WO2015085808A1 - 移动终端自动切换不同通道联网接口的安全应用*** - Google Patents

移动终端自动切换不同通道联网接口的安全应用*** Download PDF

Info

Publication number
WO2015085808A1
WO2015085808A1 PCT/CN2014/087301 CN2014087301W WO2015085808A1 WO 2015085808 A1 WO2015085808 A1 WO 2015085808A1 CN 2014087301 W CN2014087301 W CN 2014087301W WO 2015085808 A1 WO2015085808 A1 WO 2015085808A1
Authority
WO
WIPO (PCT)
Prior art keywords
networking
channel
mobile terminal
application
network
Prior art date
Application number
PCT/CN2014/087301
Other languages
English (en)
French (fr)
Inventor
朱雄关
刘晓岩
Original Assignee
成都达信通通讯设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 成都达信通通讯设备有限公司 filed Critical 成都达信通通讯设备有限公司
Publication of WO2015085808A1 publication Critical patent/WO2015085808A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks

Definitions

  • the present invention relates to a method for establishing a secure application system using a dedicated wireless data network including an APN channel or a VPDN network, ensuring information security, and implementing an Internet access channel and a secure application switching network channel on the mobile terminal.
  • APN Access Point Name
  • IP Internet Protocol
  • GPRS General Packet Radio Service
  • APN GPRS Service Support Node
  • SGSN GPRS Service Support Node
  • DNS Domain Name System, Domain Name System
  • the server queries the GGSN IP address corresponding to the APN to determine the GGSN that the user should access; the APN serves as the service domain identifier: the GGSN is based on the APN.
  • the user's service flow is sent to different service domains, and different service domains correspond to different service bearer networking modes, user identity acquisition modes, and charging modes.
  • the service support node SGSN mainly completes the routing and forwarding of packet data packets, mobility management, session management, logical link management, authentication, encryption, and words. Single generation and output functions.
  • the SGSN is a GPRS service support node, which provides a connection with a wireless packet controller PCU (Package Control Unit) through the Gb interface to perform mobile data management, such as user identification, encryption, and compression functions; and through the Gr interface and the HLR (Home)
  • the Location Register the home location register is connected to perform user database access and access control; it is also connected to the GGSN through the Gn interface to provide functions such as transmission path and protocol conversion between the IP data packet and the wireless unit; the SGSN can also provide It is connected to the Gs interface of the MSC (Message Switching Center) and the Gd interface between the SMS and the Short Message Service Center (SMS) to support the cooperation of data services and circuit services and the transmission and reception of short messages. And other functions.
  • MSC Message Switching Center
  • SMS Short Message Service Center
  • the SGSN cooperates with the GGSN to jointly assume the PS (Packet Switch) function of TD-SCDMA (WCDMA).
  • PS Packet Switch
  • BSS Base Station Subsystem
  • Its main role is to perform mobility management for the MS of the SGSN service area, and forward the input/output IP packets, which is similar to the VMSC (Visited Mobile-services Switching Centre) in the GSM circuit network.
  • the SGSN also integrates a function similar to the VLR (Visitor Location Register) in the GSM network.
  • VLR Visitor Location Register
  • the SGSN When the SGSN is the PS domain function node of the TD-SCDMA (WCDMA) core network, it is connected to the UMRAN (UMTS Terrestrial Radio Access Network-UMTS) through the Iu_PS interface, mainly providing routing forwarding, mobility management, session management, and authentication of the PS domain.
  • UMRAN UMTS Terrestrial Radio Access Network-UMTS
  • GGSN9811 is mainly used as the earliest two APNs provided by China Mobile and currently the most widely used by users - CMWAP and CMNET:
  • CMWAP and CMNET are two GPRS access channels divided by China Mobile.
  • the former is set up for the mobile phone WAP Internet access, while the latter is mainly used for PC, laptop or PDA (Personal Digital Assistant) and other GPRS Internet access services.
  • CMWAP APN is mainly for services based on HTTP (Hypertext Transfer Protocol) protocol, such as WAP Internet access. Browse or MMS, etc.
  • HTTP Hypertext Transfer Protocol
  • the CMWAP APN uses the WAP gateway as a proxy node for HTTP access, and provides some auxiliary functions for users, such as free mobile phone number, content conversion, and adaptive pre-judgment.
  • CMNET is an APN set up for open Internet access services. Users can access the Internet using any protocol without any control and restriction policies, but also do not provide other accessibility features.
  • the mobile terminal accesses the GGSN through the access SGSN, and the service data stream is translated into the Internet through the NAT corresponding to the firewall of the GGSN.
  • VPDN is an abbreviation of Virtual Private Dialup Network. It is based on the virtual private dial-up network service of dial-up users. It can establish a secure virtual private network by using the bearer functions of IP and other networks, combined with the corresponding authentication and authorization mechanisms. .
  • the VPDN business is primarily for business and government administration. After the enterprise applies for the service, it only needs to access its intranet through a dedicated line to the Internet. Users can dial VPDN service anywhere in the country to enter the virtual private network and securely access the information resources they need. . The user can conveniently and flexibly perform operations such as opening an account, canceling an account, and setting user rights for the dial-up user.
  • the characteristics of the virtual dial-up private network are: security is good, not vulnerable to attack; good confidentiality can effectively prevent illegal access; user network construction is fast; network management is convenient, and VPDN users can be generated and managed by themselves.
  • the difference between the mobile network VPDN and the ordinary VPDN is mainly the concept of wireless Internet access.
  • the wireless data network of the mobile network is used to construct a virtual private network for wireless mobile users, so that the user can realize the special use through the wireless data network in any place.
  • the connection of the lines greatly increases the practicality and flexibility.
  • dedicated channels can guarantee the security of information and systems, today's Internet applications are becoming more and more popular. People need to take into account the two application modes of Internet applications and security applications on mobile terminals.
  • the current mobile terminal operating system whether it is a browser or an application's API (Application Programming Interface) interface, only provides a single-channel Internet access mode.
  • the intelligent system of the mobile terminal lacks an interface for automatically switching between different channels. Bring no difference to different business applications Will. How to rely on the public network to realize secure communication and data exchange between mobile terminals and enterprise intranets has become an urgent problem for major enterprises.
  • Remote access usually involves three parts: access terminal, access channel and intranet application. The lack of protection for any of these three parts will bring security risks to the entire remote access process.
  • the traditional virtual private network-based mobile terminal access scheme focuses on the establishment of a secure transmission channel. Although it provides a guarantee for data security transmission to a certain extent, it lacks protection for the entire access process and cannot meet the enterprise-to-terminal remote. Security requirements for access.
  • the object of the present invention is to provide a direct connection between a private data network and the Internet, avoiding intrusion from the Internet, and implementing an Internet access channel and security on the mobile terminal on the mobile Internet.
  • the application switches the secure application system of the networking channel to meet the technical needs of the mobile terminal to switch when using different applications.
  • a mobile terminal automatically switches a security application system of different channel networking interfaces, including an application layer, a mobile terminal networking subsystem, and different Internet channel data networks connected to a dedicated data network
  • the Internet channel uses WIFI or the carrier's standard APN network, which is characterized in that the application layer contains a browser, a client and an application, and a channel switching program module is embedded, and the dedicated data network is built in an internal data network physically separated from the Internet.
  • the internal data network is connected to the virtual private dial-up network VPDN private line or the access point name APN network, and is linked with the mobile network gateway GGSN or the regional gateway SGSN to perform information interaction with the mobile terminal; the application layer monitors the webpage and service used by the user. Or function, when detecting the need to switch different networked networks, call the embedded channel switching function module, close the current Internet networking channel, modify the networking parameters of the current mobile terminal networking subsystem, and specify the APN of the dedicated data network for the application layer. Networking parameters and/or VPDN Network parameters, initiate network requests, the network is successful, a success message feedback, the feedback network failure failure message.
  • a mobile terminal automatically switches a security application system of different channel networking interfaces, including an application layer, a mobile terminal networking subsystem, and a different Internet channel data network connected to a dedicated data network, and the Internet channel uses WIFI or a carrier's standard APN network.
  • the application layer contains a browser, a client and an application, and a channel switching program module is embedded.
  • the dedicated data network is built in an internal data network physically separated from the Internet, and the internal data network is connected to a virtual private dial-up network VPDN line or access point name.
  • the APN network is also linked to the gateway GGSN of the mobile network or the regional gateway SGSN to perform information interaction with the mobile terminal; the application layer monitors the webpage, service or function used by the user, and when detecting the need to switch different networked networks, Call the embedded channel switching function module, close the current Internet networking channel, modify the networking parameters of the current mobile terminal networking subsystem, specify the APN networking parameters and/or VPDN networking parameters of the dedicated data network for the application layer, initiate the networking request, and successfully connect. After the feedback success message, the network failure feedback feedback message.
  • the browser is a dedicated browser for the embedded channel switching program.
  • the client and the application are dedicated software for the embedded channel switching program.
  • the browser performs channel switching operation through the embedded channel switching program; the client and the application.
  • the software performs channel switching operations by means of an embedded channel switching program.
  • the application layer includes a client browser and application software embedded with a channel switch program module plug-in and/or a built-in channel switch program module, a browser and/or embedded embedded channel switch program module plug-in
  • the client and application software of the channel switching program module links the internet channel and the private data network through the networking channel of the mobile terminal networking subsystem.
  • the application layer includes a client and application software or a browser with a plug-in; a browser or browser plug-in or client or application software links the channel switching program module through the application programming interface API, and connects the mobile terminal to the network
  • the subsystem switching channel module is a module built in the mobile terminal operating system and linked with the mobile terminal networking subsystem to perform the channel switching operation function; the browser or the browser plug-in or the client or application software is invoked through the application programming interface API.
  • the channel switching program module performs switching of different networking channels.
  • the application layer includes a client and application software or a browser with a plug-in; a browser or browser plug-in or a client or application software links the channel switching software through the application programming interface API, and connects the mobile terminal networking System; channel switching software is a program that needs to be manually started, independent of the operating system of the mobile terminal.
  • channel switching software When the channel switching software is manually started, it resides in the memory, and provides an application programming interface API to the application layer, and according to The application layer instruction performs the channel switching operation. After the channel switching software exits the memory, the application layer programming interface API in the memory disappears, and the browser or the browser plug-in or the client or the application software invokes the channel switching after the startup through the application programming interface API.
  • the software switches between different networking channels.
  • the channel networking command sent by the application layer includes the APN networking parameter, or the APN networking parameter is preset in the channel switching plug-in or the channel switching program module, and the channel switching command is directly sent to switch to the preset APN network.
  • the mobile terminal networking subsystem includes software and hardware systems for mobile terminal networking parameter storage and modification, network management, and networking operation functions.
  • an embedded channel switching plug-in or channel switching program module records the networking parameters of the current mobile terminal networking subsystem before receiving the channel switching command to modify the networking parameters of the mobile terminal networking subsystem, and is initiated at the next application layer.
  • the channel returns a command, the stored networking parameters are extracted, the networking parameters of the mobile terminal networking subsystem are modified, and a networking request is initiated.
  • the dedicated APN data network switched by the channel switching plug-in or the channel switching program module is a VPDN network
  • the APN networking parameter is an APN and VPDN networking parameter
  • the channel switching plug-in or channel switching program module includes an embedded VPDN dialing The subroutine or the VPDN dialer that comes with the mobile terminal operating system.
  • the channel management module first queries the network channel of the current mobile phone system. If the currently used networking channel is the same as the APN channel accessed by the VPDN, the channel management module directly uses the VPDN dialing software to dial. Linking the intranet of the target address specified by the application layer; if the currently used networking channel is different from the APN channel accessed by the VPDN, the channel management module first confines the current networking channel, then modifies the networking parameters of the mobile terminal networking subsystem, and connects the mobile terminal to the network.
  • the networking parameters of the subsystem are set to specify the networking parameters of the APN network by the application layer, and then initiate the networking request; after the networking is successful, the channel management module links the intranet of the target address specified by the application layer through the VPDN dialing software.
  • the Internet channel uses WIFI or the operator's standard APN network, such as CMNET or CMWAP network used by China Mobile, CTNET or CTWAP network used by China Telecom.
  • the present invention uses a dedicated mobile data network physically isolated from the Internet, including APN or VPDN data channels to secure information and data security of the application system.
  • the three-level deep protection of the secure access of the mobile terminal is realized from the three aspects of the secure transmission channel of the access terminal and the protection of the intranet application system, thereby improving the security of the terminal, ensuring the security of access from the source, and providing high-strength data security transmission.
  • the channel ensures the security of the data transmission process; the security access control technology ensures the security of the intranet application system.
  • the browser, client or application on the mobile terminal can switch the networking channel according to different applications.
  • This connection mode prevents the private data network from directly connecting to the Internet, thus completely avoiding intrusions from the Internet.
  • the invention can use the private mobile data network APN or VPDN secure channel isolated from the Internet to secure the application system information and data security on the mobile internet, and realize the method for switching the network access channel between the Internet access channel and the security application on the mobile terminal, It meets the technical needs of mobile terminals to switch when using different applications.
  • FIG. 1 is a schematic diagram of a system model for a mobile terminal of the present invention to automatically switch between different channel networking interfaces using a dedicated browser;
  • FIG. 2 is a schematic diagram of a system model of a mobile terminal of the present invention automatically switching between different channel networking interfaces using a universal browser;
  • FIG. 3 is a schematic diagram of a system model for a mobile terminal to automatically switch between different channel networking interfaces by using an embedded channel switching program module;
  • FIG. 4 is a schematic diagram of a system model for a mobile terminal to automatically switch between different channel networking interfaces using an independent channel switching procedure
  • FIG. 5 is a schematic diagram of a system model for implementing a security application by a dedicated intranet of the present invention.
  • the mobile terminal is supported to implement a channel networking switching system model for different service applications, which in turn includes an application layer and a mobile terminal networking subsystem.
  • the application layer consists of any of the following two parts, one is the browser that contains the channel switcher, and the other is the client and application that contains the channel switcher.
  • the browser in the application layer links the Internet channel or the dedicated data network through the networking channel of the mobile terminal networking subsystem, or the client and the application in the application layer link the Internet channel or the dedicated data network through the networking channel of the mobile terminal networking subsystem.
  • Application The layer monitors the web pages, services, and functions used by the user. When encountering the need to use a dedicated data network channel, the browser, or the client and the application, by calling the channel switching program, send channel switching commands to perform different networking channels. Switching.
  • the channel switching program closes the current networking channel, modifies the network type and APN networking parameters of the mobile terminal networking subsystem, and the APN networking parameter is specified or pre-defined by the browser, the client, or the application software. Set the network type and APN networking parameters, initiate networking requests, and perform channel switching. After the networking is successful, the networking success message is fed back to the application layer; the networking fails, and the networking failure message is fed back to the application layer.
  • the browser, client or application uses the new data channel for data interaction.
  • the browser, or the channel switching command sent by the client and the application may be a channel switching command with an APN networking parameter, or a channel switching command without an APN networking parameter but pointing to a preset APN networking channel.
  • the mobile terminal networking subsystem refers to a software and hardware system including functions such as storage and modification of network parameters of the mobile terminal, network management, and networking operations.
  • Mobile terminal networking parameters include, but are not limited to, APN networking parameters such as WIFI, CMNET, and the like.
  • Embodiment 2 Professional browser mode
  • the browser is a dedicated browser with a built-in channel switching program
  • the client and the application are dedicated software for the embedded channel switching program, and the browser performs channel switching operation through the embedded channel switching program;
  • the client and the application software perform channel switching operations through an embedded channel switching program.
  • the application calls the embedded channel switching program, sends a channel switching command, and connects the dedicated data network through the networking terminal of the mobile terminal networking subsystem.
  • the embedded channel switching program receives the dedicated browser, or the client and the application command, closes the current network, and modifies the networking parameters of the mobile terminal to the browser, or the APN or VPDN specified or preset by the client and the application.
  • Networking parameters launching networking dedicated to the mobile terminal networking subsystem The request of the data network; after the networking is successful, the success message is fed back to the browser, or the client and the application, the networking fails, and the failure message is fed back to the browser, or the client and the application.
  • a dedicated browser, or a client and application receive a network success message, using a dedicated data network channel to interact with the application system within the private data network; a dedicated browser, or a client and application ending the private data network After the application interaction, the embedded channel switching program is called to switch the mobile terminal networking channel back to the Internet access channel.
  • Embodiment 3 Universal browser mode
  • the mobile terminal is supported to implement a channel networking switching system model for different service applications, which in turn includes an application layer and a mobile terminal networking subsystem.
  • the application layer includes a client browser and application software embedded in the channel switch program module plug-in and/or a built-in channel switch program module browser, and a built-in channel switch program module plug-in browser and/or an embedded channel switch program module.
  • the client and application software link the Internet channel and the private data network through the mobile terminal networking subsystem system networking channel.
  • the client and application software of the universal browser and/or embedded channel switching program module of the embedded channel switching program module plug-in monitors the pages, services and functions used by the user, and when it encounters the need to use a dedicated data network, the universal The browser invokes the embedded channel switching plug-in, the client and the application call the embedded channel switching program module, and send a channel switching command; the embedded channel switching plug-in receives the command of the universal browser, and/or the embedded channel.
  • the switching program module closes the current networked network, and modifies the networking parameters of the mobile terminal networking subsystem to the APN or VPDN networking parameters specified or preset by the browser, and initiates the mobile terminal networking subsystem.
  • a request for a networked private data network after successful networking, a success message is fed back to the browser, the network fails, and a failure message is fed back to the browser.
  • the universal browser, and/or the client and the application After the universal browser, and/or the client and the application receive the networking success message, use the dedicated data network channel to interact with the application system within the private data network; the generic browser, and/or the client and the application complete After the application service in the dedicated data network, the embedded channel switching plug-in or program module is called to switch the mobile terminal networking channel back to the Internet access channel.
  • Embodiment 4 Method for embedding a channel switching program module in a mobile terminal operating system
  • the mobile terminal is supported to implement a channel networking switching system model for different service applications, which in turn includes an application layer, a channel switching program module, and a mobile Terminal networking subsystem.
  • the application layer includes a client and application software, or a browser with a plug-in; a browser, a browser plug-in, or a client or application software links the channel switching program module through the application programming interface API, and connects the mobile terminal networking subsystem
  • the channel switching program module is a module built in the mobile terminal operating system and linked with the mobile terminal networking subsystem and performs channel switching operation functions; the browser, the browser plug-in, or the client or application software calls the channel through the application programming interface API; The switching program module switches between different networking channels.
  • the application layer monitors the pages, services, and functions used by the user.
  • the channel switching module is invoked through the API interface to send a channel switching command.
  • the channel switching module After receiving the command of the application layer, the channel switching module closes the current network, and modifies the networking parameters of the mobile terminal networking subsystem to the APN or VPDN networking parameters specified or preset by the application layer, and initiates network dedicated data to the mobile terminal networking subsystem.
  • the request of the network after the connection is successful, the success message is fed back to the browser, the network fails, and the failure message is fed back to the browser.
  • the application layer After receiving the message that the channel switching succeeds, the application layer uses the dedicated data network for information interaction. After the application layer completes the service of the dedicated data, the channel switching module is invoked to switch the networked channel back to the Internet access channel.
  • Embodiment 5 Independent Software Operation Mode
  • the mobile terminal is supported to implement a channel networking switching system model for different service applications, which in turn includes an application layer, a channel switching software, and a mobile terminal.
  • Networking subsystem The application layer includes a client and application software or a browser with a plug-in; a browser, a browser plug-in, or a client and application software link channel switching software through an application programming interface API, and connect the mobile terminal networking subsystem;
  • the switching software is an application that needs to be manually started, independent of the operating system of the mobile terminal.
  • the channel switching software When the channel switching software is manually started, it resides in the memory, provides an application programming interface API to the application layer, and performs channel switching operations according to the application layer instructions. After the channel switching software exits the memory, the application layer programming interface API in the memory disappears. Browser, browser The plug-in, or the client and the application software, invokes the channel switching software after the startup through the application programming interface API to switch between different networking channels.
  • the channel switching plug-in or the channel switching program module records the networking parameters of the current mobile terminal networking subsystem before receiving the channel switching command and modifying the networking parameters of the mobile terminal networking subsystem, in the next application.
  • the layer initiates the channel return command, the stored networking parameters are extracted, the networking parameters of the mobile terminal networking subsystem are modified, and a networking request is initiated.
  • the dedicated APN data network switched by the channel switching plug-in or module is a VPDN network
  • the APN networking parameters are APN and VPDN networking parameters.
  • the channel switching plug-in, module contains the embedded VPDN dialing subroutine or calls the VPDN dialer that comes with the mobile terminal operating system.
  • the channel management module first queries the networking channel of the current mobile phone system. If the currently used networking channel is the same as the APN channel accessed by the VPDN, the channel management module directly uses the VPDN dialing software to dial and connect the application layer to specify The target address of the intranet. If the currently used networking channel is different from the APN channel accessed by the VPDN, the channel management module first confines the current networking channel, then modifies the networking parameters of the mobile terminal networking subsystem, and sets the networking parameter of the mobile terminal networking subsystem to the application layer designation. The networking parameters of the APN network are then initiated by the networking request. After the networking is successful, the channel management module connects to the intranet of the target address specified by the application layer through the VPDN dialing software.
  • Embodiment 8 Private Data Network Architecture
  • the system model of the security application is constructed using a dedicated data channel physically isolated from the Internet as described below.
  • the application layer embedded channel switching function model includes a GSN, APN or VPDN data network and application system in sequence.
  • the APN or VPDN data network and application system together become a dedicated data network.
  • the private data network uses the APN or VPDN private line linked with the GGSN or SGSN of the mobile network, and the information interaction with the mobile terminal includes the application server, the virtual private dial-up network VPDN dial-up line and/or the access point name APN network, and the authentication device.
  • GSN equipment The application server and the authentication device are built in an internal data network that is isolated from the Internet.
  • the application server passes the virtual private dial-up network VPDN dial-up line and/or the access point name APN network through the authentication device.
  • the GSN device is linked, and the base station and the mobile terminal are linked.
  • the GSN device simultaneously links the Internet through the mobile network gateway GPRS and the support node GGSN.
  • GGSN Gateway GSN
  • the mobile payment service is performed, the Internet access channel is automatically confined, and after the physical isolation of the Internet is successful, the mobile terminal performs the interaction between the graphic verification code information and the application server through the base station.
  • GGSN Gateway GSN
  • the GGSN can perform protocol conversion on GPRS packet data packets in the GSM network, so that these packet data packets can be transmitted to a remote TCP/IP or X.25 network.
  • SGSN is the abbreviation of English Serving GPRS SUPPORT NODE.
  • WCDMA GPRS/TD-SCDMA
  • SGSN mainly completes packet forwarding, mobility management, session management, logical link management, authentication and encryption, bill generation and output. And other functions.
  • the SGSN is a GPRS service support node, which provides a link with the wireless packet controller PCU through the Gb interface, performs mobile data management, such as user identification, encryption, and compression functions; and connects to the HLR through the Gr interface to perform user database access. And access control; it is also connected to the GGSN through the Gn interface, providing functions such as transmission path and protocol conversion between the IP data packet and the wireless unit; the SGSN can also provide a Gs interface link with the MSC and a Gd interface with the SMSC. Links to support the collaborative work of data services and circuit services, as well as messaging and other functions.
  • the GGSN and the SGSN (collectively, the GSN) use the UDP port 2123 to listen for GTP-C packets, and the UDP port 2152 listens for GTP-U packets.
  • the program may be stored in a mobile terminal readable storage medium, optionally
  • Each module/unit of the terminal in the above embodiment may be implemented in the form of hardware or in the form of a software function module.
  • the present invention is not limited to the combination of any specific form of hardware and software, and is intended to be within the scope of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提出的一种移动终端自动切换不同通道联网接口的安全应用***，旨在提供一能够避免专用数据网络与互联网进行直接连接，规避互联网入侵的安全应用***,本发明通过下述技术方案予以实现：应用层含有浏览器、客户端与应用程序，并内嵌通道切换程序模块，专用数据网络构建于与互联网物理隔离的内部数据网内，内部数据网连接虚拟专用拨号网VPDN专线或接入点名称APN网络，同时与移动网络的网关GGSN或区域网关SGSN相连接；当应用层检测到需要切换不同联网网络的需求时，调用内嵌的通道切换功能模块，关闭当前互联网联网通道，修改当前移动终端联网子***的联网参数，为应用层指定专用数据网络的APN联网参数和/或VPDN联网参数，发起联网请求。

Description

移动终端自动切换不同通道联网接口的安全应用***
本申请要求于2013年12月09日提交中国专利局、申请号为201310661251.X、发明名称为“移动终端自动切换不同通道联网接口的安全应用***”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及使用专用的无线数据网络包括APN通道或VPDN网络建立安全应用***，保障信息安全，以及在移动终端上实现互联网访问通道与安全应用切换联网通道的方法。
背景技术
随着移动互联网的高速发展，各类移动应用层出不穷，黑客入侵、钓鱼网站等各种非法手段无时无刻不在侵害互联网的安全，各种预装软件、病毒打包等威胁手机网络安全的问题日益突出，并逐渐形成黑色产业链。互联网应用***的安全，日益成为人们关注的焦点。棱镜门之后，人们发现，在拥有强大技术实力的美国政府面前，任何互联网公司包括当前拥有互联网技术最顶尖科技的苹果和谷歌公司，只要在互联网上建立的信息***，即使拥有各类安全防护措施，都无法避免被窃取信息的安全漏洞。
在传统技术领域，物理隔离是保障内部网络安全最重要最有效的举措，无论银行信息***还是政府信息***都是使用与互联网物理隔离的内部网络来保障信息安全的。使用与互联网物理隔离的内部网络杜绝了互联网的联网通道，任何黑客都无法进行入侵。对于普通用户而言，APN(Access Point Name，接入点名称)只是为了上网而在手机终端上预先配置或手工设定的一组参数。而对于移动网络来说，APN是用来实现将用户互联网协议IP(Internet Protocol)报文路由至相应GPRS(General Packet Radio Service，通用分组无线服务技术)网络路由器GGSN(Gateway GPRS Support Node，网关GPRS支持节点)及外部网络的必不可少的标识，其作用具体包括：APN作为路由标识：GPRS服务支持节点SGSN(Serving GPRS Support Node)根据APN，向特定域名***DNS(Domain Name System，域名***)服务器查询该APN对应的GGSN IP地址，以确定用户应接入的GGSN；APN作为业务域标识：GGSN根据APN 不同，将用户的业务流送到不同的业务域，而不同的业务域则对应了不同的业务承载组网方式、用户标识获取方式以及计费模式等。服务支持节点SGSN作为GPRS/TD-SCDMA(WCDMA)核心网分组域设备的重要组成部分，主要完成分组数据包的路由转发、移动性管理、会话管理、逻辑链路管理、鉴权、加密、话单产生和输出等功能。SGSN即GPRS服务支持节点，它通过Gb接口提供与无线分组控制器PCU(Package Control Unit)的连接，进行移动数据的管理，如用户身份识别，加密以及压缩等功能；通过Gr接口与HLR(Home Location Register，归属位置寄存器)相连，进行用户数据库的访问及接入控制；它还通过Gn接口与GGSN相连，提供IP数据包到无线单元之间的传输通路和协议变换等功能；SGSN还可以提供与MSC(Message Switching Center，移动交换中心)的Gs接口连接以及与SMSC(Short Message Service Center，短消息服务中心)之间的Gd接口连接，用以支持数据业务和电路业务的协同工作和短信收发等功能。SGSN与GGSN配合，共同承担TD-SCDMA(WCDMA)的PS(Packet Switch)功能。当作为GPRS网络的一个基本的组成网元时，通过Gb接口和BSS(基站子***)相连。其主要的作用就是为本SGSN服务区域的MS进行移动性管理，并转发输入/输出的IP分组，其地位类似于GSM电路网中的VMSC(Visited Mobile-services Switching Centre)。此外，SGSN中还集成了类似于GSM网络中VLR(Visitor Location Register)的功能，当用户处于GPRS Attach(GPRS附着)状态时，SGSN中存储了同分组相关的用户信息和位置信息。当SGSN作为TD-SCDMA(WCDMA)核心网的PS域功能节点，它通过Iu_PS接口与UTRAN(UMTS Terrestrial Radio Access Network-UMTS)相连，主要提供PS域的路由转发、移动性管理、会话管理、鉴权和加密等功能。GGSN9811主要以***最早提供、也是目前用户使用最广的两个APN——CMWAP、CMNET为例：
1)CMWAP APN
CMWAP和CMNET是***人为划分的两个GPRS接入通道。前者是为手机WAP上网而设立的，后者则主要是为PC、笔记本电脑或PDA(Personal Digital Assistant)等利用GPRS上网服务。CMWAP APN在设计之初主要面向基于HTTP(Hypertext transfer protocol)协议的业务，如WAP上网 浏览或彩信等。随着数据业务的不断发展，为了支持逐渐引入的非超文本传输协议HTTP的业务，通过对无线应用协议WAP域进行升级改造和配置，逐渐演变为面向绝大多数自营业务和合作业务的默认业务域，面向用户提供彩信、PIM(Protocol Independent Multicast)、流媒体、通用下载、快讯、音乐随身听以及游戏等业务。CMWAP APN使用了WAP网关作为HTTP访问的代理节点，同时可面向用户提供一些辅助功能，例如免输手机号码、内容转换、适配预判等。
2)CMNET APN
CMNET是为了开展开放的互联网接入服务设置的APN，用户可使用任何协议访问互联网，没有任何控制和限制策略，但同时也不提供其他辅助功能。使用CMNET APN时，移动终端通过接入地SGSN就近接入GGSN，业务数据流通过GGSN对应的防火墙进行NAT地址转换后接入互联网。
VPDN是虚拟拨号专用网络(Virtual Private Dialup Network)的缩写，它基于拨号用户的虚拟专用拨号网业务，利用IP和其他网络的承载功能，结合相应的认证和授权机制，可以建立安全的虚拟专用网络。VPDN业务主要面向企业以及政府管理部门。企业申请该业务后，只需要将其企业内部网通过一条专线接入到互联网络，用户即可在国内任何地方拨号使用VPDN业务进入到该虚拟专用网中，安全地访问自己所需要的信息资源。用户可以方便灵活地自行对所属拨号用户进行开户、销户、设置用户权限等操作。虚拟拨号专用网(VPDN)的特点有：安全性好，不易受攻击；保密性好，可有效防止非法访问；用户网络建设快；网络管理方便，可以自行生成和管理VPDN用户。移动网络VPDN与普通的VPDN不同之处主要体现的是无线上网的概念，利用移动网络的无线数据网络为无线移动用户构建虚拟专用网络，从而使用户在任何地点都能够通过无线数据网络，实现专用线路的连接，从而大大提高了实用性和灵活性。专用通道虽然可以保障信息与***安全，但是互联网应用日益普及的今天，人们需要在移动终端上兼顾互联网应用与安全应用两种应用模式。但是，当前的移动终端操作***，无论是浏览器还是应用程序的API(Application Programming Interface)接口都只提供单通道的互联网访问模式，同时，移动终端的智能***缺乏自动切换不同通道联网的接口，给不同的业务应用带来不 便。如何依托公网实现移动终端与企业内网之间的安全通信和数据交换成为当前各大企业亟待解决的问题。远程接入通常涉及三个部分：接入终端、接入通道和内网应用，对这三个部分中任一个部分保护的不到位都将给整个远程接入过程带来安全隐患。传统的基于虚拟专网的移动终端接入方案关注于安全传输通道的建立，虽然在一定程度上对数据安全传输提供了保证，但是缺乏对整个接入过程的保护，无法满足企事业对终端远程接入的安全要求。
发明内容
本发明的目的是针对现有技术存在的不足之处，提供一种在移动互联网上，能够避免专用数据网络与互联网进行直接连接，规避来自互联网的入侵，在移动终端上实现互联网访问通道与安全应用切换联网通道的安全应用***,以满足移动终端在使用不同应用时进行切换的技术需要。
本发明的上述目的可以通过以下措施来达到，一种移动终端自动切换不同通道联网接口的安全应用***，包括应用层、移动终端联网子***和连接专用数据网络在内的不同互联网通道数据网络，互联网通道使用WIFI或运营商的标准APN网络，其特征在于：应用层含有浏览器、客户端与应用程序，并内嵌通道切换程序模块，专用数据网络构建于与互联网物理隔离的内部数据网内，内部数据网连接虚拟专用拨号网VPDN专线或接入点名称APN网络，同时与移动网络的网关GGSN或区域网关SGSN相链接，与移动终端进行信息交互；应用层通过监测用户使用的网页、业务或功能，当检测到需要切换不同联网网络的需求时，调用内嵌的通道切换功能模块，关闭当前互联网联网通道，修改当前移动终端联网子***的联网参数，为应用层指定专用数据网络的APN联网参数和/或VPDN联网参数，发起联网请求，联网成功后，反馈成功消息，联网失败反馈失败消息。
本发明技术方案如下：
一种移动终端自动切换不同通道联网接口的安全应用***，包括应用层、移动终端联网子***和连接专用数据网络在内的不同互联网通道数据网络，互联网通道使用WIFI或运营商的标准APN网络，应用层含有浏览器、客户端与应用程序，并内嵌通道切换程序模块，专用数据网络构建于与互联网物理隔离的内部数据网内，内部数据网连接虚拟专用拨号网VPDN专线或接入点名 称APN网络，同时与移动网络的网关GGSN或区域网关SGSN相链接，与移动终端进行信息交互；应用层通过监测用户使用的网页、业务或功能，当检测到需要切换不同联网网络的需求时，调用内嵌的通道切换功能模块，关闭当前互联网联网通道，修改当前移动终端联网子***的联网参数，为应用层指定专用数据网络的APN联网参数和/或VPDN联网参数，发起联网请求，联网成功后，反馈成功消息，联网失败反馈失败消息。
可选的：浏览器是内嵌通道切换程序的专用浏览器，客户端与应用程序是内嵌通道切换程序的专用软件，浏览器通过内嵌的通道切换程序进行通道切换操作；客户端与应用软件通过内嵌的通道切换程序，进行通道切换的操作。
可选的：应用层包括内嵌通道切换程序模块插件的通用浏览器和/或内嵌通道切换程序模块的客户端与应用程序软件，内嵌通道切换程序模块插件的浏览器和/或内嵌通道切换程序模块的客户端与应用程序软件通过移动终端联网子***联网通道链接互联网通道和专用数据网络。
可选的：应用层包括客户端与应用软件或带有插件程序的浏览器；浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API链接通道切换程序模块，并连通移动终端联网子***；通道切换程序模块是内置于移动终端操作***内与移动终端联网子***链接，执行通道切换操作功能的模块；浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API调用通道切换程序模块进行不同联网通道的切换。
可选的：应用层包括客户端与应用软件或带有插件程序的浏览器；浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API链接通道切换软件，并连通移动终端联网子***；通道切换软件是一段需要手工启动的，独立于移动终端操作***外的应用程序,当通道切换软件被手动启动后，驻留在内存中，向应用层提供应用程序编程接口API，并根据应用层指令进行通道切换操作,通道切换软件退出内存后，内存中的应用层程序编程接口API消失,浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API调用启动后的通道切换软件进行不同联网通道的切换。
可选的：应用层发送的通道联网指令包含APN联网参数，或者将APN联网参数预设在通道切换插件或通道切换程序模块中，直接发送通道切换命令，使之切换到预设的APN网络。
可选的：移动终端联网子***包含移动终端联网参数存储与修改、网络管理、联网操作功能在内的软硬件***。
可选的：内嵌的通道切换插件或通道切换程序模块，在收到通道切换命令，修改移动终端联网子***的联网参数前，记录当前移动终端联网子***的联网参数，在下次应用层发起通道返回命令时，提取存储的联网参数，对移动终端联网子***的联网参数进行修改，并发起联网请求。
可选的：通道切换插件或通道切换程序模块所切换的专用APN数据网络是VPDN网络，所述的APN联网参数是APN和VPDN联网参数；通道切换插件或通道切换程序模块包含内嵌的VPDN拨号子程序或调用移动终端操作***自带的VPDN拨号程序。
可选的：在VPDN通道切换过程中，通道管理模块首先查询当前手机***的联网通道，如果是当前使用的联网通道与VPDN接入的APN通道相同，通道管理模块直接使用VPDN拨号软件进行拨号，链接应用层指定的目标地址的内网；如果当前使用的联网通道与VPDN接入的APN通道不同，通道管理模块先禁闭当前联网通道，然后修改移动终端联网子***的联网参数，将移动终端联网子***的联网参数设定为应用层指定APN网络的联网参数，然后发起联网请求；联网成功后，通道管理模块再通过VPDN拨号软件链接应用层指定的目标地址内网。
互联网通道使用WIFI或运营商的标准APN网络，例如：***使用的CMNET或CMWAP网络，中国电信使用的CTNET或CTWAP网络。
本发明相比于现有技术具有如下有益效果：
本发明使用与互联网物理隔离的专用移动数据网络，包括APN或VPDN数据通道来保障应用***的信息与数据安全。从接入终端安全传输通道和内网应用***防护三个方面实现移动终端安全接入的三级纵深防护，提升了终端安全性，从源头保证接入的安全；提供了高强度的数据安全传输通道，保证数据传输过程的安全；采用安全访问控制技术保证了内网应用***的安全。
移动终端上浏览器、客户端或应用程序可以根据不同的应用进行联网通道的切换。这种连接模式可以避免专用数据网络与互联网进行直接连接，从而彻底规避来自互联网的入侵。
本发明可以在移动互联网上，使用与互联网隔离的专用移动数据网络APN或VPDN安全通道来保障应用***信息与数据安全，并在移动终端上实现互联网访问通道与安全应用切换联网通道的方法，可以满足移动终端在使用不同应用时进行切换的技术需要。
附图说明
为使本发明的目的、技术方案和优点更加清楚明白，下面将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
图1是本发明移动终端使用专用浏览器自动切换不同通道联网接口的***模型示意图；
图2是本发明移动终端使用通用浏览器自动切换不同通道联网接口的***模型示意图；
图3是移动终端使用内嵌通道切换程序模块自动切换不同通道联网接口的***模型示意图；
图4是移动终端使用独立通道切换程序自动切换不同通道联网接口的***模型示意图；
图5是本发明专用内网实现安全应用的***模型示意图。
具体实施方式：
实施例1。
参阅图1。在以下描述的移动终端自动切换不同通道联网接口的安全应用***的一个最佳实施例中，支持移动终端实现针对不同业务应用进行通道联网切换***模型，依次包括应用层和移动终端联网子***。应用层包含下述两部分中的任意一种，一部分是包含通道切换程序的浏览器，另一部分是包含通道切换程序的客户端与应用程序。应用层中的浏览器通过移动终端联网子***的联网通道链接互联网通道或专用数据网络，或者，应用层中的客户端与应用程序通过移动终端联网子***的联网通道链接互联网通道或专用数据网络。应用 层监测用户使用的网页、业务与功能，当遇到需要使用专用数据网络通道的需求的时候，浏览器，或者客户端与应用程序通过调用通道切换程序，发送通道切换命令，进行不同的联网通道的切换。
通道切换程序收到应用层发送的通道切换命令后，关闭当前联网通道，修改移动终端联网子***的网络类型和APN联网参数，所述APN联网参数为浏览器、客户端或应用软件指定或预设的网络类型和APN联网参数，发起联网请求，进行通道切换。联网成功后，向应用层反馈联网成功消息；联网失败，向应用层反馈联网失败消息。
通道切换成功后，浏览器、客户端或应用软件使用新的数据通道进行数据交互。浏览器，或者客户端与应用程序所发送的通道切换命令，可以是带有APN联网参数的通道切换命令，还可以是没有APN联网参数但指向预设的APN联网通道的通道切换命令。
移动终端联网子***是指包含移动终端联网参数存储与修改、网络管理以及联网操作等功能在内的软硬件***。
移动终端联网参数包括但不限于WIFI、CMNET等网络类型的APN联网参数等参数。
实施例2：专业浏览器方式
参阅图1。在上述描述实施例1中，浏览器是内嵌通道切换程序的专用浏览器，客户端与应用程序是内嵌通道切换程序的专用软件，浏览器通过内嵌的通道切换程序进行通道切换操作；客户端与应用软件通过内嵌的通道切换程序，进行通道切换的操作。
内嵌通道切换程序的专用浏览器，或者内嵌通道切换程序的客户端与应用程序监测用户使用的页面、业务与功能，当遇到需要使用专用数据网络需求时，浏览器，或者客户端与应用程序调用内嵌的通道切换程序，发送通道切换命令，并通过移动终端联网子***联网通道，联网专用数据网络。
内嵌通道切换程序收到专用浏览器，或者客户端与应用程序命令后，关闭当前联网网络，将移动终端的联网参数修改为浏览器，或者客户端与应用程序指定或预设的APN或VPDN联网参数，向移动终端联网子***发起联网专用 数据网络的请求；联网成功后，向浏览器，或者客户端与应用程序反馈成功消息，联网失败，向浏览器，或者客户端与应用程序反馈失败消息。
专用浏览器，或者客户端与应用程序收到联网成功消息后，使用专用数据网络通道，与专用数据网络内的应用***进行信息交互；专用浏览器，或者客户端与应用程序结束专用数据网络的应用交互后，调用内嵌的通道切换程序，将移动终端联网通道切换回互联网访问通道。
实施例3：通用浏览器方式
参阅图2。在以下描述的移动终端自动切换不同通道联网接口的安全应用***的一个最佳实施例中，支持移动终端实现针对不同业务应用进行通道联网切换***模型，依次包括应用层和移动终端联网子***。应用层包括内嵌通道切换程序模块插件的通用浏览器和/或内嵌通道切换程序模块的客户端与应用程序软件，内嵌通道切换程序模块插件的浏览器和/或内嵌通道切换程序模块的客户端与应用程序软件通过移动终端联网子******联网通道链接互联网通道和专用数据网络。
内嵌通道切换程序模块插件的通用浏览器和/或内嵌通道切换程序模块的客户端与应用程序软件监测用户使用的页面、业务与功能，当遇到需要使用专用数据网络的需求时，通用浏览器调用内嵌的通道切换插件，客户端与应用程序调用内嵌的通道切换程序模块，发送通道切换命令；内嵌的通道切换插件收到通用浏览器的命令，和/或内嵌的通道切换程序模块收到客户端或应用程序的命令后，关闭当前联网网络，将移动终端联网子***的联网参数修改为浏览器指定或预设的APN或VPDN联网参数，向移动终端联网子***发起联网专用数据网络的请求；联网成功后，向浏览器反馈成功消息，联网失败，向浏览器反馈失败消息。
通用浏览器，和/或客户端与应用程序收到联网成功消息后，使用专用数据网络通道，与专用数据网络内的应用***进行信息交互；通用浏览器，和/或客户端与应用程序完成专用数据网络内的应用业务后，调用内嵌的通道切换插件或程序模块，将移动终端联网通道切换回互联网访问通道。
实施例4：移动终端操作***内嵌通道切换程序模块的方式
参阅图3。在以下描述的移动终端自动切换不同通道联网接口的安全应用***的一个最佳实施例中，支持移动终端实现针对不同业务应用进行通道联网切换***模型，依次包括应用层、通道切换程序模块和移动终端联网子***。应用层包括客户端与应用软件，或者带有插件程序的浏览器；浏览器，浏览器插件，或者客户端或应用软件通过应用程序编程接口API链接通道切换程序模块，并连通移动终端联网子***；通道切换程序模块是内置于移动终端操作***内与移动终端联网子***链接并且执行通道切换操作功能的模块；浏览器，浏览器插件，或者客户端或应用软件通过应用程序编程接口API调用通道切换程序模块进行不同联网通道的切换。
应用层监测用户使用的页面、业务与功能，当遇到需要使用专用数据网络的需求时，通过API接口调用通道切换模块发送通道切换命令。
通道切换模块收到应用层的命令后，关闭当前联网网络，将移动终端联网子***的联网参数修改为应用层指定或预设的APN或VPDN联网参数，向移动终端联网子***发起联网专用数据网络的请求；联网成功后，向浏览器反馈成功消息，联网失败，向浏览器反馈失败消息。
应用层收到通道切换成功的消息后，使用专用数据网络进行信息交互。应用层完成专用数据的业务后，调用通道切换模块，将联网通道切换回互联网访问通道。
实施例5：独立软件运行方式
参阅图4。在以下描述的移动终端自动切换不同通道联网接口的安全应用***的一个最佳实施例中，支持移动终端实现针对不同业务应用进行通道联网切换***模型，依次包括应用层、通道切换软件和移动终端联网子***。应用层包括客户端与应用软件或带有插件程序的浏览器；浏览器，浏览器插件，或者客户端与应用软件通过应用程序编程接口API链接通道切换软件，并连通移动终端联网子***；通道切换软件是一段需要手工启动的，独立于移动终端操作***外的应用程序。当通道切换软件被手动启动后，驻留在内存中，向应用层提供应用程序编程接口API，并根据应用层指令进行通道切换操作。通道切换软件退出内存后，内存中的应用层程序编程接口API消失。浏览器，浏览器 插件，或者客户端与应用软件通过应用程序编程接口API调用启动后的通道切换软件进行不同联网通道的切换。
实施例6
参阅图1—图4。在上述实施例1～5中，通道切换插件或通道切换程序模块，在收到通道切换命令，修改移动终端联网子***的联网参数前，记录当前移动终端联网子***的联网参数，在下次应用层发起通道返回命令时，提取存储的联网参数，对移动终端联网子***的联网参数进行修改，并发起联网请求。
实施例7
上述的实施例1～6中，通道切换插件或模块所切换的专用APN数据网络是VPDN网络，所述的APN联网参数是APN和VPDN联网参数。通道切换插件、模块包含内嵌的VPDN拨号子程序或调用移动终端操作***自带的VPDN拨号程序。
VPDN通道的切换过程中，通道管理模块首先查询当前手机***的联网通道，如果是当前使用的联网通道与VPDN接入的APN通道相同，通道管理模块直接使用VPDN拨号软件进行拨号，连接应用层指定的目标地址的内网。如果当前使用的联网通道与VPDN接入的APN通道不同，通道管理模块先禁闭当前联网通道，然后修改移动终端联网子***的联网参数，将移动终端联网子***的联网参数设定为应用层指定APN网络的联网参数，然后发起联网请求。联网成功后，通道管理模再通过VPDN拨号软件连接应用层指定的目标地址内网。
实施例8：专用数据网络构架
参阅图5。在以下描述的使用与互联网物理隔离的专用数据通道构建安全应用的***模型，应用层内嵌通道切换功能模型依次包括GSN、APN或VPDN数据网络和应用***。APN或VPDN数据网络和应用***一起成为专用数据网络。专用数据网使用与移动网络的GGSN或SGSN相链接的APN或VPDN专线，与移动终端进行信息交互依次包括应用服务器、虚拟专用拨号网VPDN拨号专线和/或接入点名称APN网络、鉴权设备和GSN设备。应用服务器以及鉴权设备在内的应用***构建在与互联网相隔离的内部数据网内，应用服务器通过鉴权设备经虚拟专用拨号网VPDN拨号专线和/或接入点名称APN网络 链接GSN设备，链接基站与移动终端，GSN设备同时通过移动网络网关GPRS、支持节点GGSN链接互联网。在进行移动支付业务时，自动禁闭互联网访问通道，物理隔离互联网成功后，移动终端通过基站与应用服务器进行图形验证码信息交互。GGSN(Gateway GSN，网关GSN)主要是起网关作用，它可以和多种不同的数据网络链接，如ISDN、PSPDN和LAN等。有的文献中，把GGSN称为GPRS路由器。GGSN可以把GSM网中的GPRS分组数据包进行协议转换，从而可以把这些分组数据包传送到远端的TCP/IP或X.25网络。SGSN是英文Serving GPRS SUPPORT NODE的缩写。SGSN作为GPRS/TD-SCDMA(WCDMA)核心网分组域设备重要组成部分，主要完成分组数据包的路由转发、移动性管理、会话管理、逻辑链路管理、鉴权和加密、话单产生和输出等功能。SGSN即GPRS服务支持节点，它通过Gb接口提供与无线分组控制器PCU的链接，进行移动数据的管理，如用户身份识别，加密以及压缩等功能；通过Gr接口与HLR相连，进行用户数据库的访问及接入控制；它还通过Gn接口与GGSN相连，提供IP数据包到无线单元之间的传输通路和协议变换等功能；SGSN还可以提供与MSC的Gs接口链接以及与SMSC之间的Gd接口链接，用以支持数据业务和电路业务的协同工作以及短信收发等功能。GGSN和SGSN(合称GSN)使用UDP2123端口侦听GTP-C报文，UDP端口2152侦听GTP-U报文。
以上所述的仅是本发明的优选实施例。应当指出，对于本领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以作出若干变形和改进，比如所述程序可以存储于移动终端可读存储介质中，可选地，上述实施例终端各模块/单元可以采用硬件的形式实现，也可采用软件功能模块的形式实现。本发明不限制于任何特定形式的硬件和软件的结合，亦属于本发明的范畴，这些变更和改变应视为属于本发明的保护范围。

Claims (10)

  1. 一种移动终端自动切换不同通道联网接口的安全应用***，包括应用层、移动终端联网子***和连接专用数据网络在内的不同互联网通道数据网络，互联网通道使用WIFI或运营商的标准APN网络，其特征在于：应用层含有浏览器、客户端与应用程序，并内嵌通道切换程序模块，专用数据网络构建于与互联网物理隔离的内部数据网内，内部数据网连接虚拟专用拨号网VPDN专线或接入点名称APN网络，同时与移动网络的网关GGSN或区域网关SGSN相链接，与移动终端进行信息交互；应用层通过监测用户使用的网页、业务或功能，当检测到需要切换不同联网网络的需求时，调用内嵌的通道切换功能模块，关闭当前互联网联网通道，修改当前移动终端联网子***的联网参数，为应用层指定专用数据网络的APN联网参数和/或VPDN联网参数，发起联网请求，联网成功后，反馈成功消息，联网失败反馈失败消息。
  2. 如权利要求1所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：浏览器是内嵌通道切换程序的专用浏览器，客户端与应用程序是内嵌通道切换程序的专用软件，浏览器通过内嵌的通道切换程序进行通道切换操作；客户端与应用软件通过内嵌的通道切换程序，进行通道切换的操作。
  3. 如权利要求1所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：应用层包括内嵌通道切换程序模块插件的通用浏览器和/或内嵌通道切换程序模块的客户端与应用程序软件，内嵌通道切换程序模块插件的浏览器和/或内嵌通道切换程序模块的客户端与应用程序软件通过移动终端联网子***联网通道链接互联网通道和专用数据网络。
  4. 如权利要求1所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：应用层包括客户端与应用软件或带有插件程序的浏览器；浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API链接通道切换程序模块，并连通移动终端联网子***；通道切换程序模块是内置于移动终端操作***内与移动终端联网子***链接，执行通道切换操作功能的模块；浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API调用通道切换程序模块进行不同联网通道的切换。
  5. 如权利要求1所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：应用层包括客户端与应用软件或带有插件程序的浏览器；浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API链接通道切换软件，并连通移动终端联网子***；通道切换软件是一段需要手工启动的，独立于移动终端操作***外的应用程序,当通道切换软件被手动启动后，驻留在内存中，向应用层提供应用程序编程接口API，并根据应用层指令进行通道切换操作,通道切换软件退出内存后，内存中的应用层程序编程接口API消失,浏览器或浏览器插件或客户端或应用软件通过应用程序编程接口API调用启动后的通道切换软件进行不同联网通道的切换。
  6. 如权利要求1～5任意一项所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：应用层发送的通道联网指令包含APN联网参数，或者将APN联网参数预设在通道切换插件或通道切换程序模块中，直接发送通道切换命令，使之切换到预设的APN网络。
  7. 如权利要求1～5任意一项所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：移动终端联网子***包含移动终端联网参数存储与修改、网络管理、联网操作功能在内的软硬件***。
  8. 如权利要求1所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：内嵌的通道切换插件或通道切换程序模块，在收到通道切换命令，修改移动终端联网子***的联网参数前，记录当前移动终端联网子***的联网参数，在下次应用层发起通道返回命令时，提取存储的联网参数，对移动终端联网子***的联网参数进行修改，并发起联网请求。
  9. 如权利要求1～8任意一项所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：通道切换插件或通道切换程序模块所切换的专用APN数据网络是VPDN网络，所述的APN联网参数是APN和VPDN联网参数；通道切换插件或通道切换程序模块包含内嵌的VPDN拨号子程序或调用移动终端操作***自带的VPDN拨号程序。
  10. 如权利要求7所述的移动终端自动切换不同通道联网接口的安全应用***，其特征在于：在VPDN通道切换过程中，通道管理模块首先查询当前手机***的联网通道，如果是当前使用的联网通道与VPDN接入的APN通道 相同，通道管理模块直接使用VPDN拨号软件进行拨号，链接应用层指定的目标地址的内网；如果当前使用的联网通道与VPDN接入的APN通道不同，通道管理模块先禁闭当前联网通道，然后修改移动终端联网子***的联网参数，将移动终端联网子***的联网参数设定为应用层指定APN网络的联网参数，然后发起联网请求；联网成功后，通道管理模块再通过VPDN拨号软件链接应用层指定的目标地址内网。
PCT/CN2014/087301 2013-12-09 2014-09-24 移动终端自动切换不同通道联网接口的安全应用*** WO2015085808A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310661251.XA CN103618736A (zh) 2013-12-09 2013-12-09 移动终端自动切换不同通道联网接口的安全应用***
CN201310661251.X 2013-12-09

Publications (1)

Publication Number Publication Date
WO2015085808A1 true WO2015085808A1 (zh) 2015-06-18

Family

ID=50169440

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/087301 WO2015085808A1 (zh) 2013-12-09 2014-09-24 移动终端自动切换不同通道联网接口的安全应用***

Country Status (2)

Country Link
CN (1) CN103618736A (zh)
WO (1) WO2015085808A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491790A (zh) * 2020-10-20 2021-03-12 国网河南省电力公司物资公司 一种基于内外网数据交互实时响应***
CN113891325A (zh) * 2021-09-17 2022-01-04 中标慧安信息技术股份有限公司 基于多接入边缘计算的网络切换方法和***
CN114268578A (zh) * 2021-12-16 2022-04-01 平安证券股份有限公司 切换线路的数据传输方法、装置、设备及存储介质

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103619020B (zh) * 2013-12-09 2017-02-08 成都达信通通讯设备有限公司 无线数据专网物理隔离互联网的移动支付安全***
CN103618736A (zh) * 2013-12-09 2014-03-05 成都达信通通讯设备有限公司 移动终端自动切换不同通道联网接口的安全应用***
CN104202343A (zh) 2014-09-26 2014-12-10 酷派软件技术（深圳）有限公司 数据传输方法、数据传输装置和数据传输***
CN105577632B (zh) * 2015-06-26 2018-08-24 宇龙计算机通信科技(深圳)有限公司 一种基于网络隔离的安全连网方法及终端
CN105471698A (zh) * 2015-12-23 2016-04-06 广东亿迅科技有限公司 基于vpdn接入内网的***及其方法
CN105550577A (zh) * 2015-12-31 2016-05-04 宇龙计算机通信科技(深圳)有限公司 一种终端容器安全的控制方法与***
CN107291741B (zh) * 2016-03-31 2021-05-11 创新先进技术有限公司 通信方法和装置
CN106792659A (zh) * 2016-12-06 2017-05-31 广东欧珀移动通信有限公司 一种移动终端的支付方法及装置
CN110351729B (zh) * 2019-07-15 2022-05-13 西安高新兴物联软件有限公司 一种自动匹配鉴权参数的方法、***、终端及存储介质
CN112243218B (zh) * 2019-07-19 2022-04-05 华为技术有限公司 一种数据业务的传输方法及电子设备
CN110708694A (zh) * 2019-10-15 2020-01-17 武汉诚迈科技有限公司 公专网同时在线的实现方法、***、存储介质及电子设备
CN112738809A (zh) * 2019-10-28 2021-04-30 成都鼎桥通信技术有限公司 移动数据连接的切换方法、装置、设备以及存储介质
CN113242262B (zh) * 2021-06-18 2022-04-19 滁州学院 一种基于物联网的网络信息安全***
CN114885115B (zh) * 2022-07-06 2022-11-22 杭州峰图信息技术有限责任公司 一种通信线路自动切换装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1578487A (zh) * 2003-07-28 2005-02-09 华为技术有限公司 一种移动终端接入分组网络的方法
CN1703925A (zh) * 2002-10-02 2005-11-30 皇家飞利浦电子股份有限公司 便携装置的智能连接管理
CN103220276A (zh) * 2013-03-29 2013-07-24 深圳创维数字技术股份有限公司 一种网络接入的方法、网关及***
CN103269326A (zh) * 2012-12-22 2013-08-28 潘铁军 一种面向泛在网的安全设备、多应用***和安全方法
CN103618736A (zh) * 2013-12-09 2014-03-05 成都达信通通讯设备有限公司 移动终端自动切换不同通道联网接口的安全应用***

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6885864B2 (en) * 1992-03-06 2005-04-26 Aircell, Inc. Virtual private network for cellular communications

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1703925A (zh) * 2002-10-02 2005-11-30 皇家飞利浦电子股份有限公司 便携装置的智能连接管理
CN1578487A (zh) * 2003-07-28 2005-02-09 华为技术有限公司 一种移动终端接入分组网络的方法
CN103269326A (zh) * 2012-12-22 2013-08-28 潘铁军 一种面向泛在网的安全设备、多应用***和安全方法
CN103220276A (zh) * 2013-03-29 2013-07-24 深圳创维数字技术股份有限公司 一种网络接入的方法、网关及***
CN103618736A (zh) * 2013-12-09 2014-03-05 成都达信通通讯设备有限公司 移动终端自动切换不同通道联网接口的安全应用***

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112491790A (zh) * 2020-10-20 2021-03-12 国网河南省电力公司物资公司 一种基于内外网数据交互实时响应***
CN113891325A (zh) * 2021-09-17 2022-01-04 中标慧安信息技术股份有限公司 基于多接入边缘计算的网络切换方法和***
CN113891325B (zh) * 2021-09-17 2022-07-22 中标慧安信息技术股份有限公司 基于多接入边缘计算的网络切换方法和***
CN114268578A (zh) * 2021-12-16 2022-04-01 平安证券股份有限公司 切换线路的数据传输方法、装置、设备及存储介质
CN114268578B (zh) * 2021-12-16 2024-04-02 平安证券股份有限公司 切换线路的数据传输方法、装置、设备及存储介质

Also Published As

Publication number Publication date
CN103618736A (zh) 2014-03-05

Similar Documents

Publication Publication Date Title
WO2015085808A1 (zh) 移动终端自动切换不同通道联网接口的安全应用***
US10356619B2 (en) Access through non-3GPP access networks
WO2015085809A1 (zh) 无线数据专网物理隔离互联网的移动支付安全***
WO2015176445A1 (zh) 移动终端预设联网地址防火墙隔离应用***
TWI386100B (zh) 通訊裝置以及處理通訊裝置內裝置呼入通訊請求之方法
WO2018014539A1 (zh) 一种信息传输方法、融合网关及***
CN101192920B (zh) 一种应答请求的方法和设备
US10681143B2 (en) Establishment of a secure connection for a communication session
WO2017167153A1 (zh) 移动通讯***及寻呼方法
CN104735027A (zh) 一种安全认证方法及鉴权认证服务器
CN108123783A (zh) 数据传输方法、装置及***
WO2015135314A1 (zh) 针对移动终端不同联网通道的防火墙联网***
WO2009000171A1 (fr) Procede et systeme de transfert de numero d'urgence, serveur et terminal utilisateur associes
CN104506406B (zh) 一种鉴权认证设备
WO2024001086A1 (zh) 一种基于共享密钥进行数据通信的方法、装置、设备和介质
Zheng et al. Ghost telephonist impersonates you: Vulnerability in 4G LTE CS fallback
US20220311810A1 (en) Public Land Mobile Network Support for a Stand-alone Non-Public Access Network
WO2012089030A1 (zh) 一种多种接入方式接入网络的方法、接入设备和认证设备
EP3454583B1 (en) Network connection method, and secure node determination method and device
WO2004023735A1 (fr) Procede associe a un service intelligent de soutien de gprs
TW202103480A (zh) 邊緣運算網路服務提供方法
US11968530B2 (en) Network authentication for user equipment access to an edge data network
US20240129730A1 (en) Authentication Indication for Edge Data Network Relocation
WO2024140580A1 (zh) 通信的方法、装置、通信设备及存储介质
Yoon et al. A design of authentication architecture for service safety in heterogeneous network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14869154

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 05.12.2016)

122 Ep: pct application non-entry in european phase

Ref document number: 14869154

Country of ref document: EP

Kind code of ref document: A1