WO2018010561A1 - 一种接入核心网的控制方法及装置 - Google Patents

一种接入核心网的控制方法及装置 Download PDF

Info

Publication number
WO2018010561A1
WO2018010561A1 PCT/CN2017/091483 CN2017091483W WO2018010561A1 WO 2018010561 A1 WO2018010561 A1 WO 2018010561A1 CN 2017091483 W CN2017091483 W CN 2017091483W WO 2018010561 A1 WO2018010561 A1 WO 2018010561A1
Authority
WO
WIPO (PCT)
Prior art keywords
connection
request
sent
core network
response
Prior art date
Application number
PCT/CN2017/091483
Other languages
English (en)
French (fr)
Inventor
武凡羽
郑震铎
苏丽芳
张郑锟
段江海
王高亮
周水生
崔丽娜
Original Assignee
大唐移动通信设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 大唐移动通信设备有限公司 filed Critical 大唐移动通信设备有限公司
Publication of WO2018010561A1 publication Critical patent/WO2018010561A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method and an apparatus for controlling access to a core network.
  • the intelligent edge network device is deployed on the access network side, and the mobile data is offloaded without affecting the Internet Protocol security (IPsec) tunnel function.
  • IPsec Internet Protocol security
  • a small cell is a low-power wireless access node that initiates authentication through a smart edge network device to a security gateway (SeGW) deployed at the edge of the core network, and establishes an IPsec tunnel while the authentication succeeds.
  • the small station uses the IPsec tunnel to initiate the flow control transmission protocol (SCTP) coupling to the Mobility Management Entity (MME) of the carrier network through the intelligent edge network device.
  • SCTP flow control transmission protocol
  • MME Mobility Management Entity
  • the intelligent edge network device is a orphan device between the small station and the core network, if the device fails, all the small station services of the device are completely interrupted.
  • the smart edge network device is deployed on the access network side, to improve the reliability of the network, deploying two sets of active and standby edge network devices will increase the overall number of access network devices and increase the cost of network deployment.
  • the intelligent edge network device is a lone point device between the small station and the core network, if the device fails, all the small station services of the device are completely interrupted, thereby reducing the reliability of the network. .
  • An embodiment of the present invention provides a method and a device for controlling access to a core network, which are used to ensure that when a smart edge network device fails, the network connection is not interrupted, that is, the smart edge, without increasing the network construction cost. All the small station services of the network equipment continue to maintain access status, which improves the reliability of the network.
  • connection successfully sent by the smart edge network device is not received, send a connection to the core network. begging;
  • the data packet is sent to the core network.
  • the connection request is directly sent to the core network, and the connection between the small station and the core network is directly established, thereby realizing the network construction cost without increasing the network construction cost. It ensures that when the intelligent edge network device fails, the network connection is not interrupted, that is, all the small station services of the intelligent edge network device continue to maintain the access state, thereby improving the reliability of the network.
  • the connection request is sent to the core network, including:
  • the response to the successful connection sent by the core network is received, including:
  • the method further comprises:
  • the request to connect to the core network is sent to the smart edge network device.
  • the response to successful device authentication sent by the security gateway includes a key for encrypting data transmitted by the small station and the security gateway;
  • the connection request is sent to the core network, including:
  • connection succeeded by the smart edge network device is not received, generating a first connection request for connecting to the core network according to the intranet address sent by the dynamic host configuration protocol server;
  • the network address translation device converts the received intranet address in the first connection request to the internal network address according to the preset network address translation table.
  • Corresponding external network address generating and sending a second connection request to the core network.
  • connection with the small station is successfully established, a response to the successful connection is sent to the small station.
  • the connection request sent by the small station is received, it is determined that the intelligent edge network device is faulty, and the connection with the small station is directly established, thereby realizing the realization without increasing the network construction cost. Even if the intelligent edge network device fails, the network connection is not interrupted, that is, all the small station services of the intelligent edge network device continue to remain in the access state, thereby improving the reliability of the network.
  • connection with the small station is established according to the connection request sent by the received small station for connecting to the core network, including:
  • the response of the device authentication success includes: a key used to encrypt data transmitted by the small station and the security gateway;
  • the method further includes:
  • a response of the connection success is sent to the small station, including:
  • the access gateway successfully establishes a flow control transmission protocol coupling and an S1 connection, sending a connection success response to the security gateway;
  • a first module configured to send, to the smart edge network device, a connection request for connecting to the core network
  • a second module configured to send a connection request to the core network if the connection successfully sent by the smart edge network device is not received
  • the third module is configured to send a data packet to the core network if receiving a response that the connection sent by the core network is successful.
  • the connection request is directly sent to the core network, and the connection between the small station and the core network is directly established, thereby realizing the network construction cost without increasing the network construction cost. It ensures that when the intelligent edge network device fails, the network connection is not interrupted, that is, all the small station services of the intelligent edge network device continue to maintain the access state, thereby improving the reliability of the network.
  • the second module is specifically configured to:
  • the response to the successful connection sent by the core network is received, including:
  • the second module is further configured to:
  • the request to connect to the core network is sent to the smart edge network device.
  • the response to successful device authentication sent by the security gateway includes a key for encrypting data transmitted by the small station and the security gateway;
  • the second module is specifically configured to:
  • connection succeeded by the smart edge network device is not received, generating a first connection request for connecting to the core network according to the intranet address sent by the dynamic host configuration protocol server;
  • the network address translation device converts the received intranet address in the first connection request to the internal network address according to the preset network address translation table.
  • Corresponding external network address generating and sending a second connection request to the core network.
  • a receiving module configured to establish a connection with the small station according to the connection request sent by the received small station for connecting to the core network
  • a response module configured to send a response of the connection success to the small station if the connection with the small station is successfully established.
  • the connection request sent by the small station is received, it is determined that the intelligent edge network device is faulty, and the connection with the small station is directly established, thereby realizing the realization without increasing the network construction cost. Even if the intelligent edge network device fails, the network connection is not interrupted, that is, all the small station services of the intelligent edge network device continue to remain in the access state, thereby improving the reliability of the network.
  • the receiving module is specifically configured to:
  • the response of the device authentication success includes: a key used to encrypt data transmitted by the small station and the security gateway;
  • the receiving module is further configured to:
  • the response module is specifically configured to:
  • the access gateway successfully establishes a flow control transmission protocol coupling and an S1 connection, sending a connection success response to the security gateway;
  • the third control device for accessing the core network includes a processor and a memory, and the processor is configured to read a program in the memory, and perform the following process:
  • the data packet is sent to the core network.
  • a fourth control device for accessing a core network includes a processor and a memory, where the processor is configured to read a program in the memory, and perform the following process:
  • connection with the small station is successfully established, a response to the successful connection is sent to the small station.
  • FIG. 1 is a network architecture diagram of a smart edge network device deployed in the prior art
  • FIG. 2 is a schematic flowchart of a method for controlling access to a core network according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for controlling access to a core network according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of a method for controlling access to a core network according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of an overall method for controlling access to a core network according to an embodiment of the present disclosure
  • FIG. 6 is a schematic structural diagram of a control device for accessing a core network according to an embodiment of the present disclosure
  • FIG. 7 is a schematic structural diagram of another control device for accessing a core network according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a third control apparatus for accessing a core network according to an embodiment of the present invention.
  • An embodiment of the present invention provides a method and a device for controlling access to a core network, which are used to ensure that when a smart edge network device fails, the network connection is not interrupted, that is, the smart edge, without increasing the network construction cost. All the small station services of the network equipment continue to maintain access status, which improves the reliability of the network.
  • an embodiment of the present invention provides a method for controlling access to a core network, where the method includes:
  • connection succeeded by the smart edge network device is not received, send a connection request to the core network.
  • step S201 includes:
  • step S303 If the response of the device authentication succeeded by the smart edge network device is not received within the preset response time, repeat step S302 and the number of authentication of the smart edge network device is increased by one; if the smart edge network device authenticates the number of times If the threshold is exceeded, the smart edge network device is determined to be faulty, and step S202 is performed;
  • step S304 If the response to the establishment of the connection successfully sent by the smart edge network device is not received within the preset response time, send the flow control transmission protocol coupling and the S1 connection to the smart edge network device.
  • the request, and the smart edge network device establishes a connection number plus one; if the smart edge network device establishes the connection number exceeds a preset number of times threshold, determining that the smart edge network device is faulty, step S202 is performed;
  • the response sent by the smart edge network device to establish a connection is received within a preset response time, it is determined that the connection between the small station and the smart edge network device is successfully established, and the data packet is sent to the smart edge network device.
  • step S202 includes:
  • the device sends a device authentication request to the security gateway in the core network.
  • the method further includes:
  • step S306 is performed;
  • step S306 the method further includes:
  • step S308 If the response to the successful establishment of the connection sent by the security gateway is not received within the preset response time, repeat step S306 and the number of times the security gateway establishes the connection is increased by one; if the number of times the security gateway establishes the connection exceeds the preset The second number of thresholds, step S201 is performed;
  • step S203 If the response to the establishment of the connection successfully sent by the security gateway is received within the preset response time, it is determined that the connection between the small station and the core network is successfully established, and step S203 is performed.
  • the security gateway sends the device to the small station.
  • the device successfully responds with a key for encrypting data transmitted by the small station and the security gateway, and encrypts the data sent to the security gateway by using the key to implement between the small station and the security gateway. Establish an IPsec tunnel.
  • the security gateway sends the received request for establishing a flow control transmission protocol coupling and an S1 connection to the access gateway, where the access gateway is coupled according to the received flow control transmission protocol.
  • the request for the S1 connection is connected.
  • the access gateway successfully establishes an SCTP coupling and S1 connection with a Mobility Management Entity (MME).
  • MME Mobility Management Entity
  • the step S306 sends a request for establishing a flow control transmission protocol coupling and an S1 connection to the security gateway, including:
  • the method further includes:
  • S301 Interact with a Dynamic Host Configuration Protocol (DHCP) server to obtain an Internet Protocol (IP) address.
  • DHCP Dynamic Host Configuration Protocol
  • IP Internet Protocol
  • step S301 includes:
  • the DHCP server Receiving, by the DHCP server, a response including an intranet IP address allocated to the small station; wherein, after receiving the DHCP message broadcast by the small station, the DHCP server determines the small station according to a preset local IP database. Intranet IP address and generate a response including the intranet IP address of the small station;
  • the internal network IP address is obtained.
  • the method for implementing interaction with the security gateway includes:
  • Method 1 determining an external network IP address corresponding to the internal network IP address according to the internal network IP address; generating a connection request for connecting to the core network according to the determined external network IP address, and performing step S201;
  • Method 2 Generate a first connection request for connecting to the core network according to the internal network IP address, and send the generated first connection request to the network address translation device (NAT), where the network address translation device is configured according to The preset network address translation table converts the received intranet address in the first connection request into an external network address corresponding to the intranet address, generates and sends a second connection request to the core network, and performs steps S202.
  • NAT network address translation device
  • the internal and external network address is converted, the external network address utilization is improved, and the small-station large-scale application is realized.
  • the configuration of the small station is divided into two types, that is, manual configuration and automatic configuration.
  • the manual configuration of the small station is to manually complete the parameter configuration process through the configuration page before the small station is enabled; the automatic configuration needs to deploy the initial network management (HeMS) device on the access network side, and obtain the IP address and data network when the small station starts up automatically.
  • HeMS initial network management
  • DNS data network service
  • the step S203 is performed by the initial HeMS, and the method includes:
  • the data packet is sent to the NAT device according to the configuration of the next hop route in the initial HeMS, and the NAT device performs the conversion of the internal and external network addresses.
  • an embodiment of the present invention provides a method for controlling access to a core network, where the method includes:
  • step S401 includes:
  • step S402 includes:
  • the access gateway successfully establishes a flow control transmission protocol coupling and an S1 connection, sending a connection success response to the security gateway;
  • the response of the device authentication success includes: a key used to encrypt data transmitted by the small station and the security gateway;
  • the method After receiving the request for establishing the flow control transmission protocol coupling and the S1 connection sent by the small station, the method further includes:
  • the method further includes:
  • SGW service gateway
  • the small station Smallcell broadcasts a DHCP message.
  • the DHCP server After receiving the DHCP message broadcast by the small station, the DHCP server is configured according to preset local IP data. a library, determining an intranet IP address of the small station, and generating a response including an intranet IP address of the small station;
  • the small station acquires an intranet address in the response sent by the DHCP server, and sends a connection request for connecting to the Internet to the smart edge network device.
  • the small station Smallcell receives the response of the successful connection sent by the smart edge network device within a preset response time, generates and sends an intranet IP address to the network address translation device according to the intranet IP address in step S503. Request for device authentication of the address;
  • the network address translation device NAT converts the intranet IP address in the received device authentication request into an external network IP address corresponding to the intranet IP address according to the preset network address translation table, and generates and forwards the security gateway to the security gateway.
  • the SeGW sends a request for device authentication including an external network IP address;
  • the security gateway SeGW receives the device authentication request sent by the network address translation device NAT, and performs a device authentication operation.
  • the device After the S570 and the security gateway SeGW succeed in the small cell small cell authentication operation, the device sends a response to the device authentication success to the network address translation device NAT.
  • the network address translation device NAT forwards the response of the device authentication successfully sent by the security gateway SeGW to the small station Smallcell;
  • the small station Smallcell After receiving the response of the device authentication successfully sent by the security gateway SeGW, the small station Smallcell generates a request for establishing the SCTP coupling and the S1 connection according to the key in the response, and sends the request to the network address translation device NAT.
  • the network address translation device NAT converts the received intranet IP address in the request for establishing the SCTP coupling and the S1 connection to the external network IP corresponding to the intranet IP address according to the preset network address translation table. Addressing, generating and transmitting to the security gateway SeGW a request for establishing an SCTP coupling and an S1 connection including an external network IP address;
  • the security gateway SeGW receives the request sent by the network address translation device NAT for establishing the SCTP coupling and the S1 connection, and decrypts the request according to the key, according to the decrypted request for establishing the SCTP coupling and the S1 connection.
  • the external network IP address, the decrypted request for establishing the SCTP coupling and the S1 connection is sent to the access gateway HeGW;
  • the access gateway HeGW establishes a connection according to the received decrypted request for establishing an SCTP coupling and an S1 connection.
  • the access gateway HeGW sends a response to the security gateway SeGW to establish a connection successfully.
  • the security gateway SeGW forwards the response of the access gateway HeGW to establish a successful connection to the network address translation device NAT;
  • the network address translation device NAT forwards the response of the security gateway SeGW to establish a connection to the small station Smallcell.
  • an embodiment of the present invention provides a control device for accessing a core network, including:
  • the first module 601 is configured to send, to the smart edge network device, a connection request for connecting to the core network.
  • the second module 602 is configured to send a connection request to the core network if the connection successfully sent by the smart edge network device is not received.
  • the third module 603 is configured to send a data packet to the core network if receiving a response that the connection sent by the core network is successful.
  • the second module 602 is specifically configured to:
  • the response to the successful connection sent by the core network is received, including:
  • the second module 602 is further configured to:
  • the request to connect to the core network is sent to the smart edge network device.
  • the response of the device that is successfully authenticated by the security gateway includes: a key used to encrypt data transmitted by the small station and the security gateway;
  • the second module 602 is specifically configured to:
  • connection succeeded by the smart edge network device is not received, generating a first connection request for connecting to the core network according to the intranet address sent by the dynamic host configuration protocol server;
  • the network address translation device converts the received intranet address in the first connection request to the internal network address according to the preset network address translation table.
  • Corresponding external network address generating and sending a second connection request to the core network.
  • the control device of the access core network may be a small station or a user equipment, that is, the small station or the user equipment includes a first module 601, a second module 602, and a third module 603.
  • an embodiment of the present invention provides a control device for accessing a core network, including:
  • the receiving module 701 is configured to establish, according to the connection request sent by the received small station for connecting to the core network, The connection of the small station;
  • the response module 702 is configured to send a connection success response to the small station if the connection with the small station is successfully established.
  • the receiving module 701 is specifically configured to:
  • the response of the device authentication success includes: a key used to encrypt data transmitted by the small station and the security gateway;
  • the receiving module 701 is further configured to:
  • the response module 702 is specifically configured to:
  • the access gateway successfully establishes a flow control transmission protocol coupling and an S1 connection, sending a connection success response to the security gateway;
  • the control device of the access core network may be a security gateway, that is, the security gateway includes a receiving module 701 and a response module 702.
  • a third access control network of the access network is provided, for example, on the access network side, and may be a base station, including a processor 500 and a memory 520, where the processor is configured to read the memory.
  • the program perform the following process:
  • connection request is sent to the core network by the transceiver 510;
  • the data packet is transmitted to the core network through the transceiver 510.
  • the transceiver 510 is configured to receive and transmit data under the control of the processor 500.
  • the connection request is sent to the core network by the transceiver 510, which specifically includes:
  • the transceiver 510 is sent to the core.
  • the security gateway in the heart network sends a request for device authentication
  • the transceiver 510 After receiving the response of the device authentication succeeded by the security gateway by the transceiver 510, the transceiver 510 sends a request for establishing a flow control transmission protocol coupling and an S1 connection to the security gateway;
  • the transceiver 510 receives the response of the successful connection sent by the core network, including:
  • the transceiver 510 receives the response of the secure gateway to successfully establish a flow control transport protocol coupling with the S1 connection.
  • the processor 500 is further configured to:
  • the request to connect to the core network is sent to the intelligent edge network device through the transceiver 510.
  • the response to successful device authentication sent by the security gateway includes a key for encrypting data transmitted by the small station and the security gateway;
  • the encrypted request is sent by the transceiver 510 to the security gateway.
  • the connection request is sent to the core network by the transceiver 510, including:
  • connection succeeded by the smart edge network device is not received, generating a first connection request for connecting to the core network according to the intranet address sent by the dynamic host configuration protocol server;
  • the external network address corresponding to the intranet address generates and sends a second connection request to the core network through the transceiver 510.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 500 and various circuits of memory represented by memory 520.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • Transceiver 510 can be a plurality of components, including a transmitter and a transceiver, providing means for communicating with various other devices on a transmission medium.
  • the processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 can store data used by the processor 500 when performing operations.
  • the processor 500 can be a central buried device (CPU), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex Complex Programmable Logic Device (CPLD)
  • CPU central buried device
  • ASIC application specific integrated circuit
  • FPGA field-programmable gate array
  • CPLD complex Complex Programmable Logic Device
  • the fourth type of control device for accessing the core network provided by the embodiment of the present application is, for example, located on the core network side, which is a security gateway, and has the same structure as that shown in FIG. 8, but the functions of the processor and the memory are different, and the embodiment includes In the processor and memory, the processor is used to read the program in the memory, and the following process is performed:
  • connection with the small station is successfully established, a response to the successful connection is sent to the small station through the transceiver.
  • establishing a connection with the small station according to a connection request sent by the small station received by the transceiver for connecting to the core network, including:
  • the response of the device authentication success includes: a key used to encrypt data transmitted by the small station and the security gateway;
  • the processor After receiving, by the transceiver, the request for establishing the flow control transmission protocol coupling and the S1 connection sent by the small station, sending the received request for establishing the flow control transmission protocol coupling and the S1 connection to the connection Before entering the gateway, the processor is also used to:
  • a response of the connection success is sent to the small station, including:
  • the transceiver sends a successful connection response to the security gateway;
  • the embodiment of the present invention provides a method and a device for controlling access to a core network, where a smart edge network device fails to connect to the core network, and then directly sends a connection request to the core network to directly establish a connection request.
  • the connection between the small station and the core network enables the access network side device to form a master-slave relationship with the core network side device, and fully utilizes the existing equipment in the existing network without increasing the network construction cost.
  • the smart edge network device fails, the network connection is not interrupted, that is, all the small station services of the intelligent edge network device continue to maintain the access state, thereby improving the reliability of the network, and localizing the local offload when the small station is densely networked.
  • the problem of the failure of the intelligent edge network device The problem is provided by the solution.
  • the internal and external network address is converted, and the utilization of the external network address is improved, which promotes the large-scale application of the small station.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种接入核心网的控制方法及装置，用以在不增加网络建设成本的前提下，确保了在智能边缘网络设备出现故障时，网络连接不中断，即该智能边缘网络设备下属的所有的小站业务持续保持接入状态，提高了网络的可靠性。所述方法包括：向智能边缘网络设备发送用于连接核心网的连接请求；若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。

Description

一种接入核心网的控制方法及装置
本申请要求在2016年7月12日提交中国专利局、申请号为201610546654.3、发明名称为“一种接入核心网的控制方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，尤其涉及一种接入核心网的控制方法及装置。
背景技术
为能够提高无线频谱资源的利用率，在接入网侧部署智能边缘网络设备，在不影响Internet协议安全性(Internet Protocol security，IPsec)隧道功能的前提下，完成移动数据的分流。
参见图1，小站(Smallcell)即为低功率无线接入节点通过智能边缘网络设备向核心网边缘部署的安全网关(Security GateWay，SeGW)发起认证，认证成功的同时建立IPsec隧道。在IPsec隧道建立完毕后，小站通过智能边缘网络设备利用IPsec隧道向运营商网络的移动性管理实体(Mobility Management Entity，MME)发起建立流控制传送协议(Stream Control Transmission Protocol，SCTP)偶联和S1链路，若SCTP偶联和S1链路建立成功，则小站成功接入到核心网，实现通过智能边缘网络设备完成网络接入。
然而，由于智能边缘网络设备在小站与核心网之间是一孤点设备，若该设备出现故障，将导致该设备下属所有的小站业务全部中断。由于智能边缘网络设备部署在接入网侧，若为提高网络的可靠性，部署两套主备的智能边缘网络设备，将增大接入网设备的整体数量，加大网络部署的成本。
综上所述，由于智能边缘网络设备在小站与核心网之间是一孤点设备，若该设备出现故障，将导致该设备下属所有的小站业务全部中断，降低了该网络的可靠性。
发明内容
本发明实施例提供了一种接入核心网的控制方法及装置，用以在不增加网络建设成本的前提下，确保了在智能边缘网络设备出现故障时，网络连接不中断，即该智能边缘网络设备下属的所有的小站业务持续保持接入状态，提高了网络的可靠性。
本发明实施例提供的一种接入核心网的控制方法，包括：
向智能边缘网络设备发送用于连接核心网的连接请求；
若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请 求；
若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
本发明实施例中，若智能边缘网络设备出现故障，无法成功连接核心网，则直接向核心网发送连接请求，直接建立小站与核心网的连接，实现了在不增加网络建设成本的前提下，确保了在智能边缘网络设备出现故障时，网络连接不中断，即该智能边缘网络设备下属的所有的小站业务持续保持接入状态，提高了网络的可靠性。
较佳地，若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求，包括：
若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网中的安全网关发送设备认证的请求；
在接收到所述安全网关发送的设备认证成功的响应后，向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求；
则接收到核心网发送的连接成功的响应，包括：
接收到所述安全网关发送的成功建立流控传输协议偶联与S1连接的响应。
较佳地，该方法还包括：
若向安全网关发送设备认证的请求的次数大于预设的第一次数阈值或向安全网关发送用于建立流控传输协议偶联与S1连接的请求的次数大于预设的第二次数阈值，则向智能边缘网络设备发送连接核心网的请求。
较佳地，所述安全网关发送的设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求，包括：
根据接收到的设备认证成功的响应中的密匙，对用于建立流控传输协议偶联与S1连接的请求进行加密，得到加密后的请求；
向所述安全网关发送所述加密后的请求。
较佳地，若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求，包括：
若未收到所述智能边缘网络设备发送的连接成功的响应，则根据动态主机配置协议服务器发送的内网地址，生成用于连接核心网的第一连接请求；
向网络地址转换设备发送生成的第一连接请求，其中，所述网络地址转换设备根据预设的网络地址转换表，将接收到的第一连接请求中的内网地址转换为与该内网地址对应的外网地址，生成并向所述核心网发送第二连接请求。
本发明实施例提供的一种接入核心网的控制方法，包括：
根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
本发明实施例中，若接收到小站直接发送的连接请求，则确定智能边缘网络设备出现故障，并直接建立与该小站的连接，实现了在不增加网络建设成本的前提下，实现了即使智能边缘网络设备出现故障，网络连接仍不中断，即该智能边缘网络设备下属的所有的小站业务继续保持接入状态，提高了网络的可靠性。
较佳地，根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接，包括：
接收小站发送的设备认证的请求；
根据接收到的设备认证的请求，对所述小站进行设备认证；
若认证成功，则向所述小站发送设备认证成功的响应；
接收所述小站发送的用于建立流控传输协议偶联与S1连接的请求；
将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，其中，所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。
较佳地，所述设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
在接收到所述小站发送的用于建立流控传输协议偶联与S1连接的请求后，在将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关之前，该方法还包括：
根据所述密钥，对接收到的用于建立流控传输协议偶联与S1连接的请求进行解析，得到解密后用于建立流控传输协议偶联与S1连接的请求。
较佳地，若成功建立与所述小站的连接，则向所述小站发送连接成功的响应，包括：
若所述接入网关成功建立流控传输协议偶联与S1连接，则向安全网关发送连接成功的响应；
接收所述接入网关发送的连接成功的响应，并将所述响应发送给所述小站。
本发明实施例提供的一种接入核心网的控制装置，包括：
第一模块，用于向智能边缘网络设备发送用于连接核心网的连接请求；
第二模块，用于若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；
第三模块，用于若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
本发明实施例中，若智能边缘网络设备出现故障，无法成功连接核心网，则直接向核心网发送连接请求，直接建立小站与核心网的连接，实现了在不增加网络建设成本的前提下，确保了在智能边缘网络设备出现故障时，网络连接不中断，即该智能边缘网络设备下属的所有的小站业务持续保持接入状态，提高了网络的可靠性。
较佳地，所述第二模块，具体用于：
若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网中的安全网关发送设备认证的请求；
在接收到所述安全网关发送的设备认证成功的响应后，向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求；
则接收到核心网发送的连接成功的响应，包括：
接收到所述安全网关发送的成功建立流控传输协议偶联与S1连接的响应。
较佳地，所述第二模块，还用于：
若向安全网关发送设备认证的请求的次数大于预设的第一次数阈值或向安全网关发送用于建立流控传输协议偶联与S1连接的请求的次数大于预设的第二次数阈值，则向智能边缘网络设备发送连接核心网的请求。
较佳地，所述安全网关发送的设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求，所述第二模块，具体用于：
根据接收到的设备认证成功的响应中的密匙，对用于建立流控传输协议偶联与S1连接的请求进行加密，得到加密后的请求；
向所述安全网关发送所述加密后的请求。
较佳地，所述第二模块，具体用于：
若未收到所述智能边缘网络设备发送的连接成功的响应，则根据动态主机配置协议服务器发送的内网地址，生成用于连接核心网的第一连接请求；
向网络地址转换设备发送生成的第一连接请求，其中，所述网络地址转换设备根据预设的网络地址转换表，将接收到的第一连接请求中的内网地址转换为与该内网地址对应的外网地址，生成并向所述核心网发送第二连接请求。
本发明实施例提供的一种接入核心网的控制装置，包括：
接收模块，用于根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
响应模块，用于若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
本发明实施例中，若接收到小站直接发送的连接请求，则确定智能边缘网络设备出现故障，并直接建立与该小站的连接，实现了在不增加网络建设成本的前提下，实现了即使智能边缘网络设备出现故障，网络连接仍不中断，即该智能边缘网络设备下属的所有的小站业务继续保持接入状态，提高了网络的可靠性。
较佳地，所述接收模块，具体用于：
接收小站发送的设备认证的请求；
根据接收到的设备认证的请求，对所述小站进行设备认证；
若认证成功，则向所述小站发送设备认证成功的响应；
接收所述小站发送的用于建立流控传输协议偶联与S1连接的请求；
将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，其中，所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。
较佳地，所述设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
所述接收模块，还用于：
根据所述密钥，对接收到的用于建立流控传输协议偶联与S1连接的请求进行解析，得到解密后用于建立流控传输协议偶联与S1连接的请求。
较佳地，所述响应模块，具体用于：
若所述接入网关成功建立流控传输协议偶联与S1连接，则向安全网关发送连接成功的响应；
接收所述接入网关发送的连接成功的响应，并将所述响应发送给所述小站。
本申请实施例提供的第三种接入核心网的控制装置，包括处理器和存储器，所述处理器用于读取所述存储器中的程序，执行下列过程：
向智能边缘网络设备发送用于连接核心网的连接请求；
若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；
若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
本申请实施例提供的第四种接入核心网的控制装置，包括处理器和存储器，所述处理器用于读取所述存储器中的程序，执行下列过程：
根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
附图说明
图1为现有技术中部署了智能边缘网络设备后的网络架构图；
图2为本发明实施例提供的一种接入核心网的控制方法的流程示意图；
图3为本发明实施例提供的一种接入核心网的控制方法的流程示意图；
图4为本发明实施例提供的一种接入核心网的控制方法的流程示意图；
图5为本发明实施例提供的一种接入核心网的控制方法的整体流程示意图；
图6为本发明实施例提供的一种接入核心网的控制装置的结构示意图；
图7为本发明实施例提供的另一种接入核心网的控制装置的结构示意图；
图8为本发明实施例提供的第三种接入核心网的控制装置的结构示意图。
具体实施方式
本发明实施例提供了一种接入核心网的控制方法及装置，用以在不增加网络建设成本的前提下，确保了在智能边缘网络设备出现故障时，网络连接不中断，即该智能边缘网络设备下属的所有的小站业务持续保持接入状态，提高了网络的可靠性。
下面将结合本发明实施例中的附图，对本发明中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
参见图2，在小站侧，本发明实施例提供了一种接入核心网的控制方法，该方法包括：
S201、向智能边缘网络设备发送用于连接核心网的连接请求；
S202、若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；
S203、若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
具体地，参见图3，步骤S201包括：
S302、向所述智能边缘网络设备发送设备认证的请求；
S303、若在预设的响应时间内未收到所述智能边缘网络设备发送的设备认证成功的响应，则重复步骤S302且智能边缘网络设备认证次数加一；若所述智能边缘网络设备认证次数超过预设的第三次数阈值，则确定所述智能边缘网络设备出现故障，执行步骤S202；
若在预设的响应时间内收到所述智能边缘网络设备发送的设备认证成功的响应，则向所述智能边缘网络设备发送用于建立流控传输协议偶联与S1连接的请求；
S304、若在预设的响应时间内未收到所述智能边缘网络设备发送的建立连接成功的响应，则再向所述智能边缘网络设备发送用于建立流控传输协议偶联与S1连接的请求，且智能边缘网络设备建立连接次数加一；若所述智能边缘网络设备建立连接次数超过预设的次数阈值，则确定所述智能边缘网络设备出现故障，执行步骤S202；
若在预设的响应时间内收到所述智能边缘网络设备发送的建立连接成功的响应，则确定成功建立小站与智能边缘网络设备的连接，并向所述智能边缘网络设备发送数据包。
具体地，步骤S202包括：
S305、若未收到所述智能边缘网络设备发送的连接成功的响应，即确定所述智能边缘网络设备出现故障，则向所述核心网中的安全网关发送设备认证的请求；
S306、在接收到所述安全网关发送的设备认证成功的响应后，向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求。
具体地，在步骤S305之后，该方法还包括：
S307、若在预设的响应时间内未收到所述安全网关发送的设备认证成功的响应，则重复步骤S305且安全网关认证次数加一；若所述安全网关认证次数超过预设的第一次数阈值，则执行步骤S201；
若在预设的响应时间内接收到所述安全网关发送的设备认证成功的响应，则执行步骤S306；
具体地，在步骤S306之后，该方法还包括：
S308、若在预设的响应时间内未收到所述安全网关发送的建立连接成功的响应，则重复步骤S306且安全网关建立连接次数加一；若所述安全网关建立连接次数超过预设的第二次数阈值，则执行步骤S201；
若在预设的响应时间内接收到所述安全网关发送的建立连接成功的响应，则确定成功建立小站与核心网的连接，并执行步骤S203。
具体地，若在预设的响应时间内收到所述安全网关发送的设备认证成功的响应，则确定小站与安全网关之间建立IPsec隧道，即所述安全网关向所述小站发送的设备认证成功的响应中包括，用于对小站与所述安全网关传输数据加密的密钥，通过该密匙对向所述安全网关发送的数据进行加密，实现在小站和安全网关之间建立IPsec隧道。
其中，所述安全网关将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，由所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。在成功建立IPsec隧道之前，所述接入网关就已成功建立与移动性管理实体(Mobility Management Entity，MME)的SCTP偶联与S1连接。当接入网关向MME发起建立SCTP偶联与S1连接时，所述接入网关是作为宏站接入MME的。
其中，步骤S306中向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求，包括：
根据接收到的设备认证成功的响应中的密匙，对用于建立流控传输协议偶联与S1连接的请求进行加密，得到加密后的请求；
向所述安全网关发送所述加密后的请求。
其中，在步骤S201之前，在小站Smallcell启动的同时，参见图3，该方法还包括：
S301、与动态主机配置协议(Dynamic Host Configuration Protocol，DHCP)服务器交互获取内网互联网(Internet Protocol，IP)地址。
具体地，步骤S301包括：
广播DHCP消息；
接收DHCP服务器发送的包括有分配给小站的内网IP地址的响应；其中，所述DHCP服务器接收到所述小站广播的DHCP消息后，根据预设的本地IP数据库，确定所述小站 的内网IP地址，并生成包括所述小站的内网IP地址的响应；
根据接收到的DHCP服务器发送的响应，得到内网IP地址。
其中，实现与所述安全网关的交互的方法，包括：
方法一：根据内网IP地址，确定该内网IP地址对应的外网IP地址；根据确定的外网IP地址，生成用于连接核心网的连接请求，并执行步骤S201；
方法二：根据内网IP地址，生成用于连接核心网的第一连接请求；向网络地址转换设备(Network Address Translation，NAT)发送生成的第一连接请求，其中，所述网络地址转换设备根据预设的网络地址转换表，将接收到的第一连接请求中的内网地址转换为与该内网地址对应的外网地址，生成并向所述核心网发送第二连接请求，并执行步骤S202。
本发明实施例中，通过在接入网侧部署网络地址转换设备，实现了内外网地址的转换，提升了外网地址利用率，实现了小站大规模应用。
具体地，所述小站的配置分为两种，即手动配置和自动配置。其中，手动配置小站为，在小站启用前手动通过配置页面完成参数配置过程；自动配置需要在接入网侧部署初始网管(HeMS)设备，在小站自启动时获取IP地址和数据网络业务(Data Network Service，DNS)地址，并通过通用的初始HeMS的域名向DNS设备获取到初始HeMS的IP地址，在通过初始HeMS获取到相关配置，执行步骤S203。具体参数如表1所示。
Figure PCTCN2017091483-appb-000001
表1
其中，所通过初始HeMS获取到相关配置，执行步骤S203，包括：
若接收到核心网发送的连接成功的响应，则根据初始HeMS中路由下一跳的配置，将数据包发送给NAT设备，并由所述NAT设备完成内外网地址的转换。
参见图4，在安全网关侧，本发明实施例提供了一种接入核心网的控制方法，该方法包括：
S401、根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
S402、若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
具体地，步骤S401包括：
接收小站发送的设备认证的请求；
根据接收到的设备认证的请求，对所述小站进行设备认证；
若认证成功，则向所述小站发送设备认证成功的响应；
接收所述小站发送的用于建立流控传输协议偶联与S1连接的请求；
将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，其中，所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。
具体地，步骤S402包括：
若所述接入网关成功建立流控传输协议偶联与S1连接，则向安全网关发送连接成功的响应；
接收所述接入网关发送的连接成功的响应，并将所述响应发送给所述小站。
其中，所述设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
在接收到所述小站发送的用于建立流控传输协议偶联与S1连接的请求后，该方法还包括：
根据所述密钥，对接收到的用于建立流控传输协议偶联与S1连接的请求进行解析，得到解密后的用于建立流控传输协议偶联与S1连接的请求；
根据解密后的用于建立流控传输协议偶联与S1连接的请求中的外网IP地址，将解密后的用于建立流控传输协议偶联与S1连接的请求发送给接入网关。
其中，在步骤S402之后，该方法还包括：
接收所述小站发送的数据包，其中，所述数据包包括数据和/或信令；
根据所述设备认证成功的响应中的密钥，对接收到的数据包进行解析，得到解密后的数据包；
根据预设的核心网地址分配表以及所述解密后的数据包，将所述解密后的数据包中的数据发送给服务网关(Service Gateway，SGW)；将所述解密后的数据包中的信令发送给MME。
为便于理解，下面将通过实施例进一步对本发明的方案进行解释。
下面将结合图5，介绍本发明实施例提供的一种接入核心网的控制方法的整体流程包括步骤：
S501、小站Smallcell广播DHCP消息；
S502、DHCP服务器接收到所述小站广播的DHCP消息后，根据预设的本地IP数据 库，确定所述小站的内网IP地址，并生成包括所述小站的内网IP地址的响应；
S503、小站Smallcell获取DHCP服务器发送的响应中的内网地址，并向智能边缘网络设备发送用于连接互联网的连接请求；
S504、小站Smallcell若在预设的响应时间内收到所述智能边缘网络设备发送的连接成功的响应，根据步骤S503中的内网IP地址，生成并向网络地址转换设备发送包括内网IP地址的设备认证的请求；
S505、网络地址转换设备NAT根据预设的网络地址转换表，将接收到的设备认证的请求中的内网IP地址转换为与该内网IP地址对应的外网IP地址，生成并向安全网关SeGW发送包括外网IP地址的设备认证的请求；
S506、安全网关SeGW接收网络地址转换设备NAT发送的设备认证的请求，并进行设备认证操作；
S507、安全网关SeGW对小站Smallcell认证操作成功后，向网络地址转换设备NAT发送设备认证成功的响应；
S508、网络地址转换设备NAT将安全网关SeGW发送的设备认证成功的响应转发给小站Smallcell；
S509、小站Smallcell接收到安全网关SeGW发送的设备认证成功的响应后，根据所述响应中的密匙，生成用于建立SCTP偶联与S1连接的请求，并向网络地址转换设备NAT发送包括内网IP地址的用于建立SCTP偶联与S1连接的请求；
S510、网络地址转换设备NAT根据预设的网络地址转换表，将接收到的用于建立SCTP偶联与S1连接的请求中的内网IP地址转换为与该内网IP地址对应的外网IP地址，生成并向安全网关SeGW发送包括外网IP地址的用于建立SCTP偶联与S1连接的请求；
S511、安全网关SeGW接收网络地址转换设备NAT发送的用于建立SCTP偶联与S1连接的请求，并根据密匙解密该请求，根据解密后的用于建立SCTP偶联与S1连接的请求中的外网IP地址，将解密后的用于建立SCTP偶联与S1连接的请求发送给接入网关HeGW；
S512、接入网关HeGW根据接收到的解密后的用于建立SCTP偶联与S1连接的请求，进行连接的建立；
S513、接入网关HeGW向安全网关SeGW发送建立连接成功的响应；
S514、安全网关SeGW将接入网关HeGW发送的建立连接成功的响应转发给网络地址转换设备NAT；
S515、网络地址转换设备NAT将安全网关SeGW发送的建立连接成功的响应转发给小站Smallcell。
参见图6，本发明实施例提供了一种接入核心网的控制装置，包括：
第一模块601，用于向智能边缘网络设备发送用于连接核心网的连接请求；
第二模块602，用于若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；
第三模块603，用于若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
具体地，所述第二模块602，具体用于：
若未收到所述智能边缘网络设备发送的连接成功的响应，则向安全网关发送设备认证的请求；
在接收到所述安全网关发送的设备认证成功的响应后，向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求；
则接收到核心网发送的连接成功的响应，包括：
接收到所述安全网关发送的成功建立流控传输协议偶联与S1连接的响应。
具体地，所述第二模块602，还用于：
若向安全网关发送设备认证的请求的次数大于预设的第一次数阈值或向安全网关发送用于建立流控传输协议偶联与S1连接的请求的次数大于预设的第二次数阈值，则向智能边缘网络设备发送连接核心网的请求。
具体地，所述安全网关发送的设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求，所述第二模块602，具体用于：
根据接收到的设备认证成功的响应中的密匙，对用于建立流控传输协议偶联与S1连接的请求进行加密，得到加密后的请求；
向所述安全网关发送所述加密后的请求。
具体地，所述第二模块602，具体用于：
若未收到所述智能边缘网络设备发送的连接成功的响应，则根据动态主机配置协议服务器发送的内网地址，生成用于连接核心网的第一连接请求；
向网络地址转换设备发送生成的第一连接请求，其中，所述网络地址转换设备根据预设的网络地址转换表，将接收到的第一连接请求中的内网地址转换为与该内网地址对应的外网地址，生成并向所述核心网发送第二连接请求。
其中，所述接入核心网的控制装置可以为小站或用户设备，即小站或用户设备包括第一模块601，第二模块602，第三模块603。
参见图7，本发明实施例提供了一种接入核心网的控制装置，包括：
接收模块701，用于根据接收到的小站发送的用于连接核心网的连接请求，建立与所 述小站的连接；
响应模块702，用于若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
具体地，所述接收模块701，具体用于：
接收小站发送的设备认证的请求；
根据接收到的设备认证的请求，对所述小站进行设备认证；
若认证成功，则向所述小站发送设备认证成功的响应；
接收所述小站发送的用于建立流控传输协议偶联与S1连接的请求；
将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，其中，所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。
具体地，所述设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
所述接收模块701，还用于：
根据所述密钥，对接收到的用于建立流控传输协议偶联与S1连接的请求进行解析，得到解密后用于建立流控传输协议偶联与S1连接的请求。
具体地，所述响应模块702，具体用于：
若所述接入网关成功建立流控传输协议偶联与S1连接，则向安全网关发送连接成功的响应；
接收所述接入网关发送的连接成功的响应，并将所述响应发送给所述小站。
其中，所述接入核心网的控制装置可以为安全网关，即所述安全网关包括接收模块701，响应模块702。
参见图8，本申请实施例提供的第三种接入核心网的控制装置，例如位于接入网侧，可以为基站，包括处理器500和存储器520，所述处理器用于读取所述存储器中的程序，执行下列过程：
通过收发机510向智能边缘网络设备发送用于连接核心网的连接请求；
若未收到所述智能边缘网络设备发送的连接成功的响应，则通过收发机510向所述核心网发送连接请求；
若通过收发机510接收到核心网发送的连接成功的响应，则通过收发机510向所述核心网发送数据包。
收发机510，用于在处理器500的控制下接收和发送数据。
较佳地，若未收到所述智能边缘网络设备发送的连接成功的响应，则通过收发机510向所述核心网发送连接请求，具体包括：
若未收到所述智能边缘网络设备发送的连接成功的响应，则通过收发机510向所述核 心网中的安全网关发送设备认证的请求；
在通过收发机510接收到所述安全网关发送的设备认证成功的响应后，通过收发机510向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求；
则通过收发机510接收到核心网发送的连接成功的响应，包括：
通过收发机510接收到所述安全网关发送的成功建立流控传输协议偶联与S1连接的响应。
较佳地，所述处理器500还用于：
若向安全网关发送设备认证的请求的次数大于预设的第一次数阈值或向安全网关发送用于建立流控传输协议偶联与S1连接的请求的次数大于预设的第二次数阈值，则通过收发机510向智能边缘网络设备发送连接核心网的请求。
较佳地，所述安全网关发送的设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
通过收发机510向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求，包括：
根据通过收发机510接收到的设备认证成功的响应中的密匙，对用于建立流控传输协议偶联与S1连接的请求进行加密，得到加密后的请求；
通过收发机510向所述安全网关发送所述加密后的请求。
较佳地，若未收到所述智能边缘网络设备发送的连接成功的响应，则通过收发机510向所述核心网发送连接请求，包括：
若未收到所述智能边缘网络设备发送的连接成功的响应，则根据动态主机配置协议服务器发送的内网地址，生成用于连接核心网的第一连接请求；
通过收发机510向网络地址转换设备发送生成的第一连接请求，其中，所述网络地址转换设备根据预设的网络地址转换表，将接收到的第一连接请求中的内网地址转换为与该内网地址对应的外网地址，生成并通过收发机510向所述核心网发送第二连接请求。
其中，在图8中，总线架构可以包括任意数量的互联的总线和桥，具体由处理器500代表的一个或多个处理器和存储器520代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发机510可以是多个元件，即包括发送机和收发机，提供用于在传输介质上与各种其他装置通信的单元。处理器500负责管理总线架构和通常的处理，存储器520可以存储处理器500在执行操作时所使用的数据。
处理器500可以是中央处埋器(CPU)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field－Programmable Gate Array，FPGA)或复杂可 编程逻辑器件(Complex Programmable Logic Device，CPLD)
本申请实施例提供的第四种接入核心网的控制装置，例如位于核心网侧，为安全网关，其结构同图8所示结构，但处理器和存储器的功能不同，该实施例中包括的处理器和存储器中，处理器用于读取存储器中的程序，执行下列过程：
根据通过收发机接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
若成功建立与所述小站的连接，则通过收发机向所述小站发送连接成功的响应。
较佳地，根据通过收发机接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接，包括：
通过收发机接收小站发送的设备认证的请求；
根据接收到的设备认证的请求，对所述小站进行设备认证；
若认证成功，则通过收发机向所述小站发送设备认证成功的响应；
通过收发机接收所述小站发送的用于建立流控传输协议偶联与S1连接的请求；
将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，其中，所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。
较佳地，所述设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
在通过收发机接收到所述小站发送的用于建立流控传输协议偶联与S1连接的请求后，在将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关之前，所述处理器还用于：
根据所述密钥，对接收到的用于建立流控传输协议偶联与S1连接的请求进行解析，得到解密后用于建立流控传输协议偶联与S1连接的请求。
较佳地，若成功建立与所述小站的连接，则向所述小站发送连接成功的响应，包括：
若所述接入网关成功建立流控传输协议偶联与S1连接，则通过收发机向安全网关发送连接成功的响应；
通过收发机接收所述接入网关发送的连接成功的响应，并将所述响应发送给所述小站。
综上所述，本发明实施例提供了一种接入核心网的控制方法及装置，用以若智能边缘网络设备出现故障，无法成功连接核心网，则直接向核心网发送连接请求，直接建立小站与核心网的连接，实现了接入网侧设备与核心网侧设备形成了主备关系，在不增加网络建设成本的前提下，充分利用了现有网络中的已有设备，确保了在智能边缘网络设备出现故障时，网络连接不中断，即该智能边缘网络设备下属的所有的小站业务持续保持接入状态，提高了网络的可靠性，对解决小站密集组网时本地分流和智能边缘网络设备出现故障的问 题提供了解决方案。通过在接入网侧部署网络地址转换设备，实现了内外网地址的转换，提升了外网地址利用率，对小站的大规模应用起了推动作用。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明实施例进行各种改动和变型而不脱离本发明实施例的精神和范围。这样，倘若本发明实施例的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (20)

  1. 一种接入核心网的控制方法，其特征在于，该方法包括：
    向智能边缘网络设备发送用于连接核心网的连接请求；
    若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；
    若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
  2. 根据权利要求1所述的方法，其特征在于，向所述核心网发送连接请求，包括：
    向所述核心网中的安全网关发送设备认证的请求；
    在接收到所述安全网关发送的设备认证成功的响应后，向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求；
    则接收到核心网发送的连接成功的响应，包括：
    接收到所述安全网关发送的成功建立流控传输协议偶联与S1连接的响应。
  3. 根据权利要求2所述的方法，其特征在于，该方法还包括：
    若向所述安全网关发送设备认证的请求的次数大于预设的第一次数阈值或向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求的次数大于预设的第二次数阈值，则向所述智能边缘网络设备发送连接核心网的请求。
  4. 根据权利要求2所述的方法，其特征在于，所述安全网关发送的设备认证成功的响应包括：用于对小站与所述安全网关传输数据加密的密钥；
    向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求，包括：
    根据接收到的设备认证成功的响应中的密匙，对用于建立流控传输协议偶联与S1连接的请求进行加密，得到加密后的请求；
    向所述安全网关发送所述加密后的请求。
  5. 根据权利要求1所述的方法，其特征在于，向所述核心网发送连接请求，包括：
    根据动态主机配置协议服务器发送的内网地址，生成用于连接核心网的第一连接请求；
    向网络地址转换设备发送生成的第一连接请求，其中，所述网络地址转换设备根据预设的网络地址转换表，将接收到的第一连接请求中目标地址的内网地址转换为与该内网地址对应的外网地址，生成并向所述核心网发送包括外网地址的第二连接请求。
  6. 一种接入核心网的控制方法，其特征在于，包括：
    根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
    若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
  7. 根据权利要求6所述的方法，其特征在于，根据接收到的小站发送的用于连接核 心网的连接请求，建立与所述小站的连接，包括：
    接收小站发送的设备认证的请求；
    根据接收到的设备认证的请求，对所述小站进行设备认证；
    若认证成功，则向所述小站发送设备认证成功的响应；
    接收所述小站发送的用于建立流控传输协议偶联与S1连接的请求；
    将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，其中，所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。
  8. 根据权利要求7所述的方法，其特征在于，所述设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
    在接收到所述小站发送的用于建立流控传输协议偶联与S1连接的请求后，在将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关之前，该方法还包括：
    根据所述密钥，对接收到的用于建立流控传输协议偶联与S1连接的请求进行解析，得到解密后用于建立流控传输协议偶联与S1连接的请求。
  9. 根据权利要求7所述的方法，其特征在于，若成功建立与所述小站的连接，则向所述小站发送连接成功的响应，包括：
    若所述接入网关成功建立流控传输协议偶联与S1连接，则向安全网关发送连接成功的响应；
    接收所述接入网关发送的连接成功的响应，并将所述响应发送给所述小站。
  10. 一种接入核心网的控制装置，其特征在于，包括：
    第一模块，用于向智能边缘网络设备发送用于连接核心网的连接请求；
    第二模块，用于若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；
    第三模块，用于若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
  11. 根据权利要求10所述的装置，其特征在于，向所述核心网发送连接请求，所述第二模块具体用于：
    向所述核心网中的安全网关发送设备认证的请求；
    在接收到所述安全网关发送的设备认证成功的响应后，向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求；
    则接收到核心网发送的连接成功的响应，包括：
    接收到所述安全网关发送的成功建立流控传输协议偶联与S1连接的响应。
  12. 根据权利要求11所述的装置，其特征在于，所述第二模块，还用于：
    若向所述安全网关发送设备认证的请求的次数大于预设的第一次数阈值或向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求的次数大于预设的第二次数阈值， 则向所述智能边缘网络设备发送连接核心网的请求。
  13. 根据权利要求11所述的装置，其特征在于，所述安全网关发送的设备认证成功的响应包括：用于对小站与所述安全网关传输数据加密的密钥；
    向所述安全网关发送用于建立流控传输协议偶联与S1连接的请求，所述第二模块，具体用于：
    根据接收到的设备认证成功的响应中的密匙，对用于建立流控传输协议偶联与S1连接的请求进行加密，得到加密后的请求；
    向所述安全网关发送所述加密后的请求。
  14. 根据权利要求10所述的装置，其特征在于，向所述核心网发送连接请求，所述第二模块具体用于：
    根据动态主机配置协议服务器发送的内网地址，生成用于连接核心网的第一连接请求；
    向网络地址转换设备发送生成的第一连接请求，其中，所述网络地址转换设备根据预设的网络地址转换表，将接收到的第一连接请求中目标地址的内网地址转换为与该内网地址对应的外网地址，生成并向所述核心网发送包括外网地址的第二连接请求。
  15. 一种接入核心网的控制装置，其特征在于，包括：
    接收模块，用于根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
    响应模块，用于若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
  16. 根据权利要求15所述的装置，其特征在于，所述接收模块，具体用于：
    接收小站发送的设备认证的请求；
    根据接收到的设备认证的请求，对所述小站进行设备认证；
    若认证成功，则向所述小站发送设备认证成功的响应；
    接收所述小站发送的用于建立流控传输协议偶联与S1连接的请求；
    将接收到的用于建立流控传输协议偶联与S1连接的请求发送给接入网关，其中，所述接入网关根据接收到的用于建立流控传输协议偶联与S1连接的请求进行连接。
  17. 根据权利要求16所述的装置，其特征在于，所述设备认证成功的响应包括，用于对小站与所述安全网关传输数据加密的密钥；
    所述接收模块，还用于：
    根据所述密钥，对接收到的用于建立流控传输协议偶联与S1连接的请求进行解析，得到解密后用于建立流控传输协议偶联与S1连接的请求。
  18. 根据权利要求16所述的装置，其特征在于，所述响应模块，具体用于：
    若所述接入网关成功建立流控传输协议偶联与S1连接，则向安全网关发送连接成功 的响应；
    接收所述接入网关发送的连接成功的响应，并将所述响应发送给所述小站。
  19. 一种接入核心网的控制装置，包括处理器和存储器，其特征在于，所述处理器，用于读取所述存储器中的程序，执行下列过程：
    向智能边缘网络设备发送用于连接核心网的连接请求；
    若未收到所述智能边缘网络设备发送的连接成功的响应，则向所述核心网发送连接请求；
    若接收到核心网发送的连接成功的响应，则向所述核心网发送数据包。
  20. 一种接入核心网的控制装置，包括处理器和存储器，其特征在于，所述处理器，用于读取所述存储器中的程序，执行下列过程：
    根据接收到的小站发送的用于连接核心网的连接请求，建立与所述小站的连接；
    若成功建立与所述小站的连接，则向所述小站发送连接成功的响应。
PCT/CN2017/091483 2016-07-12 2017-07-03 一种接入核心网的控制方法及装置 WO2018010561A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610546654.3 2016-07-12
CN201610546654.3A CN107635224B (zh) 2016-07-12 2016-07-12 一种接入核心网的控制方法及装置

Publications (1)

Publication Number Publication Date
WO2018010561A1 true WO2018010561A1 (zh) 2018-01-18

Family

ID=60952239

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/091483 WO2018010561A1 (zh) 2016-07-12 2017-07-03 一种接入核心网的控制方法及装置

Country Status (2)

Country Link
CN (1) CN107635224B (zh)
WO (1) WO2018010561A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116032879A (zh) * 2022-12-30 2023-04-28 中国联合网络通信集团有限公司 内网设备与外网设备的互访方法、路由设备及服务器

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102355647A (zh) * 2011-10-28 2012-02-15 电信科学技术研究院 专用s1信令连接建立和进行定位的方法、系统及设备
CN103650550A (zh) * 2011-07-01 2014-03-19 交互数字专利控股公司 用于选择的网际协议（ip）业务卸载（sipto）和本地ip接入（lipa）移动性的方法和设备
WO2014131000A2 (en) * 2013-02-25 2014-08-28 Interdigital Patent Holdings, Inc. Centralized content enablement service for managed caching in wireless networks
CN104244308A (zh) * 2014-09-29 2014-12-24 京信通信系统（中国）有限公司 一种sctp偶联断开的处理方法、设备及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103650550A (zh) * 2011-07-01 2014-03-19 交互数字专利控股公司 用于选择的网际协议（ip）业务卸载（sipto）和本地ip接入（lipa）移动性的方法和设备
CN102355647A (zh) * 2011-10-28 2012-02-15 电信科学技术研究院 专用s1信令连接建立和进行定位的方法、系统及设备
WO2014131000A2 (en) * 2013-02-25 2014-08-28 Interdigital Patent Holdings, Inc. Centralized content enablement service for managed caching in wireless networks
CN104244308A (zh) * 2014-09-29 2014-12-24 京信通信系统（中国）有限公司 一种sctp偶联断开的处理方法、设备及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116032879A (zh) * 2022-12-30 2023-04-28 中国联合网络通信集团有限公司 内网设备与外网设备的互访方法、路由设备及服务器

Also Published As

Publication number Publication date
CN107635224A (zh) 2018-01-26
CN107635224B (zh) 2020-10-30

Similar Documents

Publication Publication Date Title
US10897509B2 (en) Dynamic detection of inactive virtual private network clients
US9027111B2 (en) Relay node authentication method, apparatus, and system
JP5079853B2 (ja) 無線アクセスポイント間での安全なローミング
CN107567017B (zh) 无线连接系统、装置及方法
CN108781110B (zh) 用于通过通信网络中继数据的系统和方法
JP3940671B2 (ja) セキュリティプロトコルの機能を実行する通信連結装置及びその通信連結方法
JP2018537912A5 (zh)
BR112020006302A2 (pt) método e dispositivo de proteção de parâmetro, e sistema
WO2017012142A1 (zh) 一种双连接安全通讯的方法及装置
WO2017167249A1 (zh) 一种专网接入方法、装置及系统
CN112087754A (zh) 动态提供在中继设备中用于认证的密钥的方法
JP2022530788A (ja) 通信方法及び通信装置
KR20190103382A (ko) 라우팅 방법 및 장치
TWI430674B (zh) 用於具有中繼節點之無線通訊系統的安全性方法
CN109936515B (zh) 接入配置方法、信息提供方法及装置
US9049012B2 (en) Secured cryptographic communication system
CN113992427B (zh) 基于相邻节点的数据加密发送方法及装置
BR112020000870A2 (pt) método de transmissão de dados, dispositivo e sistema relacionados ao mesmo
WO2018010561A1 (zh) 一种接入核心网的控制方法及装置
WO2018098630A1 (zh) 一种x2业务传输方法及网络设备
TW201414345A (zh) 建立資料傳輸通道的Ｗｉ－Ｆｉ無線網路存取點及系統
CN108307683B (zh) 通讯方法、微基站、微基站控制器、终端和系统
US9923810B1 (en) Application update using multiple disparate networks
CN106792664B (zh) 一种生成动态gtp隧道的方法
WO2020093860A1 (zh) 伪网络设备识别方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17826898

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17826898

Country of ref document: EP

Kind code of ref document: A1