接入点配置方法、装置、系统、设备及介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109802920A (zh) * 2017-11-16 2019-05-24 杭州中威电子股份有限公司 一种用于安防行业的设备接入混合认证系统
CN111931797B (zh) * 2019-05-13 2023-09-08 中国移动通信集团湖南有限公司 业务所属网络的识别方法、装置及设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060077926A1 (en) * 2004-10-08 2006-04-13 Telefonaktiebolaget Lm Ericsson (Publ) Home network-assisted selection of intermediary network for a roaming mobile terminal
CN1823498A (zh) * 2003-05-01 2006-08-23 美商内数位科技公司 在耦合于3gpp装置的无线局域网上的数据的传递
CN102448064A (zh) * 2008-04-11 2012-05-09 艾利森电话股份有限公司 通过非3gpp接入网的接入
EP2117240B1 (en) * 2007-01-05 2014-04-23 NTT DoCoMo, Inc. Mobile communication system, mobile communication method, access device, and gateway information storage device
CN103945493A (zh) * 2013-01-17 2014-07-23 中兴通讯股份有限公司 选择v-andsf方法及装置、接入网接入方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1823498A (zh) * 2003-05-01 2006-08-23 美商内数位科技公司 在耦合于3gpp装置的无线局域网上的数据的传递
US20060077926A1 (en) * 2004-10-08 2006-04-13 Telefonaktiebolaget Lm Ericsson (Publ) Home network-assisted selection of intermediary network for a roaming mobile terminal
EP2117240B1 (en) * 2007-01-05 2014-04-23 NTT DoCoMo, Inc. Mobile communication system, mobile communication method, access device, and gateway information storage device
CN102448064A (zh) * 2008-04-11 2012-05-09 艾利森电话股份有限公司 通过非3gpp接入网的接入
CN103945493A (zh) * 2013-01-17 2014-07-23 中兴通讯股份有限公司 选择v-andsf方法及装置、接入网接入方法及装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114760195A (zh) * 2020-12-29 2022-07-15 中国移动通信集团北京有限公司 一种网络接入点配置方法、装置、系统、设备及介质
CN113746864A (zh) * 2021-09-22 2021-12-03 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质
CN113746864B (zh) * 2021-09-22 2023-06-23 中国联合网络通信集团有限公司 用户终端的认证方法、装置、设备、存储介质

Also Published As

Publication number Publication date
CN106921967A (zh) 2017-07-04

Similar Documents

Publication Publication Date Title
US11089480B2 (en) Provisioning electronic subscriber identity modules to mobile wireless devices
KR102341680B1 (ko) Ue-기반 네트워크 서브스크립션 관리
CN105934926B (zh) 使用公共订户信息的无线装置的会话和服务控制的方法和设备
CN106465120B (zh) 用于对网络进行集成的方法和节点
KR101167781B1 (ko) 콘텍스트 전달을 인증하는 시스템 및 방법
TWI748952B (zh) 利用單個連線性上下文支援多個併發服務上下文
CN102893669B (zh) 接入移动网络的方法、装置及系统
WO2017107739A1 (zh) 数据业务处理方法及装置
WO2015196396A1 (zh) 建立网络连接的方法、网关及终端
TWI516151B (zh) 通訊方法與通訊系統
WO2011116713A2 (zh) Mtc终端通过网关与网络通信的方法、设备及系统
CN110710178B (zh) 无线接入网络中的用户认证
US20160044487A1 (en) Network access method and apparatus, and network system
CN103843445B (zh) 接入网络的方法和装置
EP3574623A1 (en) Methods and devices for parameter exchange during emergency access
CN103974230B (zh) 一种位置信息的获取方法及相应装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16877550

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16877550

Country of ref document: EP

Kind code of ref document: A1