WO2018058365A1 - 一种网络接入授权方法、相关设备及系统 - Google Patents

一种网络接入授权方法、相关设备及系统 Download PDF

Info

Publication number
WO2018058365A1
WO2018058365A1 PCT/CN2016/100553 CN2016100553W WO2018058365A1 WO 2018058365 A1 WO2018058365 A1 WO 2018058365A1 CN 2016100553 W CN2016100553 W CN 2016100553W WO 2018058365 A1 WO2018058365 A1 WO 2018058365A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
unlicensed spectrum
local
network
authorization
Prior art date
Application number
PCT/CN2016/100553
Other languages
English (en)
French (fr)
Inventor
于游洋
李欢
靳维生
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201680089581.8A priority Critical patent/CN109792435B/zh
Priority to PCT/CN2016/100553 priority patent/WO2018058365A1/zh
Priority to EP16917120.4A priority patent/EP3509265B1/en
Publication of WO2018058365A1 publication Critical patent/WO2018058365A1/zh
Priority to US16/368,596 priority patent/US11102656B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/009—Security arrangements; Authentication; Protecting privacy or anonymity specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/72—Subscriber identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a network access authorization method, related device, and system.
  • the 3GPP discussion group established the Long Term Evolution (LTE) of mobile communication networks in 2004.
  • LTE Long Term Evolution
  • EPS Evolved Packet System
  • the EPS is composed of a User Equipment (UE), an access network, and an Evolved Packet Core (EPC).
  • UE User Equipment
  • EPC Evolved Packet Core
  • the home operator EPC needs to perform access authorization. Only the authorized UE can access the home carrier EPC.
  • the spectrum used by the access network is the licensed spectrum, such as the Universal Terrestrial Radio Access Network (UTRAN) and the Evolved UTRAN (E-UTRAN).
  • UTRAN Universal Terrestrial Radio Access Network
  • E-UTRAN Evolved UTRAN
  • the licensed spectrum is gradually unable to meet the rapidly growing service demand.
  • the adoption of the unlicensed spectrum as the new radio access technology to improve the air interface carrying capacity has become the development trend of the EPS access network. Therefore, how to access the UE from the unlicensed spectrum access node to the home carrier EPC for access authorization has become an urgent problem to be solved.
  • the embodiment of the invention discloses a network access authorization method, a related device and a system, which can access the authorization of the UE from the unlicensed spectrum access node to the home operator EPC.
  • a first aspect of the embodiments of the present invention discloses a network access authorization method, which is applied to an EPS, where the EPS includes an unlicensed spectrum access node, a local network device, and a control plane network element, where the method may include include:
  • the control plane network element may access the home network from the unlicensed spectrum access node for access authorization according to the first message and the subscription data of the UE, and An authorization indication is sent to the UE.
  • the first message includes a request message and access information of the UE, and the request message is used to request the UE to access the home network of the UE from the unlicensed spectrum access node, where the authorization indication includes an authorization result of the access authorization.
  • the request message may be an access request message or a service request message
  • the unlicensed spectrum access node may refer to a wireless fidelity (Wi-Fi), an unlicensed spectrum in LTE (Unlicensed LTE, LTE-U).
  • Wi-Fi wireless fidelity
  • LTE unlicensed LTE
  • LTE-U unlicensed LTE
  • the access node even the 5G unlicensed spectrum, is not limited in the embodiment of the present invention.
  • the control plane network element needs to perform access authorization on the UE according to the subscription data of the UE, so that the access authorization of the UE when accessing the home network can be implemented.
  • the local network can share some services of the home network, thereby reducing the load on the home network and improving resource utilization.
  • the subscription data may include the second indication information of the access technology that the UE accesses the home network, and the access information may include the first indication information, where the first indication information is used to indicate that the UE accesses the home network.
  • Access technology is accessed from an unlicensed spectrum access node; then the control plane network element accesses the home network from the unlicensed spectrum access node based on the request message, the access information, and the subscription data of the UE.
  • the specific way of authorization can be:
  • the subscription data may further include a first access mode of the unlicensed spectrum access node when the UE is allowed to access the home network from the unlicensed spectrum access node, and the access information further includes the UE requesting to connect from the unlicensed spectrum.
  • the control plane network element determines the first access mode and Whether the second access mode matches, if it matches, the control plane network element can determine The UE accesses the home network from the unlicensed spectrum access node.
  • the control plane network element determines to reject the UE from accessing the home network from the unlicensed spectrum access node. .
  • the subscription data may further include a domain identifier list, where the domain identifier list includes at least one of a service provider identifier and a roaming alliance identifier of the local network that allows the UE to access the home network from the unlicensed spectrum access node; If the access information further includes the identifier of the local network that the UE requests to access the home network from the unlicensed spectrum access node, if the second indication information includes the first indication information, the control plane network element further determines the domain identifier.
  • the control plane network element determines that the UE is allowed to access the home network from the unlicensed spectrum access node, where the identifier of the local network includes the local network. At least one of a service provider identity and a roaming alliance identity.
  • the control plane network element determines to reject the UE from accessing the home network from the unlicensed spectrum access node.
  • control plane network element may further determine, in the case that the first access mode and the second access mode match, whether the identifier of the local network exists in the domain identifier list, and if the identifier of the local network exists, control The planar network element determines that the UE is allowed to access the home network from the unlicensed spectrum access node.
  • the control plane network element determines to reject the identifier.
  • the UE accesses the home network from the unlicensed spectrum access node.
  • the subscription data may further extend time information, location information (such as 3GPP location information), the security level of the unlicensed spectrum access node, and the local network, which allow the UE to access the home network from the unlicensed spectrum access node. At least one of the secure authentication methods.
  • the access information sent by the local network device to the control plane network element may also include time information, location information, and security level of the unlicensed spectrum access node that the UE requests to access the home network from the unlicensed spectrum access node, and At least one of the secure authentication methods of the local network.
  • the existing information included in the access information is generally compared with the corresponding information in the subscription data, but the access information does not necessarily include the subscription information. All the information in the data.
  • an indication such as LTE-U not allowed is set.
  • binding the unlicensed spectrum access authorization to the area or time that is, setting the area or time period for which the unlicensed spectrum access node allows or prohibits access.
  • the subscription data of the UE adds a domain identifier list, such as a roaming alliance identifier list, a service provider list, and the like, and allows the UE to access the home network from the network deployed by the service provider or the roaming alliance member in the list.
  • the subscription data may further limit the access mode and security level (such as trusted or untrusted) of the network deployed by the service provider or the roaming alliance, that is, limit the UE from the matched access mode and the security level.
  • the access network deployed by the commerce or roaming alliance accesses the home network.
  • the control plane network element performs access authorization for the UE to access the home network from the unlicensed spectrum access node based on the access information and the subscription data of the UE, thereby improving the accuracy of access authorization for the UE.
  • the EPS may further include a Home Subscriber Server (HSS).
  • HSS Home Subscriber Server
  • the request message may be an access request message, that is, when the UE initially attaches to the home network through the unlicensed spectrum access node
  • the control plane network element After receiving the first message sent by the local network device, the control plane network element further sends a second message for acquiring the subscription data of the UE to the HSS, if the HSS accesses the UE based on the subscription data and the access information of the UE.
  • the control plane network element receives the subscription data of the UE sent by the HSS, so that the UE accesses the home network from the unlicensed spectrum access node for access authorization based on the received subscription data. If the HSS fails to access the UE based on the subscription data of the UE, the control plane network element receives the authorization result of the access failure, and forwards the authorization result to the UE through the local network device and the unlicensed spectrum access node.
  • the HSS When the UE initially attaches to the home network through the unlicensed spectrum access node, the HSS performs initial access authorization on the UE based on the subscription data of the UE, and sends the subscription data of the UE to the control plane network element when the authorization is passed, and controls
  • the area network element performs the access authorization on the UE again based on the subscription data, and performs access authorization on the UE in a hierarchical manner, which can improve the efficiency of accessing the UE for authorization.
  • the request message is a service request message
  • the UE attaches the home network through the authorized spectrum access node in advance, and then sends a service request to the home network through the unlicensed spectrum access node, where the service request message carries
  • the temporary identifier of the UE such as the identifier of the control plane network element to which the UE is attached, may be specifically allocated to the UE by the home network.
  • the control plane network element determines whether the control plane network element is attached to the UE according to the temporary identifier of the UE. If yes, the control plane network element has obtained the HSS from the HSS.
  • the subscription data of the UE is obtained; the control plane network element further determines whether the UE is in an idle state on the 3GPP side, and if the UE is in an idle state, the UE is not authorized spectrum based on the request message, the access information, and the subscription data of the UE.
  • the access node accesses the home network for access authorization. If the UE is in the connected state, the control plane network element rejects the service request of the UE.
  • the UE is attached to the home network through the authorized spectrum access node.
  • the unlicensed spectrum access node sends a service request to the home network.
  • the control plane network element attached to the UE determines that the UE is in the idle state, based on the prior
  • the subscription data of the UE obtained from the HSS performs access authorization on the UE, so that the efficiency of access authorization for the UE can be improved.
  • the control plane network element may also obtain a local service type that is allowed to be used by the UE on the local network from the subscription data of the UE, and then generate a local service policy of the UE based on the local service type, so as to be sent to the local network device, so that the local network device is
  • the local service authorization may be performed on the UE based on the local service policy, thereby improving the efficiency of local service authorization when the UE accesses the unlicensed spectrum network.
  • the local service policy may be carried in the authorization indication and sent to the local network device, or may be sent to the local network device separately, which is not limited in the embodiment of the present invention.
  • the second aspect of the embodiment of the present invention discloses a control plane network element, where the control plane network element may include a receiving module, a processing module, and a sending module, and may be used to perform the network access authorization method disclosed in the first aspect.
  • a third aspect of the embodiment of the present invention discloses another control plane network element, where the control plane network element may include The receiver, the processor and the transmitter, the receiver corresponds to the receiving module of the control plane network element disclosed in the second aspect, the processor corresponds to the processing module of the control plane network element disclosed in the second aspect, and the transmitter corresponds to the control disclosed in the second aspect
  • the sending module of the surface network element can be used to perform the network access authorization method disclosed in the first aspect.
  • a fourth aspect of the embodiments of the present invention discloses another network access authorization method, which is applied to an EPS, where the EPS includes a UE, an unlicensed spectrum access node, a local network device, and a control plane network element, where the method may include:
  • the local network device After receiving the request message of the UE sent by the unlicensed spectrum access node, the local network device sends a first message including the request message and the access information to the control plane network element, and then can receive the transmission of the control plane network element. An authorization indication of the authorization result, thereby transmitting the authorization result to the UE.
  • the authorization indication is obtained by the control plane network element by using the request message, the access information, and the subscription data of the UE to access the home network from the unlicensed spectrum access node to access the home network, and the request message may be a service request message.
  • the access request message may also be used in the embodiment of the present invention.
  • the request message is used to request the UE to access the home network from the unlicensed spectrum access node.
  • the local network device sends the authorization result to the UE through the unlicensed spectrum access node.
  • the request message may include an identifier of the home network
  • the local network device may generate routing information, such as a network access identifier, according to the identifier of the home network.
  • the Network Access Identifier (NAI) is configured to send the first message to the control plane network element of the home network according to the routing information.
  • the NAI includes, in addition to the Home Public Land Mobile Network (HPLMA) information, the destination domain that the final arrival of the request message belongs to, and the intermediate node domain identifier information, such as a virtual public land mobile network (Virtual Public). Land Mobile Network (VPLMN), domain name, such as Fully Qualified Domain Name (FQDN).
  • HPLMA Home Public Land Mobile Network
  • VPN Virtual Public
  • FQDN Fully Qualified Domain Name
  • the authorization indication may further include the local service policy of the UE (the control plane network element is based on the UE subscription).
  • the local network device may perform local service authorization for the UE based on the local service policy of the UE.
  • the surface network element sends a request message to establish a Public Data Network (PDN) connection to the UE.
  • PDN Public Data Network
  • the second message may be a PDN connection setup request message, including the requested local service type or the requested local service access point name (APN).
  • the service authorization information is added to the allowed local service type, such as the data service, the voice service, or the local APN containing the service provider identifier, and the quality of service (QoS) of the service, the charging policy, and the access network security. Level, user level. Further, the local service authorization is performed as a service provider identity or a roaming alliance identity restriction, that is, the local service is allowed to be implemented on a local network deployed by a specified service provider or a roaming alliance.
  • the local network device may perform local service authorization on the UE based on the local service policy of the UE, thereby Improve the efficiency of local service authorization when the UE accesses the local network of the unlicensed spectrum.
  • the specific manner in which the local network device performs local service authorization on the UE according to the local service policy of the UE may be:
  • Manner 1 If the second message includes the local service type requested by the UE, after receiving the second message, the local network device determines whether the service type in the local service policy includes the type of the local service requested by the UE. If yes, it determines that the local service authorization for the UE passes, and if not, determines that the local service authorization for the UE fails.
  • the local network device determines, after receiving the second message, whether the service APN identifier in the local service policy includes the local service APN identifier, if Then, it is determined that the local service authorization of the UE passes, and if not, it determines that the local service authorization for the UE fails.
  • the local service of the UE can be performed on the local network, so that Share part of the services of the home network, reduce the load on the home network, and improve resource utilization.
  • a fifth aspect of the embodiments of the present invention discloses a local network device, where the local network may include a receiving module, a sending module, and a processing module, and may be used to perform the network access authorization method disclosed in the fourth aspect.
  • a sixth aspect of the embodiments of the present invention discloses another local network device, where the local network device may include a receiver, a transmitter, a processor, and the like, and the receiver corresponds to the receiving module of the local network device disclosed in the fifth aspect, and the transmitter Corresponding to the sending module of the local network device disclosed in the fifth aspect, the processor corresponding to the processing module of the local network device disclosed in the fifth aspect may be used to perform the network access authorization method disclosed in the fourth aspect.
  • a seventh aspect of the embodiments of the present invention discloses a network access authorization method, which is applied to an EPS, where the EPS includes a UE, an unlicensed spectrum access node, a local network device, a control plane network element, and an HSS, where the method may include :
  • the HSS After receiving the first message sent by the control plane network element for acquiring the subscription data of the UE, the HSS first acquires the subscription data of the UE, and accesses the UE from the unlicensed spectrum based on the first message and the subscription data.
  • the node accesses the home network for access authorization, and when the UE is allowed to access the home network from the unlicensed spectrum access node, sends the subscription data of the UE to the control plane network element, so that the control plane network element is based on the subscription data pair.
  • the UE accesses the home network from the unlicensed spectrum access node to perform access authorization again.
  • the first message includes an access request message and access information of the UE, where the access request message is used to request the UE to access the home network from the unlicensed spectrum access node.
  • the HSS if the HSS does not allow the UE to access the home network from the unlicensed spectrum access node, the HSS sends an authorization indication such as LTE-U not allowed to the control plane network element, and the control plane network element forwards the same to the UE. .
  • the subscription data may include the second indication information of the access technology that the UE accesses the home network, and the access information may include the first indication information, where the first indication information is used to indicate that the UE accesses the home network.
  • the access technology is accessed from an unlicensed spectrum access node. Then the HSS accesses the UE from the unlicensed spectrum access node based on the access request message, the access information, and the subscription data of the UE.
  • the specific way for the home network to perform access authorization can be:
  • the subscription data may include a domain identifier list, where the domain identifier list includes at least one of a service provider identifier and a roaming alliance identifier of the local network that allows the UE to access the home network from the unlicensed spectrum access node;
  • the information further includes an identifier of the local network that the UE requests to access the home network from the unlicensed spectrum access node, where the identifier of the local network includes at least one of a service provider identifier and a roaming alliance identifier of the local network.
  • the specific manner in which the HSS accesses the home network from the unlicensed spectrum access node by using the access request message, the access information, and the subscription data of the UE may be:
  • the HSS may be based on the access request message, the access information, and the first message.
  • the subscription data of the UE performs initial access authorization for the UE.
  • the license data is sent to the control plane network element when the authorization is passed, so that the control plane network element re-accesses the UE based on the subscription data.
  • the access authorization of the UE from the unlicensed spectrum access node to the home network is performed hierarchically by the HSS and the control plane network element, which can improve the accuracy of access authorization for the UE.
  • the eighth aspect of the embodiment of the present invention discloses an HSS, which may include a receiving module, a processing module, and a sending module, and may be used to implement the network access authorization method disclosed in the seventh aspect.
  • a ninth aspect of the embodiment of the present invention discloses another HSS, which may include a receiver, a processor, and a transmitter, where the receiver corresponds to the receiving module of the HSS disclosed in the eighth aspect, and the processor corresponds to the eighth aspect.
  • the processing module of the HSS, the transmitter corresponds to the sending module of the HSS disclosed in the eighth aspect, It can be used to perform the network access authorization method disclosed in the seventh aspect.
  • a tenth aspect of the embodiments of the present invention discloses a network access authorization system, where the system is applied to an EPS, the system includes an unlicensed spectrum access node, the control plane network element disclosed in the second aspect, and the local network disclosed in the fifth aspect.
  • Equipment where:
  • the unlicensed spectrum access node may forward the request message to the local network device, and the local network device sends the request message and the access information of the UE accessing the home network to the
  • the control plane network element, the control plane network element can perform access authorization for the UE to access the home network from the unlicensed spectrum access node based on the request message, the access information, and the subscription data of the UE, and send the authorization result to the UE.
  • the subscription data of the UE extends the second indication information of the access technology that the UE accesses the home network, and the first indication information is included in the access information that is sent by the local network device to the control plane network element, where the first indication is The information is used to indicate that the access technology used by the UE to request access to the home network is to access from the unlicensed spectrum access node. Therefore, after receiving the request message and the access information of the UE, the control plane network element determines whether the second indication information includes the first indication information, and if yes, indicates that the UE is allowed to access the home network from the unlicensed spectrum access node. .
  • the network access authorization system may further include the HSS disclosed in the eighth aspect.
  • the request message may be an access request message or a service request message. If it is an access request message, the control plane network element obtains the subscription data of the UE from the HSS after receiving the access request message and the access information of the UE sent by the local network device, and accesses the UE to the home network. The inbound technology is sent to the HSS.
  • the HSS authorizes the UE to access the home network from the unlicensed spectrum access node based on the access technology used by the UE. If the authorization is passed, the contract data is returned to the control plane network element to facilitate the control plane.
  • the network element performs access authorization for the UE to access the home network from the unlicensed spectrum access node.
  • the control plane network element of the home network and the HSS may perform access authorization for the UE to access the home network from the unlicensed spectrum access node.
  • the control plane network element of the home network may generate a local service policy of the UE and send it to the local network device, where the local network device may perform local service authorization based on the local service initiated by the UE. Therefore, the local service authorization when the UE accesses the local network of the unlicensed spectrum is realized, and the local service authorization is successful.
  • the local service of the UE can be performed on the local network, so that part of the services of the home network can be shared, the load of the home network can be reduced, and resource utilization can be improved.
  • FIG. 1 is a schematic structural diagram of an EPS disclosed in an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a network access authorization method according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of another network access authorization method according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of still another network access authorization method according to an embodiment of the present invention.
  • FIG. 5 is a schematic flowchart of a local service authorization method according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a control plane network element according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of another control plane network element according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a local network device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of another local network device according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an HSS according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of another HSS according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of a network access authorization system according to an embodiment of the present invention.
  • the embodiment of the invention discloses a network access authorization method, related device and system, which can The UE accesses the home network EPC from the unlicensed spectrum access node for access authorization. The details are described below separately.
  • FIG. 1 is a schematic diagram of an EPS architecture disclosed in an embodiment of the present invention.
  • the UE the local network, and the carrier core network EPC are included.
  • the UE may include various handheld devices with wireless communication functions, in-vehicle devices, wearable devices, computing devices, or other processing devices connected to the wireless modem, and various forms of user equipment, mobile stations (MSs). , terminal, terminal equipment, etc.
  • MSs mobile stations
  • terminal terminal equipment
  • the devices mentioned above are collectively referred to as user equipments or UEs.
  • the local network refers to a network deployed by a third party, which is different from the carrier network.
  • the local network includes an unlicensed spectrum access node (such as an LTE-U radio access node, referred to as an LTE-U access node), a Wi-Fi access node, a 5G unlicensed spectrum access node, and the like, and a local network control plane.
  • the network element and the local network user plane network element are examples of the network user plane network element.
  • the unlicensed spectrum access node refers to a base station, an access point (AP), or the like that uses an unlicensed spectrum;
  • the local network control plane network element is a Mobility Management Entity (MME) or a control plane node ( Control Point, CP);
  • the local network user plane network element is a Gateway (GW) or a User Point (UP).
  • the operator EPC includes a control plane network element, a user plane network element, an HSS, and a Public Data Network Gate Way (PGW).
  • the control plane network element is an MME, an authentication, authorization, and accounting (Authentication, Authorization, Accounting, AAA) server, an Evolved Packet Data Gateway (ePDG), and a General Packet Radio Service (GPRS).
  • the user plane network element is a Security Gateway (SeGW), a Serving Gate Way (SGW), or an UP, which is not limited in the embodiment of the present invention.
  • the local network device mentioned in the embodiment of the present invention is a local network control plane network element
  • the control plane network element mentioned in the embodiment of the present invention refers to a control plane network element of the operator EPC.
  • the embodiments of the present invention are not described herein again.
  • the home operator EPC needs to perform access authorization on the UE, that is, whether to allow the UE to permit the unlicensed spectrum.
  • the access node accesses the home network to which the access node belongs. If the home operator EPC allows the UE to access from the unlicensed spectrum access node of the local network, the UE may initiate a local service to the local network.
  • the system architecture shown in Figure 1 uses unlicensed spectrum as a new radio access technology, which can improve the air interface carrying capacity of the system network.
  • FIG. 2 is a schematic flowchart diagram of a network access authorization method according to an embodiment of the present invention. As shown in FIG. 2, the network access authorization method may include the following steps:
  • the UE sends a request message to the unlicensed spectrum access node.
  • the request message may be an access request message or a service request message, which is not limited in the embodiment of the present invention.
  • the request message may specifically be an attach request Attach Request message, an authentication and authorization request (including a NAI) message, a connection request message, or a non-access stratum (Non-Access Stratum).
  • NAS Non-Access Stratum
  • Attach Request messages carry Diameter messages (such as Authentication and Authorization Request (NAI) messages).
  • NAI Authentication and Authorization Request
  • the request message is a service request message, it may be a service request, a re-authorization request message, a re-authentication request, or a connection request message, which is not limited in the embodiment of the present invention.
  • the UE may send a request message to the UE, and the request message is used to request the UE to access the home network, where the UE may also identify the home carrier network.
  • the home public land mobile network (HPLMN) identifier is sent to the unlicensed spectrum access node in the air interface message, which may be sent by an independent message, or may be The sending of the request message is not limited in the embodiment of the present invention.
  • the request message may further include location information and access point information where the UE is currently located. At least one of, such as geographic location information (longitude, latitude) of the UE, 3GPP location information, cellular network broadcast location information of the home network operator (eg, LTE base station identity), access to the unlicensed spectrum cell identity, access The unlicensed spectrum base station identifier, or the local network-defined access point identifier (such as "cafe access point", "airport access point”), and the like are not limited in the embodiment of the present invention.
  • the unlicensed spectrum access node receives the request message and forwards the request message to the local network device.
  • the unlicensed spectrum access node after receiving the request message sent by the UE, forwards the request message to the control plane network element of the local network, such as the MME, based on the identifier of the home network.
  • the unlicensed spectrum access node may also send the location information of the unlicensed spectrum access node or the access point information while forwarding the request message of the UE.
  • the cellular network broadcast location information of the home network operator such as the LTE base station identifier
  • the cellular network broadcast location information of the home network operator is configured with the neighboring cellular network base station identifier configured on the unlicensed spectrum access node, and when the unlicensed spectrum is configured with the neighboring cellular base station identifiers of the multiple operators,
  • the unlicensed spectrum access node sends the identity of the home network to the local network device based on the selected network.
  • the identifier of the home network may be carried in the request message.
  • the unlicensed spectrum access node may also send the access mode of the access point, such as an open mode, a closed mode, a hybrid mode, etc., to the local network device.
  • the open mode identifies that the access point allows any UE to access
  • the closed mode identifies that the access point only allows the UE with the subscription relationship to access
  • the hybrid mode is the convergence of the foregoing two modes, that is, in addition to allowing the subscribed UE to access.
  • non-contracted UE access may also be allowed based on local policies. Local policies include allowing non-contracted UE access, such as based on access point load status or time period.
  • the local network device receives the request message and sends a first message including the request message and the access information to the control plane network element.
  • the local network device after receiving the request message, determines, according to the identifier of the home network, the HPLMN marked by the identifier. Specifically, if the request message received by the local network device is an Attach Request message, and the message carries a Diameter message (ie, the NAS message carries a Diameter message), the local network device sends the Diameter message to the control plane network in the HPLMN. yuan. That is, the first message may be a Diameter message, which is not limited in the embodiment of the present invention.
  • the local network device can also access the UE from the unlicensed spectrum when sending the first message.
  • the access information of the node accessing the home network is sent to the control plane network element of the home network, so that the control plane network element performs access authorization on the UE according to the access information and the subscription data of the UE.
  • the access information includes the feature information of the local network and the feature information of the unlicensed spectrum access node (which may be obtained by the local network device, or may be sent by the unlicensed spectrum access node to the local network device together with the forwarded request message) And at least one of location information of the UE (including 3GPP information of the UE, etc.) and time information.
  • the local network device may send the access information together with the request message to the control plane network element, that is, the first message includes the request message and the access information, and the local network device may separately send the access information to the control plane network element.
  • the embodiments of the present invention are not limited.
  • the control plane network element receives the first message, and performs access authorization for the UE to access the home network from the unlicensed spectrum access node based on the request message, the access information, and the subscription data of the UE.
  • the control plane network element may determine, according to the request message of the UE, the access information and the subscription data of the UE, whether the UE is allowed to access the home network from the unlicensed spectrum access node.
  • the control plane network element sends an authorization indication including the authorization result to the local network device.
  • the local network device sends the authorization result to the unlicensed spectrum access node.
  • the unlicensed spectrum access node sends the authorization result to the UE.
  • control plane network element may send an authorization indication including the authorization result to the UE after the UE accesses the home network from the unlicensed spectrum access node, and specifically sends the authorization indication to the local
  • the network device the local network device sends the authorization result to the unlicensed spectrum access node, and is sent to the UE by the unlicensed spectrum access node.
  • the control plane network element when the UE is allowed to access the home network from the unlicensed spectrum access node, the control plane network element sends an authorization indication for indicating that the UE is allowed to access the home network from the unlicensed spectrum access node (the authorization indication may be The authorization result of allowing the UE to access the home network from the unlicensed spectrum access node, or may be the local service policy of the UE, that is, indicating that the UE is allowed to access the home network from the unlicensed spectrum access node); when the UE is not allowed to be unauthorized When the spectrum access node accesses the home network, the control plane network element sends an authorization indication for indicating that the UE is denied access to the home network from the unlicensed spectrum access node (the authorization indication is to reject the UE from the unlicensed spectrum access node. Authorization result into the home network).
  • the authorization indication may be The authorization result of allowing the UE to access the home network from the unlicensed spectrum access node, or may be the local service policy of the UE
  • the UE when the UE needs to access the home network from the unlicensed spectrum access node, the UE sends a request message to the home network, and the control plane network element of the home network is based on the subscription data of the UE.
  • the unlicensed spectrum access node accesses the home network for access authorization, that is, determines whether the UE is allowed to access the home network from the unlicensed spectrum access node, thereby transmitting the authorization result to the UE.
  • the EPS can access the authorization of the UE from the unlicensed spectrum access node to the home network of the home carrier. After the access authorization is successful, the local network can share part of the services of the home network, thereby reducing the attribution. Network load to improve resource utilization.
  • FIG. 3 is a schematic flowchart of another network access authorization method according to an embodiment of the present invention.
  • the method shown in FIG. 3 is applied to a scenario in which an unlicensed spectrum access node sends an access request message to a home operator EPC when the UE initially attaches.
  • the network access authorization method may include the following steps:
  • the UE sends an access request message to the unlicensed spectrum access node.
  • the access request message may be an Attach Request message, an Authentication and Authorization Request (NAI) message, a connection request message, or a NAS message, where the NAS message carries a Diameter message, such as an Authentication and Authorization Request (NAI) message.
  • NAI Authentication and Authorization Request
  • the UE searches for the surrounding access network when it is powered on, and sends a request for requesting access to the home network of the UE to the unlicensed spectrum access node when searching for the unlicensed spectrum network.
  • the request message may include an identifier of the home network, location information of the UE, current time information, and the like.
  • the unlicensed spectrum access node receives the access request message and forwards the message to the local network device.
  • the unlicensed spectrum access node after receiving the access request message sent by the UE, the unlicensed spectrum access node forwards the access request message to the local network device based on the identifier of the home network.
  • the unlicensed spectrum access node sends at least one of its access mode and security level to the local network device, which may be added to the local network device in the request message, or may be The other information is sent to the local network device, which is not limited in the embodiment of the present invention.
  • the local network device receives the access request message and generates routing information according to the home network identifier included in the access request message.
  • the network device of the present invention after receiving the request message, the network device of the present invention generates routing information according to the identifier of the home network and the network topology, such as generating an NAI.
  • the NAI also includes intermediate node domain identifier information, such as a VPLMN, a domain name such as an FQDN, and the like.
  • the NAI can be understood as the access information that the UE accesses the home network from the unlicensed spectrum access node.
  • the local network device may write, to the NAI, the first indication information used to indicate the access technology used by the UE to access the home network, where the access technology is accessed from the unlicensed spectrum access node; the local network device It is also possible to write the security authentication information used by the local network to the NAI. For example, if the secure authentication scheme used by the local network is Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA) or EAP-AKA', then the local network device The identifier representing EAP-AKA or EAP-AKA' will be written to the NAI.
  • EAP-AKA Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement
  • the local network device may also allocate a temporary identifier to the UE, and the temporary identifier may also be written in the NAI.
  • the local network device sends a first message including the access request message and the access information to the control plane network element according to the routing information.
  • the local network device may send the first message to the control plane network element of the home network according to the intermediate node domain identifier and the destination domain HPLMN identifier in the routing information.
  • the first message is used to request the UE to access the home network from the unlicensed spectrum.
  • the first message may be a Diameter message, such as an Authentication and Authorization Request message, or a message defined by other protocols, which is not limited in the embodiment of the present invention.
  • the first message includes an access request message of the UE and access information of the UE accessing the home network from the unlicensed spectrum access node, such as the first indication information, and the unlicensed spectrum access node sends Access mode of the unlicensed spectrum access node, the service provider identifier to which the local network belongs (Service Provider Identifier/Identity, SP ID) and/or the roaming alliance identifier (Union ID), the security level of the unlicensed spectrum access node, and the like, which are not limited in the embodiment of the present invention.
  • the service provider identifier to which the local network belongs Service Provider Identifier/Identity, SP ID
  • Union ID the roaming alliance identifier
  • the local network device may also send the security authentication information supported by the local network to the control plane network element of the home network by using a related parameter (Security info).
  • a related parameter Security info
  • the access information included in the first message mainly includes the first indication information, that is, the access technology used by the UE to access the home network; optionally, the access mode of the unlicensed spectrum access node may also be included.
  • the identifier of the local network further, the location information of the UE, the time information, the security level of the unlicensed spectrum access node, and the security authentication mode of the local network may also be included.
  • the identifier of the local network includes at least one of an SP ID and a Union ID of the local network.
  • the service provider identifies the identifier of the service provider deploying the local network, or the enterprise identity of the deployed local network, or the infrastructure provider identifier, or even the government department identifier.
  • the roaming alliance is an alliance of service providers, mobile operators, fixed network operators, Wi-Fi carriers, enterprises, infrastructure providers, government departments, etc. Each alliance has a unique alliance identifier, which is shared by alliance members. This alliance ID.
  • the control plane network element receives the first message, and sends a second message to the HSS according to the first message.
  • the control plane network element after receiving the first message sent by the local network device, the control plane network element sends a second message to the HSS according to the access request message in the first message.
  • the second message is used to obtain subscription data of the UE.
  • the second message may be an update location request message, where the update location request message includes a permanent identifier of the UE, such as an International Mobile Subscriber Identification Number (IMSI).
  • IMSI International Mobile Subscriber Identification Number
  • the control plane network element may store the access information, and may also indicate the SP ID, the Union ID, and the first indication information in the access information, indicating the used by the UE.
  • the Radio Access Technologies (RAT) type is sent to the HSS by at least one of an unlicensed spectrum (such as LTE-U).
  • the second message may carry at least one of a RAT type, a Union ID, and an SP ID in the access information
  • the control plane network element may also use the RAT type, the Union ID, and the At least one of the SP IDs is separately sent to the HSS, which is not limited in the embodiment of the present invention.
  • the HSS receives the second message, and obtains subscription data of the UE.
  • the HSS after receiving the second message, updates the control plane network element (such as the MME) that provides the service to the UE, and searches for the subscription data of the UE according to the IMSI of the UE.
  • the control plane network element such as the MME
  • the HSS accesses the home network from the unlicensed spectrum access node for access authorization according to the access request message, the access information, and the subscription data of the UE.
  • the HSS after the HSS finds the subscription data of the UE, the HSS accesses the home network from the unlicensed spectrum access node for access authorization based on the subscription data.
  • the specific manner in which the HSS accesses the home network from the unlicensed spectrum access node by using the access request message, the access information, and the subscription data of the UE may be:
  • the HSS determines whether the access information matches the subscription data; if the access information matches the subscription data, allows the UE to access the home network from the unlicensed spectrum access node; or, in the access information If the subscription data does not match, the UE is denied access to the home network from the unlicensed spectrum access node.
  • the HSS detects whether the UE can access from the unlicensed spectrum access node based on the received access information and the subscription data of the UE. Further, it can also detect whether the UE can be marked by the service provider marked by the SP ID or Network access deployed by the roaming alliance marked by Union ID.
  • the subscription data For detecting whether the UE can access from the unlicensed spectrum access node: the subscription data extends the RAT type that the UE accesses the home network, that is, the second indication information, if the second indication information does not contain the unlicensed spectrum access (the An indication information), or the subscription data indicates that the unlicensed spectrum does not allow access, then the HSS returns an authorization indication including the cause value that the RAT type is not allowed to access to the control plane network element, or returns the rejection of the UE from the unlicensed spectrum access.
  • the authorization result of the node accessing the home network is sent to the control plane network element.
  • the control plane network element sends the authorization result to the UE through the local network device and the unlicensed spectrum access node, and specifically, the sending access failure message is sent to the UE, or the sending access reply message includes the foregoing failure cause value to the UE.
  • the embodiment of the invention is not limited.
  • the subscription data extension allows the UE to roam (ie, allows the UE to access the home network from the local network) a list of domain identifiers (such as SP list, or / and Union) List), if the domain ID list (such as SP list, or / and Union list) does not contain the SP ID or Union ID, the HSS returns an authorization indication including the reason value for roaming disallowed to the control plane network element, such as VPLMN not allowed
  • the indication, the service provider does not allow the indication, or the roaming does not allow the indication, and the like.
  • the control plane network element sends an access failure message to the UE, or sends the access reply message to include the foregoing failure cause value to the UE, which is not limited in the embodiment of the present invention.
  • the HSS sends the subscription data of the UE to the control plane network element.
  • the HSS if the HSS detects that the UE can access the home network from the unlicensed spectrum access node deployed by the current SP or the Union, the HSS returns the subscription data of the UE to the control plane network element. Further, the HSS may also return an authorization result that allows the UE to access the home network from the unlicensed spectrum access node to the control plane network element.
  • the subscription data of the UE returned by the HSS may include: related subscription data of the unlicensed spectrum access authorization, related subscription data of the SP ID or the Union ID access authorization, related subscription data of the local network local service authorization, and the EPC service. Authorized related contract data, etc.
  • the related subscription data of the unlicensed spectrum access authorization may include: the unlicensed spectrum is further bound to at least one of the UE location or time as the allowed access technology, such as the unlicensed spectrum in a certain location area (geographic location) Or the 3GPP cellular location, such as a Tracking Area Identity (TAI) or a TAI list, may be accessed, or the unlicensed spectrum may not be allowed to access in a certain location area, or the unlicensed spectrum may be accessed within a certain period of time, Or the unlicensed spectrum is not allowed to access for a certain period of time, or an effective combination of the above location and time.
  • the allowed access technology such as the unlicensed spectrum in a certain location area (geographic location)
  • the 3GPP cellular location such as a Tracking Area Identity (TAI) or a TAI list
  • the relevant subscription data of the SP ID or the Union ID access authorization may include: the SP deployed the local network as the network to be accessed further with the access mode, the access network trusted or untrusted indication, or at least in the UE location area A binding. For example, if the UE only allows the access mode of the SP to be deployed as a closed access network, or the UE only allows access to the trusted access network deployed by the SP, or the UE only allows access to the network in certain locations where the SP is deployed, or Any combination of the above.
  • the relevant subscription data of the local network local service authorization may include: an allowed local service type identifier or a local service APN (the local service APN includes a service identifier or/and a service provider identifier), such as Data services, voice services, Internet services, or any business. Or prohibited local service types, such as prohibiting data services, voice services, or Internet services.
  • an allowed local service type identifier or a local service APN the local service APN includes a service identifier or/and a service provider identifier
  • prohibited local service types such as prohibiting data services, voice services, or Internet services.
  • the quality of service parameters such as the Guaranteed Bit Rate (GBR), Maximum Bit Rate (MBR)
  • the service scheduling policy priority required for the service type of the allowed service type such as the guaranteed bandwidth (GBR), the maximum bit rate (MBR))
  • QCI QoS Class Identifier
  • ARP Address Resolution Protocol
  • billing policy such as post-paid or pre-paid, or based on time-based billing or traffic billing
  • users Level such as gold, silver and bronze user ID
  • the allowed service types may be bound to the trusted or non-trusted features of the access network or the SP ID or Union ID, such as the trusted unlicensed spectrum that some local services can only deploy at the specified SP ID or Union ID.
  • the access node performs.
  • the related subscription data of the EPC service authorization may include: contracted APN information, that is, APN configuration data.
  • the control plane network element receives the subscription data of the UE sent by the HSS, and performs access authorization for the UE to access the home network from the unlicensed spectrum access node based on the access information and the subscription data.
  • the control plane network element after receiving the subscription data of the UE sent by the HSS, the control plane network element performs access authorization for the UE to access the home network from the unlicensed spectrum access node based on the access information and the subscription data. .
  • control plane network element performs access authorization for the UE to access the home network from the unlicensed spectrum access node based on the access information and the subscription data may be:
  • the second indication information determines, by the second indication information, whether the first indication information is included in the second indication information, that is, whether the access technology allowed by the UE to access the home network includes an access technology used by the UE to access the home network, and if the first indication information is included, determining The UE is allowed to access the home network from the unlicensed spectrum access node; or, if the first indication information is not included, it is determined that the UE is denied access to the home network from the unlicensed spectrum access node.
  • the control plane network element determines that the second indication information includes the first indication information, it may also determine that the subscription mode data allows the UE to access the home network from the unlicensed spectrum, and the first access mode of the unlicensed spectrum access node Whether the second access mode of the unlicensed spectrum access node in the access information matches, whether the first access mode is consistent with the second access mode or the first access mode Whether the second access mode is included, if it is matched, it can be determined that the UE is allowed to access the home network from the unlicensed spectrum access node; or, even if the second indication information includes the first indication information, the first access mode and the first access mode If the two access modes do not match, the control plane network element also determines to reject the UE from accessing the home network from the unlicensed spectrum access node.
  • control plane network element determines that the second indication information includes the first indication information, it may further determine whether the domain identifier list in the subscription data includes an identifier (SP ID and/or Union ID) of the local network in the access information, If included, it can be determined that the UE is allowed to access the home network from the unlicensed spectrum access node; or, even if the second indication information includes the first indication information, the domain identifier list does not include the identifier of the local network, and the control plane network element It is also determined that the UE is denied access to the home network from the unlicensed spectrum access node.
  • SP ID and/or Union ID an identifier
  • the control plane network element may simultaneously determine whether the domain identifier list includes the identifier of the local network in the access information, and the first access mode and the second access Whether the entry mode matches.
  • the network supporting EAP-AKA' is a trusted network
  • the network supporting EAP-AKA is an untrusted network, or the local networks deployed by which service providers are trusted networks, and the rest are non-trusted networks.
  • the subscription data specifies that the UE can access from the trusted network
  • the control plane network element determines the local network based on the security authentication mode or related parameters of the local network carried in the NAI, or based on the local network security authentication mode and the SP ID. Whether it is a trusted network to determine whether to allow the UE to access from the local network.
  • the control plane network element obtains the subscription data of the UE. And determining whether the access mode of the unlicensed spectrum access node is a closed mode, and whether the unlicensed spectrum access node is deployed by the service provider A, and if yes, determining that the UE can access the unlicensed spectrum access node Access to the home network.
  • control plane network element may further determine, according to location information or time information that the UE accesses the home network from the unlicensed spectrum access node, whether to allow the UE to access the home network from the unlicensed spectrum access node.
  • the control plane network element If it is determined that the UE is not allowed to access the home network from the unlicensed spectrum access node based on the access information and the subscription data of the UE, the control plane network element sends an access failure message to the UE, or the sending access reply message includes The reason for the failure is given to the UE.
  • the control plane network element In the case that the UE is allowed to access the home network from the unlicensed spectrum access node, the control plane network element generates a local service policy of the UE based on the subscription data of the UE.
  • the control plane network element may further obtain the UE from the subscription data of the UE.
  • the local service type allowed by the local network so that the local service policy of the UE is generated based on the local service type.
  • the control plane network element determines which local services of the UE can be used in the current network. Thereby generating a local service policy of the UE based on the information of the allowed local service.
  • the local service policy may include a local service type identifier, a local service APN, a QoS parameter, a charging policy, or a user level, and the like.
  • the control plane network element sends an authorization indication including the local service policy of the UE and the authorization result to the local network device, if the authorization is passed.
  • the control plane network element sends an authorization indication to the local network device after the UE accesses the home network from the unlicensed spectrum access node for authorization. If the UE is allowed to access the home network from the unlicensed spectrum access node, the control plane network element sends the local service policy or the authorized authorization result to the local network device, and the local network device sends the authorization result through the unlicensed spectrum access node. If the UE is not allowed to access the home network from the unlicensed spectrum access node, the control plane network element sends an access failure authorization result to the UE, or sends an access reply message containing the failure cause value to the UE.
  • the local network device receives the authorization indication, and stores the local service policy of the UE.
  • the local network device may store the local service policy of the UE included in the authorization indication, so that the UE subsequently performs the local service request locally, based on the stored local service policy, locally.
  • Business authorization may be stored in the authorization indication, so that the UE subsequently performs the local service request locally, based on the stored local service policy, locally.
  • Steps 313-314 are the same as steps 206-207 in the previous embodiment, and the embodiments of the present invention are no longer used herein. Said.
  • the unlicensed spectrum access node when the UE initially attaches, the unlicensed spectrum access node sends an access request message to the home carrier core network, the control plane network element of the home operator, and the HSS UE-based subscription data.
  • the access technology used by the UE, the access mode of the unlicensed spectrum access node, the identifier of the local network, the time information, and the location information are used to perform access authorization on the UE, so that the UE can be connected from the unlicensed spectrum access node.
  • the local network can share some services of the home network, thereby reducing the load on the home network and improving resource utilization.
  • FIG. 4 is a schematic flowchart of another network access authorization method according to an embodiment of the present invention.
  • the method shown in FIG. 4 is applied to a scenario in which the UE has been initially attached to the operator EPC by the authorized spectrum access node, and then the service request message is sent to the home operator EPC through the unlicensed spectrum access node.
  • the network access authorization method may include the following steps:
  • the UE sends a service request message to the unlicensed spectrum access node.
  • the service request message may be a Service Request, a Re-Authorization Request, or a connection request message.
  • the service request message may include a temporary identifier allocated by the home carrier network for the UE, where the temporary identifier includes an identifier of a control plane network element, such as an MME, to which the UE is attached.
  • the UE after the UE is attached to the home network from the authorized spectrum access node, the UE sends a service request message to the unlicensed spectrum access node when searching for the unlicensed spectrum network.
  • the service request message may include an identifier of the home network, location information of the UE, current time information, and the like.
  • the unlicensed spectrum access node receives the service request message and forwards the message to the local network device.
  • the local network device receives the service request message and generates routing information according to the home network identifier included in the service request message.
  • the local network device sends a first message including the service request message and the access information to the control plane network element according to the routing information.
  • the steps 402 to 404 are the same as the steps 302 to 304 in the previous embodiment, and the embodiments of the present invention are not described herein again.
  • the control plane network element receives the first message, and determines whether the control plane network element attached to the UE is determined according to the temporary identifier of the UE included in the service request message.
  • the temporary identifier of the UE is allocated by the home network device to the UE.
  • the control plane network element determines whether the control plane network element attached to the UE is determined according to the temporary identifier included in the service request message. Specifically, the control plane network element determines whether the context of the UE exists, such as searching for the context of the UE based on the temporary identifier of the UE, or determining whether the control is the same based on the identifier information of the control plane network element in the temporary identifier of the UE. Face network element.
  • the control plane network element forwards the first message (including the service request message and the access information) to the control plane network element attached to the UE.
  • the control plane network element to which the UE is attached may access the home network from the unlicensed spectrum access node for access authorization based on the service request message, the access information, and the subscription data of the UE.
  • control plane network element determines whether the UE is in an idle state.
  • the control plane network element when the control plane network element determines that it is the control plane network element to which the UE is attached, the control plane network element first determines whether the UE can be from the connection state of the UE on the 3GPP side. Unlicensed spectrum access node access. Specifically, if the UE is currently in the connected state on the 3GPP side, the control plane network element rejects the service request of the UE; if the UE is currently in the idle state on the 3GPP side, the control plane network element is based on the service request message and access. The information and the subscription data of the UE are used for the access authorization of the UE from the unlicensed spectrum access node to the home network, which is the same as the previous embodiment, and details are not described herein again. .
  • control plane network element determines whether the UE is in the idle state.
  • the control plane network element determines the state of the UE based on whether the S1 interface connection exists. If the S1 interface connection exists, the UE is in the connected state, otherwise the UE is in the connected state. Idle state.
  • the control plane network element accesses the home network from the unlicensed spectrum access node for access authorization based on the service request message, the access information, and the subscription data of the UE.
  • the control plane network element when the UE is in an idle state, the control plane network element performs access authorization for the UE to access the home network from the unlicensed spectrum access node based on the service request message, the access information, and the subscription data of the UE. .
  • the specific manner is the same as step 309.
  • the steps 408 to 412 are the same as the steps 310 to 314 in the previous embodiment, and are not described herein again.
  • the UE has initially attached to the operator EPC through the authorized spectrum access node, and subsequently sends the service request message to the home carrier core network through the unlicensed spectrum access node, and the home operator controls.
  • the network element can perform access authorization for the UE based on the subscription data of the UE, the access technology used by the UE, the access mode of the unlicensed spectrum access node, the identifier of the local network, the time information, and the location information.
  • the local network can share some services of the home network, which can reduce the load of the home network and improve resource utilization.
  • FIG. 5 is a schematic flowchart of a local service authorization method according to an embodiment of the present invention.
  • the local service authorization method shown in FIG. 5 is performed on the basis of the network access authorization method shown in FIG. 2, FIG. 3, and FIG.
  • the local service authorization method may include the following steps.
  • the UE sends a local service connection establishment request message to the unlicensed spectrum access node.
  • the UE receives the authorization result of the authorization.
  • the local service may be sent to the LTE-U access node, that is, the local service connection establishment request message is sent to the unlicensed spectrum access node, and the local service connection establishment request message is used to request the local network device to The UE establishes a local service connection.
  • the unlicensed spectrum access node receives and forwards the local service connection establishment request message to the local network device.
  • the local network device receives the local service connection establishment request message, and performs local service authorization on the UE according to the local service policy of the UE.
  • the local service connection establishment request message may be a PDN connection establishment request message, and the request message may include a local service type of the UE or a local service APN identifier.
  • the local network device After receiving the local service connection setup request message, the local network device performs local service authorization for the UE based on the local service policy of the UE.
  • the specific manner in which the local network device authorizes the local service according to the local service policy of the UE may be:
  • the local service connection setup request message includes the local service type requested by the UE, determine whether the service type in the local service policy of the UE includes the local service type requested by the UE, if the local service type requested by the UE is included. Determining that the local service authorization of the UE is passed;
  • the local service connection setup request message includes the local service APN identifier requested by the UE
  • the service APN identity determines that the local service authorization for the UE passes.
  • the local service device sends a PDN connection to the control plane network element.
  • the request message (which may also be a PDN connection setup request message sent by the UE) is forwarded, and the control plane network element establishes a PDN connection on the EPC based on the existing process.
  • the local network device establishes a local service connection for the UE.
  • the local network device for the request for the local service authorization, establishes a connection for the foregoing service, and provides QoS guarantee according to the relevant QoS parameter in the local service policy, and completes the charging requirement.
  • the user level indication sent by the UE's home network may also be used to perform service scheduling control, such as preferentially guaranteeing user services with high user levels when congestion occurs.
  • the above business connection is established The method is the same as the prior art, that is, the local network device selects the serving gateway of the local network, and sends a local service connection establishment request message (PDN connection establishment request message), such as creating a session request message to the serving gateway of the local network, and the serving gateway of the local network is the service. Allocate resources and notify local network devices.
  • PDN connection establishment request message a local service connection establishment request message
  • the local network device sends a notification that the local service connection establishment is successful to the unlicensed spectrum access node.
  • the unlicensed spectrum access node forwards the notification that the local service connection is successfully established to the UE.
  • the local network device when the control plane network element of the home network and the HSS authorize the UE to access the home network from the LTE-U access node, the local network device sends according to the control plane network element.
  • the subscription data of the UE performs local service authorization on the UE, so that the local service authorization of the UE when accessing the LTE-U network can be implemented.
  • the local service of the UE After the local service authorization is successful, the local service of the UE can be performed on the local network, thereby sharing the attribution. Part of the network's services reduce the load on the home network and improve resource utilization.
  • FIG. 6 is a schematic structural diagram of a control plane network element according to an embodiment of the present invention.
  • the control plane network element 600 described in FIG. 6 can be applied to the above method embodiments.
  • the control plane network element 600 can include a receiving module 601, a processing module 602, and a sending module 603, where:
  • the receiving module 601 is configured to receive a first message sent by the local network device, where the first message includes a request message and access information of the UE, where the request message is used to request the UE to access the UE from the unlicensed spectrum access node. Home network.
  • the processing module 602 is configured to perform access authorization for the UE to access the home network from the unlicensed spectrum access node based on the request message, the access information, and the subscription data of the UE.
  • the sending module 603 is configured to send an authorization indication to the UE, where the authorization indication includes an authorization result of the access authorization.
  • the sending module 603 sends the authorization indication to the local network device, and the local network device sends the authorization result to the UE via the LTE-U access node.
  • the subscription data may include that the UE accesses the home network to allow
  • the second indication information of the access technology the access information may include the first indication information, where the first indication information is used to indicate that the access technology used by the UE to access the home network is accessed from the unlicensed spectrum access node;
  • the specific manner in which the processing module 602 accesses the home network from the unlicensed spectrum access node to the home network based on the request message, the access information, and the subscription data of the UE may be:
  • the subscription data may further include a first access mode of the unlicensed spectrum access node when the UE is allowed to access the home network from the unlicensed spectrum access node, and the access information further includes the UE.
  • the processing module 602 determines the first Whether the access mode and the second access mode match, if matched, can determine that the UE is allowed to access the home network from the unlicensed spectrum access node.
  • the second indication information includes the first indication information, but the first access mode and the second access mode do not match, determining to reject the UE from accessing the home network from the unlicensed spectrum access node.
  • the subscription data may further include a domain identifier list, where the domain identifier list includes a service provider identifier and a roaming alliance identifier of a local network that allows the UE to access the home network from the unlicensed spectrum access node. At least one of the following: if the access information further includes an identifier of the local network that the UE requests to access the home network from the unlicensed spectrum access node, if the second indication information includes the first indication information, the processing module 602 further The identifier of the local network is further determined in the domain identifier list.
  • the identifier of the local network exists, it is determined that the UE is allowed to access the home network from the unlicensed spectrum access node, where the identifier of the local network includes the local network. At least one of a service provider identity and a roaming affiliate identity.
  • the second indication information includes the first indication information, but the identifier of the local network does not exist in the domain identifier list, it is determined that the UE is denied access to the home network from the unlicensed spectrum access node.
  • the subscription data may also be extended to allow the UE to access from an unlicensed spectrum access node.
  • the access information sent by the local network device to the control plane network element may also include time information, location information, and security level of the unlicensed spectrum access node that the UE requests to access the home network from the unlicensed spectrum access node, and At least one of the secure authentication methods of the local network.
  • the request message of the UE is an access request message
  • the sending module 603 is further configured to send a second message to the HSS, where the second message is used to obtain subscription data of the UE.
  • the receiving module 601 is further configured to receive subscription data of the UE sent by the HSS.
  • the UE when the UE is initially attached, the UE sends an access request message to the control plane network element 600 through the unlicensed spectrum access node, and the control plane network element 600 needs to acquire the subscription data of the UE from the HSS.
  • the request message of the UE is a service request message
  • the service request message includes a temporary identifier allocated by the home network to the UE
  • the processing module 602 is further configured to determine, according to the temporary identifier, whether the control plane network element 600 is a control plane network element attached to the UE, where the control plane network element 600 is a control plane network element attached to the UE, and determining Whether the UE is in an idle state, and if the UE is in an idle state, performing access authorization based on the request message, the access information, and the subscription data of the UE to access the home network from the unlicensed spectrum access node by the UE. Operation.
  • the UE when the UE has attached the home network, the UE sends a service request message to the control plane network element 600 through the unlicensed spectrum access node, and the control plane network element 600 needs to determine whether it is the control plane network to which the UE initially attaches. If the control plane network element 600 is the control plane network element to which the UE is initially attached, and the UE is in the idle state on the 3GPP side, the control plane network element 600 is based on the request message and the access information. The access authorization is performed on the UE with the subscription data.
  • the processing module 602 is further configured to: when the authorization result of the access authorization is to allow the UE to access the home network from the unlicensed spectrum access node, A local service type that allows the UE to use on the local network is obtained from the data, and a local service policy of the UE is generated based on the local service type.
  • the sending module 603 is further configured to send the local service policy of the UE to the local network device, so that the local network device performs local service authorization for the local service initiated by the UE based on the local service policy of the UE.
  • the control plane network element 600 may generate a local service policy of the UE for the local service type that the UE is allowed to use on the local network, so that the UE When the local service is initiated, the local network device can perform local service authorization on the local service policy based on the local service policy, thereby improving the efficiency of local service authorization for the UE.
  • FIG. 7 is a schematic structural diagram of another control plane network element according to an embodiment of the present invention.
  • the control plane network element 700 described in FIG. 7 can be applied to the foregoing method embodiments.
  • the control plane network element 700 can include a receiver 701, a processor 702, and a transmitter 703, where:
  • the receiver 701 is configured to receive a first message sent by the local network device, where the first message includes a request message and access information of the UE, where the request message is used to request the UE to access the UE from the unlicensed spectrum access node. Home network.
  • the processor 702 is configured to perform access authorization for the UE to access the home network from the unlicensed spectrum access node based on the subscription data of the UE.
  • the sender 703 is configured to send an authorization indication to the UE, where the authorization indication includes an authorization result of the access authorization.
  • the transmitter 703 sends the authorization indication to the local network device, and the local network device sends the authorization result to the UE via the LTE-U access node.
  • the subscription data may include the second indication information of the access technology that the UE accesses the home network, and the access information may include the first indication information, where the first indication information is used to indicate that the UE is connected.
  • the access technology used by the home network is accessed from the unlicensed spectrum access node; the processor 702 accesses the home network from the unlicensed spectrum access node based on the request message, the access information, and the subscription data of the UE.
  • the specific way to perform access authorization can be:
  • the subscription data may further include a first access mode of the unlicensed spectrum access node when the UE is allowed to access the home network from the unlicensed spectrum access node, and the access information further includes the UE.
  • the second indication information includes the first indication information
  • the processor 702 further determines the first Whether the access mode and the second access mode match, if matched, can determine that the UE is allowed to access the home network from the unlicensed spectrum access node.
  • the second indication information includes the first indication information, but the first access mode and the second access mode do not match, determining to reject the UE from accessing the home network from the unlicensed spectrum access node.
  • the subscription data may further include a domain identifier list, where the domain identifier list includes a service provider identifier and a roaming alliance identifier of a local network that allows the UE to access the home network from the unlicensed spectrum access node. At least one of the following: if the access information further includes an identifier of the local network that the UE requests to access the home network from the unlicensed spectrum access node, if the second indication information includes the first indication information, the processor 702 further The identifier of the local network is further determined in the domain identifier list.
  • the identifier of the local network exists, it is determined that the UE is allowed to access the home network from the unlicensed spectrum access node, where the identifier of the local network includes the local network. At least one of a service provider identity and a roaming affiliate identity.
  • the second indication information includes the first indication information, but the identifier of the local network does not exist in the domain identifier list, it is determined that the UE is denied access to the home network from the unlicensed spectrum access node.
  • the subscription data may further extend time information, location information (such as 3GPP location information), the security level of the unlicensed spectrum access node, and the local network, which allow the UE to access the home network from the unlicensed spectrum access node. At least one of the secure authentication methods.
  • the access information sent by the local network device to the control plane network element may also include time information, location information, and security level of the unlicensed spectrum access node that the UE requests to access the home network from the unlicensed spectrum access node, and At least one of the secure authentication methods of the local network.
  • the request message of the UE is an access request message
  • the sender 703 is further configured to send a second message to the HSS, where the second message is used to obtain subscription data of the UE.
  • the receiver 701 is further configured to receive subscription data of the UE sent by the HSS.
  • the UE when the UE is initially attached, the UE sends an access request message to the control plane network element 700 through the unlicensed spectrum access node, and the control plane network element 700 needs to acquire the subscription data of the UE from the HSS.
  • the request message of the UE is a service request message
  • the service request message includes a temporary identifier allocated by the home network to the UE
  • the processor 702 is further configured to determine, according to the temporary identifier, whether the control plane network element 700 is a control plane network element attached to the UE, where the control plane network element 700 is a control plane network element attached to the UE, and determining Whether the UE is in an idle state, and if the UE is in an idle state, performing access authorization based on the request message, the access information, and the subscription data of the UE to access the home network from the unlicensed spectrum access node by the UE. Operation.
  • the UE when the UE has attached the home network, the UE sends a service request message to the control plane network element 700 through the unlicensed spectrum access node, and the control plane network element 700 needs to determine whether it is the control plane network to which the UE initially attaches. If the control plane network element 700 is the control plane network element to which the UE is initially attached, and the UE is in the idle state on the 3GPP side, the control plane network element 700 connects the UE based on the subscription data. Into the authorization.
  • the processor 702 is further configured to: when the authorization result of the access authorization is to allow the UE to access the home network from the unlicensed spectrum access node, from the subscription data of the UE. Obtain a local service type that allows the UE to use on the local network, and generate a local service policy of the UE based on the local service type.
  • the transmitter 703 is further configured to send the local service policy of the UE to the local network device, so that the local network device performs the local service initiated by the UE based on the local service policy of the UE. Local business authorization.
  • the control plane network element 700 may generate a local service policy of the UE for the local service type that the UE is allowed to use on the local network, so that the UE When the local service is initiated, the local network device can perform local service authorization on the local service policy based on the local service policy, thereby improving the efficiency of local service authorization for the UE.
  • the control plane network element after receiving the request message that the UE accesses the home network from the unlicensed spectrum access node, the control plane network element may be based on the subscription data of the UE and the UE.
  • the local network can share part of the services of the home network, thereby reducing the load of the home network and improving resource utilization.
  • FIG. 8 is a schematic structural diagram of a local network device according to an embodiment of the present invention.
  • the local network device 800 described in FIG. 8 can be applied to the above method embodiments.
  • the local network device 800 can include a receiving module 801, a sending module 802, and a processing module 803, where:
  • the receiving module 801 is configured to receive a request message of the UE sent by the unlicensed spectrum access node, where the request message is used to request the UE to access the home network of the UE from the unlicensed spectrum access node.
  • the sending module 802 is configured to send a first message to the control plane network element, where the first message includes the request message and the access information.
  • the receiving module 801 is further configured to receive an authorization indication sent by the control plane network element, where the authorization indication is sent by the control plane network element to the UE from the unlicensed spectrum access node based on the request message, the access information, and the subscription data of the UE.
  • the access authorization is obtained by entering the home network, and the authorization indication includes the authorization result of the access authorization.
  • the sending module 802 is further configured to send the authorization result to the UE.
  • the local network device sends the authorization result to the unlicensed spectrum access node, and the non-authorized The weight spectrum access node forwards to the UE.
  • the processing module 803 is configured to generate routing information according to the identifier of the home network.
  • the specific manner in which the sending module 802 sends the first message to the control plane network element can be understood as:
  • the routing information may be an NAI.
  • the NAI includes intermediate node domain identifier information, such as a VPLMN and a domain name, such as an FQDN, in addition to the destination domain HPLMA information that the request message finally arrives at.
  • the sending module 802 can send the request message of the UE to the control plane network element of the home network according to the intermediate node domain identifier information and the destination domain information in the routing information, thereby improving the information transmission efficiency.
  • the authorization indication may further include the local service policy of the UE:
  • the receiving module 801 is further configured to receive a second message sent by the unlicensed spectrum access node, where the second message is used to request to establish a local service connection for the UE.
  • the processing module 803 is further configured to perform local service authorization on the UE based on the local service policy of the UE, and establish a local service connection for the UE if the local service authorization of the UE passes.
  • the local network device 800 can perform local service authorization for the UE based on the local service policy of the UE, thereby The efficiency of local service authorization when the UE accesses the unlicensed spectrum network can be improved.
  • the specific manner in which the processing module 803 performs local service authorization on the UE based on the local service policy of the UE may be:
  • the second message contains the local service type requested by the UE, it is determined whether the service type in the local service policy of the UE includes the local service type requested by the UE, and if the local service type requested by the UE is included, The local service authorization of the UE is passed; or, if the local service type requested by the UE is not included, it is determined that the local service authorization of the UE fails.
  • the second message contains the local service APN identifier requested by the UE, it is determined whether the service APN identifier in the local service policy of the UE includes the local service APN identifier, and if the local service APN identifier is included, determining the UE The local service authorization is passed; or, if the local service APN identity is not included, it is determined that the local service authorization of the UE fails.
  • FIG. 9 is a schematic structural diagram of another local network device according to an embodiment of the present invention.
  • the local network device 900 described in FIG. 9 can be applied to the foregoing method embodiments.
  • the local network device 900 can include a receiver 901, a transmitter 902, and a processor 903, where:
  • the receiver 901 is configured to receive a request message of the UE sent by the unlicensed spectrum access node, where the request message is used to request the UE to access the home network of the UE from the unlicensed spectrum access node.
  • the transmitter 902 is configured to send a first message to the control plane network element, where the first message includes the request message and the access information.
  • the receiver 901 is further configured to receive an authorization indication sent by the control plane network element, where the authorization indication is received by the control plane network element from the unlicensed spectrum access node based on the request message, the access information, and the subscription data of the UE.
  • the access authorization is obtained by entering the home network, and the authorization indication includes the authorization result of the access authorization.
  • the transmitter 902 is further configured to send the authorization result to the UE.
  • the processor 903 is configured to generate routing information according to the identifier of the home network.
  • the specific manner in which the transmitter 902 sends the first message to the control plane network element can be understood as:
  • the authorization indication may further include the local service policy of the UE:
  • the receiver 901 is further configured to receive a second message sent by the unlicensed spectrum access node, where the second message is used to request to establish a local service connection for the UE.
  • the processor 903 is further configured to perform local service authorization on the UE based on a local service policy of the UE, And in the case that the local service of the UE is authorized to pass, a local service connection is established for the UE.
  • the local network device 900 may perform local service authorization for the UE based on the local service policy of the UE, thereby The efficiency of local service authorization when the UE accesses the unlicensed spectrum network can be improved.
  • the specific manner in which the processor 903 performs local service authorization on the UE based on the local service policy of the UE may be:
  • the second message contains the local service type requested by the UE, it is determined whether the service type in the local service policy of the UE includes the local service type requested by the UE, and if the local service type requested by the UE is included, The local service authorization of the UE is passed; or, if the local service type requested by the UE is not included, it is determined that the local service authorization of the UE fails.
  • the second message contains the local service APN identifier requested by the UE, it is determined whether the service APN identifier in the local service policy of the UE includes the local service APN identifier, and if the local service APN identifier is included, determining the UE The local service authorization is passed; or, if the local service APN identity is not included, it is determined that the local service authorization of the UE fails.
  • the local network device when receiving the request message that the UE accesses the home network from the unlicensed spectrum access node, the local network device forwards the request message to the control network of the home network. yuan.
  • the control plane network element is authorized to access the UE
  • the local network device may perform local service authorization on the UE based on the local service policy of the UE, so that the UE can access the unlicensed spectrum network.
  • the local service authorization is successful, the local service of the UE can be performed on the local network, so that part of the service of the home network can be shared, the load of the home network can be reduced, and resource utilization can be improved.
  • FIG. 10 is a schematic structural diagram of an HSS according to an embodiment of the present invention.
  • the HSS 1000 described in FIG. 10 can be applied to the above method embodiments.
  • the HSS1000 can include The receiving module 1001, the processing module 1002, and the sending module 1003, wherein:
  • the receiving module 1001 is configured to receive a first message sent by a control plane network element, where the first message is used to obtain subscription data of the UE, where the first message includes an access request message and access information of the UE, where the The incoming request message is used to request the UE to access the home network from the unlicensed spectrum access node.
  • the processing module 1002 is configured to acquire subscription data of the UE, and access the home network from the unlicensed spectrum access node for access authorization according to the access request message, the access information, and the subscription data.
  • the sending module 1003 is configured to: when the UE is allowed to access the home network from the unlicensed spectrum access node, send the subscription data to the control plane network element, so that the control plane network element selects the UE based on the subscription data.
  • the unlicensed spectrum access node accesses the home network and performs access authorization again.
  • the subscription data may include second indication information used to indicate that the UE accesses an access technology allowed to be used by the home network
  • the access information may include an access technology used to indicate that the UE accesses the home network.
  • the processing module 1002 accesses the home network from the unlicensed spectrum access node for access authorization based on the access request message, the access information, and the subscription data.
  • the specific way can be:
  • the subscription data may include a domain identifier list, where the domain identifier list includes at least one of a service provider identifier and a roaming alliance identifier of the local network that allows the UE to access the home network from the unlicensed spectrum access node.
  • the access information further includes an identifier of the local network that the UE requests to access the home network from the unlicensed spectrum access node, where the identifier of the local network includes at least one of a service provider identifier and a roaming alliance identifier of the local network.
  • FIG. 11 is a schematic structural diagram of another HSS according to an embodiment of the present invention.
  • the HSS 1100 described in FIG. 11 can be applied to the above method embodiments.
  • the HSS 1100 may include a receiver 1101, a processor 1102, and a transmitter 1103, where:
  • the receiver 1101 is configured to receive a first message sent by a control plane network element, where the first message is used to obtain subscription data of the UE, where the first message includes an access request message and access information of the UE, where the The incoming request message is used to request the UE to access the home network from the unlicensed spectrum access node.
  • the processor 1102 is configured to acquire subscription data of the UE, and access the home network from the unlicensed spectrum access node for access authorization based on the access request message, the access information, and the subscription data.
  • the transmitter 1103 is configured to: when the UE is allowed to access the home network from the unlicensed spectrum access node, send the subscription data to the control plane network element, so that the control plane network element selects the UE based on the subscription data.
  • the unlicensed spectrum access node accesses the home network and performs access authorization again.
  • the subscription data may include second indication information used to indicate that the UE accesses an access technology allowed to be used by the home network
  • the access information may include an access technology used to indicate that the UE accesses the home network.
  • the processor 1102 accesses the home network from the unlicensed spectrum access node for access authorization based on the access request message, the access information, and the subscription data.
  • the specific way can be:
  • the subscription data may include a domain identifier list, where the domain identifier list includes at least one of a service provider identifier and a roaming alliance identifier of the local network that allows the UE to access the home network from the unlicensed spectrum access node.
  • the access information further includes an identifier of the local network that the UE requests to access the home network from the unlicensed spectrum access node, where the identifier of the local network includes the service of the local network. At least one of a service provider identity and a roaming alliance identity.
  • the specific manner in which the processor 1102 accesses the home network from the unlicensed spectrum access node to access the home network based on the access request message, the access information, and the subscription data may be:
  • the HSS may be based on the first message.
  • the access request message, the access information, and the subscription data of the UE in a message perform initial access authorization for the UE.
  • the license data is sent to the control plane network element when the authorization is passed, so that the control plane network element re-accesses the UE based on the subscription data.
  • the access authorization of the UE from the unlicensed spectrum access node to the home network is performed hierarchically by the HSS and the control plane network element, which can improve the accuracy of access authorization for the UE.
  • FIG. 12 is a schematic structural diagram of a network access authorization system according to an embodiment of the present invention.
  • the system may include a UE 121, an unlicensed spectrum access node 122, a local network device 123, a control plane network element 124, and an HSS 125, for performing the process of the network access authorization method disclosed in the foregoing method embodiment. step.
  • the local network device 123 is the local network device described in FIG. 8 and FIG. 9.
  • the control plane network element 124 is the control plane network element described in FIG. 6 and FIG. 7, and the HSS is the HSS described in FIG. 10 and FIG.
  • the UE 121 may send a request message to the unlicensed spectrum access node to request access to the home network, where the request message includes an identifier of the home network.
  • the unlicensed spectrum access node 122 forwards the request message to the local network device 123, such as the MME of the local network.
  • the local network device 123 generates routing information based on the identity of the home network and the network topology, thereby routing the request message to the control plane network element 124 of the home network according to the routing information, such as MME/AAA server, etc.
  • the control plane network element 124 acquires the subscription data of the UE 121 from the HSS 125 based on the access request message.
  • the HSS 125 performs access authorization on the UE 121 based on the subscription data and the access information of the UE 121 from the unlicensed spectrum access node 122 to the home network in the request message, and sends the subscription data of the UE 121 to the control plane network only when the authorization is passed.
  • the element 124 is configured such that the control plane network element 124 re-authorizes the UE 121 based on the subscription data.
  • the control plane network element 124 determines that the UE 121 is attached.
  • the control plane network element and the UE 121 when the 3GPP side is in an idle state, perform access authorization on the UE 121 based on the subscription data and the access information of the UE 121.
  • the subscription data of the UE 121 may extend the indication information of the access technology allowed by the UE 121 to access the home network, and allow the UE 121 to access the access mode of the unlicensed spectrum access node when the unlicensed spectrum access node accesses the home network, and the local network.
  • the associated service provider or roaming alliance identity, etc.; the access information may include indication information that the UE 121 requests to access the access technology used by the home network (accessed from the unlicensed spectrum access node 122), and the UE 121 requests the non-negative The access mode of the unlicensed spectrum access node 122 when the authorized spectrum access node accesses the home network, the service provider to which the local network belongs or the roaming alliance identifier, and the like.
  • control plane network element 124 authorizes the UE 121 to access the home network from the unlicensed spectrum access node 122, if the UE 121 initiates a local service to the local network device 123, the local network device 123 according to the local service of the UE 121 The policy performs local service authorization for the UE 121.
  • the network access authorization system can implement access authorization and local service authorization for the UE to access the home network from the unlicensed spectrum access node, after the access authorization succeeds.
  • the local network can share part of the services of the home network, thereby reducing the load on the home network and improving resource utilization.
  • control plane network element the local network device, and the modules in the HSS may be combined, divided, and deleted according to actual needs.
  • control plane network element the local network device, and the HSS in the embodiment of the present invention may be implemented by a general-purpose integrated circuit, such as a CPU (Central Processing Unit) or an ASIC (Application Specific Integrated Circuit). achieve.
  • a general-purpose integrated circuit such as a CPU (Central Processing Unit) or an ASIC (Application Specific Integrated Circuit).
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Abstract

本发明实施例公开了一种网络接入授权方法、相关设备及系统，其中，该方法包括：UE在从非授权频谱接入节点接入归属网络时，会向归属网络发送请求消息，归属网络的控制面网元会基于接入信息和UE的签约数据对从非授权频谱接入节点接入归属网络进行接入授权，即判断是否允许UE从非授权频谱接入节点接入归属网络，从而将授权结果发送给UE。通过本发明实施例，EPS可以对UE从非授权频谱接入节点接入归属运营商核心网络进行接入授权，在接入授权成功后，本地网络可以分担归属网络的部分业务，从而可以减少归属网络负载，提高资源利用率。

Description

一种网络接入授权方法、相关设备及系统 技术领域
本发明实施例涉及通信技术领域，具体涉及一种网络接入授权方法、相关设备及系统。
背景技术
为了应对无线宽带技术的挑战，保持第三代合作伙伴项目(3rd Generation Partnership Project，3GPP)网络的领先优势，3GPP讨论组在2004年制定了移动通信网络的长期演进计划(Long Term Evolution，LTE)，并在此计划的指导下定义了新的移动通信网络架构—演进的分组系统(Evolved Packet System，EPS)。其中，EPS由用户设备(User Equipment，UE)、接入网和演进的分组核心网(Evolved Packet Core，EPC)组成。
目前，UE从接入网接入归属运营商EPC时，归属运营商EPC需要对其进行接入授权，只有授权通过的UE才能接入归属运营商EPC。在EPS中，接入网采用的频谱均为授权频谱，如通用地面无线接入网(Universal Terrestrial Radio Access Network，UTRAN)、演进的通用地面无线接入网(Evolved UTRAN，E-UTRAN)等，随着移动宽带业务的发展，授权频谱逐渐不能满足快速增长的业务需求，采用非授权频谱作为新的无线接入技术以提升空口承载能力成为EPS接入网的发展趋势。因此，如何对UE从非授权频谱接入节点接入归属运营商EPC进行接入授权已成为亟待解决的问题。
发明内容
本发明实施例公开了一种网络接入授权方法、相关设备及系统，能够对UE从非授权频谱接入节点接入归属运营商EPC进行接入授权。
本发明实施例第一方面公开了一种网络接入授权方法，应用于EPS，EPS包括非授权频谱接入节点、本地网络设备和控制面网元，其中，该方法可以包 括：
控制面网元在接收到本地网络设备发送的第一消息后，可以基于该第一消息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权，并将授权指示发送给该UE。其中，该第一消息包括UE的请求消息和接入信息，该请求消息用于请求UE从非授权频谱接入节点接入该UE的归属网络，该授权指示包括接入授权的授权结果。
其中，该请求消息可以为接入请求消息或者服务请求消息，非授权频谱接入节点可以是指无线保真(Wireless Fidelity，Wi-Fi)、LTE中的非授权频谱(Unlicensed LTE，LTE-U)接入节点，甚至5G的非授权频谱，本发明实施例不做限定。当UE从非授权频谱接入节点的本地网络接入归属网络时，控制面网元需要根据UE的签约数据对UE进行接入授权，从而可以实现UE接入归属网络时的接入授权，在接入授权成功后，本地网络可以分担归属网络的部分业务，从而可以减少归属网络负载，提高资源利用率。
可选的，签约数据可以包括该UE接入归属网络允许使用的接入技术的第二指示信息，接入信息可以包括第一指示信息，第一指示信息用于指示该UE接入归属网络使用的接入技术为从非授权频谱接入节点接入；那么控制面网元基于请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于请求消息判断第二指示信息是否包含第一指示信息，如果包含第一指示信息，则确定允许该UE从该非授权频谱接入节点接入归属网络，即对UE接入授权通过；或者，如果未包含第一指示信息，则确定拒绝该UE从该非授权频谱接入节点接入归属网络，即对UE接入授权失败。
进一步的，该签约数据还可以包括允许UE从非授权频谱接入节点接入归属网络时，非授权频谱接入节点的第一接入模式，在接入信息还包括UE请求从非授权频谱接入节点接入归属网络时，该非授权频谱接入节点的第二接入模式的情况下，如果第二指示信息包含第一指示信息，控制面网元则会进一步判断第一接入模式和第二接入模式是否匹配，如果匹配，控制面网元才能确定允 许该UE从该非授权频谱接入节点接入归属网络。
或者说，如果第二指示信息包含第一指示信息，但第一接入模式和第二接入模式不匹配，控制面网元则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
进一步的，该签约数据还可以包括域标识列表，域标识列表包括允许该UE从非授权频谱接入节点接入归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；在该接入信息还包括该UE请求从非授权频谱接入节点接入归属网络的本地网络的标识的情况下，如果第二指示信息包含第一指示信息，控制面网元则会进一步判断域标识列表中是否存在该本地网络的标识，如果存在该本地网络的标识，控制面网元才确定允许该UE从该非授权频谱接入节点接入归属网络，其中，本地网络的标识包括本地网络的服务提供商标识和漫游联盟标识中的至少一种。
或者说，如果第二指示信息包含第一指示信息，但域标识列表中不存在该本地网络的标识，控制面网元则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
可选的，控制面网元还可以在第一接入模式和第二接入模式匹配的情况下，进一步判断域标识列表中是否存在该本地网络的标识，如果存在该本地网络的标识，控制面网元才确定允许该UE从该非授权频谱接入节点接入归属网络。
或者说，如果第二指示信息包含第一指示信息，第一接入模式和第二接入模式匹配，但域标识列表中不存在该本地网络的标识，那么控制面网元同样会确定拒绝该UE从该非授权频谱接入节点接入归属网络。
进一步的，该签约数据还可以扩展允许该UE从非授权频谱接入节点接入归属网络的时间信息、位置信息(如3GPP位置信息)、非授权频谱接入节点的安全等级，以及本地网络的安全认证方式中的至少一种。那么本地网络设备给控制面网元发送的接入信息同样还可以包括该UE请求从非授权频谱接入节点接入归属网络的时间信息、位置信息、非授权频谱接入节点的安全等级，以及本地网络的安全认证方式中的至少一种。
需要说明是，控制面网元对UE进行接入授权时，一般是将接入信息中包括的已有信息与签约数据中相应的信息进行比对，但并不要求接入信息中一定包括签约数据中的所有信息。
扩展非授权频谱接入归属网络授权相关的签约数据，当不允许UE从非授权频谱接入节点接入时，设置如LTE-U not allowed的指示。或者将非授权频谱接入授权与区域或时间绑定，即设置非授权频谱接入节点允许或禁止接入的区域或时间段。
UE的签约数据新增域标识列表，如漫游联盟标识列表、服务提供商列表等，允许UE从列表中的服务提供商或漫游联盟成员部署的网络接入归属网络。签约数据还可以进一步对上述服务提供商或漫游联盟部署的网络的接入模式、安全等级(如可信或非可信)做限制，即限制UE从匹配的接入模式和安全等级的服务提供商或漫游联盟部署的接入网络访问归属网络。
控制面网元基于UE的接入信息和签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权，从而可以提高对UE进行接入授权的准确度。
可选的，EPS还可以包括归属网络签约服务器(Home Subscriber Server，HSS)，当该请求消息可以为接入请求消息时，即在UE通过非授权频谱接入节点初始附着归属网络的情况下，控制面网元在接收到本地网络设备发送的第一消息后，还会向HSS发送用于获取该UE的签约数据的第二消息，如果HSS基于UE的签约数据和接入信息对UE接入授权通过，控制面网元会接收到HSS发送的该UE的签约数据，从而基于接收的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。如果HSS基于UE的签约数据对UE接入授权失败，控制面网元会接收到接入失败的授权结果，从而将该授权结果经本地网络设备、非授权频谱接入节点转发给UE。
在UE通过非授权频谱接入节点初始附着归属网络时，HSS会基于UE的签约数据对UE进行初次接入授权，在授权通过的情况下将该UE的签约数据发送给控制面网元，控制面网元基于该签约数据对该UE再次进行接入授权，分层次对UE进行接入授权，可以提高对UE接入授权的效率。
可选的，当该请求消息为服务请求消息时，即UE事先通过授权频谱接入节点附着归属网络，后续再通过非授权频谱接入节点发送服务请求给归属网络，其中，该服务请求消息携带有该UE的临时标识，如该UE附着的控制面网元的标识，具体可以是归属网络分配给UE的。控制面网元在接收到本地网络设备发送的第一消息后，会根据该UE的临时标识确定是否为UE附着的控制面网元，如果是，说明该控制面网元事先已经从HSS处获取到了该UE的签约数据；控制面网元会进一步确定UE在3GPP侧是否处于空闲态，如果UE处于空闲态，才会基于请求消息、接入信息和该UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。如果UE处于连接态，控制面网元会拒绝该UE的服务请求。
在UE通过授权频谱接入节点已经附着归属网络，此时通过非授权频谱接入节点发送服务请求给归属网络，该UE附着的控制面网元在确定UE处于空闲态的情况下，会基于事先从HSS处获取的该UE的签约数据对UE进行接入授权，从而可以提高对UE进行接入授权的效率。
可选的，控制面网元基于该UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权之后，如果允许该UE从非授权频谱接入节点接入归属网络，控制面网元还可以从该UE的签约数据中获取允许UE在本地网络使用的本地业务类型，然后基于该本地业务类型生成该UE的本地业务策略，从而发送给本地网络设备，以便本地网络设备在UE发起本地业务的时候可以基于本地业务策略对UE进行本地业务授权，从而可以提高对UE接入非授权频谱网络时本地业务授权的效率。
具体的，本地业务策略可以是携带于授权指示中发送给本地网络设备，也可以是单独发送给本地网络设备，本发明实施例不做限定。
本发明实施例第二方面公开了一种控制面网元，该控制面网元可以包括接收模块、处理模块和发送模块，可以用于执行第一方面公开的网络接入授权方法。
本发明实施例第三方面公开了另一种控制面网元，该控制面网元可以包括 接收器、处理器和发送器，接收器对应第二方面公开的控制面网元的接收模块，处理器对应第二方面公开的控制面网元的处理模块，发送器对应第二方面公开的控制面网元的发送模块，可以用于执行第一方面公开的网络接入授权方法。
本发明实施例第四方面公开了另一种网络接入授权方法，应用于EPS，EPS包括UE、非授权频谱接入节点、本地网络设备和控制面网元，其中，该方法可以包括：
本地网络设备在接收到非授权频谱接入节点发送的UE的请求消息后，会向控制面网元发送包括该请求消息和接入信息的第一消息，而后可以接收控制面网元发送的包括授权结果的授权指示，从而将该授权结果发送给UE。
其中，该授权指示由控制面网元基于该请求消息、接入信息和UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权得到，该请求消息可以为服务请求消息，也可以为接入请求消息，本发明实施例不做限定。该请求消息用于请求该UE从非授权频谱接入节点接入归属网络。具体的，本地网络设备通过非授权频谱接入节点将授权结果发送给UE。
可选的，该请求消息可以包括该归属网络的标识，本地网络设备在接收到非授权频谱接入节点发送的UE的请求消息后，可以根据归属网络的标识生成路由信息，如网络接入标识符(Network Access Identifier，NAI)，从而根据该路由信息将第一消息发送给归属网络的控制面网元。
其中，NAI中除了含有该请求消息最终到达的目的域归属公共陆地移动网络(Home Public Land Mobile Network，HPLMA)信息之外，还包含中间节点域标识信息，如虚拟公共陆上移动网(Virtual Public Land Mobile Network，VPLMN)、域名，如完全合格域名/全称域名(Fully Qualified Domain Name，FQDN)等。
可选的，在接入授权的授权结果为允许该UE从非授权频谱接入节点接入归属网络的情况下，该授权指示还可以包括UE的本地业务策略(控制面网元基于UE的签约数据生成的)，那么本地网络设备在接收到控制面网元发送的该UE的本地业务策略后，如果接收到非授权频谱接入节点发送的用于请求为UE 建立本地业务连接的第二消息，本地网络设备可以基于该UE的本地业务策略对该UE进行本地业务授权。如果授权通过，即允许该UE在本地网络使用发起的本地业务，则为该UE建立本地业务连接；或者，如果授权不通过，即不允许该UE在本地网络使用发起的本地业务，则向控制面网元发送请求消息以对UE建立公用数据网(Public Data Network，PDN)连接。
其中，该第二消息具体可以为PDN连接建立请求消息，包含有请求的本地业务类型或者请求的本地业务接入点名称(Access Piont Network，APN)。业务授权信息新增允许的本地业务类型，如数据业务，语音业务或含有服务提供商标识的本地APN，以及上述业务的签约服务质量(Quality of Service，QoS)，计费策略，接入网安全级别，用户等级。进一步对上述本地业务授权做服务提供商标识或漫游联盟标识限制，即允许从指定的服务提供商或漫游联盟部署的本地网络上实现上述本地业务。
在对UE从非授权频谱接入节点接入归属网络进行接入授权通过的情况下，如果UE发起本地业务，本地网络设备可以基于该UE的本地业务策略对该UE进行本地业务授权，从而可以提高对UE接入非授权频谱的本地网络时本地业务授权的效率。
具体的，本地网络设备根据该UE的本地业务策略对该UE进行本地业务授权的具体方式可以为：
方式一、如果第二消息包括的是该UE请求的本地业务类型，本地网络设备在接收到第二消息后，会判断本地业务策略中的业务类型是否包含有该UE请求的本地业务的类型，如果包含，则确定对UE的本地业务授权通过，如果没有包含，则确定对UE的本地业务授权失败。
方式二、如果第二消息包括的是该UE请求的本地业务APN标识，本地网络设备在接收到第二消息后，会判断本地业务策略中的业务APN标识是否包含该本地业务APN标识，如果包含，则确定对UE的本地业务授权通过，如果未包含，则确定对UE的本地业务授权失败。
在本地业务授权成功后，UE的本地业务可以在本地网络进行，从而可以 分担归属网络的部分业务，减少归属网络负载，提高资源利用率。
本发明实施例第五方面公开了一种本地网络设备，该本地网络可以包括接收模块、发送模块和处理模块，可以用于执行第四方面公开的网络接入授权方法。
本发明实施例第六方面公开了另一种本地网络设备，该本地网络设备可以包括接收器、发送器和处理器等，接收器对应于第五方面公开的本地网络设备的接收模块，发送器对应于第五方面公开的本地网络设备的发送模块，处理器对应于第五方面公开的本地网络设备的处理模块，可以用于执行第四方面公开的网络接入授权方法。
本发明实施例第七方面公开了又一种网络接入授权方法，应用于EPS，EPS包括UE、非授权频谱接入节点、本地网络设备、控制面网元以及HSS，其中，该方法可以包括：
HSS在接收到控制面网元发送的用于获取UE的签约数据的第一消息后，首先会获取该UE的签约数据，并基于该第一消息和该签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权，在允许UE从非授权频谱接入节点接入归属网络的情况下，向控制面网元发送该UE的签约数据，以便控制面网元基于该签约数据对UE从非授权频谱接入节点接入归属网络再次进行接入授权。
其中，第一消息包括有该UE的接入请求消息和接入信息，该接入请求消息用于请求UE从非授权频谱接入节点接入归属网络。
进一步的，HSS在不允许UE从非授权频谱接入节点接入归属网络的情况下，会发送如LTE-U not allowed的授权指示给控制面网元，控制面网元从而将其转发给UE。
可选的，签约数据可以包括该UE接入归属网络允许使用的接入技术的第二指示信息，接入信息可以包括第一指示信息，第一指示信息用于指示该UE接入归属网络使用的接入技术为从非授权频谱接入节点接入。那么HSS基于接入请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入 归属网络进行接入授权的具体方式可以为：
基于该接入请求消息判断第二指示信息是否包含第一指示信息，如果包含第一指示信息，则确定允许该UE从非授权频谱接入节点接入归属网络；或者，如果未包含第一指示信息，则确定拒绝该UE从非授权频谱接入节点接入归属网络。
可选的，签约数据可以包括域标识列表，域标识列表包括允许该UE从非授权频谱接入节点接入归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；接入信息还包括该UE请求从非授权频谱接入节点接入归属网络的本地网络的标识，本地网络的标识包括本地网络的服务提供商标识和漫游联盟标识中的至少一种。那么HSS基于接入请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于接入请求消息判断域标识列表中是否存在该本地网络的标识，如果存在该本地网络的标识，则确定允许该UE从该非授权频谱接入节点接入归属网络；或者，如果不存在该本地网络的标识，则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
在UE通过非授权频谱接入节点初始附着归属网络的情况下，HSS在接收到用于获取UE的签约数据的第一消息后，可以基于第一消息中的接入请求消息、接入信息和UE的签约数据对UE进行初次接入授权。在授权通过的情况下才将其签约数据发送给控制面网元，以便控制面网元基于该签约数据对UE进行再次接入授权。由HSS和控制面网元分层次对UE从非授权频谱接入节点接入归属网络进行接入授权，可以提高对UE进行接入授权的准确度。
本发明实施例第八方面公开了一种HSS，该HSS可以包括接收模块、处理模块和发送模块，可以用于执行第七方面公开的网络接入授权方法。
本发明实施例第九方面公开了另一种HSS，该HSS可以包括接收器、处理器和发送器，接收器对应于第八方面公开的HSS的接收模块、处理器对应于第八方面公开的HSS的处理模块，发送器对应于第八方面公开的HSS的发送模块， 可以用于执行第七方面公开的网络接入授权方法。
本发明实施例第十方面公开了一种网络接入授权系统，该系统应用于EPS，该系统包括非授权频谱接入节点，第二方面公开的控制面网元以及第五方面公开的本地网络设备，其中：
非授权频谱接入节点在接收到UE请求接入归属网络的请求消息后，可以将该请求消息转发给本地网络设备，本地网络设备将该请求消息和UE接入归属网络的接入信息发送给控制面网元，控制面网元从而可以基于该请求消息、接入信息和UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权，并将授权结果发送给UE。
可选的，UE的签约数据扩展UE接入归属网络允许使用的接入技术的第二指示信息，本地网络设备发送给控制面网元的接入信息中包含第一指示信息，该第一指示信息用于指示UE请求接入归属网络使用的接入技术为从非授权频谱接入节点接入。因此，控制面网元在接收到UE的请求消息和接入信息后，判断第二指示信息中是否包含第一指示信息，如果包含，则表明允许UE从非授权频谱接入节点接入归属网络。
可选的，该网络接入授权系统进一步还可以包括第八方面公开的HSS。该请求消息可以是接入请求消息，也可以是服务请求消息。如果是接入请求消息，控制面网元在接收到本地网络设备发送的UE的接入请求消息和接入信息后，会向HSS获取UE的签约数据，并将UE接入归属网络使用的接入技术发送给HSS，HSS基于UE使用的接入技术对UE从非授权频谱接入节点接入归属网络进行授权，如果授权通过，则将其签约数据返回给控制面网元，以便于控制面网元对UE从非授权频谱接入节点接入归属网络再次进行接入授权。
通过本发明实施例，归属网络的控制面网元以及HSS可以对UE从非授权频谱接入节点接入归属网络进行接入授权。在接入授权通过的情况下，归属网络的控制面网元可以生成该UE的本地业务策略，并将其发送给本地网络设备，本地网络设备可以基于UE发起的本地业务对其进行本地业务授权，从而实现了对UE接入非授权频谱的本地网络时的本地业务授权，在本地业务授权成功 后，UE的本地业务可以在本地网络进行，从而可以分担归属网络的部分业务，减少归属网络负载，提高资源利用率。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例公开的一种EPS的架构示意图；
图2是本发明实施例公开的一种网络接入授权方法的流程示意图；
图3是本发明实施例公开的另一种网络接入授权方法的流程示意图；
图4是本发明实施例公开的又一种网络接入授权方法的流程示意图；
图5是本发明实施例公开的一种本地业务授权方法的流程示意图；
图6是本发明实施例公开的一种控制面网元的结构示意图；
图7是本发明实施例公开的另一种控制面网元的结构示意图；
图8是本发明实施例公开的一种本地网络设备的结构示意图；
图9是本发明实施例公开的另一种本地网络设备的结构示意图；
图10是本发明实施例公开的一种HSS的结构示意图；
图11是本发明实施例公开的另一种HSS的结构示意图；
图12是本发明实施例公开的网络接入授权系统的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例公开了一种网络接入授权方法、相关设备及系统，能够对 UE从非授权频谱接入节点接入归属网络EPC进行接入授权。以下分别进行详细说明。
为了更好的理解本发明实施例公开的一种网络接入授权方法、相关设备及系统，下面先对本发明实施例适用的EPS架构进行描述。请参阅图1，图1是本发明实施例公开的一种EPS架构示意图。在图1所示的系统架构中，包括UE、本地网络和运营商核心网络EPC。其中，UE可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式的用户设备，移动台(Mobile station，MS)，终端(terminal)，终端设备(Terminal Equipment)等等。为方便描述，本发明实施例中，上面提到的设备统称为用户设备或UE。
图1所示的系统架构应用于漫游场景，在图1中，本地网络是指第三方部署的网络，区别于运营商网络。本地网络包括非授权频谱接入节点(如LTE-U无线接入节点，简称LTE-U接入节点)，Wi-Fi接入节点、5G的非授权频谱接入节点等)，本地网络控制面网元以及本地网络用户面网元。其中，非授权频谱接入节点是指使用非授权频谱的基站、接入点(Access Point，AP)等；本地网络控制面网元为移动管理实体(Mobility Management Entity，MME)或控制面节点(Control Point，CP)；本地网络用户面网元为网关(Gate Way，GW)或用户面节点(User Point，UP)。运营商EPC包括控制面网元、用户面网元、HSS和公用数据网关(Public Data Network Gate Way，PGW)。其中，控制面网元为MME、验证、授权和记账(Authentication、Authorization、Accounting，AAA)服务器、演进数据网关(Evolved Packet Data Gateway，ePDG)、通用无线分组业务(General Packet Radio Service，GPRS)服务支持节点(Serving GPRS Support Node，SGSN)或CP；用户面网元为安全网关(Security Gate Way，SeGW)、服务网关(Serving Gate Way，SGW)或UP，本发明实施例不做限定。
需要说明的是，本发明实施例所提及的本地网络设备即为本地网络控制面网元，而本发明实施例所提及的控制面网元是指运营商EPC的控制面网元， 本发明实施例在此不再赘述。
在图1所示的系统架构中，UE从本地网络的非授权频谱接入节点接入归属运营商EPC时，归属运营商EPC需要对UE进行接入授权，即确定是否允许UE从非授权频谱接入节点接入其所属的归属网络，如果归属运营商EPC允许UE从本地网络的非授权频谱接入节点接入，UE可以对本地网络发起本地业务。图1所示的系统架构采用了非授权频谱作为新的无线接入技术，从而可以提高系统网络的空口承载能力。
基于图1所示的系统架构，本发明实施例公开了一种网络接入授权方法。请参阅图2，图2是本发明实施例公开的一种网络接入授权方法的流程示意图。如图2所示，该网络接入授权方法可以包括以下步骤：
201、UE向非授权频谱接入节点发送请求消息。
本发明实施例中，该请求消息可以为接入请求消息，也可以为服务请求消息，本发明实施例不做限定。当该请求消息为接入请求消息时，其具体可以为附着请求Attach Request消息、鉴权与授权请求Authentication and Authorization Request(包括NAI)消息、连接请求消息或者采用非接入层(Non-Access Stratum，NAS)消息(如Attach Request消息)承载Diameter消息(如Authentication and Authorization Request(NAI)消息)等。当该请求消息为服务请求消息时，其具体可以为Service Request、重授权请求消息Re-Authorization Request或者连接请求消息等，本发明实施例不做限定。
本发明实施例中，UE在发现并选择非授权频谱接入节点后，可以向其发送请求消息，该请求消息用于请求该UE接入归属网络，其中，UE还可以将归属运营商网络标识，也称为归属公共陆地移动网络(Home public land mobile network，HPLMN)标识作为选择的网络在空口消息中发送给非授权频谱接入节点，具体可以是以独立的消息发送出去，也可以是在请求消息中发送出去，本发明实施例不做限定。
可选的，该请求消息中还可以包括UE当前所在的位置信息和接入点信息 中的至少一种，如该UE的地理位置信息(经度，纬度)、3GPP位置信息、归属网络运营商的蜂窝网络广播位置信息(如LTE基站标识)、接入的非授权频谱小区标识、接入的非授权频谱基站标识、或者本地网络自定义的接入点标识(如“咖啡厅接入点”、“机场接入点”)等，本发明实施例不做限定。
202、非授权频谱接入节点接收该请求消息并转发给本地网络设备。
本发明实施例中，非授权频谱接入节点在接收到UE发送的请求消息后，会基于归属网络的标识将该请求消息转发给本地网络的控制面网元，如MME。其中，非授权频谱接入节点在转发该UE的请求消息的同时，还可以发送非授权频谱接入节点所在的位置信息或此接入点信息。
可选的，归属网络运营商的蜂窝网络广播位置信息如LTE基站标识为非授权频谱接入节点上配置有临近蜂窝网络基站标识，当非授权频谱配置多个运营商的临近蜂窝基站标识时，非授权频谱接入节点会基于选择的网络向本地网络设备发送归属网络的标识。具体可以是在请求消息中携带该归属网络的标识。
此外，非授权频谱接入节点还可以将接入点的接入模式，如开放模式、封闭模式、混合模式等发送给本地网络设备。其中，开放模式标识此接入点允许任何UE接入，封闭模式标识此接入点只允许有签约关系的UE接入，混合模式为上述两种模式的融合，即除了允许签约UE接入之外，还可能基于本地策略允许非签约UE接入。本地策略包括如根据接入点负荷状态或时间段等允许非签约UE接入。
203、本地网络设备接收该请求消息并向控制面网元发送包括该请求消息和接入信息的第一消息。
本发明实施例中，本地网络设备在接收到该请求消息后，根据归属网络的标识确定该标识所标记的HPLMN。具体的，如果本地网络设备接收到的请求消息为Attach Request消息，且该消息携带有Diameter消息(即NAS消息承载Diameter消息)，本地网络设备会将该Diameter消息发送给该HPLMN中的控制面网元。也就是说，该第一消息可以为Diameter消息，本发明实施例不做限定。
此外，本地网络设备在发送第一消息时，还可以将UE从非授权频谱接入 节点接入归属网络的接入信息发送给归属网络的控制面网元，以便该控制面网元根据接入信息和UE的签约数据对UE进行接入授权。其中，接入信息包括本地网络的特征信息、非授权频谱接入节点的特征信息(可以是本地网络设备获取的，也可以是非授权频谱接入节点与转发的请求消息一同发送给本地网络设备的)、UE的位置信息(包括UE的3GPP信息等)以及时间信息中的至少一种。
本地网络设备可以将接入信息和请求消息一同发送给控制面网元，即第一消息中同时包括请求消息和接入信息，本地网络设备也可以将接入信息单独发送给控制面网元，本发明实施例不做限定。
204、控制面网元接收第一消息，并基于请求消息、接入信息和该UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。
本发明实施例中，控制面网元在接收到第一消息后，可以根据UE的请求消息，接入信息和UE的签约数据判断是否允许UE从非授权频谱接入节点接入归属网络。
205、控制面网元将包括授权结果的授权指示发送给本地网络设备。
206、本地网络设备将该授权结果发送给非授权频谱接入节点。
207、非授权频谱接入节点将该授权结果发送给该UE。
本发明实施例中，控制面网元在对UE从非授权频谱接入节点接入归属网络进行接入授权之后，可以将包括授权结果的授权指示发送给UE，具体是将授权指示发送给本地网络设备，本地网络设备将授权结果发送给非授权频谱接入节点，从而由非授权频谱接入节点发送给UE。
具体的，当允许UE从非授权频谱接入节点接入归属网络时，控制面网元即发送用于指示允许UE从非授权频谱接入节点接入归属网络的授权指示(该授权指示可以为允许UE从非授权频谱接入节点接入归属网络的授权结果，也可以为UE的本地业务策略，即表明允许UE从非授权频谱接入节点接入归属网络)；当不允许UE从非授权频谱接入节点接入归属网络时，控制面网元即发送用于指示拒绝UE从非授权频谱接入节点接入归属网络的授权指示(该授权指示为拒绝UE从非授权频谱接入节点接入归属网络的授权结果)。
可见，在图2所描述的方法中，UE在需要从非授权频谱接入节点接入归属网络时，会向归属网络发送请求消息，归属网络的控制面网元会基于UE的签约数据对从非授权频谱接入节点接入归属网络进行接入授权，即判断是否允许UE从非授权频谱接入节点接入归属网络，从而将授权结果发送给UE。通过本发明实施例，EPS可以对UE从非授权频谱接入节点接入归属运营商核心网络进行接入授权，在接入授权成功后，本地网络可以分担归属网络的部分业务，从而可以减少归属网络负载，提高资源利用率。
基于图1所示的系统架构，本发明实施例公开了另一种网络接入授权方法。请参阅图3，图3是本发明实施例公开的另一种网络接入授权方法的流程示意图。其中，图3所示的方法应用于UE初始附着时通过非授权频谱接入节点发送接入请求消息到归属运营商EPC的场景。如图3所示，该网络接入授权方法可以包括以下步骤：
301、UE向非授权频谱接入节点发送接入请求消息。
本发明实施例中，该接入请求消息可以为Attach Request消息、Authentication and Authorization Request(NAI)消息、连接请求消息或NAS消息，其中，NAS消息承载Diameter消息如Authentication and Authorization Request(NAI)消息等。
本发明实施例中，UE在刚开机的情况下，搜索周围的接入网，在搜索到非授权频谱网络时，向非授权频谱接入节点发送用于请求接入该UE的归属网络的请求消息。其中，该请求消息可以包括该归属网络的标识、UE的位置信息、当前的时间信息等。
302、非授权频谱接入节点接收该接入请求消息并转发给本地网络设备。
本发明实施例中，非授权频谱接入节点在接收到UE发送的接入请求消息后，会基于归属网络的标识将该接入请求消息转发给本地网络设备。
同时，非授权频谱接入节点会将其接入模式和安全等级中的至少一种发送给本地网络设备，可以是添加在请求消息中发送给本地网络设备，也可以是以 另外的消息发送给本地网络设备，本发明实施例不做限定。
303、本地网络设备接收该接入请求消息并根据接入请求消息包括的归属网络标识生成路由信息。
本发明实施例中，本发明网络设备在接收到本地网络设备在接收到该请求消息后，会根据该归属网络的标识以及网络拓扑结构生成路由信息，如生成NAI。NAI中除了含有该接入请求消息最终到达的目的域HPLMA信息之外，还包含中间节点域标识信息，如VPLMN、域名如FQDN等。其中，NAI可以理解为UE从非授权频谱接入节点接入归属网络的接入信息。
可选的，本地网络设备可以将用于指示UE接入归属网络使用的接入技术的第一指示信息，写入NAI，该接入技术为从非授权频谱接入节点接入；本地网络设备还可以将本地网络使用的安全认证信息写入NAI。例如，假设本地网络使用的安全认证方案为可扩展鉴权协议鉴权与秘钥协商(Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement，EAP-AKA)或者EAP-AKA'，那么本地网络设备就会将代表EAP-AKA或者EAP-AKA'的标识写入NAI。
可选的，本地网络设备还可以为该UE分配临时标识，该临时标识也可以写入NAI中。
304、本地网络设备根据路由信息向控制面网元发送包括该接入请求消息和接入信息的第一消息。
本发明实施例中，本地网络设备在生成路由信息之后，可以根据路由信息中的中间节点域标识以及目的域HPLMN标识向归属网络的控制面网元发送第一消息。该第一消息用于请求UE从非授权频谱接入归属网络。
需要说明的是，该第一消息可以为Diameter消息，如Authentication and Authorization Request消息，或者其他协议定义的消息，本发明实施例不做限定。
本发明实施例中，第一消息包括有该UE的接入请求消息和UE从非授权频谱接入节点接入归属网络的接入信息，如第一指示信息，以及非授权频谱接入节点发送的非授权频谱接入节点的接入模式，本地网络所属的服务提供商标识 (Service Provider Identifier/Identity，SP ID)和/或漫游联盟标识(Union ID)，非授权频谱接入节点的安全等级等，本发明实施例不做限定。
可选的，本地网络设备还可以将本地网络所支持的安全认证信息通过相关参数(Security info)发送给归属网络的控制面网元。
值得注意的是，第一消息中包括的接入信息主要包括第一指示信息，即UE接入归属网络使用的接入技术；可选的，还可以包括非授权频谱接入节点的接入模式，以及本地网络的标识；进一步，还可以包括UE的位置信息、时间信息、非授权频谱接入节点的安全等级以及本地网络的安全认证方式。其中，本地网络的标识包括本地网络的SP ID和Union ID中的至少一种。
需要说明的是，服务提供商标识为部署本地网络的服务提供商的标识、或部署本地网络的企业标识、或基础设施提供商标识、甚至政府部门标识等。漫游联盟为服务提供商、移动运营商、固网运营商、Wi-Fi运营商、企业、基础设施提供商、政府部门等多个组织组成的联盟，每个联盟有唯一联盟标识，联盟成员共享此联盟标识。
305、控制面网元接收第一消息，并根据第一消息向HSS发送第二消息。
本发明实施例中，控制面网元在接收到本地网络设备发送的第一消息后，会根据第一消息中的接入请求消息向HSS发送第二消息。其中，该第二消息用于获取该UE的签约数据。
本发明实施例中，第二消息具体可以为更新位置请求(update location request)消息，该更新位置请求消息包括该UE的永久标识，如国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)等。
此外，控制面网元在接收到本地网络设备发送的接入信息后，可以存储该接入信息，还可以将接入信息中的SP ID、Union ID和第一指示信息，指示该UE使用的无线接入技术(Radio Access Technologies，RAT)类型为非授权频谱(如LTE-U)中的至少一种发送给HSS。
具体的，第二消息可以携带上述接入信息中的RAT类型、Union ID、SP ID中的至少一种，控制面网元也可以将上述接入信息中的RAT类型、Union ID、 SP ID中的至少一种单独发送给HSS，本发明实施例不做限定。
306、HSS接收第二消息，并获取UE的签约数据。
本发明实施例中，HSS接收到第二消息后，会更新为UE提供服务的控制面网元(如MME)，并根据UE的IMSI查找该UE的签约数据。
307、HSS基于接入请求消息、接入信息和该UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。
本发明实施例中，HSS在查找到该UE的签约数据后，会基于该签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。
本发明实施例中，HSS基于接入请求消息、接入信息和该UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
HSS判断该接入信息与该签约数据是否匹配；在该接入信息与该签约数据匹配的情况下，允许该UE从非授权频谱接入节点接入归属网络；或者说，在该接入信息与该签约数据不匹配的情况下，拒绝该UE从非授权频谱接入节点接入归属网络。
具体的，HSS主要基于接收的接入信息和该UE的签约数据检测UE是否可以从非授权频谱接入节点接入，进一步的，还可以检测UE是否可以从SP ID所标记的服务提供商或Union ID所标记的漫游联盟部署的网络接入。
对于检测UE是否可以从非授权频谱接入节点接入：签约数据扩展了UE接入归属网络允许使用的RAT类型，即第二指示信息，如果第二指示信息不含有非授权频谱接入(第一指示信息)，或者签约数据指示非授权频谱不允许接入，那么HSS会返回包括原因值为RAT类型不允许接入的授权指示给控制面网元，或者返回拒绝UE从非授权频谱接入节点接入归属网络的授权结果给控制面网元。控制面网元从而将该授权结果经本地网络设备、非授权频谱接入节点发送给该UE，具体可以是发送接入失败消息给UE，或者发送接入回复消息中包含上述失败原因值给UE，本发明实施例不做限定。
对于检测UE是否可以接入SP ID或Union ID：签约数据扩展允许UE漫游(即允许UE从本地网络接入归属网络)的域标识列表(如SP list，或/和Union  list)，如果域标识列表(如SP list，或/和Union list)中不含有SP ID或Union ID，则HSS返回包括原因值为漫游不允许的授权指示给控制面网元，如VPLMN不允许指示、服务提供商不允许指示、或漫游不允许指示等。控制面网元从而发送接入失败消息给UE，或者发送接入回复消息中包含上述失败原因值给UE，本发明实施例不做限定。
308、在允许UE从非授权频谱接入节点接入归属网络的情况下，HSS将该UE的签约数据发送给控制面网元。
本发明实施例中，如果HSS检测UE可以从当前的SP或Union部署的非授权频谱接入节点接入归属网络，HSS则返回该UE的签约数据给控制面网元。进一步的，HSS还可以返回允许UE从非授权频谱接入节点接入归属网络的授权结果给控制面网元。
具体的，HSS返回的该UE的签约数据可以包括：非授权频谱接入授权的相关签约数据、SP ID或Union ID接入授权的相关签约数据、本地网络本地业务授权的相关签约数据、EPC业务授权的相关签约数据等。
需要说明的是，非授权频谱接入授权的相关签约数据可以包括：非授权频谱作为允许的接入技术进一步与UE位置或时间的至少一个绑定，如非授权频谱在某位置区域(地理位置或3GPP蜂窝位置如追踪区域标识(Tracking Area Identity，TAI)或TAI列表)内可以接入、或非授权频谱在某位置区域不允许接入、或非授权频谱在某时间段内可以接入、或非授权频谱在某时间段内不允许接入，或上述位置与时间的有效组合。
SP ID或Union ID接入授权的相关签约数据可以包括：SP部署的本地网络作为允许接入的网络进一步与接入模式、接入网络可信或非可信指示、或UE位置区中的至少一个绑定。如UE只允许接入SP部署的接入模式为封闭的接入网络，或UE只允许接入SP部署的可信接入网络，或UE只允许接入SP部署的某些位置的网络，或上述情况的任意组合。
本地网络本地业务授权的相关签约数据可以包括：允许的本地业务类型标识或本地业务APN(本地业务APN中含有服务标识或/和服务提供商标识)，如 数据业务、语音业务、互联网业务、或任意业务等。或禁止的本地业务类型，如禁止数据业务、语音业务、或互联网业务等。进一步，对于允许的业务类型签约所需的服务质量参数(如业务需要保证的带宽(保证比特速率(Guaranteed Bit Rate，GBR)，最大比特速率(Maximum Bit Rate，MBR))、业务调度策略优先级等(服务质量等级标识(QoS Class Identifier，QCI)，地址解析协议(Address Resolution Protocol，ARP)))，计费策略(如后付费或预付费，或基于时长计费或流量计费)，用户等级(如金银铜牌用户标识)。此外，允许的业务类型可能与接入网络的可信或者非可信特征或SP ID或Union ID绑定，如某些本地业务只能在指定的SP ID或Union ID部署的可信非授权频谱接入节点进行。
EPC业务授权的相关签约数据可以包括：签约APN信息，即APN配置数据。
309、控制面网元接收HSS发送的该UE的签约数据，并基于接入信息和该签约数据对UE从非授权频谱接入节点接入归属网络再次进行接入授权。
本发明实施例中，控制面网元在接收到HSS发送的该UE的签约数据后，会基于接入信息和该签约数据对UE从非授权频谱接入节点接入归属网络再次进行接入授权。
本发明实施例中，控制面网元基于接入信息和该签约数据对UE从非授权频谱接入节点接入归属网络再次进行接入授权的具体方式可以为：
可以再次判断第二指示信息中是否含有第一指示信息，即UE接入归属网络允许使用的接入技术是否包含UE接入归属网络所使用的接入技术，如果包含第一指示信息，则确定允许该UE从非授权频谱接入节点接入归属网络；或者说，如果不包含第一指示信息，则确定拒绝该UE从非授权频谱接入节点接入归属网络。
进一步的，控制面网元如果判断出第二指示信息包含第一指示信息，还可以判断签约数据中允许UE从非授权频谱接入归属网络时，非授权频谱接入节点的第一接入模式与接入信息中非授权频谱接入节点的第二接入模式是否匹配，可以理解为，第一接入模式是否与第二接入模式一致，或者第一接入模式 是否包含第二接入模式，如果匹配，才能确定允许该UE从非授权频谱接入节点接入归属网络；或者说，即使第二指示信息包含第一指示信息，但第一接入模式与第二接入模式不匹配，控制面网元同样确定拒绝该UE从非授权频谱接入节点接入归属网络。
进一步的，控制面网元如果判断出第二指示信息包含第一指示信息，还可以判断签约数据中域标识列表是否包含接入信息中的本地网络的标识(SP ID和/或Union ID)，如果包含，才能确定允许该UE从非授权频谱接入节点接入归属网络；或者说，即使第二指示信息包含第一指示信息，但域标识列表中未包含本地网络的标识，控制面网元同样确定拒绝该UE从非授权频谱接入节点接入归属网络。
进一步的，控制面网元在判断出第二指示信息包含第一指示信息后，还可以同时判断域标识列表是否包含接入信息中的本地网络的标识，以及第一接入模式与第二接入模式是否匹配。
举例来说，假设支持EAP-AKA'的网络为可信网络，支持EAP-AKA的网络为非可信网络，或者哪些服务提供商部署的本地网络为可信网络，其余为非可信网络，签约数据中规定UE可以从可信网络接入，那么控制面网元会基于NAI中携带的本地网络的安全认证方式或相关参数，或者基于本地网络的安全认证方式与SP ID相结合判断本地网络是否为可信网络，从而确定是否允许UE从本地网络接入。
又举例来说，假设签约数据中只允许该UE从服务提供商A部署的接入模式为封闭模式的非授权频谱接入节点接入，那么控制面网元在获取到该UE的签约数据后，可以确定非授权频谱接入节点的接入模式是否为封闭模式，且非授权频谱接入节点是否是服务提供商A部署的，如果均是，则确定UE可以从该非授权频谱接入节点接入归属网络。
进一步的，控制面网元还可以根据UE从非授权频谱接入节点接入归属网络的位置信息或者时间信息来确定是否允许该UE从该非授权频谱接入节点接入归属网络。
如果基于接入信息和该UE的签约数据确定不允许该UE从该非授权频谱接入节点接入归属网络，控制面网元则发送接入失败消息给UE，或者发送接入回复消息中包含失败原因值给UE。
310、在允许UE从非授权频谱接入节点接入归属网络的情况下，控制面网元基于该UE的签约数据生成UE的本地业务策略。
本发明实施例中，如果根据接入信息和该UE的签约数据确定允许该UE从该非授权频谱接入节点接入归属网络，控制面网元可以进一步从该UE的签约数据中获取UE在本地网络允许使用的本地业务类型，从而基于该本地业务类型生成该UE的本地业务策略。
也即是说，对于接入授权通过的UE，控制面网元会判断UE的哪些本地业务可以在当前网络使用。从而基于允许的本地业务的信息生成该UE的本地业务策略。其中，该本地业务策略可以包括本地业务类型标识、本地业务APN、QoS参数、计费策略或者用户等级，等等。
311、控制面网元在授权通过的情况下，将包括UE的本地业务策略和授权结果的授权指示发送给本地网络设备。
本发明实施例中，控制面网元在对UE从非授权频谱接入节点接入归属网络进行接入授权后，会向本地网络设备发送授权指示。如果允许UE从非授权频谱接入节点接入归属网络，控制面网元则发送本地业务策略或者授权通过的授权结果给本地网络设备，本地网络设备从而将授权结果经非授权频谱接入节点发送给UE；如果不允许UE从非授权频谱接入节点接入归属网络，控制面网元则发送接入失败授权结果给UE，或者发送接入回复消息中包含失败原因值给UE。
312、本地网络设备接收授权指示，并存储该UE的本地业务策略。
本发明实施例中，本地网络设备在接收到授权指示后，可以存储授权指示包括的该UE的本地业务策略，以便UE后续在发起本地业务请求时，基于存储的本地业务策略对该UE进行本地业务授权。
步骤313～314与上一实施例中步骤206～207相同，本发明实施例在此不再赘 述。
可见，在图3所描述的方法中，UE初始附着时，通过非授权频谱接入节点发送接入请求消息到归属运营商核心网络，归属运营商的控制面网元以及HSS基于UE的签约数据和UE使用的接入技术、非授权频谱接入节点的接入模式、本地网络的标识、时间信息、位置信息等对UE进行接入授权，从而可以实现对UE从非授权频谱接入节点接入归属网络进行接入授权，在接入授权成功后，本地网络可以分担归属网络的部分业务，从而可以减少归属网络负载，提高资源利用率。
基于图1所示的系统架构，本发明实施例公开了又一种网络接入授权方法。请参阅图4，图4是本发明实施例公开的另一种网络接入授权方法的流程示意图。其中，图4所示的方法应用于UE已经通过授权频谱接入节点初始附着到运营商EPC，后续通过非授权频谱接入节点发送服务请求消息到归属运营商EPC的场景。如图4所示，该网络接入授权方法可以包括以下步骤：
401、UE向非授权频谱接入节点发送服务请求消息。
本发明实施例中，服务请求消息可以为Service Request、Re-Authorization Request或者连接请求消息等。服务请求消息可以包含有归属运营商网络为该UE分配的临时标识，该临时标识中含有UE附着的控制面网元如MME的标识。
本发明实施例中，UE在从授权频谱接入节点附着到归属网络后，此时在搜索到非授权频谱网络时，向非授权频谱接入节点发送服务请求消息。其中，该服务请求消息可以包括该归属网络的标识、UE的位置信息、当前的时间信息等。
402、非授权频谱接入节点接收该服务请求消息并转发给本地网络设备。
403、本地网络设备接收该服务请求消息并根据服务请求消息包括的归属网络标识生成路由信息。
404、本地网络设备根据路由信息向控制面网元发送包括该服务请求消息和接入信息的第一消息。
本发明实施例中，步骤402～404同上一实施例中步骤302～304，本发明实施例在此不再赘述。
405、控制面网元接收第一消息，并根据服务请求消息包括的UE的临时标识确定是否为UE附着的控制面网元。
本发明实施例中，UE的临时标识为归属网络设备为UE分配的。控制面网元在接收到本地网络设备发送的第一消息后，会根据服务请求消息中包括的临时标识确定是否为该UE附着的控制面网元。具体的，控制面网元会判断是否存在该UE的上下文，如基于该UE的临时标识查找该UE的上下文，或者基于该UE的临时标识中控制面网元的标识信息判断是否为相同的控制面网元。如果当前的控制面网元不是该UE附着的控制面网元，那么该控制面网元会将该第一消息(包括服务请求消息和接入信息)转发给该UE附着的控制面网元，该UE附着的控制面网元从而会基于该服务请求消息、接入信息以及UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权。
406、在该控制面网元为UE附着的控制面网元的情况下，控制面网元判断UE是否处于空闲态。
本发明实施例中，在该控制面网元判断出其为该UE附着的控制面网元的情况下，该控制面网元首先会根据该UE在3GPP侧的连接状态判断该UE是否可以从非授权频谱接入节点接入。具体的，如果UE当前在3GPP侧为连接态，那么控制面网元会拒绝该UE的服务请求；如果UE当前在3GPP侧为空闲态，那么控制面网元会即基于服务请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权，具体同上一实施例，本发明实施例在此不再赘述。。
具体实现中，控制面网元判断UE是否处于空闲态的具体方式可以为：控制面网元基于S1接口连接是否存在来判断UE的状态，如果S1接口连接存在，则UE处于连接态，否则处于空闲态。
407、在UE处于空闲态的情况下，控制面网元基于服务请求消息、接入信息和UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。
本发明实施例中，在UE处于空闲状态的情况下，控制面网元会基于服务请求消息、接入信息和UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。具体方式同步骤309。
步骤408～412与上一实施例中步骤310～314相同，本发明实施例在此不再赘述。
可见，在图4所描述的方法中，UE已经通过授权频谱接入节点初始附着到运营商EPC，后续通过非授权频谱接入节点发送服务请求消息到归属运营商核心网络，归属运营商的控制面网元基于UE的签约数据和UE使用的接入技术、非授权频谱接入节点的接入模式、本地网络的标识、时间信息、位置信息等对UE进行接入授权，从而可以实现UE接入非授权频谱网络时的接入授权，在接入授权成功后，本地网络可以分担归属网络的部分业务，从而可以减少归属网络负载，提高资源利用率。
基于图1所示的系统架构，本发明实施例公开了一种本地业务授权方法。请参阅图5，图5是本发明实施例公开的一种本地业务授权方法的流程示意图。其中，图5所示的本地业务授权方法是在图2、图3和图4所示的网络接入授权方法的基础上进行的。如图5所示，该本地业务授权方法可以包括以下步骤。
501、UE向非授权频谱接入节点发送本地业务连接建立请求消息。
本发明实施例中，归属网络的控制面网元以及HSS在对UE从非授权频谱接入节点接入归属网络授权通过后，UE会接收到授权通过的授权结果。当UE需要进行本地业务时，可以向LTE-U接入节点发起本地业务，即发送本地业务连接建立请求消息给非授权频谱接入节点，该本地业务连接建立请求消息用于请求本地网络设备为该UE建立本地业务连接。
502、非授权频谱接入节点接收并转发该本地业务连接建立请求消息给本地网络设备。
503、本地网络设备接收该本地业务连接建立请求消息，并根据该UE的本地业务策略对UE进行本地业务授权。
本发明实施例中，该本地业务连接建立请求消息具体可以为PDN连接建立请求消息，该请求消息可以包括该UE的本地业务类型或者本地业务APN标识。本地网络设备在接收到该本地业务连接建立请求消息后，会基于该UE的本地业务策略对该UE进行本地业务授权。
本发明实施例中，本地网络设备根据该UE的本地业务策略对UE进行本地业务授权的具体方式可以为：
在该本地业务连接建立请求消息包括该UE请求的本地业务类型的情况下，判断该UE的本地业务策略中的业务类型是否包含该UE请求的本地业务类型，如果包括该UE请求的本地业务类型，则确定对该UE的本地业务授权通过；
或者，
在该本地业务连接建立请求消息包括该UE请求的本地业务APN标识的情况下，判断该UE的本地业务策略中的业务APN标识是否包含该UE请求的本地业务APN标识，如果存在该UE的本地业务APN标识，则确定对该UE的本地业务授权通过。
具体的，如果UE请求的本地业务类型与本地业务策略中的业务类型匹配，则业务授权通过，或UE请求的本地业务APN的标识与本地业务策略中业务APN的标识匹配，则授权通过。或者，当UE请求的本地业务(本地业务类型或本地业务APN标识)与本地业务策略中的本地业务不匹配，或UE没有携带任何业务指示时，本地网络设备会向控制面网元发送PDN连接建立请求消息(也可以是转发UE发送的PDN连接建立请求消息)，控制面网元基于现有流程在EPC建立PDN连接。
504、在对UE的本地业务授权通过的情况下，本地网络设备为UE建立本地业务连接。
本发明实施例中，对于本地业务授权通过的请求，本地网络设备为上述业务建立连接，并根据本地业务策略中相关的QoS参数提供QoS保证，以及完成计费需求。此外，UE的归属网络发送的用户等级指示也可以用来进行业务调度控制，如当拥塞发生时优先保证用户等级高的用户业务。上述业务连接建立 方式同现有技术，即本地网络设备选择本地网络的服务网关，发送本地业务连接建立请求消息(PDN连接建立请求消息)如创建会话请求消息给本地网络的服务网关，本地网络的服务网关为业务分配资源并通知本地网络设备。
505、本地网络设备向非授权频谱接入节点发送本地业务连接建立成功的通知。
506、非授权频谱接入节点转发本地业务连接建立成功的通知给UE。
可见，在图5所描述的方法中，归属网络的控制面网元以及HSS在对UE从LTE-U接入节点接入归属网络授权通过的情况下，本地网络设备会根据控制面网元发送的该UE的签约数据对UE进行本地业务授权，从而可以实现UE接入LTE-U网络时的本地业务授权，在本地业务授权成功后，UE的本地业务可以在本地网络进行，从而可以分担归属网络的部分业务，减少归属网络负载，提高资源利用率。
基于图1所示的系统架构，本发明实施例公开了一种控制面网元。请参阅图6，图6是本发明实施例公开的一种控制面网元的结构示意图。其中，图6所描述的控制面网元600可以应用于上述方法实施例。如图6所示，该控制面网元600可以包括接收模块601、处理模块602以及发送模块603，其中：
接收模块601，用于接收本地网络设备发送的第一消息，该第一消息包括UE的请求消息和接入信息，该请求消息用于请求该UE从非授权频谱接入节点接入该UE的归属网络。
处理模块602，用于基于该请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权。
发送模块603，用于将授权指示发送给该UE，该授权指示包括该接入授权的授权结果。
具体的，发送模块603将授权指示发送给本地网络设备，本地网络设备经LTE-U接入节点将授权结果发送给该UE。
作为一种可行的实施方式，签约数据可以包括该UE接入归属网络允许使 用的接入技术的第二指示信息，接入信息可以包括第一指示信息，第一指示信息用于指示该UE接入归属网络使用的接入技术为从非授权频谱接入节点接入；处理模块602基于该请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于请求消息判断第二指示信息是否包含第一指示信息，如果包含第一指示信息，则确定允许该UE从该非授权频谱接入节点接入归属网络，即对UE接入授权通过；或者，如果未包含第一指示信息，则确定拒绝该UE从该非授权频谱接入节点接入归属网络，即对UE接入授权失败。
作为另一种可行的实施方式，该签约数据还可以包括允许UE从非授权频谱接入节点接入归属网络时，非授权频谱接入节点的第一接入模式，在接入信息还包括UE请求从非授权频谱接入节点接入归属网络时，该非授权频谱接入节点的第二接入模式的情况下，如果第二指示信息包含第一指示信息，处理模块602会进一步判断第一接入模式和第二接入模式是否匹配，如果匹配，才能确定允许该UE从该非授权频谱接入节点接入归属网络。
或者说，如果第二指示信息包含第一指示信息，但第一接入模式和第二接入模式不匹配，则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
作为又一种可行的实施方式，该签约数据还可以包括域标识列表，域标识列表包括允许该UE从非授权频谱接入节点接入归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；在该接入信息还包括该UE请求从非授权频谱接入节点接入归属网络的本地网络的标识的情况下，如果第二指示信息包含第一指示信息，处理模块602还会进一步判断域标识列表中是否存在该本地网络的标识，如果存在该本地网络的标识，才确定允许该UE从该非授权频谱接入节点接入归属网络，其中，本地网络的标识包括本地网络的服务提供商标识和漫游联盟标识中的至少一种。
或者说，如果第二指示信息包含第一指示信息，但域标识列表中不存在该本地网络的标识，则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
进一步的，该签约数据还可以扩展允许该UE从非授权频谱接入节点接入 归属网络的时间信息、位置信息(如3GPP位置信息)、非授权频谱接入节点的安全等级，以及本地网络的安全认证方式中的至少一种。那么本地网络设备给控制面网元发送的接入信息同样还可以包括该UE请求从非授权频谱接入节点接入归属网络的时间信息、位置信息、非授权频谱接入节点的安全等级，以及本地网络的安全认证方式中的至少一种。
作为又一种可行的实施方式，在该UE的请求消息为接入请求消息的情况下，
发送模块603，还用于向HSS发送第二消息，该第二消息用于获取该UE的签约数据。
接收模块601，还用于接收该HSS发送的该UE的签约数据。
本发明实施例中，在UE初始附着时，UE通过非授权频谱接入节点向控制面网元600发送接入请求消息，控制面网元600需要从HSS获取该UE的签约数据。
作为又一种可行的实施方式，在该UE的请求消息为服务请求消息，且该服务请求消息包括归属网络为该UE分配的临时标识的情况下，
处理模块602，还用于基于该临时标识确定该控制面网元600是否为该UE附着的控制面网元，在该控制面网元600为该UE附着的控制面网元的情况下，判断该UE是否处于空闲态，并在该UE处于空闲态的情况下，执行基于请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的操作。
本发明实施例中，在UE已经附着归属网络时，UE通过非授权频谱接入节点向控制面网元600发送服务请求消息，控制面网元600需要确定其是否为UE初始附着的控制面网元，且UE在3GPP侧是否处于空闲态，如果控制面网元600为UE初始附着的控制面网元，且UE在3GPP侧处于空闲态，控制面网元600才基于请求消息、接入信息和签约数据对UE进行接入授权。
作为又一种可行的实施方式，处理模块602，还用于在该接入授权的授权结果为允许该UE从非授权频谱接入节点接入归属网络的情况下，从该UE的签 约数据中获取允许UE在本地网络使用的本地业务类型，并基于该本地业务类型生成该UE的本地业务策略。
发送模块603，还用于将该UE的本地业务策略发送给本地网络设备，以便于本地网络设备基于该UE的本地业务策略对后续该UE发起的本地业务进行本地业务授权。
本发明实施例中，在对UE从非授权频谱接入节点接入归属网络授权通过后，控制面网元600可以针对允许UE在本地网络使用的本地业务类型生成UE的本地业务策略，以便UE在发起本地业务时，本地网络设备可以基于本地业务策略对其进行本地业务授权，从而提高了对UE进行本地业务授权的效率。
基于图1所示的系统架构，本发明实施例公开了另一种控制面网元。请参阅图7，图7是本发明实施例公开的另一种控制面网元的结构示意图。其中，图7所描述的控制面网元700可以应用于上述方法实施例。如图7所示，该控制面网元700可以包括接收器701、处理器702以及发送器703，其中：
接收器701，用于接收本地网络设备发送的第一消息，该第一消息包括UE的请求消息和接入信息，该请求消息用于请求该UE从非授权频谱接入节点接入该UE的归属网络。
处理器702，用于基于该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权。
发送器703，用于将授权指示发送给该UE，该授权指示包括该接入授权的授权结果。
具体的，发送器703将授权指示发送给本地网络设备，本地网络设备经LTE-U接入节点将授权结果发送给该UE。
作为一种可行的实施方式，签约数据可以包括该UE接入归属网络允许使用的接入技术的第二指示信息，接入信息可以包括第一指示信息，第一指示信息用于指示该UE接入归属网络使用的接入技术为从非授权频谱接入节点接入；处理器702基于该请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于请求消息判断第二指示信息是否包含第一指示信息，如果包含第一指示信息，则确定允许该UE从该非授权频谱接入节点接入归属网络，即对UE接入授权通过；或者，如果未包含第一指示信息，则确定拒绝该UE从该非授权频谱接入节点接入归属网络，即对UE接入授权失败。
作为另一种可行的实施方式，该签约数据还可以包括允许UE从非授权频谱接入节点接入归属网络时，非授权频谱接入节点的第一接入模式，在接入信息还包括UE请求从非授权频谱接入节点接入归属网络时，该非授权频谱接入节点的第二接入模式的情况下，如果第二指示信息包含第一指示信息，处理器702会进一步判断第一接入模式和第二接入模式是否匹配，如果匹配，才能确定允许该UE从该非授权频谱接入节点接入归属网络。
或者说，如果第二指示信息包含第一指示信息，但第一接入模式和第二接入模式不匹配，则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
作为又一种可行的实施方式，该签约数据还可以包括域标识列表，域标识列表包括允许该UE从非授权频谱接入节点接入归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；在该接入信息还包括该UE请求从非授权频谱接入节点接入归属网络的本地网络的标识的情况下，如果第二指示信息包含第一指示信息，处理器702还会进一步判断域标识列表中是否存在该本地网络的标识，如果存在该本地网络的标识，才确定允许该UE从该非授权频谱接入节点接入归属网络，其中，本地网络的标识包括本地网络的服务提供商标识和漫游联盟标识中的至少一种。
或者说，如果第二指示信息包含第一指示信息，但域标识列表中不存在该本地网络的标识，则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
进一步的，该签约数据还可以扩展允许该UE从非授权频谱接入节点接入归属网络的时间信息、位置信息(如3GPP位置信息)、非授权频谱接入节点的安全等级，以及本地网络的安全认证方式中的至少一种。那么本地网络设备给控制面网元发送的接入信息同样还可以包括该UE请求从非授权频谱接入节点接入归属网络的时间信息、位置信息、非授权频谱接入节点的安全等级，以及 本地网络的安全认证方式中的至少一种。
作为又一种可行的实施方式，在该UE的请求消息为接入请求消息的情况下，
发送器703，还用于向HSS发送第二消息，该第二消息用于获取该UE的签约数据。
接收器701，还用于接收该HSS发送的该UE的签约数据。
本发明实施例中，在UE初始附着时，UE通过非授权频谱接入节点向控制面网元700发送接入请求消息，控制面网元700需要从HSS获取该UE的签约数据。
作为又一种可行的实施方式，在该UE的请求消息为服务请求消息，且该服务请求消息包括归属网络为该UE分配的临时标识的情况下，
处理器702，还用于基于该临时标识确定该控制面网元700是否为该UE附着的控制面网元，在该控制面网元700为该UE附着的控制面网元的情况下，判断该UE是否处于空闲态，并在该UE处于空闲态的情况下，执行基于请求消息、接入信息和该UE的签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的操作。
本发明实施例中，在UE已经附着归属网络时，UE通过非授权频谱接入节点向控制面网元700发送服务请求消息，控制面网元700需要确定其是否为UE初始附着的控制面网元，且UE在3GPP侧是否处于空闲态，如果控制面网元700为UE初始附着的控制面网元，且UE在3GPP侧处于空闲态，控制面网元700才基于签约数据对UE进行接入授权。
作为又一种可行的实施方式，处理器702，还用于在该接入授权的授权结果为允许该UE从非授权频谱接入节点接入归属网络的情况下，从该UE的签约数据中获取允许UE在本地网络使用的本地业务类型，并基于该本地业务类型生成该UE的本地业务策略。
发送器703，还用于将该UE的本地业务策略发送给本地网络设备，以便于本地网络设备基于该UE的本地业务策略对后续该UE发起的本地业务进行本 地业务授权。
本发明实施例中，在对UE从非授权频谱接入节点接入归属网络授权通过后，控制面网元700可以针对允许UE在本地网络使用的本地业务类型生成UE的本地业务策略，以便UE在发起本地业务时，本地网络设备可以基于本地业务策略对其进行本地业务授权，从而提高了对UE进行本地业务授权的效率。
可见，在图6和图7所描述的控制面网元中，控制面网元在接收到UE从非授权频谱接入节点接入归属网络的请求消息后，可以基于该UE的签约数据和UE使用的接入技术、非授权频谱接入节点的接入模式、本地网络的标识、时间信息、位置信息等对UE从非授权频谱接入节点接入归属网络进行接入授权，从而可以实现UE接入非授权频谱网络的接入授权。进一步的，在接入授权成功后，本地网络可以分担归属网络的部分业务，从而可以减少归属网络负载，提高资源利用率。
基于图1所示的系统架构，本发明实施例公开了一种本地网络设备。请参阅图8，图8是本发明实施例公开的一种本地网络设备的结构示意图。其中，图8所描述的本地网络设备800可以应用于上述方法实施例。如图8所示，该本地网络设备800可以包括接收模块801、发送模块802以及处理模块803，其中：
接收模块801，用于接收非授权频谱接入节点发送的UE的请求消息，其中，该请求消息用于请求该UE从非授权频谱接入节点接入该UE的归属网络。
发送模块802，用于向控制面网元发送第一消息，其中，该第一消息包括该请求消息和接入信息。
接收模块801，还用于接收该控制面网元发送的授权指示，其中，该授权指示由控制面网元基于请求消息、接入信息和UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权得到，该授权指示包括接入授权的授权结果。
发送模块802，还用于将该授权结果发送给该UE。
具体的，本地网络设备将该授权结果发送给非授权频谱接入节点，由非授 权频谱接入节点转发给该UE。
作为一种可行的实施方式，在该请求消息包括该归属网络的标识的情况下，处理模块803，用于根据该归属网络的标识生成路由信息。
那么发送模块802向控制面网元发送第一消息的具体方式可以理解为：
根据该路由信息向该控制面网元发送第一消息。
其中，该路由信息可以为NAI，NAI中除了含有该请求消息最终到达的目的域HPLMA信息之外，还包含中间节点域标识信息，如VPLMN、域名如FQDN等。发送模块802根据路由信息中的中间节点域标识信息以及目的域信息可以将UE的请求消息发送给归属网络的控制面网元，从而提高了信息的传递效率。
作为另一种可行的实施方式，在该接入授权的授权结果为允许该UE从非授权频谱接入节点接入归属网络的情况下，该授权指示还可以包括该UE的本地业务策略：
接收模块801，还用于接收非授权频谱接入节点发送的第二消息，其中，该第二消息用于请求为该UE建立本地业务连接。
处理模块803，还用于基于该UE的本地业务策略对该UE进行本地业务授权，并在对该UE的本地业务授权通过的情况下，为该UE建立本地业务连接。
在对UE从非授权频谱接入节点接入归属网络进行接入授权通过的情况下，如果UE发起本地业务，本地网络设备800可以基于该UE的本地业务策略对该UE进行本地业务授权，从而可以提高对UE接入非授权频谱网络时本地业务授权的效率。
作为又一种可行的实施方式，处理模块803基于该UE的本地业务策略对该UE进行本地业务授权的具体方式可以为：
在第二消息含有UE请求的本地业务类型的情况下，判断该UE的本地业务策略中的业务类型是否包含该UE请求的本地业务类型，如果包含该UE请求的本地业务类型，则确定对该UE的本地业务授权通过；或者，如果未包含该UE请求的本地业务类型，则确定对该UE的本地业务授权失败。
或者，
在第二消息含有该UE请求的本地业务APN标识的情况下，判断该UE的本地业务策略中的业务APN标识是否包含该本地业务APN标识，如果包含该本地业务APN标识，则确定对该UE的本地业务授权通过；或者，如果未包含该本地业务APN标识，则确定对该UE的本地业务授权失败。
基于图1所示的系统架构，本发明实施例公开了另一种本地网络设备。请参阅图9，图9是本发明实施例公开的另一种本地网络设备的结构示意图。其中，图9所描述的本地网络设备900可以应用于上述方法实施例。如图9所示，该本地网络设备900可以包括接收器901、发送器902以及处理器903，其中：
接收器901，用于接收非授权频谱接入节点发送的UE的请求消息，其中，该请求消息用于请求该UE从非授权频谱接入节点接入该UE的归属网络。
发送器902，用于向控制面网元发送第一消息，其中，该第一消息包括该请求消息和接入信息。
接收器901，还用于接收该控制面网元发送的授权指示，其中，该授权指示由控制面网元基于请求消息、接入信息和UE的签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权得到，该授权指示包括接入授权的授权结果。
发送器902，还用于将该授权结果发送给该UE。
作为一种可行的实施方式，在该请求消息包括该归属网络的标识的情况下，处理器903，用于根据该归属网络的标识生成路由信息。
那么发送器902向控制面网元发送第一消息的具体方式可以理解为：
根据该路由信息向该控制面网元发送第一消息。
作为另一种可行的实施方式，在该接入授权的授权结果为允许该UE从非授权频谱接入节点接入归属网络的情况下，该授权指示还可以包括该UE的本地业务策略：
接收器901，还用于接收非授权频谱接入节点发送的第二消息，其中，该第二消息用于请求为该UE建立本地业务连接。
处理器903，还用于基于该UE的本地业务策略对该UE进行本地业务授权， 并在对该UE的本地业务授权通过的情况下，为该UE建立本地业务连接。
在对UE从非授权频谱接入节点接入归属网络进行接入授权通过的情况下，如果UE发起本地业务，本地网络设备900可以基于该UE的本地业务策略对该UE进行本地业务授权，从而可以提高对UE接入非授权频谱网络时本地业务授权的效率。
作为又一种可行的实施方式，处理器903基于该UE的本地业务策略对该UE进行本地业务授权的具体方式可以为：
在第二消息含有UE请求的本地业务类型的情况下，判断该UE的本地业务策略中的业务类型是否包含该UE请求的本地业务类型，如果包含该UE请求的本地业务类型，则确定对该UE的本地业务授权通过；或者，如果未包含该UE请求的本地业务类型，则确定对该UE的本地业务授权失败。
或者，
在第二消息含有该UE请求的本地业务APN标识的情况下，判断该UE的本地业务策略中的业务APN标识是否包含该本地业务APN标识，如果包含该本地业务APN标识，则确定对该UE的本地业务授权通过；或者，如果未包含该本地业务APN标识，则确定对该UE的本地业务授权失败。
可见，在图8和图9所描述的本地网络设备中，本地网络设备在接收到UE从非授权频谱接入节点接入归属网络的请求消息时，会将其转发给归属网络的控制面网元。在控制面网元对UE接入授权通过的情况下，如果UE发起本地业务，本地网络设备可以基于UE的本地业务策略对该UE进行本地业务授权，从而可以实现UE接入非授权频谱网络时的本地业务授权，在本地业务授权成功后，UE的本地业务可以在本地网络进行，从而可以分担归属网络的部分业务，减少归属网络负载，提高资源利用率。
基于图1所示的系统架构，本发明实施例公开了一种HSS。请参阅图10，图10是本发明实施例公开的一种HSS的结构示意图。其中，图10所描述的HSS1000可以应用于上述方法实施例。如图10所示，该HSS1000可以包括接 收模块1001、处理模块1002以及发送模块1003，其中：
接收模块1001，用于接收控制面网元发送的第一消息，其中，该第一消息用于获取UE的签约数据，该第一消息包括该UE的接入请求消息和接入信息，该接入请求消息用于请求该UE从非授权频谱接入节点接入归属网络。
处理模块1002，用于获取该UE的签约数据，并基于接入请求消息、接入信息和签约数据对UE从非授权频谱接入节点接入归属网络进行接入授权。
发送模块1003，用于在允许该UE从非授权频谱接入节点接入归属网络的情况下，将该签约数据发送给该控制面网元，以便控制面网元基于该签约数据对该UE从非授权频谱接入节点接入归属网络再次进行接入授权。
作为一种可行的实施方式，签约数据可以包括用于指示UE接入归属网络允许使用的接入技术的第二指示信息，接入信息可以包括用于指示UE接入归属网络使用的接入技术为从非授权频谱接入节点接入的第一指示信息，那么处理模块1002基于接入请求消息、接入信息和签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于该接入请求消息判断第二指示信息是否匹配包含第一指示信息，如果包含第一指示信息，则确定允许该UE从非授权频谱接入节点接入归属网络；或者，如果未包含第一指示信息，则确定拒绝该UE从非授权频谱接入节点接入归属网络。
作为另一种可行的实施方式，签约数据可以包括域标识列表，域标识列表包括允许该UE从非授权频谱接入节点接入归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；接入信息还包括该UE请求从非授权频谱接入节点接入归属网络的本地网络的标识，本地网络的标识包括本地网络的服务提供商标识和漫游联盟标识中的至少一种。那么处理模块1002基于接入请求消息、接入信息和签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于接入请求消息判断域标识列表中是否存在该本地网络的标识，如果存在该本地网络的标识，则确定允许该UE从该非授权频谱接入节点接入归属网 络；或者，如果不存在该本地网络的标识，则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
基于图1所示的系统架构，本发明实施例公开了另一种HSS。请参阅图11，图11是本发明实施例公开的另一种HSS的结构示意图。其中，图11所描述的HSS1100可以应用于上述方法实施例。如图11所示，该HSS1100可以包括接收器1101、处理器1102以及发送器1103，其中：
接收器1101，用于接收控制面网元发送的第一消息，其中，该第一消息用于获取UE的签约数据，该第一消息包括该UE的接入请求消息和接入信息，该接入请求消息用于请求该UE从非授权频谱接入节点接入归属网络。
处理器1102，用于获取该UE的签约数据，并基于接入请求消息、接入信息和签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权。
发送器1103，用于在允许该UE从非授权频谱接入节点接入归属网络的情况下，将该签约数据发送给该控制面网元，以便控制面网元基于该签约数据对该UE从非授权频谱接入节点接入归属网络再次进行接入授权。
作为一种可行的实施方式，签约数据可以包括用于指示UE接入归属网络允许使用的接入技术的第二指示信息，接入信息可以包括用于指示UE接入归属网络使用的接入技术为从非授权频谱接入节点接入的第一指示信息，那么处理器1102基于接入请求消息、接入信息和签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于该接入请求消息判断第二指示信息是否匹配包含第一指示信息，如果包含第一指示信息，则确定允许该UE从非授权频谱接入节点接入归属网络；或者，如果未包含第一指示信息，则确定拒绝该UE从非授权频谱接入节点接入归属网络。
作为另一种可行的实施方式，签约数据可以包括域标识列表，域标识列表包括允许该UE从非授权频谱接入节点接入归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；接入信息还包括该UE请求从非授权频谱接入节点接入归属网络的本地网络的标识，本地网络的标识包括本地网络的服 务提供商标识和漫游联盟标识中的至少一种。那么处理器1102基于接入请求消息、接入信息和签约数据对该UE从非授权频谱接入节点接入归属网络进行接入授权的具体方式可以为：
基于接入请求消息判断域标识列表中是否存在该本地网络的标识，如果存在该本地网络的标识，则确定允许该UE从该非授权频谱接入节点接入归属网络；或者，如果不存在该本地网络的标识，则确定拒绝该UE从该非授权频谱接入节点接入归属网络。
可见在图10和图11所描述的HSS中，在UE通过非授权频谱接入节点初始附着归属网络的情况下，HSS在接收到用于获取UE的签约数据的第一消息后，可以基于第一消息中的接入请求消息、接入信息和UE的签约数据对UE进行初次接入授权。在授权通过的情况下才将其签约数据发送给控制面网元，以便控制面网元基于该签约数据对UE进行再次接入授权。由HSS和控制面网元分层次对UE从非授权频谱接入节点接入归属网络进行接入授权，可以提高对UE进行接入授权的准确度。
基于图1所示的系统架构，本发明实施例公开了一种网络接入授权系统。请参阅图12，图12是本发明实施例公开的一种网络接入授权系统的结构示意图。如图12所示，该系统可以包括UE121、非授权频谱接入节点122、本地网络设备123、控制面网元124以及HSS125，用于执行上述方法实施例所公开的网络接入授权方法的流程步骤。其中，本地网络设备123为图8和图9所描述的本地网络设备，控制面网元124为图6和图7所描述的控制面网元，HSS为图10和图11所描述的HSS。
UE121在发现非授权频谱接入节点122后，可以向非授权频谱接入节点发送请求消息，请求接入归属网络，其中，该请求消息包括有归属网络的标识。非授权频谱接入节点122会将该请求消息转发给本地网络设备123，如本地网络的MME。本地网络设备123基于归属网络的标识以及网络拓扑结构生成路由信息，从而根据路由信息将请求消息路由到归属网络的控制面网元124，如 MME/AAA服务器等。
如果该请求消息为接入请求消息，即UE121为初始附着归属网络，那么控制面网元124会基于该接入请求消息向HSS125获取该UE121的签约数据。HSS125基于该签约数据以及请求消息中UE121从非授权频谱接入节点122接入归属网络的接入信息对UE121进行接入授权，在授权通过的情况下才将UE121的签约数据发送给控制面网元124，以便控制面网元124基于该签约数据对UE121再次进行接入授权。
如果该请求消息为服务请求消息，即UE121已经通过授权频谱接入节点附着归属网络，现需要通过非授权频谱接入节点122发送服务请求到归属网络，那么控制面网元124在确定为UE121附着的控制面网元且UE121在3GPP侧为空闲状态的情况下，会基于UE121的签约数据和接入信息对UE121进行接入授权。
其中，UE121的签约数据可以扩展UE121接入归属网络允许使用的接入技术的指示信息，允许UE121从非授权频谱接入节点接入归属网络时非授权频谱接入节点的接入模式，本地网络所属的服务提供商或漫游联盟标识，等等；接入信息可以包括UE121请求接入归属网络所使用的接入技术(从非授权频谱接入节点122接入)的指示信息，UE121请求从非授权频谱接入节点接入归属网络时非授权频谱接入节点122的接入模式，本地网络所属的服务提供商或漫游联盟标识，等等。
进一步的，在控制面网元124对UE121从非授权频谱接入节点122接入归属网络授权通过的情况下，如果UE121向本地网络设备123发起本地业务，本地网络设备123会根据UE121的本地业务策略对UE121进行本地业务授权。
可见，在图12所描述的网络接入授权系统中，网络接入授权系统可以实现对UE从非授权频谱接入节点接入归属网络的接入授权和本地业务授权，在接入授权成功后，本地网络可以分担归属网络的部分业务，从而可以减少归属网络负载，提高资源利用率。
需要说明的是，在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详细描述的部分，可以参见其他实施例的相关描述。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
本发明实施例方法中的步骤可以根据实际需要进行顺序调整、合并和删减。
本发明实施例控制面网元、本地网络设备、HSS中的模块可以根据实际需要进行合并、划分和删减。
本发明实施例中所述控制面网元、本地网络设备、HSS，可以通过通用集成电路，例如CPU(Central Processing Unit，中央处理器)，或通过ASIC(Application Specific Integrated Circuit，专用集成电路)来实现。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上对本发明实施例公开的一种网络接入授权方法、相关设备及系统进行了详细介绍，本文中应用了具体实例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (29)

  1. 一种网络接入授权方法，应用于演进的分组系统EPS，其特征在于，所述EPS包括非授权频谱接入节点和本地网络设备，所述方法包括：
    控制面网元接收所述本地网络设备发送的第一消息，所述第一消息包括用户设备UE的请求消息和接入信息，所述请求消息用于请求所述UE从所述非授权频谱接入节点接入所述UE的归属网络；
    所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述所述非授权频谱接入节点接入所述归属网络进行接入授权；
    所述控制面网元将授权指示发送给所述UE，所述授权指示包括所述接入授权的授权结果。
  2. 根据权利要求1所述的方法，其特征在于，所述接入信息包括第一指示信息，所述第一指示信息用于指示所述UE接入所述归属网络使用的接入技术为从所述非授权频谱接入节点接入，所述签约数据包括用于指示所述UE接入所述归属网络允许使用的接入技术的第二指示信息；
    所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权，包括：
    所述控制面网元基于所述请求消息判断所述第二指示信息是否包含所述第一指示信息；
    在所述第二指示信息包含所述第一指示信息的情况下，所述控制面网元确定允许所述UE从所述非授权频谱接入节点接入所述归属网络；
    或者，
    在所述第二指示信息未包含所述第一指示信息的情况下，所述控制面网元确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  3. 根据权利要求2所述的方法，其特征在于，所述签约数据还包括允许所述UE从所述非授权频谱接入节点接入所述归属网络时，所述非授权频谱接入 节点的第一接入模式，所述接入信息还包括所述UE请求从所述非授权频谱接入节点接入所述归属网络时，所述非授权频谱接入节点的第二接入模式；
    所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权，还包括：
    在所述第二指示信息包含所述第一指示信息的情况下，所述控制面网元判断所述第一接入模式和所述第二接入模式是否匹配；
    在所述第一接入模式和所述第二接入模式匹配的情况下，执行所述控制面网元确定允许所述UE从所述非授权频谱接入节点接入所述归属网络的操作；
    或者，
    在所述第一接入模式和所述第二接入模式不匹配的情况下，所述控制面网元确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  4. 根据权利要求2所述的方法，其特征在于，所述签约数据还包括域标识列表，所述域标识列表包括允许所述UE从所述非授权频谱接入节点接入所述归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；所述接入信息还包括所述UE请求从所述非授权频谱接入节点接入所述归属网络的本地网络的标识，所述本地网络的标识包括所述本地网络的服务提供商标识和漫游联盟标识中的至少一种；
    所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权，还包括：
    在所述第二指示信息包含所述第一指示信息的情况下，所述控制面网元判断所述域标识列表中是否存在所述本地网络的标识；
    在所述域标识列表中存在所述本地网络的标识的情况下，执行所述控制面网元确定允许所述UE从所述非授权频谱接入节点接入所述归属网络的操作；
    或者，
    在所述域标识列表中不存在所述本地网络的标识的情况下，所述控制面网元确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  5. 根据权利要求3或4所述的方法，其特征在于，所述签约数据还包括允许所述UE从所述非授权频谱接入节点接入所述归属网络的时间信息、位置信息、所述非授权频谱接入节点的安全等级以及本地网络的安全认证方式中的至少一种；
    或者，
    所述接入信息还包括所述UE请求从所述非授权频谱接入节点接入所述归属网络的时间信息、位置信息、所述非授权频谱接入节点的安全等级以及本地网络的安全认证方式中的至少一种。
  6. 根据权利要求1～5任一项所述的方法，其特征在于，当所述请求消息为接入请求消息时，所述控制面网元接收所述本地网络设备发送的第一消息之后，以及所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权之前，所述方法还包括：
    所述控制面网元向归属网络签约服务器HSS发送第二消息，所述第二消息用于获取所述UE的签约数据；
    所述控制面网元接收所述HSS发送的所述签约数据。
  7. 根据权利要求1～5任一项所述的方法，其特征在于，当所述请求消息为服务请求消息时，所述服务请求消息包括所述UE的临时标识，所述控制面网元接收所述本地网络设备发送的第一消息之后，所述方法还包括：
    所述控制面网元基于所述临时标识确定所述控制面网元是否为所述UE附着的控制面网元；
    在所述控制面网元为所述UE附着的控制面网元的情况下，所述控制面网 元判断所述UE是否处于空闲态；在所述UE处于空闲态的情况下，执行所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权的操作。
  8. 根据权利要求1所述的方法，其特征在于，所述签约数据包括允许所述UE在本地网络使用的本地业务类型，所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权之后，所述方法还包括：
    在所述接入授权的授权结果为允许所述UE从所述非授权频谱接入节点接入所述归属网络的情况下，所述控制面网元从所述签约数据中获取所述本地业务类型；
    所述控制面网元基于所述本地业务类型生成所述UE的本地业务策略；
    所述控制面网元将所述本地业务策略发送给所述本地网络设备，以便所述本地网络设备基于所述本地业务策略对所述UE发起的本地业务进行本地业务授权。
  9. 一种网络接入授权方法，应用于EPS，其特征在于，所述EPS包括非授权频谱接入节点和本地网络设备，所述方法包括：
    所述本地网络设备接收所述非授权频谱接入节点发送的UE的请求消息，所述请求消息用于请求所述UE从所述非授权频谱接入节点接入所述UE的归属网络；
    所述本地网络设备向控制面网元发送第一消息，所述第一消息包括所述请求消息和接入信息；
    所述本地网络设备接收所述控制面网元发送的授权指示，所述授权指示由所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权得到，所述授权指示包括所述接入授权的授权结果；
    所述本地网络设备将所述授权结果发送给所述UE。
  10. 根据权利要求9所述的方法，其特征在于，在所述接入授权的授权结果为允许所述UE从所述非授权频谱接入节点接入所述归属网络的情况下，所述授权指示还包括所述UE的本地业务策略，所述方法还包括：
    所述本地网络设备接收所述非授权频谱接入节点发送的第二消息，所述第二消息用于请求为所述UE建立本地业务连接；
    所述本地网络设备基于所述本地业务策略对所述UE进行本地业务授权；
    在对所述UE的本地业务授权通过的情况下，所述本地网络设备为所述UE建立本地业务连接。
  11. 根据权利要求10所述的方法，其特征在于，所述本地网络设备基于所述UE的本地业务策略对所述UE进行本地业务授权，包括：
    在所述第二消息包括所述UE请求的本地业务类型的情况下，所述本地网络设备判断所述本地业务策略中的业务类型是否包含所述UE请求的本地业务类型，如果包含所述UE请求的本地业务类型，则确定对所述UE的本地业务授权通过；
    或者，
    在所述第二消息包括所述UE请求的本地业务接入点名称APN标识的情况下，所述本地网络设备判断所述本地业务策略中的业务APN标识是否包含所述本地业务APN标识，如果包含所述本地业务APN标识，则确定对所述UE的本地业务授权通过。
  12. 一种网络接入授权方法，应用于EPS，其特征在于，所述EPS包括非授权频谱接入节点和本地网络设备，所述方法包括：
    HSS接收控制面网元发送的第一消息，所述第一消息用于获取UE的签约数据，所述第一消息包括所述UE的接入请求消息和接入信息，所述接入请求 消息用于请求所述UE从所述非授权频谱接入节点接入所述UE的归属网络；
    所述HSS获取所述UE的签约数据；
    所述HSS基于所述接入请求消息、所述接入信息和所述签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权；
    在允许所述UE从所述非授权频谱接入节点接入所述归属网络的情况下，所述HSS将所述签约数据发送给所述控制面网元，以便所述控制面网元基于所述签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络再次进行接入授权。
  13. 根据权利要求12所述的方法，其特征在于，所述接入信息包括第一指示信息，所述第一指示信息用于指示所述UE接入所述归属网络使用的接入技术为从所述非授权频谱接入节点接入，所述签约数据包括用于指示所述UE接入所述归属网络允许使用的接入技术的第二指示信息；
    所述HSS基于所述接入请求消息、所述接入信息和所述签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权，包括：
    所述HSS基于所述接入请求消息判断所述第二指示信息是否包含所述第一指示信息；
    在所述第二指示信息包含所述第一指示信息的情况下，所述HSS确定允许所述UE从所述非授权频谱接入节点接入所述归属网络；
    或者，
    在所述第二指示信息未包含所述第一指示信息的情况下，所述HSS确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  14. 根据权利要求12所述的方法，其特征在于，所述签约数据包括域标识列表，所述域标识列表包括允许所述UE从所述非授权频谱接入节点接入所述归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；所述接入信息包括所述UE请求从所述非授权频谱接入节点接入所述归属网络的本地 网络的标识，所述本地网络的标识包括所述本地网络的服务提供商标识和漫游联盟标识中的至少一种；
    所述HSS基于所述接入请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权，包括：
    所述HSS基于所述接入请求消息判断所述域标识列表中是否存在所述本地网络的标识；
    在所述域标识列表中存在所述本地网络的标识的情况下，所述HSS确定允许所述UE从所述非授权频谱接入节点接入所述归属网络；
    或者，
    在所述域标识列表中不存在所述本地网络的标识的情况下，所述HSS确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  15. 一种控制面网元，应用于EPS，其特征在于，所述EPS包括非授权频谱接入节点和本地网络设备，所述控制面网元包括：
    接收模块，用于接收所述本地网络设备发送的第一消息，所述第一消息包括UE的请求消息和接入信息，所述请求消息用于请求所述UE从所述非授权频谱接入节点接入所述UE的归属网络；
    处理模块，用于基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权；
    发送模块，用于将授权指示发送给所述UE，所述授权指示包括所述接入授权的授权结果。
  16. 根据权利要求15所述的控制面网元，其特征在于，所述接入信息包括第一指示信息，所述第一指示信息用于指示所述UE接入所述归属网络使用的接入技术为从所述非授权频谱接入节点接入，所述签约数据包括用于指示所述UE接入所述归属网络允许使用的接入技术的第二指示信息；
    所述处理模块基于所述请求消息、所述接入信息和所述UE的签约数据对 所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权的具体方式为：
    基于所述请求消息判断所述第二指示信息是否包含所述第一指示信息；
    在所述第二指示信息包含所述第一指示信息的情况下，确定允许所述UE从所述非授权频谱接入节点接入所述归属网络；
    或者，
    在所述第二指示信息未包含所述第一指示信息的情况下，确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  17. 根据权利要求16所述的控制面网元，其特征在于，所述签约数据还包括允许所述UE从所述非授权频谱接入节点接入所述归属网络时，所述非授权频谱接入节点的第一接入模式，所述接入信息还包括所述UE请求从所述非授权频谱接入节点接入所述归属网络时，所述非授权频谱接入节点的第二接入模式；
    所述处理模块，还用于在所述第二指示信息包含所述第一指示信息的情况下，判断所述第一接入模式和所述第二接入模式是否匹配，并在所述第一接入模式和所述第二接入模式匹配的情况下，执行所述确定允许所述UE从所述非授权频谱接入节点接入所述归属网络的操作；或者，在所述第一接入模式和所述第二接入模式不匹配的情况下，确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  18. 根据权利要求16所述的控制面网元，其特征在于，所述签约数据还包括域标识列表，所述域标识列表包括允许所述UE从所述非授权频谱接入节点接入所述归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；所述接入信息还包括所述UE请求从所述非授权频谱接入节点接入所述归属网络的本地网络的标识，所述本地网络的标识包括所述本地网络的服务提供商标识和漫游联盟标识中的至少一种；
    所述处理模块，还用于在所述第二指示信息包含所述第一指示信息的情况下，判断所述域标识列表中是否存在所述本地网络的标识，并在所述域标识列表中存在所述本地网络的标识的情况下，执行所述确定允许所述UE从所述非授权频谱接入节点接入所述归属网络的操作；或者，在所述域标识列表中不存在所述本地网络的标识的情况下，确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  19. 根据权利要求17或18所述的控制面网元，其特征在于，所述签约数据还包括允许所述UE从所述非授权频谱接入节点接入所述归属网络的时间信息、位置信息、所述非授权频谱接入节点的安全等级以及本地网络的安全认证方式中的至少一种；
    或者，
    所述接入信息还包括所述UE请求从所述非授权频谱接入节点接入所述归属网络的时间信息、位置信息、所述非授权频谱接入节点的安全等级以及本地网络的安全认证方式中的至少一种。
  20. 根据权利要求15～19任一项所述的控制面网元，其特征在于，
    所述发送模块，还用于在所述请求消息为接入请求消息的情况下，向所述HSS发送第二消息，所述第二消息用于获取所述UE的签约数据；
    所述接收模块，还用于接收所述HSS发送的所述UE的签约数据。
  21. 根据权利要求15～19任一项所述的控制面网元，其特征在于，
    所述处理模块，还用于在所述请求消息为服务请求消息，所述服务请求消息包括所述UE的临时标识的情况下，基于所述临时标识确定所述控制面网元是否为所述UE附着的控制面网元，在所述控制面网元为所述UE附着的控制面网元的情况下，判断所述UE是否处于空闲态，并在所述UE处于空闲态的情况下，执行所述基于所述请求消息、所述接入信息和所述UE的签约数据对所述 UE从所述非授权频谱接入节点接入所述归属网络进行接入授权的操作。
  22. 根据权利要求15所述的控制面网元，其特征在于，所述签约数据包括允许所述UE在本地网络使用的本地业务类型，
    所述处理模块，还用于在所述接入授权的授权结果为允许所述UE从所述非授权频谱接入节点接入所述归属网络的情况下，从所述签约数据中获取所述本地业务类型，并基于所述本地业务类型生成所述UE的本地业务策略；
    所述发送模块，还用于将所述本地业务策略发送给所述本地网络设备，以便所述本地网络设备基于所述本地业务策略对所述UE发起的本地业务进行本地业务授权。
  23. 一种本地网络设备，应用于EPS，其特征在于，所述EPS包括非授权频谱接入节点和所述本地网络设备，所述本地网络设备包括：
    接收模块，用于接收所述非授权频谱接入节点发送的UE的请求消息，所述请求消息用于请求所述UE从所述非授权频谱接入节点接入所述UE的归属网络；
    发送模块，用于向控制面网元发送第一消息，所述第一消息包括所述请求消息和接入信息；
    所述接收模块，还用于接收所述控制面网元发送的授权指示，所述授权指示由所述控制面网元基于所述请求消息、所述接入信息和所述UE的签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权得到，所述授权指示包括所述接入授权的授权结果；
    所述发送模块，还用于将所述授权结果发送给所述UE。
  24. 根据权利要求23所述的本地网络设备，其特征在于，在所述接入授权的授权结果为允许所述UE从所述非授权频谱接入节点接入所述归属网络的情况下，所述授权指示还包括所述UE的本地业务策略，
    所述接收模块，还用于接收所述非授权频谱接入节点发送的第二消息，所述第二消息用于请求为所述UE建立本地业务连接；
    所述本地网络设备还包括处理模块，其中：
    所述处理模块，用于基于所述本地业务策略对所述UE进行本地业务授权，并在对所述UE的本地业务授权通过的情况下，为所述UE建立本地业务连接。
  25. 根据权利要求24所述的本地网络设备，其特征在于，所述处理模块基于所述本地业务策略对所述UE进行本地业务授权的具体方式为：
    在所述第二消息包括所述UE请求的本地业务类型的情况下，判断所述本地业务策略中的业务类型是否包含所述UE请求的本地业务类型，如果包含所述UE请求的本地业务类型，则确定对所述UE的本地业务授权通过；
    或者，
    在所述第二消息包括所述UE请求的本地业务APN标识的情况下，判断所述本地业务策略中的业务APN标识是否包含所述本地业务APN标识，如果包含所述本地业务APN标识，则确定对所述UE的本地业务授权通过。
  26. 一种HSS，应用于EPS，其特征在于，所述EPS包括非授权频谱接入节点和本地网络设备，所述HSS包括：
    接收模块，用于接收控制面网元发送的第一消息，所述第一消息用于获取UE的签约数据，所述第一消息包括所述UE的接入请求消息和接入信息，所述接入请求消息用于请求所述UE从所述非授权频谱接入节点接入所述UE的归属网络；
    处理模块，用于获取所述UE的签约数据，并基于所述接入请求消息、所述接入信息和所述签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权；
    发送模块，用于在允许所述UE从所述非授权频谱接入节点接入所述归属网络的情况下，将所述签约数据发送给所述控制面网元，以便所述控制面网元 基于所述签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络再次进行接入授权。
  27. 根据权利要求26所述的HSS，其特征在于，所述接入信息包括第一指示信息，所述第一指示信息用于指示所述UE接入所述归属网络使用的接入技术为从所述非授权频谱接入节点接入，所述签约数据包括用于指示所述UE接入所述归属网络允许使用的接入技术的第二指示信息；
    所述处理模块基于所述接入请求消息、所述接入信息和所述签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权的具体方式为：
    基于所述接入请求消息判断所述第二指示信息是否包含所述第一指示信息，并在所述第二指示信息包含所述第一指示信息的情况下，确定允许所述UE从所述非授权频谱接入节点接入所述归属网络；或者，在所述第二指示信息未包含所述第一指示信息的情况下，确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  28. 根据权利要求26所述的HSS，其特征在于，所述签约数据包括域标识列表，所述域标识列表包括允许所述UE从所述非授权频谱接入节点接入所述归属网络的本地网络的服务提供商标识和漫游联盟标识中的至少一种；所述接入信息包括所述UE请求从所述非授权频谱接入节点接入所述归属网络的本地网络的标识，所述本地网络的标识包括所述本地网络的服务提供商标识和漫游联盟标识中的至少一种；
    所述处理模块基于所述接入请求消息、所述接入信息和所述签约数据对所述UE从所述非授权频谱接入节点接入所述归属网络进行接入授权的具体方式为：
    基于所述接入请求消息判断所述域标识列表中是否存在所述本地网络的标识，并在所述域标识列表中存在所述本地网络的标识的情况下，确定允许所 述UE从所述非授权频谱接入节点接入所述归属网络；或者，在所述域标识列表中不存在所述本地网络的标识的情况下，确定拒绝所述UE从所述非授权频谱接入节点接入所述归属网络。
  29. 一种网络接入授权系统，应用于EPS，其特征在于，所述网络接入授权系统包括如权利要求15～22所述的任一项控制面网元、如权利要求23～25所述的任一项本地网络设备以及如权利要求26～28任一项所述的HSS。
PCT/CN2016/100553 2016-09-28 2016-09-28 一种网络接入授权方法、相关设备及系统 WO2018058365A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN201680089581.8A CN109792435B (zh) 2016-09-28 2016-09-28 一种网络接入授权方法、相关设备及系统
PCT/CN2016/100553 WO2018058365A1 (zh) 2016-09-28 2016-09-28 一种网络接入授权方法、相关设备及系统
EP16917120.4A EP3509265B1 (en) 2016-09-28 2016-09-28 Network access authorization method, and related device and system
US16/368,596 US11102656B2 (en) 2016-09-28 2019-03-28 Network access authorization method, related device, and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/100553 WO2018058365A1 (zh) 2016-09-28 2016-09-28 一种网络接入授权方法、相关设备及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/368,596 Continuation US11102656B2 (en) 2016-09-28 2019-03-28 Network access authorization method, related device, and system

Publications (1)

Publication Number Publication Date
WO2018058365A1 true WO2018058365A1 (zh) 2018-04-05

Family

ID=61763636

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/100553 WO2018058365A1 (zh) 2016-09-28 2016-09-28 一种网络接入授权方法、相关设备及系统

Country Status (4)

Country Link
US (1) US11102656B2 (zh)
EP (1) EP3509265B1 (zh)
CN (1) CN109792435B (zh)
WO (1) WO2018058365A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110808942B (zh) * 2018-08-06 2021-12-10 华为技术有限公司 一种签约信息配置方法、网络设备和终端设备
CN110808798A (zh) * 2019-11-19 2020-02-18 张家港市集成电路产业发展有限公司 一种基于频谱管理器的无线电空闲资源共享系统
CN116965102A (zh) * 2021-02-25 2023-10-27 Oppo广东移动通信有限公司 无线通信方法、终端设备和网络设备
CN115087075A (zh) * 2021-03-11 2022-09-20 维沃移动通信有限公司 使用免授权频段的方法、装置、终端及网络侧设备
CN114338817B (zh) * 2021-12-22 2023-11-10 中国人民银行清算总中心 多平面网络访问控制方法及多平面网络

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101151920A (zh) * 2005-03-31 2008-03-26 诺基亚公司 用于非授权移动接入的认证机制
CN104852896A (zh) * 2015-02-03 2015-08-19 四川通信科研规划设计有限责任公司 一种Wi-Fi无线节点入网方法及系统
WO2015156641A1 (en) * 2014-04-10 2015-10-15 Samsung Electronics Co., Ltd. Method and apparatus for using unlicensed band channel in cellular wireless communication system
CN105207756A (zh) * 2014-06-21 2015-12-30 上海朗帛通信技术有限公司 一种利用非授权频谱通信的方法和装置
WO2016120436A1 (en) * 2015-01-30 2016-08-04 Telefonaktiebolaget Lm Ericsson (Publ) Methods providing listen-before-talk and related ues and network nodes

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI20050235A0 (fi) * 2005-03-03 2005-03-03 Nokia Corp Pääsy viestintäjärjestelmään
CN102802201B (zh) * 2011-05-27 2017-03-15 上海贝尔股份有限公司 蜂窝网与无线局域网融合网络环境下的通信方法
CN103024737B (zh) * 2011-09-23 2017-08-11 中兴通讯股份有限公司 可信任非3gpp接入网元、接入移动网络及去附着方法
US9154641B2 (en) * 2012-11-21 2015-10-06 At&T Intellectual Property I, L.P. Long term evolution intelligent subscriber profile
US10412666B2 (en) * 2012-12-19 2019-09-10 Telefonaktiebolabet Lm Ericsson (Publ) UE accessibility indication for WI-FI integration in RAN
EP2750349A1 (en) * 2012-12-31 2014-07-02 British Telecommunications public limited company Method and device for secure network access
US9603192B2 (en) * 2013-01-16 2017-03-21 Ncore Communications, Inc. Methods and apparatus for hybrid access to a core network
US20160014127A1 (en) * 2013-01-16 2016-01-14 Behzad Mohebbi Methods and apparatus for hybrid access to a core network based on proxied authentication
US9942762B2 (en) * 2014-03-28 2018-04-10 Qualcomm Incorporated Provisioning credentials in wireless communications
EP3783954B1 (en) * 2014-07-14 2023-09-06 IPLA Holdings Inc. Network-initiated handover in integrated small cell and wifi networks
US9078137B1 (en) * 2014-09-26 2015-07-07 Fortinet, Inc. Mobile hotspot managed by access controller
CN104540185B (zh) * 2014-12-15 2019-02-05 上海华为技术有限公司 一种接入网络的方法、接入网关及接入控制设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101151920A (zh) * 2005-03-31 2008-03-26 诺基亚公司 用于非授权移动接入的认证机制
WO2015156641A1 (en) * 2014-04-10 2015-10-15 Samsung Electronics Co., Ltd. Method and apparatus for using unlicensed band channel in cellular wireless communication system
CN105207756A (zh) * 2014-06-21 2015-12-30 上海朗帛通信技术有限公司 一种利用非授权频谱通信的方法和装置
WO2016120436A1 (en) * 2015-01-30 2016-08-04 Telefonaktiebolaget Lm Ericsson (Publ) Methods providing listen-before-talk and related ues and network nodes
CN104852896A (zh) * 2015-02-03 2015-08-19 四川通信科研规划设计有限责任公司 一种Wi-Fi无线节点入网方法及系统

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
PENTIKOUSIS, K. ET AL.: "Mobileflow: Toward Software-Defined Mobile Networks", IEEE COMMUNICATIONS MAGAZINE, vol. 51, 12 July 2013 (2013-07-12), pages 44 - 53, XP011519224, ISSN: 0163-6804, DOI: doi:10.1109/MCOM.2013.6553677 *
See also references of EP3509265A4 *

Also Published As

Publication number Publication date
EP3509265A1 (en) 2019-07-10
CN109792435B (zh) 2021-01-15
US20190223012A1 (en) 2019-07-18
EP3509265A4 (en) 2019-09-11
US11102656B2 (en) 2021-08-24
CN109792435A (zh) 2019-05-21
EP3509265B1 (en) 2021-07-21

Similar Documents

Publication Publication Date Title
US11102828B2 (en) User plane function selection for isolated network slice
US10993112B2 (en) Systems and methods for accessing a network
EP3515098B1 (en) Local service authorization method and related device
US11706705B2 (en) Multimedia priority service
CN110495214B (zh) 用于处理pdu会话建立过程的方法和amf节点
US11102656B2 (en) Network access authorization method, related device, and system
JP2023506462A (ja) ネットワークスライスの制御
US20210168151A1 (en) Method for implementing user plane security policy, apparatus, and system
EP3745757A1 (en) Communication method and communication apparatus
WO2020224622A1 (zh) 一种信息配置方法及装置
WO2013016968A1 (zh) 一种接入方法、系统及移动智能接入点
US20210385283A1 (en) Multimedia Priority Service
WO2008131689A1 (fr) Procédé et système de fourniture d'un service de communication d'urgence et dispositifs correspondants
US20190223013A1 (en) Method for establishing public data network connection and related device
CN115412911A (zh) 一种鉴权方法、通信装置和系统
CN111226452B (zh) 一种业务策略创建方法及装置
WO2017129101A1 (zh) 路由控制方法、装置及系统
KR101954397B1 (ko) Ｌｔｅ 이동통신 시스템에서 패킷 차단 방법 및 패킷 차단 시스템
US20230284128A1 (en) Method of slice support for vehicle-to-everything service
WO2022166892A1 (zh) 信息处理方法、装置、通信设备及可读存储介质
US20240129793A1 (en) Network Overload Control
KR20230043969A (ko) 접속 제어 방법, 장치 및 통신기기

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16917120

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2016917120

Country of ref document: EP

Effective date: 20190405