WO2018058691A1 - 一种建立公用数据网连接的方法及相关设备 - Google Patents

一种建立公用数据网连接的方法及相关设备 Download PDF

Info

Publication number
WO2018058691A1
WO2018058691A1 PCT/CN2016/101415 CN2016101415W WO2018058691A1 WO 2018058691 A1 WO2018058691 A1 WO 2018058691A1 CN 2016101415 W CN2016101415 W CN 2016101415W WO 2018058691 A1 WO2018058691 A1 WO 2018058691A1
Authority
WO
WIPO (PCT)
Prior art keywords
identifier
request message
control plane
network element
plane network
Prior art date
Application number
PCT/CN2016/101415
Other languages
English (en)
French (fr)
Inventor
于游洋
李欢
靳维生
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201680089580.3A priority Critical patent/CN109792787A/zh
Priority to PCT/CN2016/101415 priority patent/WO2018058691A1/zh
Publication of WO2018058691A1 publication Critical patent/WO2018058691A1/zh
Priority to US16/368,639 priority patent/US20190223013A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/73—Access point logical identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/17—Selecting a data network PoA [Point of Attachment]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/16—Gateway arrangements

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a method for establishing a public data network connection and related devices.
  • an Evolved Packet System is composed of a User Equipment (UE), an access network, and an Evolved Packet Core (EPC).
  • the spectrum used by the access network is a licensed spectrum, such as a Universal Terrestrial Radio Access Network (UTRAN), an Evolved UTRAN (E-UTRAN), and the like.
  • UTRAN Universal Terrestrial Radio Access Network
  • E-UTRAN Evolved UTRAN
  • the adoption of unlicensed spectrum as a new radio access technology to enhance the air bearer carrying capacity has become the development trend of the EPS access network.
  • the UE is connected to the home carrier EPC from the access network, and the home carrier EPC establishes a Public Data Network (PDN) connection for the UE to implement "permanent online" of the UE.
  • PDN Public Data Network
  • the UE may only need to perform local services. If the UE is permanently connected after the UE is attached, the EPC network will be occupied. Resources, thereby reducing the utilization of EPC network resources.
  • the embodiment of the invention discloses a method for establishing a PDN connection, a related device and a system, and can implement a PDN connection for the UE when the UE accesses the EPC from the unlicensed spectrum.
  • the first aspect of the embodiment of the present invention discloses a method for establishing a PDN connection, which is applied to an EPS, where the method may include:
  • the security gateway acquires the wireless of the UE after receiving the first request message sent by the local network device for requesting to establish a PDN connection for the UE.
  • the access technology indication and the identity of the control plane network element to which the UE is attached, and the base Sending a second request message to the control plane network element, where the second request message carries the user identifier of the UE and the radio access technology indication, and is used to request the identifier of the data gateway (PGW).
  • the control plane network element After receiving the second request message, the control plane network element sends the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication.
  • the SeGW may thus send a third request message to the corresponding PGW based on the identifier of the PGW for requesting establishment of a session channel connection between the SeGW and the PGW.
  • the SeGW can thus receive a response from the PGW to establish a session channel connection with the SeGW based on the third request message.
  • the first request message is sent by the UE to the local network device, and is used to request to establish a PDN connection for the UE.
  • the PDN connection of the UE includes a secure channel connection between the UE and the SeGW and a session channel connection between the SeGW and the PGW.
  • the first request message may be an Access Point Name (APN) connection request message, or may be a PDN connection request message
  • the second request message may be a PDN connection establishment request message.
  • the third request message may be a session establishment request message.
  • the PGW After receiving the second request message, the PGW establishes a session channel connection with the SeGW. At the same time, the PGW allocates an IP address to the UE, allocates a tunnel, a Quality of Service (QoS) parameter for the PDN connection, and records the PDN connection as an unlicensed spectrum access.
  • QoS Quality of Service
  • the UE After being attached to the home network, the UE triggers the establishment of a PDN connection when there is an EPC service requirement, thereby avoiding the occupation of the EPC network resources without the EPC service, and improving the utilization of the EPC network resources.
  • the specific manner in which the SeGW obtains the radio access technology indication of the UE may include the following two types:
  • the local network device when forwarding the first request message, carries a radio access technology indication indicating that the RAT accessed by the UE is an unlicensed spectrum access, and the SeGW may receive the first request message after receiving the first request message. Obtain the wireless access technology indication in the message.
  • the local network device While forwarding the first request message, the local network device carries information of the wireless access node of the local network, where the information indicates that the wireless access node is an unlicensed spectrum wireless access node. Therefore, after receiving the first request message, the SeGW may determine, according to the information of the radio access node, that the RAT accessed by the UE is an unlicensed spectrum access, and generate a radio access technology indication.
  • the specific manner in which the SeGW obtains the identifier of the control plane network element to which the UE is attached may include the following:
  • the local network device when forwarding the first request message, carries the temporary identifier allocated by the home network to the UE, where the temporary identifier includes the identifier of the control plane network element to which the UE is attached, and the SeGW may obtain the temporary request message after receiving the first request message.
  • the identifier of the control plane network element to which the UE is attached is obtained in the identifier; or the local network device directly carries the identifier of the control plane network element attached to the UE, and the SeGW directly obtains the UE from the first request message while forwarding the first request message The identifier of the attached control plane network element.
  • the local network device After forwarding the first request message, the local network device carries the local IP address allocated by the local network device to the UE. After receiving the first request message, the SeGW may send a control plane for requesting acquisition of the UE attachment to the local network device.
  • the request message of the identifier of the network element such as a connection information request message, carries the local Internet Protocol (IP) address of the UE.
  • IP Internet Protocol
  • the local network device searches for the context of the UE based on the local IP address of the UE, so that the identifier of the control plane network element currently attached by the UE included in the UE context is sent to the SeGW through the connection information reply message. .
  • IP Internet Protocol
  • the SeGW may send, to the Home Subscriber Server (HSS), a request message for requesting to obtain an identifier of the control plane network element attached to the UE, such as an update location request message, where the message includes The permanent identifier of the UE, such as the International Mobile Subscriber Identification Number (IMSI), the HSS searches for the context of the UE based on the IMSI of the UE. If the UE has been attached to the control plane network element, the HSS stores the currently attached control plane. The identifier of the network element is returned to the SeGW, and the message carries the identifier of the control plane network element to which the UE is attached.
  • HSS Home Subscriber Server
  • IMSI International Mobile Subscriber Identification Number
  • the method may further include:
  • the SeGW may receive an indication message sent by the control plane network element to indicate a session channel connection establishment result between the SeGW feedback and the PGW, and a session between the PGW and the PGW. After the channel connection is established, the connection information of the session channel connection is sent to the control plane network element.
  • the indication message may be an Acknowledge (ACK) negotiated indication, a Supported Handover (HO) supported indication, or a service continuity indication.
  • the connection information may include a Tunnel Endpoint Identity (TEID) allocated by the PGW for the session channel connection, at least one of an IP address of the UE and a QoS.
  • TEID Tunnel Endpoint Identity
  • the SeGW receives the identifier of the PGW returned by the control plane network element based on the user identifier and the radio access technology indication, including:
  • the first request message carries the APN requested by the UE, where the requested APN is the APN indicated by the radio access technology
  • the second request message sent by the SeGW to the control plane network element also carries the requested APN
  • the SeGW is Receiving, by the control plane network element, an identifier of the APN corresponding to the APN that the user identity passes after the authorization of the requested APN is authorized to pass;
  • the SeGW receives the identifier of the APN corresponding to the default APN in the subscription data of the UE returned by the control plane network element based on the user identifier and the radio access technology indication.
  • the UE In the process of establishing a PDN connection for the UE, the UE directly establishes a secure channel with the SeGW, and then the SeGW searches for the control plane network element, so that the UE and the SeGW can use the secure channel for communication, and the third party deploys the local network to the communication content. Invisible, thus achieving protection of the operator's business.
  • the second aspect of the embodiment of the present invention discloses a security gateway, which may include a transceiver module and a processing module, and may be used to perform the method for establishing a PDN connection disclosed in the first aspect.
  • the third aspect of the embodiment of the present invention discloses another security gateway, where the security gateway may include a transceiver and a processor, where the transceiver corresponds to the transceiver module of the security gateway disclosed in the second aspect, and the processor corresponds to the second aspect.
  • the processing module of the security gateway may be used to perform the method for establishing a PDN connection disclosed in the first aspect.
  • a fourth aspect of the embodiments of the present invention discloses another method for establishing a PDN connection, which is applied to an EPS, where the method may include:
  • the control plane network element may receive the second request message sent by the SeGW, and set the PGW based on the user identifier of the UE and the radio access technology indication carried in the second request message.
  • the identifier is sent to the SeGW so that the SeGW establishes a session channel connection with the PGW marked by the identifier of the PGW corresponding to the APN.
  • the second request message is used to request to obtain the identifier of the PGW, and the second request message carries the user identifier of the UE and the radio access technology indication, where the radio access technology indicates that the radio access technology used by the UE is an unlicensed spectrum.
  • the second request message is sent by the SeGW to the control plane network element after receiving the first request message of the UE and establishing a secure channel connection with the UE, the first request message is used to request to establish a PDN connection for the UE, the PDN Connections include secure channel connections and session channel connections
  • the first request message may be an APN connection request message, or may be a PDN connection request message
  • the second request message may be a PDN connection establishment request message.
  • an IP address is allocated to the UE, a tunnel, a QoS, and the like are allocated for the PDN connection, and the PDN connection is recorded as an unlicensed spectrum access.
  • control plane network element sends the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication may be:
  • the control plane network element may first authorize the APN requested by the UE. Only when the authorization is passed, the identifier of the corresponding PGW is sent to the SeGW, and the SeGW completes.
  • the establishment of the session channel connection with the PGW enables the PDN connection to be established for the UE after the UE is attached to the home network, thereby avoiding the resource occupation of the EPC network, thereby improving the utilization of the EPC network resources.
  • the specific manner in which the control plane network element performs the APN authorization based on the subscription data and the radio access technology indication may include any one of the following:
  • the control plane network element determines whether the subscription data includes the radio access technology indication, and if so, Determining that the requested APN authorization is passed; or, if not, determining that the requested APN authorization is not passed;
  • the control plane network element determines whether the radio access technology indication is included in the subscription data, and if so, determines to pass the default APN authorization in the subscription data; or, if not, determines the default APN in the subscription data. Authorization does not pass.
  • the specific manner in which the control plane network element sends the identifier of the PGW corresponding to the APN that is authorized to be sent to the SeGW may include the following two types:
  • the control plane network element may, after granting the APN authorization, the identifier of the PGW that is closest to the UE location in the PGW corresponding to the approved APN based on the location information of the UE. Sent to SeGW.
  • the control plane network element can obtain the load information of each PGW, and after the authorization of the APN, the identifier of the PGW with the smallest load in the PGW corresponding to the approved APN is sent to the SeGW based on the load information of each PGW.
  • the identifier of the PGW that is closest to the UE or has the smallest load in the PGW corresponding to the approved APN is sent to the SeGW, so that the SeGW establishes a session channel connection with the PGW that is closest to the UE or has the smallest load, thereby improving the utilization of network resources.
  • the method may further include:
  • the control plane network element sends an indication message to the SeGW, where the indication message is used to indicate the session channel connection establishment result between the SeGW feedback and the PGW, and the control plane network element can receive the SeGW after the establishment of the session connection with the PGW. Connection information for the session channel connection.
  • a fifth aspect of the embodiment of the present invention discloses a control plane network element, where the control plane network element may include a transceiver module and a processing module, and may be used to perform the method for establishing a PDN connection disclosed in the fourth aspect.
  • a sixth aspect of the embodiments of the present invention discloses another control plane network element, where the control plane network element may include a transceiver and a processor, where the transceiver corresponds to the transceiver module of the control plane network element disclosed in the fifth aspect, and the processor
  • the processing module corresponding to the control plane network element disclosed in the fifth aspect may be used to perform the method for establishing a PDN connection disclosed in the fourth aspect.
  • a seventh aspect of the embodiments of the present invention discloses a UE, which is applied to an EPS.
  • the home network device may send the SeGW identifier to the UE, such as the IP address of the SeGW and the fully qualified domain name.
  • the Fully Qualified Domain Name (FQDN), etc. the UE can receive the identifier of the SeGW, so that the UE can carry the identifier of the SeGW when sending the first request message to the local network device.
  • FQDN Fully Qualified Domain Name
  • the local network device may also allocate a local IP address to the UE, and the UE is authorized to access the network. After that, you can also receive the local IP address sent by the local network device.
  • the eighth aspect of the embodiment of the present invention discloses a local network device, which is applied to an EPS, and the local network device receives the first request message sent by the UE, and may also carry the identifier of the SeGW, that is, the source address of the first request message is set as the local network device.
  • the local IP address assigned to the UE, and the destination address is the IP address corresponding to the SeGW received by the UE.
  • a ninth aspect of the embodiments of the present invention discloses a system for establishing a PDN connection, where the system is applied to an EPS system, and may include the SeGW disclosed in the second aspect, the control plane network element disclosed in the fifth aspect, and the local network disclosed in the eighth aspect.
  • the system can be implemented after the UE is attached to the home network from the unlicensed spectrum. If the UE has the EPC service requirement, the PDN connection is established for the UE to avoid resource occupation of the EPC network, thereby improving the EPC network resources. Utilization rate.
  • the UE directly establishes a secure channel with the SeGW, and then the SeGW searches for the control plane network element, so that the UE and the SeGW can use the secure channel to communicate, and the third-party deployed local network pair
  • the communication content is not visible, thus realizing the protection of the operator's business.
  • FIG. 1 is a schematic diagram of an EPS architecture disclosed in an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a method for establishing a PDN connection according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a security gateway according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of another security gateway according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a control plane network element according to an embodiment of the present invention.
  • FIG. 6 is a structural view of another control plane network element disclosed in an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a system for establishing a PDN connection according to an embodiment of the present invention.
  • the embodiment of the invention discloses a method, a related device and a system for establishing a PDN connection, which can improve the utilization rate of the EPC network resource. The details are described below separately.
  • FIG. 1 is a schematic diagram of an EPS architecture disclosed in an embodiment of the present invention.
  • the UE the local network, and the carrier core network EPC are included.
  • the UE may include various handheld devices with wireless communication functions, in-vehicle devices, wearable devices, computing devices, or other processing devices connected to the wireless modem, and various forms of user equipment, mobile stations (MSs). , terminal, terminal equipment, etc.
  • MSs mobile stations
  • terminal terminal equipment
  • the devices mentioned above are collectively referred to as user equipments or UEs.
  • the local network refers to a network deployed by a third party, which is different from the carrier network.
  • the local network includes unlicensed spectrum radio access nodes (such as Wi-Fi access nodes, Unlicensed Long Term Evolution (LTE-U) access nodes, referred to as LTE-U access nodes, etc.), local Network control plane network element and local network user plane network element.
  • LTE-U Unlicensed Long Term Evolution
  • the LTE-U access node refers to a base station, an access point (AP), and the like that use an unlicensed spectrum;
  • the local network control plane network element is a Mobility Management Entity (MME) or a control plane node ( Control Point, CP);
  • the local network user plane network element is a Gateway (GW) or a User Point (UP).
  • the operator EPC includes control plane network elements, user plane network elements, HSS, and PGW.
  • the control plane network element is an MME, an authentication, authorization, and accounting (Authentication, Authorization, Accounting, AAA) server, an Evolved Packet Data Gateway (ePDG), and a General Packet Radio Service (GPRS).
  • the user plane network element includes a SeGW, a Serving Gate Way (SGW), or an UP, which is not limited in the embodiment of the present invention.
  • the local network device mentioned in the embodiment of the present invention is a local network control plane network element
  • the control plane network element mentioned in the embodiment of the present invention refers to the control plane network element of the operator EPC.
  • the embodiments of the invention are not described herein again.
  • the home operator EPC needs to perform access authorization on the UE, that is, whether to allow the UE to permit the unlicensed spectrum.
  • the access node accesses the home network to which the access node belongs. If the home carrier EPC allows the UE to access the unlicensed spectrum access node of the local network, the UE can initiate the local service through the local network, and can also initiate the EPC service (ie, the home operator). Core network business).
  • the system architecture shown in Figure 1 uses unlicensed spectrum as a new radio access technology, which can improve the air interface carrying capacity of the system network.
  • FIG. 2 is a schematic flowchart diagram of a method for establishing a PDN connection according to an embodiment of the present invention. As shown in FIG. 2, the method for establishing a PDN connection may include the following steps:
  • the UE initiates an attach procedure by using a local network that uses an unlicensed spectrum.
  • the unlicensed spectrum network is searched for and discovered, and the attach request message is sent to the unlicensed spectrum access node, where the unlicensed spectrum access node may be an LTE-U access node.
  • the Wi-Fi access node the unlicensed spectrum access node forwards the attach request message to the local network device, and the local network device generates the routing information according to the identifier of the home network carried in the attach request message and the network topology, thereby
  • the attach request message is routed to a control plane network element of the home network, such as an MME.
  • the local network device when routing the attach request message to the control plane network element, also accesses the access information of the UE from the unlicensed spectrum access node to the home network, such as the characteristic information of the local network and the unlicensed spectrum access node.
  • the feature information, the location information of the UE, the current time information, and the like are sent to the control plane network element.
  • the characteristic information of the local network includes the security authentication information used by the local network, such as the identifier of the used security authentication scheme, the service provider identifier to which the local network belongs, the roaming alliance identifier, and the radio access technology used by the local network (Radio Access). At least one of the types of Technologies, RAT).
  • the RAT is an unlicensed spectrum access.
  • the feature information of the unlicensed spectrum access node includes the access mode of the unlicensed spectrum access node (such as open mode, closed mode, mixed mode) and security, etc. At least one of the levels.
  • the control plane network element After receiving the attach request message and the access information of the UE, the control plane network element stores the access information, and sends a location update request message to the HSS based on the attach request message to update the control plane network that provides the service for the UE. yuan.
  • the control plane network element also sends the radio access technology indication of the unlicensed spectrum access used by the UE or the service provider identifier of the local network, the roaming alliance identifier, and the like to the HSS, so that the HSS is based on the UE's user identifier (
  • the UE may first perform access authorization based on the subscription data of the UE, that is, determine whether to allow the UE to access the home network from the unlicensed spectrum access node (unlicensed spectrum network). And whether the UE is allowed to access the home network or the like from the unlicensed spectrum network deployed by the service provider or the roaming alliance member.
  • the HSS sends the subscription data of the UE to the control plane network element, and the control plane network element performs the access authorization for the UE again according to the subscription data. If it is determined whether the current time or location allows the UE to access the home network from the unlicensed spectrum access node, whether the access mode or security level of the unlicensed spectrum access node is sufficient to allow the UE to access the home from the unlicensed spectrum access node.
  • the condition of the network, whether the local network is a trusted or non-trusted network, and whether the UE is allowed to access from the trusted network or the non-trusted network when the home network is in the network is not limited.
  • the authorization for the UE to access the home network from the unlicensed spectrum access node is successful, that is, the UE is successfully attached.
  • control plane network element further determines whether the authorized APN exists in the subscription data based on the subscription data and the feature information of the local network, that is, whether the feature information of the local network matches the authorization condition of the APN, and if yes, based on the location of the UE.
  • the information, the network load request, or the contracted APN information selects the SeGW, such as selecting a SeGW that is close to the UE, or a lighter-loading SeGW, or a SeGW corresponding to the subscribed APN, thereby identifying the SeGW (such as the SeGW IP address and FQDN). Or, the corresponding relationship between the APN and the SeGW is sent to the UE. If the feature information of the local network does not match the authorization condition of the APN, it means that the authorized APN does not exist, and the control plane network element does not allocate the identifier of the SeGW to the UE.
  • the control plane network element can determine whether the license conditions of the subscribed APN are allowed to be accessed from the untrusted network, or whether Local network access from service provider A deployment, or whether the RAT allowed to use is unlicensed spectrum access, and so on. If allowed, it is determined that the contracted APN is an authorized APN, or it is determined that the contracted APN is authorized to pass.
  • the control plane network element may further generate a local service policy of the UE based on the subscription data of the UE, and send the local service policy to the local network device, where the local network device may request the local service of the UE by using the local service policy.
  • Conduct business authorization After receiving the indication of the access permission sent by the control plane network element, the local network device allocates a local IP address to the UE, and forwards an attach reply message, where the attach reply message carries the temporary identifier allocated by the home network to the UE, which is the UE.
  • the identifier of the assigned SeGW or the identifier of the authorized APN and its corresponding SeGW is not limited in the embodiment of the present invention.
  • the UE may send a first request message to the local network device.
  • the first request message is used to request to establish a PDN connection for the UE, and the PDN connection of the UE includes a secure channel connection between the UE and the SeGW and a session channel connection between the SeGW and the PGW.
  • the first request message may be a PDN connection request message or an APN connection request message, which is not limited in the embodiment of the present invention.
  • the sending, by the UE, the first request message to the local network device may be sent to the unlicensed spectrum access node and forwarded to the local network device by the unlicensed spectrum access node.
  • the message when the first request message is an APN connection request message, the message may be an IKE_AUTH request message, and the source address of the message is set to a local IP address allocated by the local network device to the UE, and the destination address is received by the UE.
  • the message When the first request message is a PDN connection request message, the message carries the identifier of the SeGW, such as the IP address and FQDN of the SeGW, and the message includes a network key exchange protocol (Internet Key) related to establishing a secure channel connection between the UE and the SeGW.
  • Exchange Protocol Version 2, IKEv2 message such as an IKE_AUTH request message or an IKE_SA_INIT message.
  • the local network device forwards the first request message to the SeGW.
  • the local network device when the first request message is an APN connection request message, the local network device, after receiving the APN connection request message, routes the APN connection request message to the pair according to the destination address. Should be SeGW.
  • the local network device When the first request message is a PDN connection request message, the local network device is required to support the control plane message, and the IP address of the SeGW is parsed from the PDN connection request message, so that the PDN connection request message is sent to the corresponding SeGW according to the IP address.
  • the SeGW receives the first request message, and obtains the radio access technology indication of the UE and the identifier of the control plane network element to which the UE is attached.
  • the SeGW receives the first request message, that is, the secure channel connection established with the UE is successfully established. Further, after receiving the first request message, the SeGW acquires the radio access technology indication of the UE.
  • the radio access technology indicates that the RAT used to indicate that the UE accesses is an unlicensed spectrum access.
  • the SeGW After receiving the first request message, the SeGW obtains the identifier of the control plane network element attached to the UE.
  • the specific manner in which the SeGW obtains the identifier of the control plane network element attached to the UE may be as follows:
  • the local network device when forwarding the first request message, carries the temporary identifier allocated by the home network to the UE, where the temporary identifier includes the identifier of the control plane network element to which the UE is attached, and the SeGW may obtain the temporary request message after receiving the first request message.
  • the identifier of the control plane network element to which the UE is attached is obtained in the identifier; or the local network device directly carries the identifier of the control plane network element attached to the UE, and the SeGW directly obtains the UE from the first request message while forwarding the first request message The identifier of the attached control plane network element.
  • the local network device After forwarding the first request message, the local network device carries the local IP address allocated by the local network device to the UE. After receiving the first request message, the SeGW may send a control plane for requesting acquisition of the UE attachment to the local network device. A request message for identifying the network element, such as a connection information request message, the message carrying the local IP address. After receiving the connection information request message, the local network device searches for the context of the UE based on the local IP address of the UE, so that the identifier of the control plane network element currently attached by the UE included in the UE context is sent to the SeGW through the connection information reply message. .
  • the SeGW may send, to the HSS, a request message for requesting to obtain an identifier of the control plane network element attached to the UE, such as an update location request message, where the message includes the user of the UE.
  • the identifier such as the IMSI
  • the HSS searches for the context of the UE based on the IMSI of the UE. If the UE has been attached to the control plane network element, the HSS stores the identifier of the currently attached control plane network element, thereby replying to the update location response message.
  • the SeGW carries the identifier of the control plane network element to which the UE is attached.
  • the specific manner in which the SeGW obtains the radio access technology indication of the UE may include the following two types:
  • the local network device when forwarding the first request message, carries a radio access technology indication indicating that the RAT accessed by the UE is an unlicensed spectrum access, and the SeGW may receive the first request message after receiving the first request message. Obtain the wireless access technology indication in the message.
  • the local network device While forwarding the first request message, the local network device carries information of the wireless access node of the local network, where the information indicates that the wireless access node is an unlicensed spectrum wireless access node. Therefore, after receiving the first request message, the SeGW may determine, according to the information of the radio access node, that the RAT accessed by the UE is an unlicensed spectrum access, and generate a radio access technology indication.
  • the SeGW sends a second request message to the control plane network element based on the identifier of the control plane network element to which the UE is attached.
  • the second request message carries the user identifier of the UE and the radio access technology indication, and the second request message is used to request to obtain the identifier of the PGW.
  • the user identifier may be a temporary identifier or a permanent identifier of the UE, where the temporary identifier may include a device identifier of the UE and an identifier of the attached control plane network element, such as an identifier of the MME.
  • the SeGW after acquiring the identifier of the control plane network element attached to the UE by using the foregoing manner, the SeGW sends a second request message to the control plane network element, where the second request message may be a PDN connection establishment request.
  • the message can also be an authentication and authorization request message.
  • the second request message may also carry the identifier of the local network as the trusted network or the non-trusted network, the service provider identifier of the local network, the roaming alliance identifier, and the like, which are not limited in the embodiment of the present invention.
  • the control plane network element receives the second request message, and sends the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication.
  • the specific manner in which the control plane network element sends the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication may be:
  • the subscription data of the UE is obtained based on the user identifier, and the APN authorization is performed based on the subscription data and the wireless access technology indication, and finally the identifier of the data gateway corresponding to the approved APN is sent to the security gateway.
  • the control plane network element after receiving the second request message, the control plane network element searches for the context of the UE based on the user identifier of the UE, such as the temporary identifier, to obtain the subscription data of the UE, and allows the UE to access based on the subscription data.
  • the indication of the RAT to determine whether to allow the UE to access from the network employing the unlicensed spectrum, and if so, to authorize the requested APN or the default APN. If the APN authorization is passed, the control plane network element selects the corresponding PGW for the authorized APN, and sends the identifier of the selected PGW to the SeGW. If the APN authorization fails, the control plane network element replies with the connection rejection or authentication and authorization failure message, or the connection establishment reply or the authentication and authorization reply message carries the failure cause value to the SeGW.
  • the identifier of the PGW corresponding to the APN that is authorized to pass can be understood as: supporting the IP address or FQDN of the APN requested by the UE or the PGW of the service type.
  • the SeGW may be obtained from the control plane network element of the UE, which is not limited in the embodiment of the present invention.
  • control plane network element performs the APN authorization based on the subscription data and the radio access technology indication may include any one of the following:
  • the control plane network element determines whether the subscription data includes the radio access technology indication, and if so, Determining that the requested APN authorization is passed; or, if not, determining that the requested APN authorization is not passed;
  • the control plane network element determines whether the subscription data includes the radio access technology indication, and if so, determines to pass the default APN authorization in the subscription data; or if If not, it is determined that the default APN authorization in the subscription data does not pass.
  • the second request message carries the APN requested by the UE, and the second request message carries the feature information of the local network, such as whether the local network is a trusted network or a non-trusted network, the service provider identifier of the local network or Roaming alliance ID, security authentication method used by the local network, etc.
  • Control The surface network element determines whether the APN can be authorized based on the feature information of the local network and the subscription data, that is, whether the feature information of the local network matches the authorization condition of the requested APN.
  • the control plane network element can determine whether the default APN can be authorized, that is, whether the feature of the local network is authorized with the default APN based on the feature information of the local network and the subscription data. Condition matching.
  • the control plane network element can determine whether the authorization condition of the subscribed APN in the subscription data allows access from the trusted network, or whether the service provider is allowed.
  • the control plane network element may also determine whether to allow the UE to access at the current time based on the authorization condition of the contracted APN in the subscription data. and many more. If allowed, it is determined that the contracted APN is an authorized APN, or it is determined that the contracted APN is authorized to pass.
  • the control plane network element may also send the authorized APN (including the APN or the default APN requested by the authorized UE) to the SeGW, so that the subsequent SeGW performs authorization based on the authorization. Controlled by the APN.
  • the specific manner in which the control plane network element sends the identifier of the PGW corresponding to the APN that is authorized to be sent to the SeGW may include at least one of the following:
  • the first request message sent by the UE includes the location information of the UE
  • the second request message sent by the SeGW to the control plane network element carries the location information of the UE, and the control plane network element can be based on the APN after the authorization is passed.
  • the location information of the UE is sent to the SeGW by the identifier of the PGW closest to the UE location in the PGW corresponding to the approved APN.
  • the control plane network element can obtain the load information of each PGW, and after the authorization of the APN, the identifier of the PGW with the smallest load in the PGW corresponding to the approved APN is sent to the SeGW based on the load information of each PGW.
  • the control plane network element sends the PGW to the SeGW.
  • the indication message may be sent to the SeGW, where the indication message is used to indicate that the SeGW needs to feed back the connection of the session channel established between the PGW and the PGW.
  • Receive information may be an indication of the ACK needed to be fed back, or may be a support for the handover of the HO supported indication, or may be a service continuity indication, which is not limited in the embodiment of the present invention.
  • the SeGW After receiving the indication message and completing the establishment of the session channel connection with the PGW, the SeGW sends a feedback message of the indication message, where the feedback message carries the connection information, or the SeGW sends the third message to the control plane network element.
  • the connection message is carried in the reply message of the request message (ie, the PDN connection establishment reply message).
  • the connection information includes at least one of a tunnel identifier IEID allocated by the PGW for the PDN connection (or a session channel connection), an IP address of the UE, a QoS, and the like.
  • the SeGW receives the identifier of the PGW, and sends a third request message to the PGW based on the identifier of the PGW.
  • the SeGW may send a third request message to the corresponding PGW based on the identifier of the PGW.
  • the third request message may be a session establishment request message for requesting establishment of a session channel connection with the PGW.
  • the SeGW sends the session establishment request message to the PGW, and also sets the RAT type of the UE to the unlicensed spectrum access, so as to send the session establishment request message to the PGW. SeGW also allocates bandwidth, QoS parameters, etc. for session channel connections.
  • the PGW receives the third request message, and establishes a session channel connection with the SeGW.
  • the PGW after receiving the second request message, the PGW establishes a session channel connection with the SeGW. At the same time, the PGW allocates an IP address to the UE, allocates a tunnel, a QoS parameter, and the like for the PDN connection, and records that the PDN connection is an unlicensed spectrum access.
  • the SeGW receives a response that the PGW establishes a session channel connection with the SeGW based on the third request message.
  • the SeGW returns a response message of the first request message to the UE.
  • the SeGW after the establishment of the session channel connection between the PGW and the SeGW, the SeGW will reply the IKE_AUTH reply message to the UE, thereby completing the establishment of the secure channel connection between the UE and the SeGW, thereby completing the PDN connection of the UE.
  • the SeGW after the home network side (the control plane network element and the PGW) establishes the PDN connection successfully, the SeGW returns a response message of the first request message to the UE.
  • the SeGW and the UE can directly communicate through the IKEv2 message, and can also reply to the PDN.
  • the connection reply message is sent to the local network device, and is forwarded to the UE by the local network device.
  • the PDN connection reply message includes an IKE_AUTH reply message.
  • the EPS system can implement the access authorization of the UE from the unlicensed spectrum access node to the home network, and the UE actively triggers the PDN connection establishment process when there is an EPC service requirement, so that After the UE is attached to the home network, the PDN connection is established for the UE, and the resource occupation of the EPC network is avoided, thereby improving the utilization of the EPC network resources.
  • the UE directly establishes a secure channel with the SeGW, and then the SeGW searches for the control plane network element, so that the UE and the SeGW can use the secure channel to communicate, and the third-party deployed local network pair
  • the communication content is not visible, thus realizing the protection of the operator's business.
  • FIG. 3 is a schematic structural diagram of a security gateway according to an embodiment of the present invention.
  • the SeGW 300 described in FIG. 3 can be applied to the foregoing method embodiments.
  • the SeGW 300 can include a transceiver module 301 and a processing module 302, where:
  • the transceiver module 301 is configured to receive a first request message sent by the local network device when the UE accesses the local network that uses the unlicensed spectrum.
  • the first request message is sent by the UE to the local network device, and is used to request to establish a PDN connection for the UE.
  • the PDN connection of the UE includes a secure channel connection between the UE and the SeGW 300 and a session channel connection between the SeGW 300 and the PGW.
  • the processing module 302 is configured to acquire the radio access technology indication of the UE, and obtain the identifier of the control plane network element that is attached to the UE, where the radio access technology indicates that the radio access technology used for the UE access is an unlicensed spectrum connection.
  • the transceiver module 301 is further configured to send a second request message to the control plane network element based on the identifier of the control plane network element to which the UE is attached, where the second request message carries the user identifier of the UE and the radio access technology indication, and the second The request message is used to request the identification of the PGW.
  • the transceiver module 301 is further configured to receive, by the control plane network element, an identifier of the PGW returned based on the user identifier and the radio access technology indication.
  • the transceiver module 301 is further configured to send a third request message to the corresponding PGW based on the identifier of the PGW.
  • the third request message is used to establish a session channel connection between the SeGW 300 and the PGW.
  • the transceiver module 301 is further configured to receive a response that the PGW establishes a session channel connection with the SeGW 300 based on the third request message.
  • the first request message may be an APN connection request message or a PDN connection request message, which is not limited in the embodiment of the present invention.
  • the second request message may be a PDN connection setup request message.
  • the third request message may be a session establishment request message.
  • the PGW After receiving the second request message, the PGW establishes a session channel connection with the SeGW 300. At the same time, the PGW allocates an IP address to the UE, allocates a tunnel, QoS, etc. for the PDN connection, and records that the PDN connection is an unlicensed spectrum access.
  • the specific manner in which the processing module 302 obtains the radio access technology indication of the UE may include the following two types:
  • the local network device when forwarding the first request message, carries a radio access technology indication indicating that the RAT accessed by the UE is an unlicensed spectrum access, and after receiving the first request message, the transceiver module 301 processes the module 302.
  • the wireless access technology indication can be obtained from the first request message.
  • the local network device While forwarding the first request message, the local network device carries information of the wireless access node of the local network, where the information indicates that the wireless access node is an unlicensed spectrum wireless access node. Therefore, after receiving the first request message, the processing module 302 may determine, according to the information of the wireless access node, that the RAT accessed by the UE is an unlicensed spectrum access, and generate a radio access technology indication.
  • the specific manner in which the processing module 302 obtains the identifier of the control plane network element to which the UE is attached may include the following:
  • the local network device when forwarding the first request message, carries the temporary identifier allocated by the home network to the UE, where the temporary identifier includes the identifier of the control plane network element to which the UE is attached, and after receiving the first request message, the transceiver module 301 receives the first request message.
  • the processing module 302 may obtain the identifier of the control plane network element to which the UE is attached from the temporary identifier.
  • the local network device directly carries the identifier of the control plane network element attached to the UE, and the processing module 302 directly The identifier of the control plane network element to which the UE is attached is obtained in the first request message.
  • the local network device carries the local network device to the UE while forwarding the first request message.
  • the transceiver module 301 may send a request message for requesting the identifier of the control plane network element attached to the UE, such as a connection information request message, to the local network device, after receiving the first request message, the message carrying There is this local IP address.
  • the local network device After receiving the connection information request message, the local network device searches for the context of the UE based on the local IP address of the UE, so that the identifier of the control plane network element currently attached by the UE included in the UE context is sent to the SeGW 300 through the connection information reply message. .
  • the transceiver module 301 may send a request message for requesting to obtain the identifier of the control plane network element attached to the UE, such as an update location request message, where the message includes the user identifier of the UE, such as a permanent identifier.
  • the HSS searches for the context of the UE based on the IMSI of the UE. If the UE has been attached to the control plane network element, the HSS stores the identifier of the currently attached control plane network element, thereby replying to the update location reply message to the SeGW 300, and the message carries The identifier of the control plane network element to which the UE is attached.
  • the transceiver module 301 is further configured to receive an indication message sent by the control plane network element, and send the PGW to the control plane network element after the establishment of the session channel connection between the SeGW 300 and the PGW. Connection information for the session channel connection.
  • the indication message is used to indicate a session channel connection establishment result between the feedback and the PGW of the SeGW 300, where the connection information includes a TEID allocated by the PGW for the session channel connection (or the PDN connection), an IP address of the UE, At least one of QoS.
  • the transceiver module 301 receives the identifier of the PGW returned by the control plane network element based on the user identifier and the radio access technology indication, including:
  • the second request message sent by the transceiver module 301 to the control plane network element also carries the requested APN.
  • the transceiver module 301 receives the identifier of the APN corresponding to the APN that the control plane network element passes based on the authorization of the user identifier after the authorization of the requested APN is passed.
  • the transceiver module 301 receives the identifier of the APN corresponding to the default APN in the subscription data of the UE returned by the control plane network element based on the user identifier and the radio access technology indication.
  • FIG. 4 is a schematic structural diagram of another security gateway according to an embodiment of the present invention.
  • the SeGW 400 described in FIG. 4 can be applied to the above method embodiments.
  • the SeGW 400 can include a transceiver 401 and a processor 402, wherein:
  • the transceiver 401 is configured to receive a first request message sent by the local network device when the UE accesses the local network that uses the unlicensed spectrum.
  • the first request message is sent by the UE to the local network device, and is used to request to establish a PDN connection for the UE.
  • the PDN connection of the UE includes a secure channel connection between the UE and the SeGW 400 and a session channel connection between the SeGW 400 and the PGW.
  • the processor 402 is configured to acquire the radio access technology indication of the UE, and obtain the identifier of the control plane network element that is attached to the UE, where the radio access technology indicates that the radio access technology used for the UE access is an unlicensed spectrum connection.
  • the transceiver 401 is further configured to send, according to the identifier of the control plane network element to which the UE is attached, the second request message to the control plane network element, where the second request message carries the user identifier of the UE and the radio access technology indication, and the second The request message is used to request the identification of the PGW.
  • the transceiver 401 is further configured to receive, by the control plane network element, an identifier of the PGW returned based on the user identifier and the radio access technology indication.
  • the transceiver 401 is further configured to send a third request message to the corresponding PGW based on the identifier of the PGW.
  • the third request message is used to establish a session channel connection between the SeGW 400 and the PGW.
  • the transceiver 401 is further configured to receive a response that the PGW establishes a session channel connection with the SeGW 400 based on the third request message.
  • the first request message may be an APN connection request message or a PDN connection request message, which is not limited in the embodiment of the present invention.
  • the second request message may be a PDN connection setup request message.
  • the third request message may be a session establishment request message.
  • the PGW After receiving the second request message, the PGW establishes a session channel connection with the SeGW 400. At the same time, the PGW allocates an IP address to the UE, allocates a tunnel, QoS, etc. for the PDN connection, and records that the PDN connection is an unlicensed spectrum access.
  • the specific manner in which the processor 402 obtains the radio access technology indication of the UE may include the following two types:
  • the local network device while forwarding the first request message, carries a radio access technology indication indicating that the RAT accessed by the UE is an unlicensed spectrum access, and the transceiver 401 receives the first request cancellation.
  • the processor 402 can obtain the wireless access technology indication from the first request message.
  • the local network device While forwarding the first request message, the local network device carries information of the wireless access node of the local network, where the information indicates that the wireless access node is an unlicensed spectrum wireless access node. Therefore, after receiving the first request message, the processor 402 may determine, according to the information of the wireless access node, that the RAT accessed by the UE is an unlicensed spectrum access, and generate a radio access technology indication.
  • the specific manner in which the processor 401 obtains the identifier of the control plane network element to which the UE is attached may include the following:
  • the local network device when forwarding the first request message, carries the temporary identifier allocated by the home network to the UE, where the temporary identifier includes the identifier of the control plane network element to which the UE is attached, and after receiving the first request message, the transceiver 401 receives the first request message.
  • the processor 402 may obtain the identifier of the control plane network element attached to the UE from the temporary identifier.
  • the local network device directly carries the identifier of the control plane network element attached to the UE, and the processor 402 directly The identifier of the control plane network element to which the UE is attached is obtained in the first request message.
  • the local network device forwards the first request message, and carries the local IP address allocated by the local network device to the UE.
  • the transceiver 401 may send a request for acquiring the UE attachment to the local network device.
  • a request message for controlling the identity of the surface network element such as a connection information request message, the message carrying the local IP address.
  • the local network device searches for the context of the UE based on the local IP address of the UE, so that the identifier of the control plane network element currently attached by the UE included in the UE context is sent to the SeGW 400 through the connection information reply message. .
  • the transceiver 401 may send, to the HSS, a request message for requesting to obtain the identifier of the control plane network element attached to the UE, such as an update location request message, where the message includes the user identifier of the UE, such as a permanent identifier.
  • the HSS searches for the context of the UE based on the IMSI of the UE. If the UE has been attached to the control plane network element, the HSS stores the identifier of the currently attached control plane network element, thereby replying to the update location reply message to the SeGW 400, and the message carries The identifier of the control plane network element to which the UE is attached.
  • the transceiver 401 is further configured to receive an indication message sent by the control plane network element, and send the PGW to the control plane network element after the session channel connection between the SeGW 400 and the PGW is established. Connection information for the session channel connection.
  • the indication message is used to indicate a session channel connection establishment result between the feedback and the PGW of the SeGW 400, where the connection information includes a TEID allocated by the PGW for the session channel connection (or the PDN connection), an IP address of the UE, At least one of QoS.
  • the transceiver 401 receives the identifier of the PGW returned by the control plane network element based on the user identifier and the radio access technology indication, including:
  • the second request message sent by the transceiver 401 to the control plane network element also carries the requested APN.
  • the transceiver 401 receives the identifier of the APN corresponding to the APN that the control plane network element passes based on the authorization of the user identifier to return after the authorization of the requested APN is passed;
  • the transceiver 401 receives the identifier of the APN corresponding to the default APN in the subscription data of the UE returned by the control plane network element based on the user identifier and the radio access technology indication.
  • the SeGW in the SeGW described in FIG. 3 and FIG. 4, after the UE is attached to the home network by using the local network of the unlicensed spectrum, if the EPC service is requested, the SeGW establishes a PDN connection request message with the UE, and then establishes with the UE.
  • the secure channel obtains the APN requested by the UE or the PGW corresponding to the default APN through the control plane network element, and establishes a session channel with the PGW, thereby completing establishment of the PDN connection for the UE.
  • the EPS system establishes a PDN connection for the UE only when the UE needs it, thereby avoiding resource occupation of the EPC network, thereby improving the utilization of the EPC network resource. Further, in the process of establishing a PDN connection for the UE, the UE directly establishes a secure channel with the SeGW, and then the SeGW searches for the control plane network element, so that the UE and the SeGW can use the secure channel to communicate, and the third-party deployed local network pair The communication content is not visible, thus realizing the protection of the operator's business.
  • FIG. 5 is a schematic structural diagram of a control plane network element according to an embodiment of the present invention.
  • the control plane network element 500 described in FIG. 5 can be applied to the above method embodiments.
  • the control plane network element 500 can include the following transceiver module 501 and processing module 502, where:
  • the transceiver module 501 is configured to receive a second request message sent by the security gateway if the UE attaches to the home network of the UE from a local network that uses an unlicensed spectrum.
  • the second request message is used to request to obtain the identifier of the PGW, and the second request message carries the user identifier of the UE and the radio access technology indication, where the radio access technology indicates that the radio access technology used for the UE access is unauthorized.
  • the spectrum access, the second request message is sent by the SeGW to the control plane network element 500 after receiving the first request message of the UE and establishing a secure channel connection with the UE, where the first request message is used to request to establish a PDN connection for the UE.
  • the PDN connection includes a secure channel connection and a session channel connection.
  • the transceiver module 501 is further configured to send the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication, so that the SeGW establishes a session channel connection with the PGW marked by the identifier of the PGW corresponding to the APN.
  • the first request message may be an APN connection request message or a PDN connection request message, which is not limited in the embodiment of the present invention.
  • an IP address is allocated to the UE, a tunnel, a QoS, and the like are allocated for the PDN connection, and the PDN connection is recorded as an unlicensed spectrum access.
  • the specific manner in which the transceiver module 501 sends the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication may be:
  • the APN authorization is performed by the processing module 502 based on the subscription data and the wireless access technology indication;
  • the identifier of the PGW corresponding to the APN through which the authorization is passed is sent to the SeGW.
  • the specific manner in which the processing module 502 performs the APN authorization based on the subscription data and the radio access technology indication may include any one of the following:
  • the processing module 502 determines whether the subscription data includes the radio access technology indication, and if so, Determining that the requested APN authorization is passed; or, if not, determining that the requested APN authorization does not pass;
  • the processing module 502 determines whether the subscription data includes the radio access technology indication, and if so, determines to pass the default APN authorization in the subscription data; or, if not Including, it is determined that the default APN authorization in the subscription data does not pass.
  • the transceiver module 501 is further configured to send the approved APN to the SeGW, so that the subsequent SeGW performs control based on the authorized APN.
  • the specific manner in which the transceiver module 501 sends the identifier of the PGW corresponding to the APN that is authorized to be sent to the SeGW may include the following two types:
  • the transceiver module 501 may, according to the location information of the UE, the PGW corresponding to the location of the UE in the PGW corresponding to the approved APN. The identity is sent to SeGW.
  • the processing module 502 can obtain the load information of each PGW, and after the APN is authorized to pass, the transceiver module 501 sends the identifier of the PGW with the smallest load in the PGW corresponding to the approved APN to the SeGW based on the load information of each PGW.
  • the identifier of the PGW that is closest to the UE or has the smallest load in the PGW corresponding to the approved APN is sent to the SeGW, so that the SeGW establishes a session channel connection with the PGW that is closest to the UE or has the smallest load, thereby improving the utilization of network resources.
  • the transceiver module 501 is further configured to send an indication message to the SeGW, where the indication message is used to indicate a session channel connection establishment result between the SeGW feedback and the PGW.
  • the transceiver module 501 is further configured to receive connection information of the session channel connection that is sent by the SeGW after the establishment of the session connection with the PGW.
  • FIG. 6 is a schematic structural diagram of another control plane network element according to an embodiment of the present invention.
  • the control plane network element 600 described in FIG. 6 can be applied to the above method embodiments.
  • the control plane network element 600 can include the following transceiver 601 and processor 602, where:
  • the second request message sent by the security gateway is received.
  • the second request message is used to request to obtain the identifier of the PGW, and the second request message carries the user identifier of the UE and the radio access technology indication, where the radio access technology indicates that the radio access technology used for the UE access is unauthorized.
  • Spectrum access the second request message is sent by the SeGW to the control plane network element 600 after receiving the first request message of the UE and establishing a secure channel connection with the UE, where the first request message is used to request to establish a PDN connection for the UE.
  • the PDN connection includes a secure channel connection and a session channel connection.
  • the transceiver 601 is further configured to send the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication, so that the SeGW establishes a session channel connection with the PGW marked by the identifier of the PGW corresponding to the APN.
  • the first request message may be an APN connection request message or a PDN connection request message, which is not limited in the embodiment of the present invention.
  • an IP address is allocated to the UE, a tunnel, a QoS, and the like are allocated for the PDN connection, and the PDN connection is recorded as an unlicensed spectrum access.
  • the specific manner in which the transceiver 601 sends the identifier of the PGW to the SeGW based on the user identifier and the radio access technology indication may be:
  • the identifier of the PGW corresponding to the APN through which the authorization is passed is sent to the SeGW.
  • the specific manner in which the processor 602 performs the APN authorization based on the subscription data and the radio access technology indication may include any one of the following:
  • the processor 602 determines whether the subscription data includes the radio access technology indication, and if so, Determining that the requested APN authorization is passed; or, if not, determining that the requested APN authorization does not pass;
  • the processor 602 determines whether the subscription data includes the radio access technology indication, and if so, determines the default in the subscription data. The APN is authorized to pass; or, if not included, it is determined that the default APN authorization in the subscription data does not pass.
  • the transceiver 601 is further configured to send the authorized APN to the SeGW, so that the subsequent SeGW performs control based on the authorized APN.
  • the specific manner in which the transceiver 601 sends the identifier of the PGW corresponding to the APN to the SeGW may include the following two types:
  • the transceiver 601 may, based on the location information of the UE, the PGW corresponding to the location of the UE in the PGW corresponding to the authorized APN. The identity is sent to SeGW.
  • the processor 602 can obtain the load information of each PGW, and after the APN is authorized to pass, the transceiver 601 sends the identifier of the PGW with the smallest load in the PGW corresponding to the approved APN to the SeGW based on the load information of each PGW.
  • the identifier of the PGW that is closest to the UE or has the smallest load in the PGW corresponding to the approved APN is sent to the SeGW, so that the SeGW establishes a session channel connection with the PGW that is closest to the UE or has the smallest load, thereby improving the utilization of network resources.
  • the transceiver 601 is further configured to send an indication message to the SeGW, where the indication message is used to indicate a session channel connection establishment result between the SeGW feedback and the PGW;
  • the transceiver 601 is further configured to receive connection information of the session channel connection that is sent by the SeGW after the establishment of the session connection with the PGW.
  • the control plane network element may first authorize the APN requested by the UE, and only if the authorization is passed. After the UE is attached to the home network, the PDN connection is established for the UE, and the PDN connection is established for the UE.
  • the resource occupancy of the EPC network can improve the utilization of EPC network resources.
  • FIG. 7 is a schematic structural diagram of a system for establishing a PDN connection according to an embodiment of the present invention.
  • the system may include a UE 701, a local network device 702, a SeGW 703, a control plane network element 704, and a PGW 705, where:
  • the local network device 702 is a service device of a local network that uses an unlicensed spectrum, and may include an MME or an AAA server, and may also include an unlicensed spectrum access node, that is, a base station or an access point that uses an unlicensed spectrum, in the embodiment of the present invention. Not limited.
  • the UE 701 attaches to the home network by using the local network (including the local network device 702, the control network element 704, and the HSS, etc.) of the unlicensed spectrum. If the UE is successfully attached, the UE 701 has the EPC service (ie, the core network service). The UE 701 sends a first request message to the local network device 702. The first request message carries the identifier of the SeGW 703 and the identifier of the control plane network element 704 to which the UE 701 is attached.
  • the APN connection setup request message may further include an APN requested by the UE 701.
  • the local network device 702 After receiving the first request message, the local network device 702 forwards the first request message to the corresponding SeGW 703, and the SeGW 703 obtains the radio access technology indication of the UE after receiving the first request message, where the radio access technology indication is used for The radio access technology indicating that the UE 701 accesses is an unlicensed spectrum access, and acquires the identifier of the control plane network element 704.
  • the SeGW 703 sends a second request message to the control plane network element 704 based on the identity of the control plane network element 704.
  • the second request message carries the user identity and radio access technology indication of the UE 701. If the second request message carries the APN requested by the UE 701, the control plane network element 704 may authorize the APN requested by the UE 701 based on the subscription data and the radio access technology indication after acquiring the subscription data of the UE 701 according to the user identifier; if the PDN is The connection establishment request message does not carry the APN requested by the UE 701, and the control plane network element 704 can authorize the default APN of the UE 701 based on the subscription data and the radio access technology indication. If the APN authorization is successful, the control plane network element 704 may send the identifier of the PGW 705 corresponding to the APN that is authorized to be sent to the SeGW 703, and if the APN authorization fails, return a reject message.
  • the SeGW 703 sends a third request message to the PGW 705 based on the identity of the PGW 705 corresponding to the APN, and the third request message carries the radio access technology indication.
  • the SeGW 703 receives a response from the PGW to establish a session channel connection with the SeGW 703 based on the third request message.
  • the PGW 705 and the SeGW 703 complete the establishment of the session channel connection, and allocate an IP address to the UE 701 and record the PDN connection of the UE 701. For unlicensed spectrum access. So far, the SeGW 703 replies to the APN connection reply message to the UE, thereby completing the PDN connection to the UE 701.
  • the SeGW 703 and the UE 701 can communicate through the established secure connection channel.
  • the access authorization of the UE from the unlicensed spectrum to the home network can be implemented, and the UE actively triggers the PDN connection establishment process when the EPC service needs, so that the UE can be attached to the home network.
  • the PDN connection is established for the UE in the case that the UE needs to avoid the resource occupation of the EPC network, thereby improving the utilization of the EPC network resource.
  • the UE directly establishes a secure channel with the SeGW, and then the SeGW searches for the control plane network element, so that the UE and the SeGW can use the secure channel for communication, and the third-party deployed local network.
  • the communication content is not visible, thus realizing the protection of the operator's business.
  • control plane network element and the module in the security gateway may be combined, divided, and deleted according to actual needs.
  • control plane network element and the security gateway in the embodiment of the present invention may be implemented by a general-purpose integrated circuit, such as a CPU (Central Processing Unit) or an ASIC (Application Specific Integrated Circuit).
  • a CPU Central Processing Unit
  • ASIC Application Specific Integrated Circuit
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例公开了一种建立PDN连接的方法及相关设备，其中，该方法可以包括：UE通过采用非授权频谱的本地网络附着到归属网络后，如果请求EPC业务，SeGW在接收到UE的PDN连接请求消息后，会与UE建立安全通道，通过控制面网元获取UE请求的APN对应的PGW，并与PGW建立会话通道，从而完成了为UE的PDN连接的建立。通过本发明实施例，UE在附着归属网络后，EPS系统在UE有需求的情况下才为UE建立PDN连接，避免对EPC网络的资源占用，从而可以提高EPC网络资源的利用率。

Description

一种建立公用数据网连接的方法及相关设备 技术领域
本发明实施例涉及通信技术领域，具体涉及一种建立公用数据网连接的方法及相关设备。
背景技术
目前，演进的分组系统(Evolved Packet System，EPS)由用户设备(User Equipment，UE)、接入网和演进的分组核心网(Evolved Packet Core，EPC)组成。其中，接入网采用的频谱为授权频谱，如通用地面无线接入网(Universal Terrestrial Radio Access Network，UTRAN)、演进的通用地面无线接入网(Evolved UTRAN，E-UTRAN)等，随着移动宽带业务的发展，授权频谱逐渐不能满足快速增长的业务需求，采用非授权频谱作为新的无线接入技术以提升空口承载能力成为EPS接入网的发展趋势。
在实践中发现，UE从接入网附着到归属运营商EPC的同时，归属运营商EPC会为其建立公用数据网(Public Data Network，PDN)连接，实现UE的“永久在线”。然而，在采用非授权频谱的本地网络接入归属运营商EPC的网络架构中，UE附着到归属运营商EPC后，可能只需要进行本地业务，如果UE附着后永久在线，则会占用EPC的网络资源，从而降低EPC网络资源的利用率。
发明内容
本发明实施例公开了一种建立PDN连接的方法、相关设备及系统，可以在UE从非授权频谱接入EPC时实现为UE建立PDN连接。
本发明实施例第一方面公开了一种建立PDN连接的方法，应用于EPS，其中，该方法可以包括：
在UE从采用非授权频谱的本地网络接入时，安全网关(Security Gate Way，SeGW)在接收到本地网络设备发送的用于请求为UE建立PDN连接的第一请求消息后，获取UE的无线接入技术指示以及UE附着的控制面网元的标识，并基 于控制面网元的标识向控制面网元发送第二请求消息，第二请求消息携带UE的用户标识和无线接入技术指示，用于请求获取数据网关(Public Data Network Gateway，PGW)的标识，这样控制面网元在接收到第二请求消息后，会基于用户标识和无线接入技术指示向SeGW发送PGW的标识。SeGW从而可以基于PGW的标识向对应的PGW发送第三请求消息，用于请求建立SeGW与PGW之间的会话通道连接。SeGW从而可以接收PGW基于第三请求消息与SeGW建立会话通道连接的响应。
其中，该第一请求消息由UE发送给本地网络设备，用于请求为UE建立PDN连接，UE的PDN连接包括UE与SeGW之间的安全通道连接和SeGW与PGW之间的会话通道连接。
具体的，第一请求消息可以为接入点名称(Access Point Name，APN)连接请求消息，也可以为PDN连接请求消息，第二请求消息可以为PDN连接建立请求消息。第三请求消息可以为会话建立请求消息。PGW在接收到第二请求消息后，会与SeGW建立会话通道连接。同时PGW会为UE分配IP地址，为PDN连接分配隧道，服务质量(Quality of Service，QoS)参数等，并记录此次PDN连接为非授权频谱接入。
UE在附着到归属网络后，在有EPC业务需求的情况下触发建立PDN连接，从而可以避免在不需要EPC业务的情况下对EPC网络资源的占用，提高了EPC网络资源的利用率。
可选的，SeGW获取UE的无线接入技术指示的具体方式可以包括以下两种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带用于指示UE接入的RAT为非授权频谱接入的无线接入技术指示，SeGW在接收到第一请求消息后，可以从第一请求消息中获取该无线接入技术指示。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络的无线接入节点的信息，该信息指示无线接入节点为非授权频谱无线接入节点。因此，SeGW在接收到第一请求消息后，可以根据无线接入节点的信息确定UE接入的RAT为非授权频谱接入，并生成无线接入技术指示。
可选的，SeGW获取UE附着的控制面网元的标识的具体方式可以包括以下几种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带归属网络为UE分配的临时标识，该临时标识中包括UE附着的控制面网元的标识，SeGW在接收到第一请求消息后可以从临时标识中获取UE附着的控制面网元的标识；或者，本地网络设备在转发第一请求消息的同时，直接携带UE附着的控制面网元的标识，SeGW直接从第一请求消息中获取该UE附着的控制面网元的标识。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络设备为UE分配的本地IP地址，SeGW在接收到第一请求消息后，可以向本地网络设备发送用于请求获取UE附着的控制面网元的标识的请求消息，如连接信息请求消息，该消息携带有UE的本地互联网协议(Internet Protocol，IP)地址。本地网络设备在接收到连接信息请求消息后，会基于UE的本地IP地址查找UE的上下文，从而将UE上下文中包含的UE当前附着的控制面网元的标识通过该连接信息回复消息发送给SeGW。
方式三、
SeGW在接收到第一请求消息后，可以向归属网络签约服务器(Home Subscriber Server，HSS)发送用于请求获取UE附着的控制面网元的标识的请求消息，如更新位置请求消息，该消息包含UE的永久标识，如国际移动用户识别码(International Mobile Subscriber Identification Number，IMSI)，HSS基于UE的IMSI查找UE的上下文，如果UE已经附着到控制面网元，则HSS会存储当前附着的控制面网元的标识，从而回复更新位置回复消息给SeGW，该消息携带UE附着的控制面网元的标识。
可选的，该方法还可以包括：
在需要保持UE移动时业务的连续性的情况下，SeGW可以接收控制面网元发送的用于指示SeGW反馈与PGW之间的会话通道连接建立结果的指示消息，并在与PGW之间的会话通道连接建立完成之后向控制面网元发送该会话通道连接的连接信息。
其中，该指示消息可以是需要反馈(Acknowledge，ACK)needed指示，也可以是支持切换(Handover，HO)supported指示，还可以是业务连续性指示。该连接信息可以包括PGW为该会话通道连接分配的隧道标识(Tunnel Endpoint Identity，TEID)，该UE的IP地址以及QoS中的至少一种。
可选的，SeGW接收控制面网元基于用户标识以及无线接入技术指示返回的PGW的标识，包括：
如果第一请求消息携带UE请求的APN，其中，该请求的APN为无线接入技术指示下的APN，SeGW向控制面网元发送的第二请求消息中也携带有该请求的APN，SeGW则接收控制面网元基于用户标识在对请求的APN授权通过后返回的授权通过的APN对应的APN的标识；
或者，
如果第一请求消息未携带UE请求的APN，SeGW则接收控制面网元基于用户标识和无线接入技术指示返回的UE的签约数据中缺省APN对应的APN的标识。
在为UE建立PDN连接过程中，UE直接与SeGW建立安全通道，然后由SeGW去找控制面网元，这样UE与SeGW之间可以采用进行安全通道进行通信，第三方部署的本地网络对通信内容不可见，从而实现了对运营商业务的保护。
本发明实施例第二方面公开了一种安全网关，该安全网关可以包括收发模块和处理模块，可以用于执行第一方面公开的建立PDN连接的方法。
本发明实施例第三方面公开了另一种安全网关，该安全网关可以包括收发器和处理器，其中，收发器对应第二方面公开的安全网关的收发模块，处理器对应第二方面公开的安全网关的处理模块，可以用于执行第一方面公开的建立PDN连接的方法。
本发明实施例第四方面公开了另一种建立PDN连接的方法，应用于EPS，其中，该方法可以包括：
在UE从采用非授权频谱的本地网络接入时，控制面网元可以接收SeGW发送的第二请求消息，并基于第二请求消息中携带的UE的用户标识和无线接入技术指示将PGW的标识发送给SeGW，以便SeGW与该APN对应的PGW的标识所标记的PGW建立会话通道连接。
其中，第二请求消息用于请求获取PGW的标识，第二请求消息携带UE的用户标识以及无线接入技术指示，无线接入技术指示用于指示UE接入的无线接入技术为非授权频谱接入，该第二请求消息由SeGW在接收到UE的第一请求消息并与UE建立安全通道连接后发送给控制面网元，该第一请求消息用于请求为UE建立PDN连接，该PDN连接包括安全通道连接和会话通道连接
具体的，第一请求消息可以为APN连接请求消息，也可以为PDN连接请求消息，第二请求消息可以为PDN连接建立请求消息。
进一步的，PGW与SeGW之间建立会话通道连接的同时，会为UE分配IP地址，为PDN连接分配隧道，QoS等，并记录此次PDN连接为非授权频谱接入。
可选的，控制面网元基于该用户标识以及无线接入技术指示将PGW的标识发送给SeGW的具体方式可以为：
基于该用户标识获取UE的签约数据，基于签约数据和无线接入技术指示进行APN授权，将授权通过的APN对应的PGW的标识发送给SeGW。
控制面网元在接收到SeGW发送的PDN连接建立请求消息后，可以先对UE请求的APN进行授权，只有授权通过的情况下，才会将其对应的PGW的标识发送给SeGW，SeGW从而完成与PGW之间的会话通道连接的建立，实现了在UE附着归属网络后，如果UE有需求才为UE建立PDN连接，避免对EPC网络的资源占用，从而可以提高EPC网络资源的利用率。
具体实现中，控制面网元基于签约数据和无线接入技术指示进行APN授权的具体方式可以包括以下任意一种：
方式一、
如果第二请求消息携带有UE请求的APN，其中，该请求的APN为无线接入技术指示下的APN，那么控制面网元会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对请求的APN授权通过；或者，如果不包含，则确定对请求的APN授权不通过；
方式二、
控制面网元会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对签约数据中的缺省APN授权通过；或者，如果不包含，则确定对签约数据中的缺省APN授权不通过。
可选的，控制面网元将授权通过的APN对应的PGW的标识发送给SeGW的具体方式可以包括以下两种：
方式一、
如果第三请求消息中携带有UE的位置信息，那么控制面网元在对APN授权通过后，可以基于该UE的位置信息，将授权通过的APN对应的PGW中距离UE位置最近的PGW的标识发送给SeGW。
方式二、
控制面网元可以获取各个PGW的负载信息，并在对APN授权通过后，基于各个PGW的负载信息，将授权通过的APN对应的PGW中负载最小的PGW的标识发送给SeGW。
将授权通过的APN对应的PGW中距离UE最近或者负载最小的PGW的标识发送给SeGW，使得SeGW与距离UE最近或者负载最小的PGW建立会话通道连接，从而可以提高网络资源的利用率。
可选的，该方法还可以包括：
控制面网元向SeGW发送指示消息，该指示消息用于指示SeGW反馈与PGW之间的会话通道连接建立结果，控制面网元从而可以接收SeGW在与PGW完成会话通道连接的建立后，发送的会话通道连接的连接信息。
本发明实施例第五方面公开了一种控制面网元，该控制面网元可以包括收发模块和处理模块，可以用于执行第四方面公开的建立PDN连接的方法。
本发明实施例第六方面公开了另一种控制面网元，该控制面网元可以包括收发器和处理器，其中，收发器对应第五方面公开的控制面网元的收发模块，处理器对应第五方面公开的控制面网元的处理模块，可以用于执行第四方面公开的建立PDN连接的方法。
本发明实施例第七方面公开了一种UE，应用于EPS，归属网络设备在对UE从非授权频谱接入授权通过后，可以向UE发送SeGW的标识，如SeGW的IP地址、完全合格域名/全称域名(Fully Qualified Domain Name，FQDN)等，因此，UE可以接收SeGW的标识，这样UE在向本地网络设备发送第一请求消息时，就可以携带SeGW的标识。
进一步的，本地网络设备还可以为UE分配本地IP地址，UE在接入授权通 过后，还可以接收本地网络设备发送的本地IP地址。
本发明实施例第八方面公开了一种本地网络设备，应用于EPS，本地网络设备接收UE发送的第一请求消息还可以携带SeGW的标识，即第一请求消息的源地址设置为本地网络设备为UE分配的本地IP地址，目的地址为UE收到的SeGW对应的IP地址。
本发明实施例第九方面公开了一种建立PDN连接的系统，该系统应用于EPS系统，可以包括第二方面公开的SeGW、第五方面公开的控制面网元、第八方面公开的本地网络设备、第七方面公开的UE以及PGW等。该系统可以实现在UE从非授权频谱的本地网络附着到归属网络后，如果UE有EPC业务的需求，才会为UE建立PDN连接，避免对EPC网络的资源占用，从而可以提高EPC网络资源的利用率。进一步的，在为UE建立PDN连接过程中，UE直接与SeGW建立安全通道，然后由SeGW去找控制面网元，这样UE与SeGW之间可以采用安全通道进行通信，第三方部署的本地网络对通信内容不可见，从而实现了对运营商业务的保护。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例公开的一种EPS架构示意图；
图2是本发明实施例公开的一种建立PDN连接的方法的流程示意图；
图3是本发明实施例公开的一种安全网关的结构示意图；
图4是本发明实施例公开的另一种安全网关的结构示意图；
图5是本发明实施例公开的一种控制面网元的结构示意图；
图6是本发明实施例公开的另一种控制面网元的结构意图；
图7是本发明实施例公开的一种建立PDN连接的系统结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例公开了一种建立PDN连接的方法、相关设备及系统，可以提高EPC网络资源的利用率。以下分别进行详细说明。
为了更好的理解本发明实施例公开的一种建立PDN连接的方法及相关设备，下面先对本发明实施例适用的EPS架构进行描述。请参阅图1，图1是本发明实施例公开的一种EPS架构示意图。在图1所示的系统架构中，包括UE、本地网络和运营商核心网络EPC。其中，UE可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式的用户设备，移动台(Mobile station，MS)，终端(terminal)，终端设备(Terminal Equipment)等等。为方便描述，本发明实施例中，上面提到的设备统称为用户设备或UE。
图1所示的系统架构应用于漫游场景，在图1中，本地网络是指第三方部署的网络，区别于运营商网络。本地网络包括非授权频谱无线接入节点(如Wi-Fi接入节点，非授权长期演进计划频谱(Unlicensed Long Term Evolution，LTE-U)接入节点，简称LTE-U接入节点等)，本地网络控制面网元以及本地网络用户面网元。其中，LTE-U接入节点是指使用非授权频谱的基站、接入点(Access Point，AP)等；本地网络控制面网元为移动管理实体(Mobility Management Entity，MME)或控制面节点(Control Point，CP)；本地网络用户面网元为网关(Gate Way，GW)或用户面节点(User Point，UP)。运营商EPC包括控制面网元、用户面网元、HSS和PGW。其中，控制面网元为MME、验证、授权和记账(Authentication、Authorization、Accounting，AAA)服务器、演进数据网关(Evolved Packet Data Gateway，ePDG)、通用无线分组业务(General Packet Radio Service，GPRS)服务支持节点(Serving GPRS Support Node，SGSN)或CP；用户面网元包括SeGW、服务网关(Serving Gate Way，SGW)或UP，本发明实施例不做限定。
需要说明的是，本发明实施例所提及的本地网络设备即为本地网络控制面网元，而本发明实施例所提及的控制面网元是指运营商EPC的控制面网元，本发明实施例在此不再赘述。
在图1所示的系统架构中，UE从本地网络的非授权频谱接入节点接入归属运营商EPC时，归属运营商EPC需要对UE进行接入授权，即确定是否允许UE从非授权频谱接入节点接入其所属的归属网络，如果归属运营商EPC允许UE从本地网络的非授权频谱接入节点接入，UE通过本地网络可以发起本地业务，也可以发起EPC业务(即归属运营商核心网络业务)。图1所示的系统架构采用了非授权频谱作为新的无线接入技术，从而可以提高系统网络的空口承载能力。
基于图1所示的系统架构，本发明实施例公开了一种建立PDN连接的方法。请参阅图2，图2是本发明实施例公开的一种建立PDN连接的方法的流程示意图。如图2所示，该建立PDN连接的方法可以包括以下步骤：
201、UE通过采用非授权频谱的本地网络发起附着流程。
本发明实施例中，UE初始附着归属网络时，搜索并发现非授权频谱网络，从而向非授权频谱接入节点发送附着请求消息，其中，非授权频谱接入节点可以为LTE-U接入节点、Wi-Fi接入节点等，非授权频谱接入节点将该附着请求消息转发给本地网络设备，本地网络设备依据附着请求消息中携带的归属网络的标识以及网络拓扑结构生成路由信息，从而将附着请求消息路由至归属网络的控制面网元，如MME。本地网络设备在将附着请求消息路由给控制面网元的同时，还会将UE从非授权频谱接入节点接入归属网络的接入信息，如本地网络的特征信息、非授权频谱接入节点的特征信息以及UE的位置信息、当前的时间信息等发送给控制面网元。
其中，本地网络的特征信息包括本地网络使用的安全认证信息，如使用的安全认证方案的标识等，本地网络所属的服务提供商标识，漫游联盟标识，本地网络使用的无线接入技术(Radio Access Technologies，RAT)类型中的至少一种。其中，RAT为非授权频谱接入。非授权频谱接入节点的特征信息包括非授权频谱接入节点的接入模式(如开放模式，封闭模式，混合模式)和安全等 级中的至少一种。
进一步的，控制面网元在接收到UE的附着请求消息以及接入信息后，会存储接入信息，并基于附着请求消息向HSS发送位置更新请求消息，以更新为UE提供服务的控制面网元。同时，控制面网元还会将UE使用的非授权频谱接入的无线接入技术指示识或者本地网络所属的服务提供商标识、漫游联盟标识等发送给HSS，以便HSS基于UE的用户标识(如永久标识)在查找到UE的签约数据后，可以基于UE的签约数据对UE初次进行接入授权，即确定是否允许UE从非授权频谱接入节点(非授权频谱网络)接入归属网络，以及是否允许UE从该服务提供商或者漫游联盟成员部署的非授权频谱网络接入归属网络等。
进一步的，HSS对UE初次进行接入授权通过的情况下，将该UE的签约数据发送给控制面网元，控制面网元从而依据该签约数据对UE再次进行接入授权。如确定当前的时间或地点是否允许UE从该非授权频谱接入节点接入归属网络，非授权频谱接入节点的接入模式或者安全等级是否满足允许UE从非授权频谱接入节点接入归属网络的条件，本地网络是否为可信或者非可信网络，以及归属网络时允许UE从可信网络接入还是允许从非可信网络接入，等等，本发明实施例不做限定。
本发明实施例中，如果上述条件均满足允许UE从非授权频谱接入节点接入归属网络，则表示对UE从非授权频谱接入节点接入归属网络授权成功，即UE附着成功。
此外，控制面网元还会基于签约数据以及本地网络的特征信息判断签约数据中是否存在授权的APN，即判断本地网络的特征信息是否与APN的授权条件匹配，如果匹配，则基于UE的位置信息、网络的负载请求或者签约APN信息选择SeGW，如选择距离UE位置近的SeGW，或者负载较轻的SeGW，或者与签约APN对应的SeGW，从而将SeGW的标识(如SeGW的IP地址、FQDN，或者APN与SeGW之间的对应关系发送给UE。如果本地网络的特征信息与APN的授权条件不匹配，则表示不存在授权APN，控制面网元则不会分配SeGW的标识给UE。
举例来说，假设本地网络为非可信网络，所属的服务提供商为A，控制面网元可以判断签约APN的授权条件中是否允许从非可信网络接入，或者是否允 许从服务提供商A部署的本地网络接入，或者是否允许使用的RAT为非授权频谱接入，等等。如果允许，则确定该签约APN为授权APN，或者确定该签约APN授权通过。
进一步的，控制面网元在对UE授权成功后，还可以基于UE的签约数据生成UE的本地业务策略，从而发送给本地网络设备，本地网络设备即可以通过本地业务策略对UE的本地业务请求进行业务授权。本地网络设备在收到控制面网元发送的接入允许的指示后，会为UE分配本地IP地址，并转发附着回复消息，该附着回复消息携带有归属网络为UE分配的临时标识，为UE分配的SeGW的标识或者授权APN及其对应的SeGW的标识，本发明实施例不做限定。
202、UE在附着成功后，向本地网络设备发送第一请求消息。
本发明实施例中，UE在附着成功(即附着到归属网络的控制面网元)后，如果要发起本地业务，只需向本地网络设备发送本地业务请求，本地网络设备从而可以基于本地业务策略对本地业务请求进行业务授权。如果UE需要发起EPC业务，UE可以向本地网络设备发送第一请求消息。其中，该第一请求消息用于请求为UE建立PDN连接，UE的PDN连接包括UE与SeGW之间的安全通道连接和SeGW与PGW之间的会话通道连接。该第一请求消息可以为PDN连接请求消息，也可以为APN连接请求消息，本发明实施例不做限定。
具体的，UE向本地网络设备发送第一请求消息具体可以是向非授权频谱接入节点发送，通过非授权频谱接入节点转发给本地网络设备。
本发明实施例中，当第一请求消息为APN连接请求消息时，该消息具体可以为IKE_AUTH请求消息，该消息的源地址设置为本地网络设备为UE分配的本地IP地址，目的地址为UE收到的SeGW对应的IP地址。当第一请求消息为PDN连接请求消息时，该消息携带SeGW的标识，如SeGW的IP地址、FQDN等，该消息包括UE与SeGW之间建立安全通道连接相关的网络秘钥交换协议(Internet Key Exchange Protocol Version 2，IKEv2)消息，如IKE_AUTH请求消息或者IKE_SA_INIT消息。
203、本地网络设备将第一请求消息转发给SeGW。
本发明实施例中，当第一请求消息为APN连接请求消息时，本地网络设备在接收到APN连接请求消息后，会基于目的地址将APN连接请求消息路由给对 应的SeGW。当第一请求消息为PDN连接请求消息时，需要本地网络设备支持控制面消息，从PDN连接请求消息中解析出SeGW的IP地址，从而根据IP地址将该PDN连接请求消息发送给对应的SeGW。
204、SeGW接收第一请求消息，获取UE的无线接入技术指示以及UE附着的控制面网元的标识。
本发明实施例中，SeGW接收到第一请求消息，即表明与UE之间的安全通道连接建立成功。进一步的，SeGW在接收到第一请求消息后，会获取UE的无线接入技术指示。其中，该无线接入技术指示用于指示UE接入的RAT为非授权频谱接入。
进一步的，SeGW在接收到第一请求消息后，还会获取UE附着的控制面网元的标识。
具体的，SeGW获取UE附着的控制面网元的标识的具体方式可以有以下几种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带归属网络为UE分配的临时标识，该临时标识中包括UE附着的控制面网元的标识，SeGW在接收到第一请求消息后可以从临时标识中获取UE附着的控制面网元的标识；或者，本地网络设备在转发第一请求消息的同时，直接携带UE附着的控制面网元的标识，SeGW直接从第一请求消息中获取该UE附着的控制面网元的标识。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络设备为UE分配的本地IP地址，SeGW在接收到第一请求消息后，可以向本地网络设备发送用于请求获取UE附着的控制面网元的标识的请求消息，如连接信息请求消息，该消息携带有该本地IP地址。本地网络设备在接收到连接信息请求消息后，会基于UE的本地IP地址查找UE的上下文，从而将UE上下文中包含的UE当前附着的控制面网元的标识通过该连接信息回复消息发送给SeGW。
方式三、
SeGW在接收到第一请求消息后，可以向HSS发送用于请求获取UE附着的控制面网元的标识的请求消息，如更新位置请求消息，该消息包含UE的用户 标识，如永久标识，如IMSI，HSS基于UE的IMSI查找UE的上下文，如果UE已经附着到控制面网元，则HSS会存储当前附着的控制面网元的标识，从而回复更新位置回复消息给SeGW，该消息携带UE附着的控制面网元的标识。
具体的，SeGW获取UE的无线接入技术指示的具体方式可以包括以下两种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带用于指示UE接入的RAT为非授权频谱接入的无线接入技术指示，SeGW在接收到第一请求消息后，可以从第一请求消息中获取该无线接入技术指示。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络的无线接入节点的信息，该信息指示无线接入节点为非授权频谱无线接入节点。因此，SeGW在接收到第一请求消息后，可以根据无线接入节点的信息确定UE接入的RAT为非授权频谱接入，并生成无线接入技术指示。
205、SeGW基于UE附着的控制面网元的标识向控制面网元发送第二请求消息。
本发明实施例中，第二请求消息携带有UE的用户标识以及无线接入技术指示，第二请求消息用于请求获取PGW的标识。其中，该用户标识可以为UE的临时标识或者永久标识，其中，临时标识可以包括UE的设备标识和附着的控制面网元的标识，如MME的标识。
本发明实施例中，SeGW在通过上述途径获取到UE附着的控制面网元的标识后，会向该控制面网元发送第二请求消息，其中，该第二请求消息可以为PDN连接建立请求消息，也可以为鉴权与授权请求消息。
进一步的，第二请求消息中还可以携带本地网络是可信网络还是非可信网络的标识，本地网络的服务提供商标识，漫游联盟标识，等等，本发明实施例不做限定。
206、控制面网元接收第二请求消息，并基于用户标识和无线接入技术指示将PGW的标识发送给SeGW。
具体实现中，控制面网元基于用户标识和无线接入技术指示将PGW的标识发送给SeGW的具体方式可以为：
基于该用户标识获取UE的签约数据，并基于该签约数据和该无线接入技术指示进行APN授权，最后将授权通过的APN对应的数据网关的标识发送给安全网关。
本发明实施例中，控制面网元在接收到第二请求消息后，会基于UE的用户标识，如临时标识查找UE的上下文，从而获取UE的签约数据，并基于签约数据中允许UE接入的RAT的指示来确定是否允许UE从采用非授权频谱的网络接入，如果允许，则对请求的APN或者缺省APN授权通过。如果APN授权通过，控制面网元则为授权通过的APN选择对应的PGW，从而将选择的PGW的标识发送给SeGW。如果APN授权未通过，控制面网元则回复连接拒绝或鉴权与授权失败消息，或连接建立回复或鉴权与授权回复消息中携带失败原因值给SeGW。
需要说明的是，授权通过的APN对应的PGW的标识可以理解为：支持UE请求的APN或者业务类型的PGW的IP地址或者FQDN。SeGW可以是从UE的控制面网元获取，本发明实施例不做限定。
进一步的，控制面网元基于该签约数据和该无线接入技术指示进行APN授权的具体方式可以包括以下任意一种：
方式一、
如果第二请求消息携带有UE请求的APN，其中，该请求的APN为无线接入技术指示下的APN，那么控制面网元会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对请求的APN授权通过；或者，如果不包含，则确定对请求的APN授权不通过；
方式二、
如果第二请求消息未携带UE请求的APN，那么控制面网元会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对签约数据中的缺省APN授权通过；或者，如果不包含，则确定对签约数据中的缺省APN授权不通过。
进一步的，如果第二请求消息中携带有UE请求的APN，且第二请求消息携带有本地网络的特征信息，如本地网络是可信网络还是非可信网络，本地网络的服务提供商标识或漫游联盟标识，本地网络使用的安全认证方式等。控制 面网元会基于本地网络的特征信息和签约数据判断上述APN是否可以被授权，即确定本地网络的特征信息是否与请求的APN的授权条件匹配。如果第二请求消息中未携带UE请求的APN，控制面网元可以判断缺省APN是否可以被授权，即基于本地网络的特征信息以及签约数据，确定本地网络的特征是否与缺省APN的授权条件匹配。
举例来说，假设本地网络为可信网络，所属的服务提供商为A，控制面网元可以判断签约数据中签约APN的授权条件是否允许从可信网络接入，或者是否允许从服务提供商A部署的本地网络接入，或者是否允许从使用的RAT为非授权频谱的本地网络接入，控制面网元还可以基于签约数据中签约APN的授权条件判断是否允许UE在当前时刻接入，等等。如果允许，则确定该签约APN为授权APN，或者确定该签约APN授权通过。
作为一种可行的实施方式，控制面网元在对APN授权通过后，还可以将授权通过的APN(包括授权通过的UE请求的APN或者缺省APN)发送给SeGW，以便后续SeGW进行基于授权通过的APN进行控制。
作为另一种可行的实施方式，控制面网元将授权通过的APN对应的PGW的标识发送给SeGW的具体方式可以包括以下至少一种：
方式一、
UE发送的第一请求消息中包括了UE的位置信息，那么SeGW向控制面网元发送的第二请求消息携带有UE的位置信息，那么控制面网元在对APN授权通过后，可以基于该UE的位置信息，将授权通过的APN对应的PGW中距离UE位置最近的PGW的标识发送给SeGW。
方式二、
控制面网元可以获取各个PGW的负载信息，并在对APN授权通过后，基于各个PGW的负载信息，将授权通过的APN对应的PGW中负载最小的PGW的标识发送给SeGW。
作为又一种可行的实施方式，如果控制网元确定UE当前处于移动状态，申请的PDN连接需要移动性，即UE移动时需要保证业务的连续性，那么控制面网元在向SeGW发送PGW的标识的时候，还可以向SeGW发送指示消息，其中，该指示消息用于指示SeGW需要反馈与PGW之间建立的会话通道连接的连 接信息。该指示消息可以是需要反馈ACK needed指示，也可以是支持切换HO supported指示，还可以是业务连续性指示，本发明实施例不做限定。
那么SeGW在接收到该指示消息，并与PGW之间完成了会话通道连接的建立之后，会发送该指示消息的反馈消息，该反馈消息携带有连接信息，或者SeGW向控制面网元发送第三请求消息的回复消息(即PDN连接建立回复消息)中携带有该连接信息。
其中，该连接信息包括PGW为本次PDN连接(或者会话通道连接)分配的隧道标识IEID、UE的IP地址、QoS等中的至少一种。
207、SeGW接收PGW的标识，并基于PGW的标识向该PGW发送第三请求消息。
本发明实施例中，SeGW在获取到PGW的标识后，可以基于该PGW的标识向对应的PGW发送第三请求消息。其中，第三请求消息可以是会话建立请求消息，用于请求建立与PGW之间的会话通道连接。
进一步的，SeGW在发送会话建立请求消息的同时，还会将UE的RAT类型设置为非授权频谱接入，从而将其同会话建立请求消息发送给PGW。SeGW还会为会话通道连接分配带宽，QoS参数等。
208、PGW接收第三请求消息，并与SeGW之间建立会话通道连接。
本发明实施例中，PGW在接收到第二请求消息后，会与SeGW之间建立会话通道连接。同时PGW会为UE分配IP地址，为PDN连接分配隧道，QoS参数等，并记录此次PDN连接为非授权频谱接入。
209、在会话通道连接建立成功后，SeGW接收PGW基于第三请求消息与SeGW建立会话通道连接的响应。
210、SeGW向UE回复第一请求消息的响应消息。
本发明实施例中，在PGW与SeGW之间完成会话通道连接建立之后，SeGW会向UE回复IKE_AUTH回复消息，从而完成了UE与SeGW之间安全通道连接的建立，从而完成了UE的PDN连接。
本发明实施例中，归属网络侧(控制面网元以及PGW)为UE建立PDN连接成功后，SeGW向UE回复第一请求消息的响应消息。
具体的，SeGW与UE之间可以直接通过IKEv2消息交互，也可以回复PDN 连接回复消息给本地网络设备，由本地网络设备转发给UE。其中，该PDN连接回复消息包含IKE_AUTH回复消息。
可见，在图2所描述的方法中，EPS系统可以实现UE从非授权频谱接入节点附着归属网络的接入授权，UE并在有EPC业务需求时，主动触发PDN连接建立流程，从而可以在UE附着归属网络后在UE有需求的情况下才为UE建立PDN连接，避免对EPC网络的资源占用，从而可以提高EPC网络资源的利用率。进一步的，在为UE建立PDN连接过程中，UE直接与SeGW建立安全通道，然后由SeGW去找控制面网元，这样UE与SeGW之间可以采用安全通道进行通信，第三方部署的本地网络对通信内容不可见，从而实现了对运营商业务的保护。
基于图1所示的系统架构，本发明实施例公开了一种安全网关的结构示意图。请参阅图3，图3是本发明实施例公开的一种安全网关的结构示意图。其中，图3所描述的SeGW300可以应用于上述方法实施例。如图3所示，该SeGW300可以包括收发模块301和处理模块302，其中：
收发模块301，用于在UE从采用非授权频谱的本地网络接入时，接收本地网络设备发送的第一请求消息。其中，该第一请求消息由UE发送给本地网络设备，用于请求为UE建立PDN连接，UE的PDN连接包括UE与SeGW300之间的安全通道连接和SeGW300与PGW之间的会话通道连接。
处理模块302，用于获取UE的无线接入技术指示，并获取UE附着的控制面网元的标识，其中，无线接入技术指示用于指示UE接入的无线接入技术为非授权频谱接入。
收发模块301，还用于基于UE附着的控制面网元的标识向该控制面网元发送第二请求消息，其中，第二请求消息携带UE的用户标识以及该无线接入技术指示，第二请求消息用于请求获取PGW的标识。
收发模块301，还用于接收控制面网元基于该用户标识以及该无线接入技术指示返回的PGW的标识。
收发模块301，还用于基于PGW的标识向对应的PGW发送第三请求消息。其中，该第三请求消息用于建立SeGW300与PGW之间的会话通道连接。
收发模块301，还用于接收PGW基于第三请求消息与SeGW300建立会话通道连接的响应。
本发明实施例中，第一请求消息可以为APN连接请求消息，也可以为PDN连接请求消息，本发明实施例不做限定。第二请求消息可以为PDN连接建立请求消息。第三请求消息可以为会话建立请求消息。PGW在接收到第二请求消息后，会与SeGW300之间建立会话通道连接。同时PGW会为UE分配IP地址，为PDN连接分配隧道，QoS等，并记录此次PDN连接为非授权频谱接入。
作为一种可行的实施方式，处理模块302获取UE的无线接入技术指示的具体方式可以包括以下两种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带用于指示UE接入的RAT为非授权频谱接入的无线接入技术指示，收发模块301在接收到第一请求消息后，处理模块302可以从第一请求消息中获取该无线接入技术指示。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络的无线接入节点的信息，该信息指示无线接入节点为非授权频谱无线接入节点。因此，收发模块301在接收到第一请求消息后，处理模块302可以根据无线接入节点的信息确定UE接入的RAT为非授权频谱接入，并生成无线接入技术指示。
作为另一种可行的实施方式，处理模块302获取UE附着的控制面网元的标识的具体方式可以包括以下几种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带归属网络为UE分配的临时标识，该临时标识中包括UE附着的控制面网元的标识，收发模块301在接收到第一请求消息后，处理模块302可以从临时标识中获取UE附着的控制面网元的标识；或者，本地网络设备在转发第一请求消息的同时，直接携带UE附着的控制面网元的标识，处理模块302直接从第一请求消息中获取该UE附着的控制面网元的标识。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络设备为UE分 配的本地IP地址，收发模块301在接收到第一请求消息后，可以向本地网络设备发送用于请求获取UE附着的控制面网元的标识的请求消息，如连接信息请求消息，该消息携带有该本地IP地址。本地网络设备在接收到连接信息请求消息后，会基于UE的本地IP地址查找UE的上下文，从而将UE上下文中包含的UE当前附着的控制面网元的标识通过该连接信息回复消息发送给SeGW300。
方式三、
收发模块301在接收到第一请求消息后，可以向HSS发送用于请求获取UE附着的控制面网元的标识的请求消息，如更新位置请求消息，该消息包含UE的用户标识，如永久标识，如IMSI，HSS基于UE的IMSI查找UE的上下文，如果UE已经附着到控制面网元，则HSS会存储当前附着的控制面网元的标识，从而回复更新位置回复消息给SeGW300，该消息携带UE附着的控制面网元的标识。
作为又一种可行的实施方式，收发模块301，还用于接收控制面网元发送的指示消息，并在SeGW300与PGW之间的会话通道连接建立完成之后，向控制面网元发送与PGW之间会话通道连接的连接信息。
其中，该指示消息用于指示SeGW300反馈与PGW之间的会话通道连接建立结果，该连接信息包括PGW为该会话通道连接(或者说是为本次PDN连接)分配的TEID、UE的IP地址、QoS中的至少一种。
作为又一种可行的实施方式，收发模块301接收控制面网元基于用户标识以及无线接入技术指示返回的PGW的标识，包括：
如果第一请求消息携带UE请求的APN，其中，该请求的APN为无线接入技术指示下的APN，收发模块301向控制面网元发送的第二请求消息中也携带有该请求的APN，收发模块301则接收控制面网元基于用户标识在对请求的APN授权通过后返回的授权通过的APN对应的APN的标识；
或者，
如果第一请求消息未携带UE请求的APN，收发模块301则接收控制面网元基于用户标识和无线接入技术指示返回的UE的签约数据中缺省APN对应的APN的标识。
基于图1所示的系统架构，本发明实施例公开了另一种安全网关的结构示 意图。请参阅图4，图4是本发明实施例公开的另一种安全网关的结构示意图。其中，图4所描述的SeGW400可以应用于上述方法实施例。如图4所示，该SeGW400可以包括收发器401和处理器402，其中：
收发器401，用于在UE从采用非授权频谱的本地网络接入时，接收本地网络设备发送的第一请求消息。其中，该第一请求消息由UE发送给本地网络设备，用于请求为UE建立PDN连接，UE的PDN连接包括UE与SeGW400之间的安全通道连接和SeGW400与PGW之间的会话通道连接。
处理器402，用于获取UE的无线接入技术指示，并获取UE附着的控制面网元的标识，其中，无线接入技术指示用于指示UE接入的无线接入技术为非授权频谱接入。
收发器401，还用于基于UE附着的控制面网元的标识向该控制面网元发送第二请求消息，其中，第二请求消息携带UE的用户标识以及该无线接入技术指示，第二请求消息用于请求获取PGW的标识。
收发器401，还用于接收控制面网元基于该用户标识以及该无线接入技术指示返回的PGW的标识。
收发器401，还用于基于PGW的标识向对应的PGW发送第三请求消息。其中，该第三请求消息用于建立SeGW400与PGW之间的会话通道连接。
收发器401，还用于接收PGW基于第三请求消息与SeGW400建立会话通道连接的响应。
本发明实施例中，第一请求消息可以为APN连接请求消息，也可以为PDN连接请求消息，本发明实施例不做限定。第二请求消息可以为PDN连接建立请求消息。第三请求消息可以为会话建立请求消息。PGW在接收到第二请求消息后，会与SeGW400之间建立会话通道连接。同时PGW会为UE分配IP地址，为PDN连接分配隧道，QoS等，并记录此次PDN连接为非授权频谱接入。
作为一种可行的实施方式，处理器402获取UE的无线接入技术指示的具体方式可以包括以下两种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带用于指示UE接入的RAT为非授权频谱接入的无线接入技术指示，收发器401在接收到第一请求消 息后，处理器402可以从第一请求消息中获取该无线接入技术指示。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络的无线接入节点的信息，该信息指示无线接入节点为非授权频谱无线接入节点。因此，收发器401在接收到第一请求消息后，处理器402可以根据无线接入节点的信息确定UE接入的RAT为非授权频谱接入，并生成无线接入技术指示。
作为另一种可行的实施方式，处理器401获取UE附着的控制面网元的标识的具体方式可以包括以下几种：
方式一、
本地网络设备在转发第一请求消息的同时，会携带归属网络为UE分配的临时标识，该临时标识中包括UE附着的控制面网元的标识，收发器401在接收到第一请求消息后，处理器402可以从临时标识中获取UE附着的控制面网元的标识；或者，本地网络设备在转发第一请求消息的同时，直接携带UE附着的控制面网元的标识，处理器402直接从第一请求消息中获取该UE附着的控制面网元的标识。
方式二、
本地网络设备在转发第一请求消息的同时，会携带本地网络设备为UE分配的本地IP地址，收发器401在接收到第一请求消息后，可以向本地网络设备发送用于请求获取UE附着的控制面网元的标识的请求消息，如连接信息请求消息，该消息携带有该本地IP地址。本地网络设备在接收到连接信息请求消息后，会基于UE的本地IP地址查找UE的上下文，从而将UE上下文中包含的UE当前附着的控制面网元的标识通过该连接信息回复消息发送给SeGW400。
方式三、
收发器401在接收到第一请求消息后，可以向HSS发送用于请求获取UE附着的控制面网元的标识的请求消息，如更新位置请求消息，该消息包含UE的用户标识，如永久标识，如IMSI，HSS基于UE的IMSI查找UE的上下文，如果UE已经附着到控制面网元，则HSS会存储当前附着的控制面网元的标识，从而回复更新位置回复消息给SeGW400，该消息携带UE附着的控制面网元的标识。
作为又一种可行的实施方式，收发器401，还用于接收控制面网元发送的指示消息，并在SeGW400与PGW之间的会话通道连接建立完成之后，向控制面网元发送与PGW之间会话通道连接的连接信息。
其中，该指示消息用于指示SeGW400反馈与PGW之间的会话通道连接建立结果，该连接信息包括PGW为该会话通道连接(或者说是为本次PDN连接)分配的TEID、UE的IP地址、QoS中的至少一种。
作为又一种可行的实施方式，收发器401接收控制面网元基于用户标识以及无线接入技术指示返回的PGW的标识，包括：
如果第一请求消息携带UE请求的APN，其中，该请求的APN为无线接入技术指示下的APN，收发器401向控制面网元发送的第二请求消息中也携带有该请求的APN，收发器401则接收控制面网元基于用户标识在对请求的APN授权通过后返回的授权通过的APN对应的APN的标识；
或者，
如果第一请求消息未携带UE请求的APN，收发器401则接收控制面网元基于用户标识和无线接入技术指示返回的UE的签约数据中缺省APN对应的APN的标识。
可见，在图3和图4所描述的SeGW中，UE通过采用非授权频谱的本地网络附着到归属网络后，如果请求EPC业务，SeGW在接收到UE的PDN连接请求消息后，会与UE建立安全通道，通过控制面网元获取UE请求的APN或缺省APN对应的PGW，并与PGW建立会话通道，从而完成了为UE的PDN连接的建立。通过本发明实施例，UE在附着归属网络后，EPS系统在UE有需求的情况下才为UE建立PDN连接，避免对EPC网络的资源占用，从而可以提高EPC网络资源的利用率。进一步的，在为UE建立PDN连接过程中，UE直接与SeGW建立安全通道，然后由SeGW去找控制面网元，这样UE与SeGW之间可以采用安全通道进行通信，第三方部署的本地网络对通信内容不可见，从而实现了对运营商业务的保护。
基于图1所示的系统架构，本发明实施例公开了一种控制面网元的结构示意图。请参阅图5，图5是本发明实施例公开的一种控制面网元的结构示意图。 其中，图5所描述的控制面网元500可以应用于上述方法实施例。如图5所示，该控制面网元500可以包括以下收发模块501和处理模块502，其中：
收发模块501，用于在UE从采用非授权频谱的本地网络附着到该UE的归属网络的情况下，接收安全网关发送的第二请求消息。其中，该第二请求消息用于请求获取PGW的标识，第二请求消息携带UE的用户标识以及无线接入技术指示，无线接入技术指示用于指示UE接入的无线接入技术为非授权频谱接入，该第二请求消息由SeGW在接收到UE的第一请求消息并与UE建立安全通道连接后发送给控制面网元500，该第一请求消息用于请求为UE建立PDN连接，该PDN连接包括安全通道连接和会话通道连接。
收发模块501，还用于基于该用户标识以及无线接入技术指示将PGW的标识发送给SeGW，以便SeGW与该APN对应的PGW的标识所标记的PGW建立会话通道连接。
本发明实施例中，第一请求消息可以为APN连接请求消息，也可以为PDN连接请求消息，本发明实施例不做限定。
本发明实施例中，PGW与SeGW之间建立会话通道连接的同时，会为UE分配IP地址，为PDN连接分配隧道，QoS等，并记录此次PDN连接为非授权频谱接入。
作为一种可行的实施方式，收发模块501基于该用户标识以及无线接入技术指示将PGW的标识发送给SeGW的具体方式可以为：
基于该用户标识获取UE的签约数据；
通过处理模块502基于签约数据和无线接入技术指示进行APN授权；
将授权通过的APN对应的PGW的标识发送给SeGW。
具体实现中，处理模块502基于签约数据和无线接入技术指示进行APN授权的具体方式可以包括以下任意一种：
方式一、
如果第二请求消息携带有UE请求的APN，其中，该请求的APN为无线接入技术指示下的APN，那么处理模块502会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对请求的APN授权通过；或者，如果不包含，则确定对请求的APN授权不通过；
方式二、
如果第二请求消息未携带UE请求的APN，那么处理模块502会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对签约数据中的缺省APN授权通过；或者，如果不包含，则确定对签约数据中的缺省APN授权不通过。
作为另一种可行的实施方式，收发模块501，还用于将授权通过的APN发送给SeGW，以便后续SeGW进行基于授权通过的APN进行控制。
作为又一种可行的实施方式，收发模块501将授权通过的APN对应的PGW的标识发送给SeGW的具体方式可以包括以下两种：
方式一、
如果第三请求消息中携带有UE的位置信息，那么处理模块502在对APN授权通过后，收发模块501可以基于该UE的位置信息，将授权通过的APN对应的PGW中距离UE位置最近的PGW的标识发送给SeGW。
方式二、
处理模块502可以获取各个PGW的负载信息，并在对APN授权通过后，收发模块501基于各个PGW的负载信息，将授权通过的APN对应的PGW中负载最小的PGW的标识发送给SeGW。
将授权通过的APN对应的PGW中距离UE最近或者负载最小的PGW的标识发送给SeGW，使得SeGW与距离UE最近或者负载最小的PGW建立会话通道连接，从而可以提高网络资源的利用率。
作为又一种可行的实施方式，收发模块501，还用于向SeGW发送指示消息，该指示消息用于指示SeGW反馈与PGW之间的会话通道连接建立结果；
收发模块501，还用于接收SeGW在与PGW完成会话通道连接的建立后，发送的会话通道连接的连接信息。
基于图1所示的系统架构，本发明实施例公开了另一种控制面网元的结构示意图。请参阅图6，图6是本发明实施例公开的另一种控制面网元的结构示意图。其中，图6所描述的控制面网元600可以应用于上述方法实施例。如图6所示，该控制面网元600可以包括以下收发器601和处理器602，其中：
收发器601，用于在UE从采用非授权频谱的本地网络附着到该UE的归 属网络的情况下，接收安全网关发送的第二请求消息。其中，该第二请求消息用于请求获取PGW的标识，第二请求消息携带UE的用户标识以及无线接入技术指示，无线接入技术指示用于指示UE接入的无线接入技术为非授权频谱接入，该第二请求消息由SeGW在接收到UE的第一请求消息并与UE建立安全通道连接后发送给控制面网元600，该第一请求消息用于请求为UE建立PDN连接，该PDN连接包括安全通道连接和会话通道连接。
收发器601，还用于基于该用户标识以及无线接入技术指示将PGW的标识发送给SeGW，以便SeGW与该APN对应的PGW的标识所标记的PGW建立会话通道连接。
本发明实施例中，第一请求消息可以为APN连接请求消息，也可以为PDN连接请求消息，本发明实施例不做限定。
本发明实施例中，PGW与SeGW之间建立会话通道连接的同时，会为UE分配IP地址，为PDN连接分配隧道，QoS等，并记录此次PDN连接为非授权频谱接入。
作为一种可行的实施方式，收发器601基于该用户标识以及无线接入技术指示将PGW的标识发送给SeGW的具体方式可以为：
基于该用户标识获取UE的签约数据；
通过处理器602基于签约数据和无线接入技术指示进行APN授权；
将授权通过的APN对应的PGW的标识发送给SeGW。
具体实现中，处理器602基于签约数据和无线接入技术指示进行APN授权的具体方式可以包括以下任意一种：
方式一、
如果第二请求消息携带有UE请求的APN，其中，该请求的APN为无线接入技术指示下的APN，那么处理器602会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对请求的APN授权通过；或者，如果不包含，则确定对请求的APN授权不通过；
方式二、
如果第二请求消息未携带UE请求的APN，那么处理器602会判断签约数据中是否包含该无线接入技术指示，如果包含，则确定对签约数据中的缺省 APN授权通过；或者，如果不包含，则确定对签约数据中的缺省APN授权不通过。
作为另一种可行的实施方式，收发器601，还用于将授权通过的APN发送给SeGW，以便后续SeGW进行基于授权通过的APN进行控制。
作为又一种可行的实施方式，收发器601将该APN对应的PGW的标识发送给SeGW的具体方式可以包括以下两种：
方式一、
如果第三请求消息中携带有UE的位置信息，那么处理器602在对APN授权通过后，收发器601可以基于该UE的位置信息，将授权通过的APN对应的PGW中距离UE位置最近的PGW的标识发送给SeGW。
方式二、
处理器602可以获取各个PGW的负载信息，并在对APN授权通过后，收发器601基于各个PGW的负载信息，将授权通过的APN对应的PGW中负载最小的PGW的标识发送给SeGW。
将授权通过的APN对应的PGW中距离UE最近或者负载最小的PGW的标识发送给SeGW，使得SeGW与距离UE最近或者负载最小的PGW建立会话通道连接，从而可以提高网络资源的利用率。
作为又一种可行的实施方式，收发器601，还用于向SeGW发送指示消息，该指示消息用于指示SeGW反馈与PGW之间的会话通道连接建立结果；
收发器601，还用于接收SeGW在与PGW完成会话通道连接的建立后，发送的会话通道连接的连接信息。
可见，在图5和图6所描述的控制面网元中，控制面网元在接收到SeGW发送的PDN连接建立请求消息后，可以先对UE请求的APN进行授权，只有授权通过的情况下，才会将其对应的PGW的标识发送给SeGW，SeGW从而完成与PGW之间的会话通道连接的建立，实现了在UE附着归属网络后，如果UE有需求才为UE建立PDN连接，避免对EPC网络的资源占用，从而可以提高EPC网络资源的利用率。
基于图1所示的系统架构，本发明实施例公开了一种建立PDN连接的系统。 请参阅图7，图7是本发明实施例公开的一种建立PDN连接的系统结构示意图。如图7所示，该系统可以包括UE701、本地网络设备702、SeGW703、控制面网元704、以及PGW705，其中：
本地网络设备702为采用非授权频谱的本地网络的服务设备，可以包括MME或AAA服务器等，还可以包括非授权频谱接入节点，即采用非授权频谱的基站或者接入点，本发明实施例不做限定。
UE701通过采用非授权频谱的本地网络(具体通过本地网络设备702、控制网元704以及HSS等)发起附着流程附着到归属网络，当UE附着成功后，如果UE701有EPC业务(即核心网络业务)的需求，UE701会向本地网络设备702发送第一请求消息，第一请求消息携带有SeGW703的标识以及UE701附着的控制面网元704的标识。可选的，该APN连接建立请求消息还可以包括UE701请求的APN。
本地网络设备702在接收到第一请求消息后，向对应的SeGW703转发该第一请求消息，SeGW703在接收到第一请求消息后获取UE的无线接入技术指示，该无线接入技术指示用于指示UE701接入的无线接入技术为非授权频谱接入，并获取控制面网元704的标识。
进一步的，SeGW703基于控制面网元704的标识向控制面网元704发送第二请求消息。第二请求消息携带UE701的用户标识和无线接入技术指示。如果第二请求消息中携带有UE701请求的APN，控制面网元704在基于用户标识获取UE701的签约数据后，可以基于签约数据和无线接入技术指示对UE701请求的APN进行授权；如果该PDN连接建立请求消息中没有携带UE701请求的APN，控制面网元704可以基于签约数据和无线接入技术指示对UE701的缺省APN进行授权。如果APN授权成功，控制面网元704可以将授权通过的APN对应的PGW705的标识发送给SeGW703，如果APN授权失败，则返回拒绝消息。
SeGW703基于授权通过APN对应的PGW705的标识向PGW705发送第三请求消息，第三请求消息携带有无线接入技术指示。SeGW703会接收到PGW基于第三请求消息与SeGW703建立会话通道连接的响应。PGW705与SeGW703完成会话通道连接的建立，并为UE701分配IP地址以及记录UE701的PDN连接 为非授权频谱接入。至此，SeGW703回复APN连接回复消息给UE，从而完成了对UE701的PDN连接。
当为UE701完成PDN连接的建立后，SeGW703与UE701之间可以通过建立的安全连接通道进行通信。
可见，在图7所描述的系统中，可以实现UE从非授权频谱附着归属网络的接入授权，UE并在有EPC业务需求时，主动触发PDN连接建立流程，从而可以在UE附着归属网络后在UE有需求的情况下才为UE建立PDN连接，避免对EPC网络的资源占用，从而可以提高EPC网络资源的利用率。进一步的，在为UE建立PDN连接过程中，UE直接与SeGW建立安全通道，然后由SeGW去找控制面网元，这样UE与SeGW之间可以采用进行安全通道进行通信，第三方部署的本地网络对通信内容不可见，从而实现了对运营商业务的保护。
需要说明的是，在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详细描述的部分，可以参见其他实施例的相关描述。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本发明所必须的。
本发明实施例方法中的步骤可以根据实际需要进行顺序调整、合并和删减。
本发明实施例控制面网元和安全网关中的模块可以根据实际需要进行合并、划分和删减。
本发明实施例中所述控制面网元和安全网关，可以通过通用集成电路，例如CPU(Central Processing Unit，中央处理器)，或通过ASIC(Application Specific Integrated Circuit，专用集成电路)来实现。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上对本发明实施例公开的一种建立PDN连接的方法、相关设备及系统进行了详细介绍，本文中应用了具体实例对本发明的原理及实施方式进行了阐 述，以上实施例的说明只是用于帮助理解本发明及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (30)

  1. 一种建立公用数据网PDN连接的方法，应用于演进的分组系统EPS，其特征在于，所述方法包括：
    在UE从采用非授权频谱的本地网络接入时，安全网关接收本地网络设备发送的第一请求消息，所述第一请求消息用于请求为所述UE建立公用数据网PDN连接；
    所述安全网关获取所述UE的无线接入技术指示，所述无线接入技术指示用于指示所述UE接入的无线接入技术为非授权频谱接入，并获取所述UE附着的控制面网元的标识；
    所述安全网关基于所述UE附着的控制面网元的标识向所述控制面网元发送第二请求消息，所述第二请求消息携带所述UE的用户标识以及所述无线接入技术指示，所述第二请求消息用于请求获取数据网关的标识；
    所述安全网关接收所述控制面网元基于所述用户标识以及所述无线接入技术指示返回的数据网关的标识；
    所述安全网关基于所述数据网关的标识向所述数据网关发送第三请求消息，所述第三请求消息用于请求建立所述安全网关与所述数据网关之间的会话通道连接；
    所述安全网关接收所述数据网关基于所述第三请求消息与所述安全网关建立会话通道连接的响应。
  2. 根据权利要求1所述的方法，其特征在于，所述安全网关获取所述UE的无线接入技术指示，包括：
    所述第一请求消息携带所述UE的无线接入技术指示，所述安全网关从所述第一请求消息中获取所述无线接入技术指示；
    或者，
    所述第一请求消息携带所述本地网络的无线接入节点信息，所述安全网关基于所述无线接入节点信息确定所述UE接入的无线接入技术为非授权频谱接入，并生成无线接入技术指示。
  3. 根据权利要求1或2所述的方法，其特征在于，所述安全网关获取所述UE附着的控制面网元的标识，包括：
    所述第一请求消息携带所述归属网络为所述UE分配的临时标识，所述安全网关从所述临时标识中获取所述UE附着的控制面网元的标识；
    或者，
    所述第一请求消息携带所述UE附着的控制面网元的标识，所述安全网关从所述第一请求消息中获取所述UE附着的控制面网元的标识。
  4. 根据权利要求1或2所述的方法，其特征在于，所述安全网关获取所述UE附着的控制面网元的标识，包括：
    所述第一请求消息携带所述本地网络设备为所述UE分配的本地互联网协议IP地址，所述安全网关向所述本地网络设备发送用于获取所述UE附着的控制面网元的标识的请求消息，所述请求消息携带所述本地IP地址；
    所述安全网关接收所述本地网络设备基于所述本地IP地址发送的所述UE附着的控制面网元的标识。
  5. 根据权利要求1或2所述的方法，其特征在于，所述安全网关获取所述UE附着的控制面网元的标识，包括：
    所述安全网关向归属网络签约服务器HSS发送用于获取所述UE附着的控制面网元的标识的请求消息，所述请求消息携带所述用户标识；
    所述安全网关接收所述HSS基于所述用户标识发送的所述UE附着的控制面网元的标识。
  6. 根据权利要求1～5任一项所述的方法，其特征在于，所述方法还包括：
    所述安全网关接收所述控制面网元发送的指示消息，所述指示消息用于指示所述安全网关反馈与所述数据网关之间的会话通道连接建立结果；
    所述安全网关接收所述数据网关基于所述第三请求消息与所述安全网关建立会话通道连接的响应之后，所述方法还包括：
    所述安全网关向所述控制面网元发送与所述数据网关之间会话通道连接的连接信息。
  7. 根据权利要求1～6任一项所述的方法，其特征在于，所述安全网关接收所述控制面网元基于所述用户标识以及所述无线接入技术指示返回的数据网关的标识，包括：
    所述第一请求消息携带所述UE请求的接入节点名称APN，所述请求的 APN为所述无线接入技术指示下的APN，所述第二请求消息携带所述请求的APN，所述安全网关接收所述控制面网元基于所述用户标识在对所述请求的APN授权通过后返回的授权通过的APN对应的数据网关的标识；
    或者，
    所述安全网关接收所述控制面网元基于所述用户标识和所述无线接入技术指示返回的所述UE的签约数据中缺省APN对应的数据网关的标识。
  8. 根据权利要求1～7任一项所述的方法，其特征在于，所述第三请求消息携带所述无线接入技术指示。
  9. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    所述安全网关接收所述控制面网元返回的所述授权通过的APN。
  10. 一种建立PDN连接的方法，应用于EPS，其特征在于，所述方法包括：
    在UE从采用非授权频谱的本地网络接入时，控制面网元接收安全网关发送的第二请求消息；所述第二请求消息携带所述UE的用户标识以及无线接入技术指示，所述无线接入技术指示用于指示所述UE接入的无线接入技术为非授权频谱接入，所述第二请求消息用于请求获取数据网关的标识；
    所述控制面网元基于所述用户标识以及所述无线接入技术指示将数据网关的标识发送给所述安全网关。
  11. 根据权利要求10所述的方法，其特征在于，所述控制面网元基于所述用户标识以及所述无线接入技术指示将数据网关的标识发送给所述安全网关，包括：
    所述控制面网元基于所述用户标识获取所述UE的签约数据；
    所述控制面网元基于所述签约数据和所述无线接入技术指示进行APN授权；
    所述控制面网元将授权通过的APN对应的数据网关的标识发送给所述安全网关。
  12. 根据权利要求11所述的方法，其特征在于，所述控制面网元基于所述签约数据和所述无线接入技术指示进行APN授权，包括：
    所述第二请求消息还携带所述UE请求的APN，所述请求的APN为所述无 线接入技术指示下的APN，所述控制面网元判断所述签约数据中是否包含所述无线接入技术指示，如果包含，则确定对所述请求的APN授权通过；或者，如果不包含，则确定对所述请求的APN授权不通过；
    或者，
    所述控制面网元判断所述签约数据中是否包含所述无线接入技术指示，如果包含，则确定对所述签约数据中的缺省APN授权通过；或者，如果不包含，则确定对所述签约数据中的缺省APN授权不通过。
  13. 根据权利要求11或12所述的方法，其特征在于，所述方法还包括：
    所述控制面网元将所述授权通过的APN发送给所述安全网关。
  14. 根据权利要求11～13任一项所述的方法，其特征在于，所述控制面网元将授权通过的APN对应的数据网关的标识发送给所述安全网关，包括：
    所述第二请求消息包括所述UE的位置信息，所述控制面网元基于所述位置信息，将授权通过的APN对应的数据网关中距离所述UE最近的数据网关的标识发送给所述安全网关；
    或者，
    所述控制面网元获取各数据网关的负载信息，并基于所述负载信息将授权通过的APN对应的数据网关中负载最小的数据网关的标识发送给所述安全网关。
  15. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述控制面网元向所述安全网关发送指示消息，所述指示消息用于指示所述安全网关反馈与所述数据网关之间的会话通道连接建立结果；
    所述控制面网元接收所述安全网关在与所述数据网关完成所述会话通道连接的建立后，发送的所述会话通道连接的连接信息。
  16. 一种安全网关，应用于EPS，其特征在于，所述安全网关包括：
    收发模块，用于在UE从采用非授权频谱的本地网络接入时，接收本地网络设备发送的第一请求消息，所述第一请求消息用于请求为所述UE建立PDN连接；
    处理模块，用于获取所述UE的无线接入技术指示，所述无线接入技术指 示用于指示所述UE接入的无线接入技术为非授权频谱接入，并获取所述UE附着的控制面网元的标识；
    所述收发模块，还用于基于所述UE附着的控制面网元的标识向所述控制面网元发送第二请求消息，所述第二请求消息携带所述UE的用户标识以及所述无线接入技术指示，所述第二请求消息用于请求获取数据网关的标识；
    所述收发模块，还用于接收所述控制面网元基于所述用户标识以及所述无线接入技术指示返回的数据网关的标识；
    所述收发模块，还用于基于所述数据网关的标识向所述数据网关发送第三请求消息，所述第三请求消息用于请求建立所述安全网关与所述数据网关之间的会话通道连接；
    所述收发模块，还用于接收所述数据网关基于所述第三请求消息与所述安全网关建立会话通道连接的响应。
  17. 根据权利要求16所述的安全网关，其特征在于，所述处理模块获取所述UE的无线接入技术指示的具体方式为：
    所述第一请求消息携带所述UE的无线接入技术指示，从所述第一请求消息中获取所述无线接入技术指示；
    或者，
    所述第一请求消息携带所述本地网络的无线接入节点信息，基于所述无线接入节点信息确定所述UE接入的无线接入技术为非授权频谱接入，并生成无线接入技术指示。
  18. 根据权利要求16或17所述的安全网关，其特征在于，所述处理模块获取所述UE附着的控制面网元的标识的具体方式为：
    所述第一请求消息携带所述归属网络为所述UE分配的临时标识，从所述临时标识中获取所述UE附着的控制面网元的标识；
    或者，
    所述第一请求消息携带所述UE附着的控制面网元的标识，从所述第一请求消息中获取所述UE附着的控制面网元的标识。
  19. 根据权利要求16或17所述的安全网关，其特征在于，所述处理模块获取所述UE附着的控制面网元的标识的具体方式为：
    所述第一请求消息携带所述本地网络设备为所述UE分配的本地互联网协议IP地址，向所述本地网络设备发送用于获取所述UE附着的控制面网元的标识的请求消息，所述请求消息携带所述本地IP地址；
    接收所述本地网络设备基于所述本地IP地址发送的所述UE附着的控制面网元的标识。
  20. 根据权利要求16或17所述的安全网关，其特征在于，所述处理模块获取所述UE附着的控制面网元的标识的具体方式为：
    向HSS发送用于获取所述UE附着的控制面网元的标识的请求消息，所述请求消息携带所述用户标识；
    接收所述HSS基于所述用户标识发送的所述UE附着的控制面网元的标识。
  21. 根据权利要求16～20任一项所述的安全网关，其特征在于，
    所述收发模块，还用于接收所述控制面网元发送的指示消息，所述指示消息用于指示所述安全网关反馈与所述数据网关之间的会话通道连接建立结果；
    所述收发模块，还用于向所述控制面网元发送与所述数据网关之间会话通道连接的连接信息。
  22. 根据权利要求16～21任一项所述的安全网关，其特征在于，所述收发模块接收所述控制面网元基于所述用户标识以及所述无线接入技术指示返回的数据网关的标识的具体方式为：
    所述第一请求消息携带所述UE请求的APN，所述请求的APN为所述无线接入技术指示下的APN，所述第二请求消息携带所述请求的APN，接收所述控制面网元基于所述用户标识在对所述请求的APN授权通过后返回的授权通过的APN对应的数据网关的标识；
    或者，
    接收所述控制面网元基于所述用户标识和所述无线接入技术指示返回的所述UE的签约数据中缺省APN对应的数据网关的标识。
  23. 根据权利要求16～22任一项所述的安全网关，其特征在于，所述第三请求消息携带所述无线接入技术指示。
  24. 根据权利要求22所述的安全网关，其特征在于，
    所述收发模块，还用于接收所述控制面网元返回的所述授权通过的APN。
  25. 一种控制面网元，应用于EPS，其特征在于，所述控制面网元包括：
    收发模块，用于在UE从采用非授权频谱的本地网络接入时，接收安全网关发送的第二请求消息；所述第二请求消息携带所述UE的用户标识以及无线接入技术指示，所述无线接入技术指示用于指示所述UE接入的无线接入技术为非授权频谱接入，所述第二请求消息用于请求获取数据网关的标识；
    所述收发模块，还用于基于所述用户标识以及所述无线接入技术指示将数据网关的标识发送给所述安全网关。
  26. 根据权利要求25所述的控制面网元，其特征在于，所述控制面网元还包括处理模块，所述收发模块基于所述用户标识以及所述无线接入技术指示将数据网关的标识发送给所述安全网关的具体方式为：
    基于所述用户标识获取所述UE的签约数据；
    通过所述处理模块基于所述签约数据和所述无线接入技术指示进行APN授权；
    将授权通过的APN对应的数据网关的标识发送给所述安全网关。
  27. 根据权利要求26所述的控制面网元，其特征在于，所述处理模块基于所述签约数据和所述无线接入技术指示进行APN授权的具体方式为：
    所述第二请求消息还携带所述UE请求的APN，所述请求的APN为所述无线接入技术指示下的APN，判断所述签约数据中是否包含所述无线接入技术指示，如果包含，则确定对所述请求的APN授权通过；或者，如果不包含，则确定对所述请求的APN授权不通过；
    或者，
    判断所述签约数据中是否包含所述无线接入技术指示，如果包含，则确定对所述签约数据中的缺省APN授权通过；或者，如果不包含，则确定对所述签约数据中的缺省APN授权不通过。
  28. 根据权利要求26或27所述的控制面网元，其特征在于，
    所述收发模块，还用于将授权通过的APN发送给所述安全网关。
  29. 根据权利要求26～28任一项所述的控制面网元，其特征在于，所述收发模块将授权通过的APN对应的数据网关的标识发送给所述安全网关的具体 方式为：
    所述第二请求消息包括所述UE的位置信息，基于所述位置信息，将授权通过的APN对应的数据网关中距离所述UE最近的数据网关的标识发送给所述安全网关；
    或者，
    获取各数据网关的负载信息，并基于所述负载信息将授权通过的APN对应的数据网关中负载最小的数据网关的标识发送给所述安全网关。
  30. 根据权利要求25所述的控制面网元，其特征在于，
    所述收发模块，还用于向所述安全网关发送指示消息，所述指示消息用于指示所述安全网关反馈与所述数据网关之间的会话通道连接建立结果；
    所述收发模块，还用于接收所述安全网关在与所述数据网关完成所述会话通道连接的建立后，发送的所述会话通道连接的连接信息。
PCT/CN2016/101415 2016-09-30 2016-09-30 一种建立公用数据网连接的方法及相关设备 WO2018058691A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN201680089580.3A CN109792787A (zh) 2016-09-30 2016-09-30 一种建立公用数据网连接的方法及相关设备
PCT/CN2016/101415 WO2018058691A1 (zh) 2016-09-30 2016-09-30 一种建立公用数据网连接的方法及相关设备
US16/368,639 US20190223013A1 (en) 2016-09-30 2019-03-28 Method for establishing public data network connection and related device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/101415 WO2018058691A1 (zh) 2016-09-30 2016-09-30 一种建立公用数据网连接的方法及相关设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/368,639 Continuation US20190223013A1 (en) 2016-09-30 2019-03-28 Method for establishing public data network connection and related device

Publications (1)

Publication Number Publication Date
WO2018058691A1 true WO2018058691A1 (zh) 2018-04-05

Family

ID=61762986

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101415 WO2018058691A1 (zh) 2016-09-30 2016-09-30 一种建立公用数据网连接的方法及相关设备

Country Status (3)

Country Link
US (1) US20190223013A1 (zh)
CN (1) CN109792787A (zh)
WO (1) WO2018058691A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110248375A (zh) * 2019-07-25 2019-09-17 维沃移动通信有限公司 一种通信方法及无线接入点

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10595187B2 (en) * 2018-07-23 2020-03-17 Syniverse Technologies, Llc System and method of selective packet data network gateway discovery
CN112312426B (zh) * 2019-07-31 2023-07-21 中国移动通信集团吉林有限公司 核心网网关的选择方法、移动性管理实体和网关设备
CN112469106A (zh) * 2019-09-06 2021-03-09 中兴通讯股份有限公司 一种接入点名称的配置方法、装置及可读存储介质
CN112654073B (zh) * 2019-10-11 2022-06-10 维沃移动通信有限公司 网络附着方法及用户设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101686578A (zh) * 2008-09-28 2010-03-31 中兴通讯股份有限公司 家庭演进基站系统及无线设备的接入方法
CN103731811A (zh) * 2012-10-11 2014-04-16 中兴通讯股份有限公司 一种演进的分组核心网络实现移动性管理的方法和系统
WO2016011011A1 (en) * 2014-07-14 2016-01-21 Convida Wireless, Llc Network-initiated handover in integrated small cell and wifi networks
WO2016011001A1 (en) * 2014-07-14 2016-01-21 Convida Wireless, Llc Inter-system handover and multi-connectivity via an integrated small cell and wifi gateway

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101909275B (zh) * 2009-06-05 2012-07-04 华为技术有限公司 一种信息同步方法及通讯系统以及相关设备
CN101990280B (zh) * 2009-08-04 2013-10-09 华为技术有限公司 选择默认接入点名称及装置
US8554933B2 (en) * 2010-10-05 2013-10-08 Verizon Patent And Licensing Inc. Dynamic selection of packet data network gateways

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101686578A (zh) * 2008-09-28 2010-03-31 中兴通讯股份有限公司 家庭演进基站系统及无线设备的接入方法
CN103731811A (zh) * 2012-10-11 2014-04-16 中兴通讯股份有限公司 一种演进的分组核心网络实现移动性管理的方法和系统
WO2016011011A1 (en) * 2014-07-14 2016-01-21 Convida Wireless, Llc Network-initiated handover in integrated small cell and wifi networks
WO2016011001A1 (en) * 2014-07-14 2016-01-21 Convida Wireless, Llc Inter-system handover and multi-connectivity via an integrated small cell and wifi gateway

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110248375A (zh) * 2019-07-25 2019-09-17 维沃移动通信有限公司 一种通信方法及无线接入点

Also Published As

Publication number Publication date
US20190223013A1 (en) 2019-07-18
CN109792787A (zh) 2019-05-21

Similar Documents

Publication Publication Date Title
US20210250767A1 (en) Systems and methods for accessing a network
US20220255936A1 (en) Method and nodes for handling access to epc services via a non-3gpp network
US8769626B2 (en) Web authentication support for proxy mobile IP
CN110495214B (zh) 用于处理pdu会话建立过程的方法和amf节点
JP5553990B2 (ja) 拡張システム・アーキテクチャにおけるポリシ制御
US10313323B2 (en) User equipment identity valid for heterogeneous networks
US8880026B2 (en) Method and apparatus for providing network services to a mobile user equipment
US10432632B2 (en) Method for establishing network connection, gateway, and terminal
WO2018058691A1 (zh) 一种建立公用数据网连接的方法及相关设备
EP3515098B1 (en) Local service authorization method and related device
US20140126532A1 (en) Seamless mobility from 3g network to wifi network
US20060294363A1 (en) System and method for tunnel management over a 3G-WLAN interworking system
US11102656B2 (en) Network access authorization method, related device, and system
US10091160B2 (en) Wireless access gateway
WO2013016968A1 (zh) 一种接入方法、系统及移动智能接入点
WO2016155012A1 (zh) 一种无线通信网络中的接入方法、相关装置及系统
WO2017129101A1 (zh) 路由控制方法、装置及系统
US11451489B2 (en) Wireless access gateway
KR101954397B1 (ko) Ｌｔｅ 이동통신 시스템에서 패킷 차단 방법 및 패킷 차단 시스템
WO2014110768A1 (zh) 一种移动网络对终端认证的方法和网元、终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16917441

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16917441

Country of ref document: EP

Kind code of ref document: A1