WO2016101267A1 - 用户设备的非可信无线局域网接入控制方法、设备和*** - Google Patents

用户设备的非可信无线局域网接入控制方法、设备和*** Download PDF

Info

Publication number
WO2016101267A1
WO2016101267A1 PCT/CN2014/095142 CN2014095142W WO2016101267A1 WO 2016101267 A1 WO2016101267 A1 WO 2016101267A1 CN 2014095142 W CN2014095142 W CN 2014095142W WO 2016101267 A1 WO2016101267 A1 WO 2016101267A1
Authority
WO
WIPO (PCT)
Prior art keywords
epdg
wlan
roaming information
local
address
Prior art date
Application number
PCT/CN2014/095142
Other languages
English (en)
French (fr)
Inventor
孙晓姬
陈松会
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2014/095142 priority Critical patent/WO2016101267A1/zh
Priority to CN201480034276.XA priority patent/CN105934918B/zh
Publication of WO2016101267A1 publication Critical patent/WO2016101267A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a non-trusted wireless local area network (English: Wireless Local Area Networks, WLAN) access control method and device for a user equipment (English: User Equipment, UE for short) system.
  • a non-trusted wireless local area network English: Wireless Local Area Networks, WLAN
  • UE User Equipment
  • the 3rd Generation Partnership Project (English: The 3rd Generation Partnership Project, 3GPP) standard defines an architecture involved in the WLAN access architecture, and one is a network deployment based on S2a interface trusted access. The network deployment is based on the S2b interface for non-trusted access.
  • the telecom operator Under the WLAN of the non-trusted access based on the S2b interface, the telecom operator deploys an evolved packet data gateway (English: evolved Packet Data Gateway, referred to as ePDG) And Authentication, Authorization and Accounting (AAA) server, upgrade the home network subscriber network server (English: Home Subscriber Server, HSS for short), packet data gateway (English: Packet Data)
  • ePDG evolved Packet Data Gateway
  • AAA Authentication, Authorization and Accounting
  • PGW Packet Data Gateway
  • MME Mobility Management Entity
  • the UE accesses the WLAN in the roaming scenario, and the WLAN is a non-trusted access network based on the S2b interface, the UE only supports the ePDG of the home location, and the AAA/HSS cannot obtain the location information of the UE, and thus the network side cannot The access of the UE is controlled.
  • the embodiments of the present invention provide a method, a device, and a system for controlling a non-trusted WLAN access of a UE, so that the network side can control the non-trusted WLAN access of the roaming UE.
  • an embodiment of the present invention provides a method for controlling a non-trusted WLAN access of a UE, where the WLAN is a visited WLAN of the UE, and the ePDG receives an Internet protocol security sent by the UE (English: Internet Protocol Security) , referred to as IPSec) tunnel establishment request, the IPSec tunnel establishment request includes a local IP address of the UE, and the WLAN is the UE
  • IPSec Internet Protocol Security
  • the IPSec tunnel establishment request includes a local IP address of the UE
  • the WLAN is the UE
  • the visited WLAN the ePDG is the home ePDG of the UE; the ePDG acquires the roaming information of the UE according to the local IP address of the UE; the ePDG sends the roaming information of the UE to the AAA server
  • the ePDG receives a decision result that the UE is sent by the AAA server to access the ePDG, and the UE determines that the UE accesses the
  • the ePDG acquires the roaming information of the UE according to the local IP address of the UE, including: the ePDG is based on a local IP address of the UE, and The correspondence between the local IP address and the roaming information is obtained, and the roaming information of the UE is obtained.
  • the roaming information of the UE includes an identifier of the PLMN accessed by the UE, At least one of an identifier of a region in which the UE is located, and an identifier of the WLAN.
  • an embodiment of the present invention provides a method for controlling a non-trusted WLAN access of a UE, where the WLAN is a visited WLAN of the UE, and the AAA server acquires roaming information of the UE; the AAA server Sending the roaming information of the UE to the HSS, so that the HSS obtains a determination result that the UE accesses the ePDG according to the roaming information of the UE, where the ePDG is the home ePDG of the UE; the AAA server receives a determination result that the UE sent by the HSS accesses the ePDG; the AAA server sends a decision result that the UE accesses the ePDG to the ePDG; wherein the UE accesses the ePDG The result is that the UE is allowed to access the ePDG or the UE is prohibited from accessing the ePDG.
  • the AAA server acquires the roaming information of the UE, where the AAA server receives the roaming information of the UE sent by the ePDG; or the AAA The server receives the local IP address of the UE sent by the ePDG, and acquires roaming information of the UE according to the local IP address of the UE.
  • the AAA server acquires the roaming information of the UE, where the AAA server receives the roaming information of the UE sent by the access device of the WLAN; or The AAA server receives the local IP address of the UE sent by the access device of the WLAN, and acquires the roaming information of the UE according to the local IP address of the UE.
  • the AAA server is configured according to the local IP address of the UE And obtaining, by the AAA server, the roaming information of the UE according to the local IP address of the UE and the correspondence between the local IP address and the roaming information.
  • the roaming information of the UE includes: At least one of an identifier of a PLMN accessed by the UE, an identifier of a region in which the UE is located, and an identifier of the WLAN.
  • an embodiment of the present invention provides a method for controlling a non-trusted WLAN access of a UE, where the WLAN is a visited WLAN of the UE, and the method includes: the HSS acquires roaming information of the UE; Obtaining, by the UE, the subscription data of the UE and the roaming information of the UE, the decision result of the UE accessing the evolved packet data gateway ePDG, where the ePDG is the visited ePDG of the UE, and the UE accesses the The result of the decision of the ePDG is that the UE is allowed to access the ePDG or the UE is prohibited from accessing the ePDG; the HSS sends a decision result of the UE accessing the ePDG to the AAA server, so that the AAA server The decision result of the UE accessing the ePDG is forwarded to the ePDG, so that the ePDG controls the non-trusted WLAN access of the UE according to the decision result of the a
  • the acquiring, by the HSS, the roaming information of the UE includes: the HSS receiving, by the AAA server, the roaming information of the UE, or the HSS receiving station
  • the local IP address of the UE sent by the AAA server is obtained, and the roaming information of the UE is obtained according to the local IP address of the UE.
  • the HSS acquires the roaming information of the UE according to the local IP address of the UE, including: The HSS acquires the roaming information of the UE according to the local IP address of the UE and the corresponding relationship between the local IP address of the UE and the roaming information.
  • the roaming information of the UE includes And at least one of an identifier of the PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • an embodiment of the present invention provides a method for controlling a non-trusted WLAN access of a UE, where the WLAN is a visited WLAN of the UE, including:
  • the access device of the WLAN allocates a local internet protocol IP address to the UE; and the access device of the WLAN sends the local IP of the UE to the authentication and authorization charging AAA server. address. or,
  • the access device of the WLAN acquires the roaming information of the UE; and the access device of the WLAN sends the roaming information of the UE to the authentication and authorization charging AAA server.
  • the roaming information of the UE includes: an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN. at least one.
  • an embodiment of the present invention provides an ePDG, including: a receiving unit, configured to receive an IPSec tunnel establishment request sent by a UE, where the IPSec tunnel establishment request includes a local IP address of the UE, and the WLAN is the a visited WLAN of the UE, the ePDG is a home ePDG of the UE, a processing unit, configured to acquire roaming information of the UE according to a local IP address of the UE, and a sending unit, configured to send, to the AAA server,
  • the receiving unit is further configured to receive a determination result that the UE sends the ePDG, where the UE accesses the ePDG, and the UE determines that the UE is connected to the ePDG.
  • the processing unit is further configured to control the non-trusted WLAN access of the UE according to a determination result that the UE accesses the ePDG, by using the ePDG or the UE to access the ePDG.
  • the processing unit is configured to acquire the roaming information of the UE according to the local IP address of the UE, where the processing unit is configured to use, according to the UE, The local IP address, and the correspondence between the local IP address and the roaming information, acquires roaming information of the UE.
  • the roaming information of the UE includes an identifier of the PLMN accessed by the UE, At least one of an identifier of a region in which the UE is located, and an identifier of the WLAN.
  • an embodiment of the present invention provides an AAA server, including: a processing unit, configured to acquire roaming information of the UE, and a sending unit, configured to send roaming information of the UE to an HSS, so that the HSS is configured according to the The roaming information of the UE acquires a determination result that the UE accesses the ePDG,
  • the ePDG is a home ePDG of the UE
  • the receiving unit is configured to receive a determination result that the UE sent by the HSS accesses the ePDG
  • the sending unit is further configured to send the The result of the UE accessing the ePDG is determined, wherein the UE accessing the ePDG determines that the UE is allowed to access the ePDG or the UE is prohibited from accessing the ePDG.
  • the processing unit is configured to acquire the roaming information of the UE, where the processing unit is configured to receive roaming information of the UE that is sent by the ePDG; Or the processing unit is configured to receive, by the ePDG, the local IP address of the UE, and obtain the roaming information of the UE according to the local IP address of the UE.
  • the processing unit is configured to acquire the roaming information of the UE, where the processing unit is configured to receive the UE sent by an access device of the WLAN.
  • the processing unit is configured to receive a local IP address of the UE sent by the access device of the WLAN, and acquire roaming information of the UE according to the local IP address of the UE.
  • the processing unit is used according to the UE And obtaining, by the local IP address, the roaming information of the UE, where the processing unit is configured to acquire the roaming information of the UE according to the local IP address of the UE, and the corresponding relationship between the local IP address and the roaming information.
  • the roaming information of the UE includes: At least one of an identifier of a PLMN accessed by the UE, an identifier of a region in which the UE is located, and an identifier of the WLAN.
  • an embodiment of the present invention provides an HSS, including: a processing unit, configured to acquire roaming information of the UE; and acquire, according to subscription data of a user that uses the UE, and roaming information of the UE.
  • a processing unit configured to acquire roaming information of the UE; and acquire, according to subscription data of a user that uses the UE, and roaming information of the UE.
  • a result of the UE accessing the ePDG where the ePDG is the visited ePDG of the UE, and the UE accessing the ePDG determines that the UE is allowed to access the ePDG or the UE is prohibited from accessing the a sending unit, configured to send, to the AAA server, a determination result that the UE accesses the ePDG, so that the AAA server forwards the determination result that the UE accesses the ePDG to the ePDG, so that the The ePDG controls the non-trusted WLAN access of the UE according to the decision result of
  • the processing unit is configured to acquire the roaming information of the UE, where the processing unit is configured to receive, by the AAA server, the roaming information of the UE, Or the processing unit is configured to receive a local IP address of the UE sent by the AAA server, and acquire roaming information of the UE according to the local IP address of the UE.
  • the processing unit is configured to acquire roaming information of the UE according to a local IP address of the UE, The processing unit is configured to acquire the roaming information of the UE according to the local IP address of the UE and the correspondence between the local IP address of the UE and the roaming information.
  • the roaming information of the UE includes And at least one of an identifier of the PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • an embodiment of the present invention provides a WLAN access device, including: a processing unit and a sending unit.
  • the processing unit is configured to allocate a local internet protocol IP address to the UE when the user equipment UE accesses the WLAN, where the WLAN is a visited WLAN of the UE, and a sending unit, configured to authenticate the authorization
  • the fee AAA server sends the local IP address of the UE.
  • the processing unit is configured to acquire, when the user equipment UE accesses the WLAN, the roaming information of the UE, where the WLAN is a visited WLAN of the UE, and the sending unit is configured to charge the authentication and authorization
  • the AAA server sends the roaming information of the UE.
  • the roaming information of the UE includes: an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN. at least one.
  • the embodiment of the present invention provides a non-trusted WLAN access control system for a UE, including: the UE, the fifth aspect of the present invention, or the ePDG provided by various possible implementation manners of the fifth aspect of the present invention, and the present invention
  • the sixth aspect or the AAA server provided by the various possible implementation manners of the sixth aspect of the present invention, the seventh aspect of the present invention or the various possible implementation manners of the seventh aspect of the present invention; the eighth aspect or the present invention
  • the first possible implementation manner of the eighth aspect of the invention provides the access device of the WLAN.
  • a non-trusted WLAN access control method, device, and system for a UE Receiving, by the ePDG, an IPSec tunnel establishment request that is sent by the UE, including the local IP address of the UE, acquiring the roaming information of the UE according to the IP address of the UE, and then sending the roaming information of the UE to the AAA server, and then receiving the AAA server to send
  • the UE accesses the decision result of the ePDG, and controls the untrusted WLAN access of the UE according to the decision result of the UE accessing the ePDG. Therefore, when the UE roams to the untrusted WLAN, the AAA server/HSS can obtain the roaming information of the UE, thereby implementing control of the access of the home ePDG to the UE.
  • FIG. 1 is a network architecture diagram of a UE accessing a non-trusted WLAN according to the present invention
  • Embodiment 2 is a flowchart of Embodiment 1 of a method for controlling a non-trusted WLAN access of a UE according to the present invention
  • Embodiment 3 is a flowchart of Embodiment 2 of a method for controlling a non-trusted WLAN access of a UE according to the present invention
  • Embodiment 4 is a flowchart of Embodiment 3 of a method for controlling a non-trusted WLAN access of a UE according to the present invention
  • FIG. 5 is a schematic structural diagram of Embodiment 1 of an ePDG according to the present invention.
  • Embodiment 1 of an AAA server according to the present invention is a schematic structural diagram of Embodiment 1 of an AAA server according to the present invention.
  • FIG. 7 is a schematic structural view of Embodiment 1 of the HSS of the present invention.
  • Embodiment 8 is a schematic structural diagram of Embodiment 2 of an ePDG according to the present invention.
  • Embodiment 9 is a schematic structural diagram of Embodiment 2 of an AAA server according to the present invention.
  • Figure 10 is a schematic structural view of Embodiment 2 of the HSS of the present invention.
  • Embodiment 1 is a schematic structural diagram of Embodiment 1 of an access device for a WLAN according to the present invention.
  • FIG. 12 is a schematic structural diagram of Embodiment 2 of an access device of a WLAN according to the present invention.
  • FIG. 13 is a schematic structural diagram of an embodiment of a non-trusted WLAN access control system of a UE according to the present invention.
  • FIG. 1 is a network architecture diagram of a UE accessing a non-trusted WLAN according to the present invention.
  • the roaming of the UE may include roaming between operators or international roaming of the UE.
  • the inter-operator roaming between the UEs means, for example, that the user using the UE belongs to the mobile operator, and the UE roams to the Unicom carrier or the telecommunication operator, and the UE roaming, for example, refers to use.
  • the user of the UE belongs to China, and the UE roams to other countries except China, such as the United States; the inter-provincial roaming of the UE, for example, indicates that the user who uses the UE belongs to Hunan province, and the UE roams to other than Hunan province.
  • a city-to-city roaming, for example, means that a user who uses the UE, for example, belongs to Beijing, and the UE roams to other cities than Beijing, such as Shanghai.
  • the UE accesses the non-trusted WLAN of the visited public land mobile network (English: Visit Public Land Mobile Network, VPLMN for short).
  • VPLMN Visit Public Land Mobile Network
  • Mobile network (English: Home Public Land Mobile Network, HPLMN), which includes: ePDG, AAA server, HSS, Policy and Charging Rules Function (PCRF) entity, Internet Protocol Multimedia Subsystem (English: Internet Protocol Multimedia Subsystem, IMS for short), wherein the communication interface between each network device is as shown in FIG. 1 .
  • HPLMN Home Public Land Mobile Network
  • PCRF Policy and Charging Rules Function
  • IMS Internet Protocol Multimedia Subsystem
  • the UE performs authentication and authorization with the access device of the WLAN to obtain the local (English) local IP address of the UE, and the local IP address of the UE is used for
  • the home ePDG of the UE establishes an IPSec tunnel.
  • the UE performs the EAP-AKA authentication with the ePDG to perform the EAP-AKA authentication, and establishes an IPSec tunnel with the ePDG.
  • the process of establishing an IPSec tunnel between the UE and the ePDG may be that the UE sends an IPSec tunnel to the ePDG.
  • the ePDG performs authentication and authorization with the AAA server/HSS, that is, the ePDG sends a first authentication authorization request to the AAA server, and the AAA server sends a second authentication authorization request to the HSS according to the first authentication authorization request, and the HSS is configured according to the
  • the second authentication authorization request sends a second authentication authorization response to the AAA server
  • the AAA server sends a first authentication authorization response to the ePDG according to the second authentication authorization response, so that the ePDG and the AAA server/HSS complete the authentication and authorization process of the UE.
  • the ePDG then sends an IPSec tunnel establishment response to the UE according to the first authentication authorization response, so that the UE completes the IPSec tunnel establishment process with the ePDG.
  • the WLAN access device may also perform WLAN authentication and authorization with the AAA server/HSS. Specifically, the WLAN access device sends a third authentication authorization request to the AAA server, and the AAA service sends the third authentication request to the HSS according to the third authentication authorization request.
  • the fourth authentication authorization request is sent by the HSS to the AAA server according to the fourth authentication authorization request, and the AAA server sends a third authentication authorization response to the access device of the WLAN according to the fourth authentication authorization response, thereby The WLAN access device and the AAA server/HSS complete the authentication and authorization process of the WLAN.
  • the first authentication authorization request may be an extended authentication protocol (English: Diameter-Extended Authentication Protocol-Request, DER for short), and the first authentication authorization response may be an extended authentication protocol response (English: Diameter-Extended Authentication Protocol-Answer) , the abbreviation: DEA);
  • the second authentication authorization request, the fourth authentication authorization request may be a multimedia authentication request (English: Multimedia-Authentication-Request, referred to as: MAR), the second authentication authorization response, the fourth authentication authorization response may be multimedia Authentication response (English: Multimedia-Authentication-Answer, abbreviation: MAA);
  • the third authentication authorization request may be an authentication and authorization request (AAR), and the third authentication authorization response may be an authentication authorization response ( English: Authentication and Authorization Answer, referred to as AAA).
  • the embodiments of the present invention provide the following embodiments to implement non-trusted WLAN access control of the UE.
  • Embodiment 1 is a flowchart of Embodiment 1 of a non-trusted WLAN access control method of a UE according to the present invention.
  • the WLAN is a visited WLAN of the UE.
  • the method in this embodiment may include:
  • the ePDG receives an internet protocol security (English: Internet Protocol Security, IPSec) tunnel establishment request sent by the UE, where the IPSec tunnel establishment request includes a local IP address of the UE, and the ePDG is a home location of the UE. ePDG.
  • IPSec Internet Protocol Security
  • the ePDG acquires roaming information of the UE according to the local IP address of the UE.
  • the ePDG sends the roaming information of the UE to an AAA server.
  • the ePDG receives a determination result that the UE sends the ePDG, and the UE determines that the UE accesses the ePDG to allow the UE to access the ePDG or prohibit the UE. Access to the ePDG.
  • the ePDG controls the non-trusted WLAN access of the UE according to a determination result that the UE accesses the ePDG.
  • the UE accesses the WLAN, the WLAN is an untrusted WLAN, and after the WLAN and the AAA/HSS complete the WLAN authentication and authorization, the UE sends an IPSec tunnel establishment request to the ePDG of the home location of the UE, and the IPSec tunnel
  • the establishment request includes the local IP address of the UE.
  • the ePDG After the ePDG receives the IPSec tunnel establishment request sent by the UE, the ePDG authenticates and authorizes the UE accessing the non-trusted WLAN to the AAA/HSS, and then the ePDG includes the IPSec tunnel establishment request.
  • the local IP address of the UE acquires the roaming information of the UE, and then the ePDG sends the roaming information of the UE to the AAA server.
  • the ePDG carries the roaming information of the UE in the first authentication and authorization request and sends the information to the AAA server.
  • the first authentication authorization request is used to request the UE to access the ePDG for authentication and authorization, and the first authentication authorization request may be DER.
  • the AAA server receives the roaming information of the UE sent by the ePDG, and forwards the roaming information of the UE to the HSS, for example, if the AAA server receives the first authentication authorization that is sent by the ePDG and includes the roaming information of the UE. Requesting, obtaining the roaming information of the UE from the first authentication authorization request, and then the AAA server carries the roaming information of the UE in the second authentication authorization request and sends the information to the HSS according to the first authentication authorization request, where the second authentication is performed.
  • the authorization request is used to request authentication authorization for the UE to access the ePDG.
  • the HSS receives the roaming information of the UE sent by the AAA server, for example, if the HSS receives the second authentication authorization request that is sent by the AAA server and includes the roaming information of the UE, the HSS obtains the second authentication authorization request from the second authentication authorization request.
  • the roaming information of the UE the HSS obtains the decision result of the UE accessing the ePDG according to the roaming information of the UE and the subscription data of the user using the UE, and the UE may access the ePDG by allowing the UE to access the UE.
  • the ePDG either prohibits the UE from accessing the ePDG, and the HSS sends the decision result of the UE accessing the ePDG to the AAA server.
  • the HSS may carry the ePDG decision result in the second authentication authorization response and send the AAA server.
  • the AAA server receives the decision result of the UE accessing the ePDG sent by the HSS, and sends the decision result of the UE accessing the ePDG to the ePDG.
  • the AAA server may carry the decision result of the UE accessing the ePDG.
  • the ePDG is sent to the ePDG from the first authentication and authorization response, and the ePDG obtains the judgment result that the UE accesses the ePDG.
  • the ePDG may control the non-trusted WLAN access of the UE according to the judgment result that the UE accesses the ePDG. Specifically, for example, when the UE accesses the ePDG, the UE determines that the UE is allowed to access the ePDG. The ePDG establishes an IPSec tunnel with the UE. When the UE accesses the ePDG, the UE refuses to access the ePDG, and the ePDG refuses to establish an IPSec tunnel with the UE.
  • the untrusted WLAN access control method of the UE receives an IPSec tunnel establishment request that is sent by the UE, including the local IP address of the UE, by the ePDG, and acquires the roaming information of the UE according to the local IP address of the UE. And then sending the roaming information of the UE to the AAA server, receiving the decision result of the UE accessing the ePDG sent by the AAA server, and the non-trusted WLAN to the UE according to the judgment result of the UE accessing the ePDG Access is controlled. Therefore, when the UE roams to the untrusted WLAN, the AAA server/HSS can obtain the roaming information of the UE, thereby implementing control of the access of the home ePDG to the UE.
  • the ePDG in the foregoing S102 acquires the roaming information of the UE according to the local IP address of the UE, including: the ePDG is based on the local IP address of the UE, and the local IP address and roaming Corresponding relationship of the information, acquiring roaming information of the UE.
  • the corresponding relationship between the local IP address and the roaming information is stored in the ePDG, and the ePDG can obtain the correspondence between the local IP address and the roaming information of the UE according to the local IP address of the UE, and acquire the correspondence relationship with the UE.
  • the roaming information corresponding to the local IP address, and the roaming information corresponding to the local IP address of the UE is used as the roaming information of the UE.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the identifier of the PLMN accessed by the UE indicates the identity of the PLMN that the UE accesses at the visited location. For example, if the user of the UE belongs to the user of the China Mobile, the identifier of the PLMN accessed by the UE may be the identifier of the China Mobile or China.
  • the identifier of the area where the UE is located indicates the identifier of the area of the UE in the visited area.
  • the identifier of the area where the UE is located may be the identifier of Shanghai.
  • the identifier of the WLAN is the service set identifier (English: Service Set Identifier, SSID) of the WLAN.
  • FIG. 3 is a flowchart of a second embodiment of a non-trusted WLAN access control method of a UE according to the present invention.
  • the WLAN is a visited WLAN of the UE.
  • the method in this embodiment may include:
  • the AAA server acquires roaming information of the UE.
  • the AAA server sends the roaming information of the UE to the HSS, so that the HSS obtains a determination result that the UE accesses the ePDG according to the roaming information of the UE, where the ePDG is the home ePDG of the UE. .
  • the AAA server receives the judgment that the UE sends the ePDG sent by the HSS. The result.
  • the AAA server sends, to the ePDG, a determination result that the UE accesses the ePDG.
  • the AAA server obtains the roaming information of the UE, and then the AAA server sends the roaming information of the UE to the HSS.
  • the HSS may be based on the UE.
  • the HSS can control the access of the UE, where the UE accesses the ePDG.
  • the result of the decision is that the UE is allowed to access the ePDG or the UE is prohibited from accessing the ePDG, and the HSS sends a decision result of the UE accessing the ePDG to the AAA server, and the AAA server can also implement the UE.
  • the access control is performed.
  • the AAA server receives the decision result of the UE accessing the ePDG
  • the AAA server forwards the decision result of the UE accessing the ePDG to the ePDG.
  • the untrusted WLAN access control method of the UE obtains the roaming information of the UE by using the AAA server, and sends the roaming information of the UE to the HSS, so that the HSS obtains the UE according to the roaming information of the UE.
  • the AAA server Entering a decision result of the home ePDG of the UE, and then the AAA server receives a decision result of the UE accessing the ePDG sent by the HSS, and sends a decision result of the UE accessing the ePDG to the ePDG. Therefore, when the UE roams to the untrusted WLAN, the AAA server/HSS can obtain the roaming information of the UE, thereby implementing control of the access of the home ePDG to the UE.
  • the AAA server receives the roaming information of the UE that is sent by the ePDG, for example, the AAA server may receive the first authentication that is sent by the ePDG, including the roaming information of the UE.
  • An authorization request the first authentication authorization request is used to request the UE to access the ePDG for authentication and authorization; and then the AAA server sends the roaming information of the UE to the HSS, for example, the AAA server may carry the roaming information of the UE.
  • the second authentication request is sent to the HSS, and the HSS obtains the judgment result of the UE accessing the ePDG according to the roaming information of the UE and the subscription data of the UE.
  • the AAA server receives the UE that is sent by the HSS and accesses the ePDG. a result of the decision, for example, the AAA server may receive a second authentication authorization response sent by the HSS including the roaming information of the UE; the AAA server sends the ePDG to the ePDG Sending the result of the UE accessing the ePDG, for example, the AAA server may carry the decision result of the UE accessing the ePDG to be sent to the ePDG in the first authentication authorization response.
  • the AAA server receives the local IP address of the UE sent by the ePDG, for example, the AAA server may receive the local IP address that is sent by the ePDG, including the UE.
  • An authentication authorization request the first authentication authorization request is sent by the ePDG according to an IPSec tunnel establishment request sent by the UE, where the first authentication authorization request is used to request the UE to access the ePDG for authentication and authorization; and then the AAA server is configured according to The local IP address of the UE acquires the roaming information of the UE, and then sends the roaming information of the UE to the HSS.
  • the AAA server may send the roaming information of the UE to the HSS, and the HSS sends the roaming information to the HSS.
  • the AAA server receives the determination result that the UE sends the ePDG, and the AAA server can receive the judgment result of the UE accessing the ePDG, for example, the AAA server can receive the roaming information of the UE and the subscription data of the user using the UE.
  • the AAA server sends, to the ePDG, a determination result that the UE accesses the ePDG, for example, the AAA service
  • the UE may access the decision result is sent to the ePDG carries the ePDG first authentication authorization response.
  • the AAA server receives the local IP address of the UE that is sent by the ePDG, for example, the AAA server may receive the local IP address that is sent by the ePDG, including the UE.
  • An authentication authorization request is sent by the ePDG according to an IPSec tunnel establishment request sent by the UE, where the first authentication authorization request is used to request the UE to access the ePDG for authentication and authorization; and then the AAA server re- Sending the local IP address of the UE to the HSS, for example, the AAA server may send the local IP address of the UE to the HSS, and the HSS obtains the roaming information of the UE according to the local IP address of the UE.
  • the HSS obtains a determination result that the UE accesses the ePDG according to the roaming information of the UE and the subscription data of the user that uses the UE;
  • the AAA server receives a determination result that the UE sends the ePDG sent by the HSS, for example:
  • the AAA server may receive a second authentication authorization response that is sent by the HSS, including the roaming information of the UE, and the AAA server sends, to the ePDG, a determination result that the UE accesses the ePDG, for example, :
  • the AAA server of the UE may access the decision result is sent to the ePDG carries the ePDG first authentication authorization response.
  • the AAA server receives the roaming information of the UE sent by the access device of the WLAN, for example, the access device in the WLAN.
  • the AAA server may receive a third authentication authorization request that is sent by the access device of the WLAN, including the roaming information of the UE, where the third authentication authorization request is used to request the WLAN.
  • the AAA server sends the roaming information of the UE to the HSS.
  • the AAA server may send the roaming information of the UE to the HSS, where the fourth authentication authorization request is used to request the pair.
  • the WLAN performs the authentication and authorization; after the WLAN access device and the AAA server/HSS complete the authentication and authorization of the WLAN, the AAA server receives the first authentication authorization request sent by the ePDG, and the first authentication authorization request is used to request the pair.
  • the UE accesses the ePDG for authentication and authorization, and the AAA server sends a second authentication authorization request to the HSS according to the first authentication authorization request, where the second authentication authorization request is used to request the UE to access the ePDG for authentication and authorization; After the HSS receives the second authentication authorization sent by the AAA server, the HSS sends the subscription data to the AAA server according to the subscription data of the user using the UE.
  • the roaming information of the UE is obtained, and the AAA server receives the decision result that the UE sends the ePDG to the ePDG, for example, the AAA server may receive the UE that is sent by the HSS and includes the UE. a second authentication authorization response of the roaming information; the AAA server sends a decision result of the UE accessing the ePDG to the ePDG, for example, the AAA server may carry the judgment result of the UE accessing the ePDG in the first authentication authorization response. Sent to the ePDG.
  • the AAA server receives the local IP address of the UE sent by the access device of the WLAN, for example, the WLAN access device and the AAA server/HSS perform WLAN.
  • the AAA server may receive a third authentication authorization request that is sent by the access device of the WLAN, including the local IP address of the UE, where the third authentication authorization request is used to request authentication and authorization for the WLAN;
  • the AAA server obtains the roaming information of the UE according to the local IP address of the UE, and then sends the roaming information of the UE to the HSS.
  • the AAA server may send the roaming information of the UE to the HSS carrying the fourth authentication authorization request, where the AAA server sends the roaming information to the HSS.
  • the fourth authentication authorization request is used to request authentication and authorization for the WLAN; after the access device of the WLAN and the AAA server/HSS complete the authentication and authorization of the WLAN, the AAA server receives the first authentication authorization request sent by the ePDG, where The first authentication authorization request is used to request authentication authorization for accessing the ePDG by the UE, and the AAA server sends a second identity to the HSS according to the first authentication authorization request.
  • the HSS receives the AAA server After the second authentication and authorization sent by the server, the HSS obtains the judgment result of the UE accessing the ePDG according to the subscription data of the user using the UE and the roaming information of the UE sent by the AAA server; the AAA server receives the a result of the UE transmitting the ePDG sent by the HSS, for example, the AAA server may receive a second authentication authorization response that is sent by the HSS and includes the roaming information of the UE; the AAA server sends the UE access to the ePDG
  • the decision result of the ePDG for example, the AAA server may carry the decision result of the UE accessing the ePDG to be sent to the ePDG in the first authentication authorization response.
  • the AAA server receives the local IP address of the UE sent by the access device of the WLAN, for example, the WLAN access device and the AAA server/HSS perform WLAN.
  • the AAA server may receive a third authentication authorization request that is sent by the access device of the WLAN, including the local IP address of the UE, where the third authentication authorization request is used to request authentication and authorization for the WLAN;
  • the AAA server sends the local IP address of the UE to the HSS.
  • the AAA server may send the local IP address of the UE to the HSS, where the fourth authentication authorization request is used to request the WLAN.
  • the authentication authorization the HSS may obtain the roaming information of the UE according to the local IP address of the UE; after the access device of the WLAN and the AAA server/HSS complete the authentication and authorization of the WLAN, the AAA server receives the first sent by the ePDG.
  • An authentication authorization request the first authentication authorization request is used to request authentication authorization for accessing the ePDG by the UE, and the AAA server requests the HSS according to the first authentication authorization request.
  • the second authentication authorization request is used to request the UE to access the ePDG for authentication and authorization; after the HSS receives the second authentication authorization sent by the AAA server, the HSS is further used according to the UE And the AAA server receives the determination result that the UE accesses the ePDG, for example, the AAA server receives the decision result of the UE accessing the ePDG.
  • the AAA server may receive a second authentication authorization response that is sent by the HSS and includes the roaming information of the UE.
  • the AAA server sends a decision result of the UE accessing the ePDG to the ePDG, for example, the AAA server may access the UE.
  • the decision result of the ePDG is carried in the first authentication and authorization response and sent to the ePDG.
  • the AAA server acquires the roaming information of the UE according to the local IP address of the UE, where the AAA server obtains according to the local IP address of the UE and the correspondence between the local IP address and the roaming information.
  • the roaming information of the UE Specifically, the AAA The server stores the mapping between the local IP address and the roaming information, and the AAA server obtains the mapping between the local IP address and the roaming information of the UE according to the local IP address of the UE, and obtains a corresponding local IP address of the UE.
  • Roaming information, the roaming information corresponding to the local IP address of the UE is used as the roaming information of the UE.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • Embodiment 3 is a flowchart of Embodiment 3 of a non-trusted WLAN access control method of a UE according to the present invention.
  • the WLAN is a visited WLAN of the UE.
  • the method in this embodiment may include:
  • the HSS acquires roaming information of the UE.
  • the HSS obtains a determination result that the UE accesses the ePDG according to the subscription data of the user that uses the UE and the roaming information of the UE, where the ePDG is the visited ePDG of the UE.
  • the HSS sends, to the AAA server, a determination result that the UE accesses the ePDG.
  • the HSS obtains the roaming information of the UE, and then the HSS obtains the judgment result of the UE accessing the home ePDG according to the subscription data of the user using the UE and the roaming information of the UE, where the UE accesses the
  • the acknowledgment result of the ePDG is that the UE is allowed to access the ePDG or the UE is prohibited from accessing the ePDG
  • the HSS sends the obtained judgment result of the UE accessing the ePDG to the AAA server, and the AAA server receives the UE sent by the HSS.
  • the AAA server After the decision result of the ePDG is accessed, the AAA server sends the decision result of the UE accessing the ePDG to the ePDG, and the ePDG is processed according to the decision result of the UE accessing the ePDG.
  • the relevant records in the article are not described here.
  • the untrusted WLAN access control method of the UE acquires the roaming information of the UE by using the HSS, and obtains the UE accessing the ePDG according to the subscription data of the user using the UE and the roaming information of the UE.
  • the ePDG is the visited ePDG of the UE; and the decision result of the UE accessing the ePDG is sent to the AAA server. Therefore, when the UE roams to the untrusted WLAN, the AAA server/HSS can obtain the roaming information of the UE, thereby implementing control of the access of the home ePDG to the UE.
  • the HSS obtains the roaming information of the UE, where the HSS receives the roaming information of the UE sent by the AAA server, or the HSS receives the local IP address of the UE sent by the AAA server, and according to the UE The local IP address is used to obtain roaming information of the UE.
  • the HSS receives the roaming information of the UE sent by the AAA server, for example, the HSS receives the second authentication authorization request that is sent by the AAA server and includes the roaming information of the UE.
  • the second authentication authorization request is used to request authentication authorization for accessing the ePDG by the UE, where the second authentication authorization request is sent by the AAA server according to the first authentication authorization request sent by the ePDG; and then the HSS is roamed according to the UE.
  • the information and the subscription data of the user using the UE are obtained, and the judgment result of the UE accessing the ePDG is obtained, and the result of the UE accessing the ePDG is sent to the AAA server, for example, the HSS accesses the ePDG to the ePDG.
  • the acknowledgment result is sent to the AAA server in the second authentication and authorization response; the AAA server sends the decision result of the UE accessing the ePDG to the ePDG, for example, the AAA server connects the UE to the ePDG.
  • the bearer is sent to the ePDG in the first authentication authorization response.
  • the HSS receives the local IP address of the UE sent by the AAA server, for example, the HSS receives the second authentication that is sent by the AAA server and includes the local IP address of the UE.
  • An authorization request the second authentication authorization request is used to request authentication authorization for accessing the ePDG by the UE, where the second authentication authorization request is sent by the AAA server according to the first authentication authorization request sent by the ePDG; and then the HSS is according to the UE Obtaining the roaming information of the UE, and obtaining the judgment result that the UE accesses the ePDG according to the roaming information of the UE and the subscription data of the user using the UE, and then the UE is connected to the ePDG.
  • the result is sent to the AAA server, for example, the decision result of the HSS accessing the ePDG is carried in the second authentication and authorization response, and sent to the AAA server; the AAA server sends the decision result of the UE accessing the ePDG to the AAA server.
  • the ePDG for example, the AAA server carries the decision result of the UE accessing the ePDG to be sent to the ePDG in the first authentication authorization response.
  • the HSS receives the roaming information of the UE sent by the AAA server, for example, in the process of performing WLAN authentication and authorization on the WLAN access device and the AAA server/HSS.
  • the HSS receives a fourth authentication authorization request that is sent by the AAA server, including the roaming information of the UE, where the fourth authentication authorization request is used to request authentication and authorization for the WLAN, where the fourth authentication authorization request is an access of the AAA server according to the WLAN.
  • the third authentication authorization request sent by the device is sent.
  • the HSS obtains the decision result of the UE accessing the ePDG according to the subscription data of the user using the UE and the roaming information of the UE sent by the AAA server, for example, the access device of the WLAN and the AAA server/HSS are completed.
  • WLAN authentication After the authorization, the AAA server receives the first authentication authorization request sent by the ePDG, where the first authentication authorization request is used to request the UE to access the ePDG for authentication and authorization, and the AAA server requests the HSS according to the first authentication authorization request.
  • Sending a second authentication authorization request the second authentication authorization request is used to request the UE to access the ePDG for authentication and authorization; after the HSS receives the second authentication authorization sent by the AAA server, the HSS is further used according to the UE.
  • the subscription data of the user and the roaming information of the UE sent by the AAA server acquire the judgment result that the UE accesses the ePDG.
  • the HSS After the HSS obtains the decision result of the UE accessing the ePDG, the HSS sends a decision result of the UE accessing the ePDG to the AAA server, for example, the decision result of the HSS accessing the ePDG by the UE is carried in the second authentication.
  • the AAA server sends the decision result of the UE accessing the ePDG to the ePDG, for example, the AAA server may carry the decision result of the UE accessing the ePDG in the first authentication authorization response. Sent to the ePDG.
  • the HSS receives the local IP address of the UE sent by the AAA server, for example, during the WLAN authentication and authorization process of the WLAN access device and the AAA server/HSS.
  • the AAA server may receive a third authentication authorization request sent by the access device of the WLAN, including the local IP address of the UE, where the third authentication authorization request is used to request authentication and authorization for the WLAN; and then the AAA server sends the AAA server to the HSS.
  • the local IP address of the UE for example, the AAA server may send the local IP address carrying the fourth authentication authorization request to the HSS, where the fourth authentication authorization request is used to request authentication and authorization for the WLAN; Obtaining roaming information of the UE according to the local IP address of the UE.
  • the HSS obtains the judgment result of the UE accessing the ePDG according to the subscription data of the user using the UE and the roaming information of the UE, for example, the access device of the WLAN and the AAA server/HSS complete the authentication and authorization of the WLAN.
  • the AAA server receives the first authentication authorization request sent by the ePDG, where the first authentication authorization request is used to request the UE to access the ePDG for authentication and authorization, and the AAA server sends the identifier to the HSS according to the first authentication authorization request.
  • the second authentication authorization request is used to request the UE to access the ePDG for authentication and authorization; after the HSS receives the second authentication authorization sent by the AAA server, the HSS is further used according to the user who uses the UE.
  • the subscription data is related to the roaming information of the UE sent by the AAA server, and the judgment result that the UE accesses the ePDG is obtained.
  • the HSS sends a decision result of the UE accessing the ePDG to the AAA server, for example, the decision result of the HSS accessing the ePDG by the UE is carried in the second authentication.
  • the AAA server sends a decision result of the UE accessing the ePDG to the ePDG, for example, the AAA server may carry the decision result of the UE accessing the ePDG in the first authentication authorization response, and send the ePDG.
  • the foregoing HSS acquires the roaming information of the UE according to the local IP address of the UE, where the HSS obtains the roaming information of the UE according to the local IP address of the UE and the correspondence between the local IP address and the roaming information. .
  • the HSS stores a correspondence between the local IP address and the roaming information, and the HSS can obtain the correspondence between the local IP address of the UE and the roaming information according to the local IP address of the UE, and obtain the local IP address of the UE.
  • the roaming information corresponding to the address, and the roaming information corresponding to the local IP address of the UE is used as the roaming information of the UE.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the executor of the embodiment is the WLAN access device, and the WLAN is the visited WLAN of the UE.
  • the access device of the WLAN allocates a local IP address to the UE; and the access device of the WLAN sends the local IP address of the UE to the AAA server.
  • the process performed by the AAA server after receiving the local IP address of the UE sent by the access device of the WLAN may be referred to the fifth feasible implementation manner and the sixth feasible implementation manner of the second embodiment of the method. Relevant records are not described here.
  • the executor of the embodiment is a WLAN access device, and the WLAN is a visited WLAN of the UE.
  • the access device of the WLAN acquires the roaming information of the UE; and the access device of the WLAN sends the roaming information of the UE to the AAA server.
  • the AAA server receives the roaming information of the UE that is sent by the access device of the WLAN.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • FIG. 5 is a schematic structural diagram of Embodiment 1 of an ePDG according to the present invention.
  • the ePDG in this embodiment may include: a receiving unit 11, a processing unit 12, and a sending unit 13, where the receiving unit 11 is configured to receive the UE.
  • the IPSec tunnel establishment request includes the local IP address of the UE, the WLAN is the visited WLAN of the UE, and the ePDG is the UE
  • the processing unit 12 is configured to acquire the roaming information of the UE according to the local IP address of the UE, and the sending unit 13 is configured to send the roaming information of the UE to the AAA server, and the receiving unit 11 is further configured to receive The decision result of the UE accessing the ePDG sent by the AAA server, the UE accessing the ePDG is to allow the UE to access the ePDG or to prohibit the UE from accessing the ePDG.
  • the processing unit 12 is further configured to The UE accesses the decision result of the ePDG, and controls the untrusted WLAN access of the UE.
  • the processing unit 12 is configured to obtain, according to the local IP address of the UE, the roaming information of the UE, where the processing unit 12 is configured to: according to the local IP address of the UE, and the correspondence between the local IP address and the roaming information. Relationship, obtaining roaming information of the UE.
  • the roaming information of the UE includes at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the ePDG of this embodiment may be used to perform the technical solution executed by the ePDG in the foregoing method embodiments of the present invention.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 6 is a schematic structural diagram of Embodiment 1 of an AAA server according to the present invention.
  • the AAA server in this embodiment may include: a processing unit 21, a sending unit 22, and a receiving unit 23; wherein, the processing unit 21 is configured to obtain a roaming information of the UE; the sending unit 22 is configured to send the roaming information of the UE to the HSS, so that the HSS obtains a decision result of the UE accessing the ePDG according to the roaming information of the UE, where the ePDG is the home ePDG of the UE a receiving unit 23, configured to receive a determination result that the UE is sent by the HSS to access the ePDG, and the sending unit 22 is further configured to send, to the ePDG, a determination result that the UE accesses the ePDG, where the UE accesses the The result of the ePDG decision is that the UE is allowed to access the ePDG or the UE is prohibited from accessing the
  • the processing unit 21 is configured to acquire the roaming information of the UE, where the processing unit 21 is configured to receive the roaming information of the UE that is sent by the ePDG, or the processing unit 21 is configured to receive the ePDG and send the UE.
  • the local IP address, and the roaming information of the UE is obtained according to the local IP address of the UE.
  • the processing unit 21 is configured to acquire the roaming information of the UE, where the processing unit 21 is configured to receive the roaming information of the UE sent by the access device of the WLAN, or the processing unit 21 is configured to receive the WLAN.
  • the local IP address of the UE sent by the access device, and the roaming information of the UE is obtained according to the local IP address of the UE.
  • the processing unit 21 is configured to acquire, according to the local IP address of the UE, the roaming of the UE.
  • the information includes: the processing unit 21, configured to acquire the roaming information of the UE according to the local IP address of the UE and the correspondence between the local IP address and the roaming information.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the AAA server in this embodiment may be used to perform the technical solution executed by the AAA server in the foregoing method embodiments of the present invention.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 7 is a schematic structural diagram of Embodiment 1 of an HSS according to the present invention.
  • the HSS of this embodiment may include: a processing unit 31 and a sending unit 32, where the processing unit 31 is configured to acquire roaming information of the UE. And obtaining, according to the subscription data of the user that uses the UE, the UE and the roaming information of the UE, the ePDG is the visited ePDG of the UE, and the UE accessing the ePDG determines that the UE is allowed to be the UE.
  • the sending unit 32 is configured to send, to the AAA server, a determination result that the UE accesses the ePDG, so that the AAA server forwards the decision result of the UE accessing the ePDG to
  • the ePDG enables the ePDG to control the untrusted WLAN access of the UE according to the decision result of the UE accessing the ePDG.
  • the processing unit 31 is configured to obtain the roaming information of the UE, where the processing unit 31 is configured to receive the roaming information that the AAA server sends the UE, or the processing unit 31 is configured to receive the The local IP address of the UE, and the roaming information of the UE is obtained according to the local IP address of the UE.
  • the processing unit 31 is configured to acquire the roaming information of the UE according to the local IP address of the UE, where the processing unit 31 is configured to: according to the local IP address of the UE, and the local IP address and roaming information of the UE. Corresponding relationship, obtaining roaming information of the UE.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the HSS of this embodiment may be used to implement the technical solution executed by the HSS in the foregoing method embodiments of the present invention.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 8 is a schematic structural diagram of Embodiment 2 of an ePDG according to the present invention.
  • the ePDG of this embodiment may include a receiver 41, a transmitter 42, and a memory 43 and are respectively connected to the receiver 41, the transmitter 42, and the memory 43.
  • the processor 44 can be a general-purpose central processing unit (English: Central Processing Unit, CPU for short), a microprocessor, and a specific application integrated circuit.
  • ASIC application-specific integrated circuit
  • the memory 43 may be a non-volatile memory, a read-only memory (abbreviation: ROM) or other types of static storage devices that can store static information and instructions, and a random access memory ( Abbreviation: random access memory (abbreviation: RAM) or other types of dynamic storage devices that can store information and instructions, or electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, EEPROM) , CD-ROM (English: Compact Disc Read-Only Memory, CD-ROM for short) or other disc storage, CD storage (including compressed discs, laser discs, CDs, digital versatile discs, Blu-ray discs, etc.), disk storage media or Other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, without limitation.
  • ROM read-only memory
  • RAM random access memory
  • EEPROM electrically erasable programmable read-only memory
  • the memory 43 is configured to store program code for performing the untrusted WLAN access control method of the UE of the present invention, and the processor 44 is configured to call the program code stored in the memory 43 for performing the following operations:
  • an IPSec tunnel establishment request sent by the UE where the IPSec tunnel establishment request includes a local IP address of the UE, the WLAN is a visited WLAN of the UE, and the ePDG is a home ePDG of the UE;
  • the receiver 41 Receiving, by the receiver 41, the decision result of the UE accessing the ePDG sent by the AAA server, and the UE accessing the ePDG determines that the UE is allowed to access the ePDG or the UE is prohibited from accessing the ePDG.
  • the non-trusted WLAN access of the UE is controlled according to the decision result of the UE accessing the ePDG.
  • the processor 44 is configured to obtain, according to the local IP address of the UE, the roaming information of the UE, where the processor 44 is configured to: according to the local IP address of the UE, and the correspondence between the local IP address and the roaming information. Relationship, obtaining roaming information of the UE.
  • the roaming information of the UE includes at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the ePDG of this embodiment may be used to perform the ePDG implementation in the foregoing method embodiments of the present invention.
  • the technical solution of the line is similar in its implementation principle and technical effect, and will not be described here.
  • FIG. 9 is a schematic structural diagram of Embodiment 2 of an AAA server according to the present invention.
  • the AAA server in this embodiment may include: a transmitter 51, a receiver 52, a memory 53, and a transmitter 51 and a receiver 52, respectively.
  • the processor 53 is connected to the memory 53.
  • Processor 54 can be a general purpose CPU, microprocessor, ASIC, or one or more integrated circuits for controlling the execution of the program of the present invention.
  • the memory 53 can be a non-volatile memory, a ROM or other type of static storage device that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, and can also be EEPROM, CD-ROM or other.
  • the memory 53 is configured to store program code for executing the non-trusted WLAN access control method of the UE of the present invention
  • the processor 54 is configured to call the program code stored in the memory 53 for performing the following operations:
  • the sender 51 Sending, by the sender 51, the roaming information of the UE to the HSS, so that the HSS obtains the decision result of the UE accessing the ePDG according to the roaming information of the UE, where the ePDG is the home ePDG of the UE;
  • the decision result of the UE accessing the ePDG is sent by the sender 51 to the ePDG.
  • the decision of the UE to access the ePDG is to allow the UE to access the ePDG or prohibit the UE from accessing the ePDG.
  • the processor 54 is configured to obtain the roaming information of the UE, where the processor 54 receives the roaming information of the UE sent by the ePDG by using the receiver 52. Alternatively, the processor 54 receives the ePDG by using the receiver 52. The local IP address of the UE, and the roaming information of the UE is obtained according to the local IP address of the UE.
  • the processor 54 is configured to obtain the roaming information of the UE, where the processor 54 receives the roaming information of the UE sent by the access device of the WLAN by using the receiver 52. Alternatively, the processor 54 receives the information through the receiver 52. The local IP address of the UE sent by the access device of the WLAN, and the roaming information of the UE is obtained according to the local IP address of the UE.
  • the processor 54 is configured to obtain, according to the local IP address of the UE, a roaming message of the UE. And the processor 54 is configured to acquire the roaming information of the UE according to the local IP address of the UE and the correspondence between the local IP address and the roaming information.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the AAA server in this embodiment may be used to perform the technical solution executed by the AAA server in the foregoing method embodiments of the present invention.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 10 is a schematic structural diagram of Embodiment 2 of the HSS of the present invention.
  • the HSS of this embodiment may include: a transmitter 61, a memory 62, and a processor 63 connected to the transmitter 61 and the memory 62, respectively.
  • Processor 63 may be a general purpose CPU, microprocessor, ASIC, or one or more integrated circuits for controlling the execution of the program of the present invention.
  • Memory 62 can be a non-volatile memory, ROM or other type of static storage device that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, or EEPROM, CD-ROM, or other Disc storage, optical storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or capable of carrying or storing desired programs in the form of instructions or data structures Code and any other medium that can be accessed by a computer, but is not limited thereto.
  • the memory 62 is configured to store program code for performing the untrusted WLAN access control method of the UE of the present invention
  • the processor 63 is configured to call the program code stored in the memory 62 for performing the following operations:
  • the ePDG is the visited ePDG of the UE, and the UE accesses the ePDG
  • the result of the decision is to allow the UE to access the ePDG or to prohibit the UE from accessing the ePDG;
  • the sender 61 Sending, by the sender 61, the decision result of the UE accessing the ePDG to the AAA server, so that the AAA server forwards the decision result of the UE accessing the ePDG to the ePDG, so that the ePDG is determined according to the UE accessing the ePDG.
  • the UE's untrusted WLAN access is controlled.
  • the HSS of this embodiment may further include a receiver 64.
  • the processor 63 is configured to acquire the roaming information of the UE, where the processor 63 is configured to receive, by the receiver 64, the AAA server to send roaming information of the UE, or the processor 63, to receive the AAA by using the receiver 64.
  • the local IP address of the UE sent by the server, and the roaming information of the UE is obtained according to the local IP address of the UE.
  • the processor 63 is configured to acquire the roaming information of the UE according to the local IP address of the UE, where the processor 63 is configured to: according to the local IP address of the UE, and the local IP address and roaming information of the UE. Corresponding relationship, obtaining roaming information of the UE.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the HSS of this embodiment may be used to implement the technical solution executed by the HSS in the foregoing method embodiments of the present invention.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 11 is a schematic structural diagram of Embodiment 1 of a WLAN access device according to the present invention.
  • the access device of the WLAN in this embodiment may include: a processing unit 71 and a sending unit 72, where the first feasible
  • the processing unit 71 is configured to allocate a local IP address to the UE when the UE accesses the WLAN, where the WLAN is a visited WLAN of the UE, and a sending unit 72, configured to send the UE to the AAA server. Local IP address.
  • the processing unit 71 is configured to acquire, when the UE accesses the WLAN, the roaming information of the UE, where the WLAN is the visited WLAN of the UE, and the sending unit 72 is configured to the AAA server. Send roaming information of the UE.
  • the roaming information of the UE includes: at least one of an identifier of a public land mobile network PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the access device of the WLAN in this embodiment may be used to perform the technical solution executed by the access device of the WLAN in the foregoing method embodiments of the present invention.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 12 is a schematic structural diagram of Embodiment 2 of an WLAN access device according to the present invention.
  • the access device of the WLAN in this embodiment may include: a transmitter 81, a memory 82, and a transmitter 81 and a memory 82, respectively.
  • the processor 83 can be a general purpose CPU, microprocessor, ASIC, or one or more integrated circuits for controlling the execution of the program of the present invention.
  • the memory 82 can be a non-volatile memory, ROM or other type of static storage device that can store static information and instructions, RAM or other types of dynamic storage devices that can store information and instructions, and can also be EEPROM, CD-ROM or other.
  • the memory 82 is configured to store program code for performing the untrusted WLAN access control method of the UE of the present invention, and the processor 83 is configured to call the program code stored in the memory 82 for performing the following operations:
  • the UE When the UE accesses the WLAN, the UE is assigned a local IP address; and the local IP address of the UE is sent to the AAA server. or,
  • the roaming information of the UE is obtained; and the roaming information of the UE is sent by the sender 81 to the AAA server.
  • the roaming information of the UE includes: at least one of an identifier of a PLMN accessed by the UE, an identifier of a region where the UE is located, and an identifier of the WLAN.
  • the access device of the WLAN in this embodiment may be used to perform the technical solution executed by the access device of the WLAN in the foregoing method embodiments of the present invention.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 13 is a schematic structural diagram of an embodiment of a non-trusted WLAN access control system of a UE according to the present invention.
  • the system of the present embodiment includes: an ePDG 10, an AAA server 20, an HSS 30, a UE 40, and a WLAN access device 50.
  • the WLAN is the visited WLAN of the UE.
  • the ePDG 10 can adopt the structure of the device embodiment shown in FIG. 5 or FIG. 8 , and correspondingly, the technical solution executed by the ePDG in the foregoing method embodiments of the present invention can be performed.
  • the AAA server 20 may adopt the structure of the device embodiment shown in FIG. 6 or FIG.
  • the HSS 30 can adopt the structure of the device embodiment shown in FIG. 7 or FIG. 10, and correspondingly, the HSS in the foregoing method embodiments of the present invention can be executed.
  • the access device 50 of the WLAN may adopt the structure of the device embodiment shown in FIG. 11 or FIG. 12, which correspondingly The method of the present invention performs the above-described aspect of the WLAN access device embodiment performed by embodiments, which achieve a similar principle and technical effects will not be repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例提供一种UE的非可信WLAN接入控制方法、设备和***，此方法包括：ePDG接收UE发送的IPSec隧道建立请求，IPSec隧道建立请求包括UE的本地IP地址，WLAN为UE的拜访地WLAN，ePDG为UE的归属地ePDG；根据UE的本地IP地址，获取UE的漫游信息；向AAA服务器发送该UE的漫游信息；接收AAA服务器发送的UE接入ePDG的判决结果，UE接入ePDG的判决结果为允许UE接入ePDG或者禁止UE接入ePDG；根据UE接入ePDG的判决结果，对UE的非可信WLAN接入进行控制。

Description

用户设备的非可信无线局域网接入控制方法、设备和*** 技术领域
本发明实施例涉及通信技术领域，尤其涉及一种用户设备(英文：User Equipment，简称：UE)的非可信无线局域网(英文：Wireless Local Area Networks，简称：WLAN)接入控制方法、设备和***。
背景技术
目前，第三代合作伙伴计划(英文：The 3rd Generation Partnership Project，简称：3GPP)标准定义了WLAN接入架构中涉及的一种架构，一种是基于S2a接口可信接入的网络部署，一种是基于S2b接口的非可信接入的网络部署，在基于S2b接口的非可信接入的WLAN下，电信运营商部署一个演进的分组数据网关(英文：evolved Packet Data Gateway，简称：ePDG)和认证、授权与计费(Authentication,Authorization and Accounting，简称：AAA)服务器，升级现网的归属地签约用户服务器(英文：Home Subscriber Server，简称：HSS)、分组数据网关(英文：Packet Data Network Gateway，简称：PGW)和移动管理实体(英文：Mobility Management Entity，简称：MME)就可以完成语音WLAN的业务接入。若UE在漫游场景下接入WLAN，并且WLAN是基于S2b接口的非可信接入的网络，目前UE仅支持选择归属地的ePDG，而AAA/HSS无法获取UE的位置信息，进而网络侧无法对该UE的接入进行控制。
发明内容
本发明实施例提供一种UE的非可信WLAN接入控制方法、设备和***，用于使得网络侧可以对发生漫游的UE的非可信WLAN接入进行控制。
第一方面，本发明实施例提供一种UE的非可信WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，包括：ePDG接收UE发送的互联网协议安全(英文：Internet Protocol Security，简称：IPSec)隧道建立请求，所述IPSec隧道建立请求包括所述UE的本地IP地址，所述WLAN为所述UE 的拜访地WLAN，所述ePDG为所述UE的归属地ePDG；所述ePDG根据所述UE的本地IP地址，获取所述UE的漫游信息；所述ePDG向AAA服务器发送所述UE的漫游信息；所述ePDG接收所述AAA服务器发送的所述UE接入所述ePDG的判决结果，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；所述ePDG根据所述UE接入所述ePDG的判决结果，对所述UE的非可信WLAN接入进行控制。
在第一方面的第一种可能的实现方式中，所述ePDG根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述ePDG根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
结合第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述UE的漫游信息包括所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第二方面，本发明实施例提供一种UE的非可信WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，包括：AAA服务器获取所述UE的漫游信息；所述AAA服务器向HSS发送所述UE的漫游信息，以使所述HSS根据所述UE的漫游信息获取所述UE接入ePDG的判决结果，所述ePDG为所述UE的归属地ePDG；所述AAA服务器接收所述HSS发送的所述UE接入所述ePDG的判决结果；所述AAA服务器向所述ePDG发送所述UE接入所述ePDG的判决结果；其中，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG。
在第二方面的第一种可能的实现方式中，所述AAA服务器获取所述UE的漫游信息，包括：所述AAA服务器接收所述ePDG发送的所述UE的漫游信息；或者，所述AAA服务器接收所述ePDG发送所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
在第二方面的第二种可能的实现方式中，所述AAA服务器获取所述UE的漫游信息，包括：所述AAA服务器接收所述WLAN的接入设备发送的所述UE的漫游信息；或者，所述AAA服务器接收所述WLAN的接入设备发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
结合第二方面的第一种可能的实现方式或第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，所述AAA服务器根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述AAA服务器根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
结合第二方面或第二方面的第一种至第三种可能的实现方式中的任意一种，在第二方面的第四种可能的实现方式中，所述UE的漫游信息包括：所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第三方面，本发明实施例提供一种UE的非可信WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，包括：HSS获取所述UE的漫游信息；所述HSS根据使用所述UE的用户的签约数据与所述UE的漫游信息，获取所述UE接入演进分组数据网关ePDG的判决结果，所述ePDG为所述UE的拜访地ePDG，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；所述HSS向AAA服务器发送所述UE接入所述ePDG的判决结果，以使所述AAA服务器将所述UE接入所述ePDG的判决结果转发至所述ePDG，使得所述ePDG根据所述UE接入所述ePDG的判决结果对所述UE的非可信WLAN接入进行控制。
在第三方面的第一种可能的实现方式中，所述HSS获取所述UE的漫游信息，包括：所述HSS接收所述AAA服务器发送所述UE的漫游信息，或者，所述HSS接收所述AAA服务器发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
结合第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，所述HSS根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述HSS根据所述UE的本地IP地址，以及所述UE的本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
结合第三方面或第三方面的第一种可能的实现方式或第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，所述UE的漫游信息包括：所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第四方面，本发明实施例提供一种UE的非可信WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，包括：
当所述UE接入所述WLAN时，所述WLAN的接入设备为所述UE分配本地互联网协议IP地址；所述WLAN的接入设备向认证授权计费AAA服务器发送所述UE的本地IP地址。或者，
当所述UE接入所述WLAN时，所述WLAN的接入设备获取所述UE的漫游信息；所述WLAN的接入设备向认证授权计费AAA服务器发送所述UE的漫游信息。
在本发明第四方面的第一种可能的实现方式中，所述UE的漫游信息包括：所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第五方面，本发明实施例提供一种ePDG，包括：接收单元，用于接收UE发送的IPSec隧道建立请求，所述IPSec隧道建立请求包括所述UE的本地IP地址，所述WLAN为所述UE的拜访地WLAN，所述ePDG为所述UE的归属地ePDG；处理单元，用于根据所述UE的本地IP地址，获取所述UE的漫游信息；发送单元，用于向AAA服务器发送所述UE的漫游信息；所述接收单元，还用于接收所述AAA服务器发送的所述UE接入所述ePDG的判决结果，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；所述处理单元，还用于根据所述UE接入所述ePDG的判决结果，对所述UE的非可信WLAN接入进行控制。
在第五方面的第一种可能的实现方式中，所述处理单元用于根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述处理单元，用于根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
结合第五方面或第四方面的第一种可能的实现方式，在第五方面的第二种可能的实现方式中，所述UE的漫游信息包括所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第六方面，本发明实施例提供一种AAA服务器，包括：处理单元，用于获取所述UE的漫游信息；发送单元，用于向HSS发送所述UE的漫游信息，以使所述HSS根据所述UE的漫游信息获取所述UE接入ePDG的判决结果， 所述ePDG为所述UE的归属地ePDG；接收单元，用于接收所述HSS发送的所述UE接入所述ePDG的判决结果；所述发送单元，还用于向所述ePDG发送所述UE接入所述ePDG的判决结果；其中，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG。
在第六方面的第一种可能的实现方式中，所述处理单元用于获取所述UE的漫游信息，包括：所述处理单元，用于接收所述ePDG发送的所述UE的漫游信息；或者，所述处理单元，用于接收所述ePDG发送所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
在第六方面的第二种可能的实现方式中，所述处理单元用于获取所述UE的漫游信息，包括：所述处理单元，用于接收所述WLAN的接入设备发送的所述UE的漫游信息；或者，所述处理单元，用于接收所述WLAN的接入设备发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
结合第六方面的第一种可能的实现方式或第六方面的第二种可能的实现方式，在第六方面的第三种可能的实现方式中，所述处理单元用于根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述处理单元，用于根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
结合第六方面或第六方面的第一种至第三种可能的实现方式中的任意一种，在第六方面的第四种可能的实现方式中，所述UE的漫游信息包括：所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第七方面，本发明实施例提供一种HSS，包括：处理单元，用于获取所述UE的漫游信息；以及根据使用所述UE的用户的签约数据与所述UE的漫游信息，获取所述UE接入ePDG的判决结果，所述ePDG为所述UE的拜访地ePDG，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；发送单元，用于向AAA服务器发送所述UE接入所述ePDG的判决结果，以使所述AAA服务器将所述UE接入所述ePDG的判决结果转发至所述ePDG，使得所述ePDG根据所述UE接入所述ePDG的判决结果对所述UE的非可信WLAN接入进行控制。
在第七方面的第一种可能的实现方式中，所述处理单元用于获取所述UE的漫游信息，包括：所述处理单元，用于接收所述AAA服务器发送所述UE的漫游信息，或者，所述处理单元，用于接收所述AAA服务器发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
结合第七方面的第一种可能的实现方式，在第七方面的第二种可能的实现方式中，所述处理单元用于根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述处理单元，用于根据所述UE的本地IP地址，以及所述UE的本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
结合第七方面或第七方面的第一种可能的实现方式或第七方面的第二种可能的实现方式，在第七方面的第三种可能的实现方式中，所述UE的漫游信息包括：所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第八方面，本发明实施例提供一种WLAN的接入设备，包括：处理单元和发送单元。
所述处理单元，用于当用户设备UE接入所述WLAN时，为所述UE分配本地互联网协议IP地址，所述WLAN为所述UE的拜访地WLAN；发送单元，用于向认证授权计费AAA服务器发送所述UE的本地IP地址。或者，
所述处理单元，用于当用户设备UE接入所述WLAN时，获取所述UE的漫游信息，所述WLAN为所述UE的拜访地WLAN；所述发送单元，用于向认证授权计费AAA服务器发送所述UE的漫游信息。
在本发明第八方面的第一种可能的实现方式中，所述UE的漫游信息包括：所述UE接入的PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
第九方面，本发明实施例提供一种UE的非可信WLAN接入控制***，包括：UE、本发明第五方面或本发明第五方面的各种可能的实现方式提供的ePDG、本发明第六方面或本发明第六方面的各种可能的实现方式提供的AAA服务器、本发明第七方面或本发明第七方面的各种可能的实现方式提供的HSS；本发明第八方面或本发明第八方面的第一种可能的实现方式提供的WLAN的接入设备。
本发明实施例提供的UE的非可信WLAN接入控制方法、设备和***， 通过ePDG接收UE发送的包括UE的本地IP地址的IPSec隧道建立请求，根据所述UE的IP地址，获取该UE的漫游信息，然后向AAA服务器发送该UE的漫游信息，再接收该AAA服务器发送的该UE接入所述ePDG的判决结果，并根据该UE接入所述ePDG的判决结果，对UE的非可信WLAN接入进行控制。从而实现UE在漫游至非可信WLAN时，AAA服务器/HSS可以获取该UE的漫游信息，进而实现归属地ePDG对UE的接入进行控制。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明提供的UE接入非可信WLAN的一种网络架构图；
图2为本发明UE的非可信WLAN接入控制方法实施例一的流程图；
图3为本发明UE的非可信WLAN接入控制方法实施例二的流程图；
图4为本发明UE的非可信WLAN接入控制方法实施例三的流程图；
图5为本发明ePDG实施例一的结构示意图；
图6为本发明AAA服务器实施例一的结构示意图；
图7为本发明HSS实施例一的结构示意图；
图8为本发明ePDG实施例二的结构示意图；
图9为本发明AAA服务器实施例二的结构示意图；
图10为本发明HSS实施例二的结构示意图；
图11为本发明WLAN的接入设备实施例一的结构示意图；
图12为本发明WLAN的接入设备实施例二的结构示意图；
图13为本发明UE的非可信WLAN接入控制***实施例的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于 本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1为本发明提供的UE接入非可信WLAN的一种网络架构图，如图1所示，当UE发生漫游时，UE发生漫游可以包括UE发生运营商之间漫游或者UE发生国际漫游或者省份间漫游或者市级间漫游，UE的运营商之间漫游例如是指使用该UE的用户属于移动运营商，而UE漫游至联通运营商或者电信运营商，UE发生国际漫游例如是指使用该UE的用户属于中国，而UE漫游至除中国之外的其它国家，如美国；UE发生省份间漫游例如是指示使用该UE的用户属于湖南省，而UE漫游至除湖南省之外的其它省份，如广东省；UE发生市级间漫游例如是指使用该UE的用户例如属于北京市，而该UE漫游至除北京市之外的其它市，如上海市。当UE发生漫游时，UE接入拜访地公共陆地移动网络(英文：Visit Public Land Mobile Network，简称：VPLMN)的非可信的WLAN中，目前UE只能支持通过WLAN接入至归属地公共陆地移动网络(英文：Home Public Land Mobile Network，简称：HPLMN)的各个网络设备，这些网络设备包括：ePDG、AAA服务器、HSS、策略与计费功能(Policy and Charging Rules Function，简称：PCRF)实体、互联网协议多媒体子***(英文：Internet Protocol Multimedia Subsystem，简称：IMS)，其中各个网络设备之间的通信接口如图1中所示。
在UE接入至非可信的WLAN的过程中，UE会先与WLAN的接入设备进行认证授权，获取该UE的本地(英文：Local)IP地址，该UE的本地IP地址会用于与UE的归属地ePDG建立IPSec隧道。在UE与WLAN完成认证授权之后，该UE与ePDG执行IKEv2过程执行EAP-AKA认证，并与该ePDG建立IPSec隧道，该UE与该ePDG建立IPSec隧道的过程可以为该UE向该ePDG发送IPSec隧道建立请求，该ePDG与AAA服务器/HSS进行认证授权，即该ePDG向该AAA服务器发送第一认证授权请求，该AAA服务器根据第一认证授权请求向HSS发送第二认证授权请求，该HSS根据该第二认证授权请求向该AAA服务器发送第二认证授权响应，该AAA服务器根据该第二认证授权响应向该ePDG发送第一认证授权响应，从而ePDG与AAA服务器/HSS完成该UE的认证授权过程；然后ePDG根据该第一认证授权响应向UE发送IPSec隧道建立响应，从而UE与ePDG完成IPSec隧道建立过程。可选地， WLAN的接入设备还可以与AAA服务器/HSS进行WLAN的认证授权，具体地，该WLAN的接入设备向AAA服务器发送第三认证授权请求，该AAA服务根据第三认证授权请求向HSS发送第四认证授权请求，该HSS根据该第四认证授权请求向该AAA服务器发送第四认证授权响应，该AAA服务器根据该第四认证授权响应向该WLAN的接入设备发送第三认证授权响应，从而WLAN的接入设备与AAA服务器/HSS完成该WLAN的认证授权过程。
其中，第一认证授权请求可以为扩展认证协议请求(英文：Diameter-Extended Authentication Protocol-Request，简称：DER)，第一认证授权响应可以为扩展认证协议响应(英文：Diameter-Extended Authentication Protocol-Answer，简称：DEA)；第二认证授权请求、第四认证授权请求可以为多媒体认证请求(英文：Multimedia-Authentication-Request，简称：MAR)，第二认证授权响应、第四认证授权响应可以为多媒体认证应答(英文：Multimedia-Authentication-Answer，简称：MAA)；第三认证授权请求可以为认证授权请求(英文：Authentication and Authorization Request，简称：AAR)，第三认证授权响应可以为认证授权应答(英文：Authentication and Authorization Answer，简称：AAA)。
基于图1所示的网络架构，本发明实施例提供如下各个实施例以实现UE的非可信WLAN接入控制。
图2为本发明UE的非可信WLAN接入控制方法实施例一的流程图，如图2所示，该WLAN为该UE的拜访地WLAN，本实施例的方法可以包括：
S101、ePDG接收UE发送的互联网协议安全(英文：Internet Protocol Security，简称：IPSec)隧道建立请求，所述IPSec隧道建立请求包括所述UE的本地IP地址，所述ePDG为所述UE的归属地ePDG。
S102、所述ePDG根据所述UE的本地IP地址，获取所述UE的漫游信息。
S103、所述ePDG向AAA服务器发送所述UE的漫游信息。
S104、所述ePDG接收所述AAA服务器发送的所述UE接入所述ePDG的判决结果，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG。
S105、所述ePDG根据所述UE接入所述ePDG的判决结果，对所述UE的非可信WLAN接入进行控制。
本实施例中，UE接入至WLAN，该WLAN为非可信WLAN，并且，WLAN与AAA/HSS完成WLAN的认证授权之后，UE向UE的归属地的ePDG发送IPSec隧道建立请求，该IPSec隧道建立请求包括该UE的本地IP地址，ePDG接收UE发送的IPSec隧道建立请求之后，ePDG会向AAA/HSS对通过非可信WLAN接入的UE进行认证授权，然后ePDG根据IPSec隧道建立请求中包括的UE的本地IP地址，获取该UE的漫游信息，然后该ePDG向该AAA服务器发送该UE的漫游信息，例如：该ePDG将该UE的漫游信息携带在第一认证授权请求中发送给AAA服务器，该第一认证授权请求用于请求对该UE接入所述ePDG进行认证授权，该第一认证授权请求可以为DER。
相应地，AAA服务器接收到该ePDG发送的该UE的漫游信息，并将该UE的漫游信息转发给HSS，例如：若AAA服务器接收到该ePDG发送的包括该UE的漫游信息的第一认证授权请求，从该第一认证授权请求中获取该UE的漫游信息，然后该AAA服务器根据该第一认证授权请求将该UE的漫游信息携带在第二认证授权请求中发送给HSS，该第二认证授权请求用于请求对该UE接入所述ePDG进行认证授权。
相应地，HSS接收到AAA服务器发送的该UE的漫游信息，例如：若HSS接收到该AAA服务器发送的包括该UE的漫游信息的第二认证授权请求，从该第二认证授权请求中获取该UE的漫游信息；然后HSS根据该UE的漫游信息与使用该UE的用户的签约数据，获取该UE接入该ePDG的判决结果，该UE接入该ePDG的判决结果可以为允许该UE接入该ePDG或者禁止该UE接入该ePDG，该HSS再将该UE接入该ePDG的判决结果发送给AAA服务器，例如：该HSS可以将该ePDG的判决结果携带在第二认证授权响应中发送给AAA服务器。AAA服务器接收到该HSS发送的该UE接入该ePDG的判决结果，再将该UE接入该ePDG的判决结果发送给ePDG，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给ePDG，该ePDG从该第一认证授权响应中获取该UE接入该ePDG的判决结果。
在ePDG获取到该UE接入该ePDG的判决结果之后，ePDG可以根据该UE接入所述ePDG的判决结果，对所述UE的非可信WLAN接入进行控制。具体地，例如当该UE接入该ePDG的判断结果为允许该UE接入该ePDG， 该ePDG与该UE建立IPSec隧道；当该UE接入该ePDG的判断结果为禁止该UE接入该ePDG，该ePDG拒绝与该UE建立IPSec隧道。
本发明实施例提供的UE的非可信WLAN接入控制方法，通过ePDG接收UE发送的包括UE的本地IP地址的IPSec隧道建立请求，根据所述UE的本地IP地址，获取该UE的漫游信息，然后向AAA服务器发送该UE的漫游信息，再接收该AAA服务器发送的该UE接入所述ePDG的判决结果，并根据该UE接入所述ePDG的判决结果，对UE的非可信WLAN接入进行控制。从而实现UE在漫游至非可信WLAN时，AAA服务器/HSS可以获取该UE的漫游信息，进而实现归属地ePDG对UE的接入进行控制。
可选地，上述S102中的所述ePDG根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述ePDG根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。本实施例中，该ePDG中存储有本地IP地址与漫游信息的对应关系，该ePDG可以根据该UE的本地IP地址，获取该UE的本地IP地址与漫游信息的对应关系，获取与该UE的本地IP地址对应的漫游信息，将该UE的本地IP地址对应的漫游信息作为该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。该UE接入的PLMN的标识表示该UE在拜访地接入的PLMN的标识，例如：若UE的用户属于***的用户，该UE接入的PLMN的标识可以为中国移通的标识或者中国电信的标识；所述UE所处地域的标识表示该UE在拜访地的区域的标识，例如：若UE的用户属于北京的用户，该UE所处区域的标识可以为上海的标识等。该WLAN的标识即为该WLAN的服务集标识(英文：Service Set Identifier，简称：SSID)。
图3为本发明UE的非可信WLAN接入控制方法实施例二的流程图，如图3所示，该WLAN为该UE的拜访地WLAN，本实施例的方法可以包括：
S201、AAA服务器获取所述UE的漫游信息。
S202、所述AAA服务器向HSS发送所述UE的漫游信息，以使所述HSS根据所述UE的漫游信息获取所述UE接入ePDG的判决结果，所述ePDG为所述UE的归属地ePDG。
S203、所述AAA服务器接收所述HSS发送的所述UE接入ePDG的判 决结果。
S204、所述AAA服务器向所述ePDG发送所述UE接入所述ePDG的判决结果。
本实施例中，AAA服务器获取该UE的漫游信息，然后该AAA服务器将向该HSS发送该UE的漫游信息，该HSS接收该AAA服务器发送的该UE漫游信息之后，该HSS可以根据该UE的漫游信息与使用该UE的用户的签约数据获取该UE接入该UE的归属地ePDG的判决结果，实现了HSS可以对该UE的接入进行控制，其中，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG，并且该HSS向AAA服务器发送该UE接入该ePDG的判决结果，也实现了AAA服务器可以对该UE的接入进行控制，相应地，该AAA服务器接收该UE接入ePDG的判决结果之后，该AAA服务器向该ePDG转发该UE接入该ePDG的判决结果。该ePDG接收该ePDG的判决结果的处理过程可以参见本发明上述方法实施例一中的相关记载，此处不再赘述。
本发明实施例提供的UE的非可信WLAN接入控制方法，通过AAA服务器获取该UE的漫游信息，向HSS发送该UE的漫游信息，以使该HSS根据该UE的漫游信息获取该UE接入该UE的归属地ePDG的判决结果，然后该AAA服务器接收该HSS发送的该UE接入ePDG的判决结果，并向该ePDG发送该UE接入该ePDG的判决结果。从而实现UE在漫游至非可信WLAN时，AAA服务器/HSS可以获取该UE的漫游信息，进而实现归属地ePDG对UE的接入进行控制。
在本发明方法实施例二的第一种可行的实现方式中，AAA服务器接收该ePDG发送的UE的漫游信息，例如：该AAA服务器可以接收该ePDG发送的包括该UE的漫游信息的第一认证授权请求，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权；然后该AAA服务器向HSS发送该UE的漫游信息，例如：该AAA服务器可以将该UE的漫游信息携带第二认证授权请求中发送给HSS，该HSS根据该UE的漫游信息和使用该UE的签约数据获取该UE接入该ePDG的判决结果；该AAA服务器接收该HSS发送的该UE接入该ePDG的判决结果，例如：该AAA服务器可以接收该HSS发送的包括该UE的漫游信息的第二认证授权响应；该AAA服务器向该ePDG 发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例二的第二种可行的实现方式中，AAA服务器接收该ePDG发送的UE的本地IP地址，例如：该AAA服务器可以接收该ePDG发送的包括该UE的本地IP地址的第一认证授权请求，该第一认证授权请求为该ePDG根据UE发送的IPSec隧道建立请求发送的，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权；然后该AAA服务器根据该UE的本地IP地址获取该UE的漫游信息，再向HSS发送该UE的漫游信息，例如：该AAA服务器可以将该UE的漫游信息携带第二认证授权请求中发送给HSS，该HSS根据该UE的漫游信息和使用该UE的用户的签约数据获取该UE接入该ePDG的判决结果；该AAA服务器接收该HSS发送的该UE接入该ePDG的判决结果，例如：该AAA服务器可以接收该HSS发送的包括该UE的漫游信息的第二认证授权响应；该AAA服务器向该ePDG发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例二的第三种可行的实现方式中，AAA服务器接收该ePDG发送的UE的本地IP地址，例如：该AAA服务器可以接收该ePDG发送的包括该UE的本地IP地址的第一认证授权请求，该第一认证授权请求为该ePDG根据UE发送的IPSec隧道建立请求发送的，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权；然后该AAA服务器再向HSS发送该UE的本地IP地址，例如：该AAA服务器可以将该UE的本地IP地址携带第二认证授权请求中发送给HSS，该HSS根据该UE的本地IP地址获取该UE的漫游信息，以及该HSS根据该UE的漫游信息和使用该UE的用户的签约数据获取该UE接入该ePDG的判决结果；该AAA服务器接收该HSS发送的该UE接入该ePDG的判决结果，例如：该AAA服务器可以接收该HSS发送的包括该UE的漫游信息的第二认证授权响应；该AAA服务器向该ePDG发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例二的第四种可行的实现方式中，AAA服务器接收该WLAN的接入设备发送的UE的漫游信息，例如：在WLAN的接入设备与 AAA服务器/HSS进行WLAN的认证授权过程中，该AAA服务器可以接收该WLAN的接入设备发送的包括该UE的漫游信息的第三认证授权请求，该第三认证授权请求用于请求对该WLAN进行认证授权；然后该AAA服务器向HSS发送该UE的漫游信息，例如：该AAA服务器可以将该UE的漫游信息携带第四认证授权请求中发送给HSS，该第四认证授权请求用于请求对该WLAN进行认证授权；在WLAN的接入设备与该AAA服务器/HSS完成该WLAN的认证授权之后，该AAA服务器接收该ePDG发送的第一认证授权请求，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权，该AAA服务器根据该第一认证授权请求向该HSS发送第二认证授权请求，该第二认证授权请求用于请求对该UE接入该ePDG进行认证授权；该HSS接收到该AAA服务器发送的第二认证授权之后，该HSS再根据使用该UE的用户的签约数据与该AAA服务器发送的该UE的漫游信息，获取该UE接入该ePDG的判决结果；该AAA服务器接收该HSS发送的该UE接入该ePDG的判决结果，例如：该AAA服务器可以接收该HSS发送的包括该UE的漫游信息的第二认证授权响应；该AAA服务器向该ePDG发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例二的第五种可行的实现方式中，AAA服务器接收该WLAN的接入设备发送的UE的本地IP地址，例如：在WLAN的接入设备与AAA服务器/HSS进行WLAN的认证授权过程中，该AAA服务器可以接收该WLAN的接入设备发送的包括该UE的本地IP地址的第三认证授权请求，该第三认证授权请求用于请求对该WLAN进行认证授权；然后该AAA服务器根据该UE的本地IP地址获取该UE的漫游信息，再向HSS发送该UE的漫游信息，例如：该AAA服务器可以将该UE的漫游信息携带第四认证授权请求中发送给HSS，该第四认证授权请求用于请求对该WLAN进行认证授权；在WLAN的接入设备与该AAA服务器/HSS完成该WLAN的认证授权之后，该AAA服务器接收该ePDG发送的第一认证授权请求，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权，该AAA服务器根据该第一认证授权请求向该HSS发送第二认证授权请求，该第二认证授权请求用于请求对该UE接入该ePDG进行认证授权；该HSS接收到该AAA服 务器发送的第二认证授权之后，该HSS再根据使用该UE的用户的签约数据与该AAA服务器发送的该UE的漫游信息，获取该UE接入该ePDG的判决结果；该AAA服务器接收该HSS发送的所述UE接入所述ePDG的判决结果，例如：该AAA服务器可以接收该HSS发送的包括该UE的漫游信息的第二认证授权响应；该AAA服务器向该ePDG发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例二的第六种可行的实现方式中，AAA服务器接收该WLAN的接入设备发送的UE的本地IP地址，例如：在WLAN的接入设备与AAA服务器/HSS进行WLAN的认证授权过程中，该AAA服务器可以接收该WLAN的接入设备发送的包括该UE的本地IP地址的第三认证授权请求，该第三认证授权请求用于请求对该WLAN进行认证授权；然后该AAA服务器再向HSS发送该UE的本地IP地址，例如：该AAA服务器可以将该UE的本地IP地址携带第四认证授权请求中发送给HSS，该第四认证授权请求用于请求对该WLAN进行认证授权，该HSS可以根据该UE的本地IP地址获取该UE的漫游信息；在WLAN的接入设备与该AAA服务器/HSS完成该WLAN的认证授权之后，该AAA服务器接收该ePDG发送的第一认证授权请求，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权，该AAA服务器根据该第一认证授权请求向该HSS发送第二认证授权请求，该第二认证授权请求用于请求对该UE接入该ePDG进行认证授权；该HSS接收到该AAA服务器发送的第二认证授权之后，该HSS再根据使用该UE的用户的签约数据与该AAA服务器发送的该UE的漫游信息，获取该UE接入该ePDG的判决结果；该AAA服务器接收该HSS发送的所述UE接入所述ePDG的判决结果，例如：该AAA服务器可以接收该HSS发送的包括该UE的漫游信息的第二认证授权响应；该AAA服务器向该ePDG发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
可选地，上述AAA服务器根据该UE的本地IP地址获取该UE的漫游信息，包括：所述AAA服务器根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。具体地，该AAA 服务器中存储有本地IP地址与漫游信息的对应关系，该AAA服务器可以根据该UE的本地IP地址，获取该UE的本地IP地址与漫游信息的对应关系，获取与该UE的本地IP地址对应的漫游信息，将该UE的本地IP地址对应的漫游信息作为该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
图4为本发明UE的非可信WLAN接入控制方法实施例三的流程图，如图4所示，该WLAN为该UE的拜访地WLAN，本实施例的方法可以包括：
S301、HSS获取所述UE的漫游信息。
S302、所述HSS根据使用所述UE的用户的签约数据与所述UE的漫游信息，获取所述UE接入ePDG的判决结果，所述ePDG为所述UE的拜访地ePDG。
S303、所述HSS向所述AAA服务器发送所述UE接入所述ePDG的判决结果。
本实施例中，该HSS获取该UE的漫游信息，然后该HSS根据使用该UE的用户的签约数据与该UE的漫游信息，获取该UE接入归属地ePDG的判决结果，该UE接入该ePDG的判决结果为允许该UE接入该ePDG或者禁止该UE接入该ePDG，该HSS将获取的该UE接入该ePDG的判决结果发送给AAA服务器，AAA服务器接收到该HSS发送的该UE接入该ePDG的判决结果之后，该AAA服务器将该UE接入该ePDG的判决结果发送给该ePDG，该ePDG根据该UE接入该ePDG的判决结果如何进行处理可以参见本发明方法实施例一中的相关记载，此处不再赘述。
本发明实施例提供的UE的非可信WLAN接入控制方法，通过HSS获取该UE的漫游信息，根据使用所述UE的用户的签约数据与该UE的漫游信息，获取该UE接入ePDG的判决结果，该ePDG为该UE的拜访地ePDG；向该AAA服务器发送该UE接入该ePDG的判决结果。从而实现UE在漫游至非可信WLAN时，AAA服务器/HSS可以获取该UE的漫游信息，进而实现归属地ePDG对UE的接入进行控制。
可选地，该HSS获取该UE的漫游信息，包括：该HSS接收该AAA服务器发送该UE的漫游信息，或者，该HSS接收该AAA服务器发送的该UE的本地IP地址，以及根据该UE的本地IP地址，获取该UE的漫游信息。
在本发明方法实施例三的第一种可行的实现方式中，HSS接收AAA服务器发送的UE的漫游信息，例如：该HSS接收该AAA服务器发送的包括该UE的漫游信息的第二认证授权请求，该第二认证授权请求用于请求对该UE接入该ePDG进行认证授权，该第二认证授权请求是AAA服务器根据ePDG发送的第一认证授权请求发出的；然后该HSS根据该UE的漫游信息以及使用该UE的用户的签约数据，获取该UE接入该ePDG的判决结果，再将该UE接入该ePDG的判决结果发送给AAA服务器，例如：该HSS将该UE接入该ePDG的判决结果携带在第二认证授权响应中发送给AAA服务器；该AAA服务器再将该UE接入该ePDG的判决结果发送给该ePDG，例如：该AAA服务器再将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例三的第二种可行的实现方式中，HSS接收AAA服务器发送的UE的本地IP地址，例如：该HSS接收该AAA服务器发送的包括该UE的本地IP地址的第二认证授权请求，该第二认证授权请求用于请求对该UE接入该ePDG进行认证授权，该第二认证授权请求是AAA服务器根据ePDG发送的第一认证授权请求发出的；然后该HSS根据该UE的本地IP地址，获取该UE的漫游信息，再根据该UE的漫游信息以及使用该UE的用户的签约数据，获取该UE接入该ePDG的判决结果，再将该UE接入该ePDG的判决结果发送给AAA服务器，例如：该HSS将该UE接入该ePDG的判决结果携带在第二认证授权响应中发送给AAA服务器；该AAA服务器再将该UE接入该ePDG的判决结果发送给该ePDG，例如：该AAA服务器再将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例三的第三种可行的实现方式中，HSS接收AAA服务器发送的UE的漫游信息，例如：在WLAN的接入设备与AAA服务器/HSS进行WLAN的认证授权过程中，该HSS接收该AAA服务器发送的包括该UE的漫游信息的第四认证授权请求，该第四认证授权请求用于请求对该WLAN进行认证授权，该第四认证授权请求是AAA服务器根据WLAN的接入设备发送的第三认证授权请求发出的。该HSS再根据使用该UE的用户的签约数据与该AAA服务器发送的该UE的漫游信息，获取该UE接入该ePDG的判决结果，例如：在WLAN的接入设备与该AAA服务器/HSS完成该WLAN的认证 授权之后，该AAA服务器接收该ePDG发送的第一认证授权请求，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权，该AAA服务器根据该第一认证授权请求向该HSS发送第二认证授权请求，该第二认证授权请求用于请求对该UE接入该ePDG进行认证授权；该HSS接收到该AAA服务器发送的第二认证授权之后，该HSS再根据使用该UE的用户的签约数据与该AAA服务器发送的该UE的漫游信息，获取该UE接入该ePDG的判决结果。该HSS获取该UE接入该ePDG的判决结果之后，该HSS向该AAA服务器发送该UE接入该ePDG的判决结果，例如：该HSS将该UE接入该ePDG的判决结果携带在第二认证授权响应中发送给该AAA服务器；该AAA服务器向该ePDG发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
在本发明方法实施例三的第四种可行的实现方式中，HSS接收AAA服务器发送的UE的本地IP地址，例如：在WLAN的接入设备与AAA服务器/HSS进行WLAN的认证授权过程中，该AAA服务器可以接收该WLAN的接入设备发送的包括该UE的本地IP地址的第三认证授权请求，该第三认证授权请求用于请求对该WLAN进行认证授权；然后该AAA服务器向HSS发送该UE的本地IP地址，例如：该AAA服务器可以将该UE的本地IP地址携带第四认证授权请求中发送给HSS，该第四认证授权请求用于请求对该WLAN进行认证授权；该HSS再根据该UE的本地IP地址获取该UE的漫游信息。该HSS再根据使用该UE的用户的签约数据与该UE的漫游信息，获取该UE接入该ePDG的判决结果，例如：在WLAN的接入设备与该AAA服务器/HSS完成该WLAN的认证授权之后，该AAA服务器接收该ePDG发送的第一认证授权请求，该第一认证授权请求用于请求对该UE接入该ePDG进行认证授权，该AAA服务器根据该第一认证授权请求向该HSS发送第二认证授权请求，该第二认证授权请求用于请求对该UE接入该ePDG进行认证授权；该HSS接收到该AAA服务器发送的第二认证授权之后，该HSS再根据使用该UE的用户的签约数据与该AAA服务器发送的该UE的漫游信息，获取该UE接入该ePDG的判决结果。该HSS获取该UE接入该ePDG的判决结果之后，该HSS向该AAA服务器发送该UE接入该ePDG的判决结果，例如：该HSS将该UE接入该ePDG的判决结果携带在第二认证授权响应中 发送给该AAA服务器；该AAA服务器向该ePDG发送该UE接入该ePDG的判决结果，例如：该AAA服务器可以将该UE接入该ePDG的判决结果携带在第一认证授权响应中发送给该ePDG。
可选地，上述HSS根据该UE的本地IP地址获取该UE的漫游信息，包括：该HSS根据该UE的本地IP地址，以及该本地IP地址与漫游信息的对应关系，获取该UE的漫游信息。具体地，该HSS中存储有本地IP地址与漫游信息的对应关系，该HSS可以根据该UE的本地IP地址，获取该UE的本地IP地址与漫游信息的对应关系，获取与该UE的本地IP地址对应的漫游信息，将该UE的本地IP地址对应的漫游信息作为该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
在本发明UE的非可信WLAN接入控制方法实施例四中，本实施例的执行主体为WLAN的接入设备，该WLAN为该UE的拜访地WLAN。当该UE接入该WLAN时，该WLAN的接入设备为该UE分配本地IP地址；以及该WLAN的接入设备向AAA服务器发送该UE的本地IP地址。后续该AAA服务器接收到该WLAN的接入设备发送的该UE的本地IP地址后执行的过程可以参见本发明方法实施例二的第五种可行的实现方式和第六种可行的实现方式中的相关记载，此处不再赘述。
在本发明UE的非可信WLAN接入控制方法实施例五中，本实施例的执行主体为WLAN的接入设备，该WLAN为该UE的拜访地WLAN。当该UE接入该WLAN时，该WLAN的接入设备获取该UE的漫游信息；以及该WLAN的接入设备向AAA服务器发送该UE的漫游信息。后续该AAA服务器接收到该WLAN的接入设备发送的该UE的漫游信息后执行的过程可以参见本发明方法实施例二的第四种可行的实现方式中的相关记载，此处不再赘述。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
图5为本发明ePDG实施例一的结构示意图，如图5所示，本实施例的ePDG可以包括：接收单元11、处理单元12和发送单元13，其中，接收单元11，用于接收UE发送的IPSec隧道建立请求，该IPSec隧道建立请求包括该UE的本地IP地址，该WLAN为该UE的拜访地WLAN，该ePDG为该UE 的归属地ePDG；处理单元12，用于根据该UE的本地IP地址，获取该UE的漫游信息；发送单元13，用于向AAA服务器发送该UE的漫游信息；接收单元11，还用于接收该AAA服务器发送的该UE接入该ePDG的判决结果，该UE接入该ePDG的判决结果为允许该UE接入该ePDG或者禁止该UE接入该ePDG；处理单元12，还用于根据该UE接入该ePDG的判决结果，对该UE的非可信WLAN接入进行控制。
可选地，处理单元12用于根据该UE的本地IP地址，获取该UE的漫游信息，包括：处理单元12，用于根据该UE的本地IP地址，以及该本地IP地址与漫游信息的对应关系，获取该UE的漫游信息。
可选地，该UE的漫游信息包括该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的ePDG，可以用于执行本发明上述各方法实施例中ePDG所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图6为本发明AAA服务器实施例一的结构示意图，如图6所示，本实施例的AAA服务器可以包括：处理单元21、发送单元22和接收单元23；其中，处理单元21，用于获取该UE的漫游信息；发送单元22，用于向HSS发送该UE的漫游信息，以使该HSS根据该UE的漫游信息获取该UE接入ePDG的判决结果，该ePDG为该UE的归属地ePDG；接收单元23，用于接收该HSS发送的该UE接入该ePDG的判决结果；发送单元22，还用于向该ePDG发送该UE接入该ePDG的判决结果；其中，该UE接入该ePDG的判决结果为允许该UE接入该ePDG或者禁止该UE接入该ePDG。
可选地，处理单元21用于获取该UE的漫游信息，包括：处理单元21，用于接收该ePDG发送的该UE的漫游信息；或者，处理单元21，用于接收该ePDG发送该UE的本地IP地址，以及根据该UE的本地IP地址，获取该UE的漫游信息。
可选地，处理单元21用于获取该UE的漫游信息，包括：处理单元21，用于接收该WLAN的接入设备发送的该UE的漫游信息；或者，处理单元21，用于接收该WLAN的接入设备发送的该UE的本地IP地址，以及根据该UE的本地IP地址，获取该UE的漫游信息。
可选地，处理单元21用于根据该UE的本地IP地址，获取该UE的漫游 信息，包括：该处理单元21，用于根据该UE的本地IP地址，以及该本地IP地址与漫游信息的对应关系，获取该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的AAA服务器，可以用于执行本发明上述各方法实施例中AAA服务器所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图7为本发明HSS实施例一的结构示意图，如图7所示，本实施例的HSS可以包括：处理单元31和发送单元32，其中，处理单元31，用于获取该UE的漫游信息；以及根据使用该UE的用户的签约数据与该UE的漫游信息，获取该UE接入ePDG的判决结果，该ePDG为该UE的拜访地ePDG，该UE接入该ePDG的判决结果为允许该UE接入该ePDG或者禁止该UE接入该ePDG；发送单元32，用于向AAA服务器发送该UE接入该ePDG的判决结果，以使该AAA服务器将该UE接入该ePDG的判决结果转发至该ePDG，使得该ePDG根据该UE接入该ePDG的判决结果对该UE的非可信WLAN接入进行控制。
可选地，处理单元31用于获取该UE的漫游信息，包括：处理单元31，用于接收该AAA服务器发送该UE的漫游信息，或者，处理单元31，用于接收该AAA服务器发送的该UE的本地IP地址，以及根据该UE的本地IP地址，获取该UE的漫游信息。
可选地，处理单元31用于根据该UE的本地IP地址，获取该UE的漫游信息，包括：处理单元31，用于根据该UE的本地IP地址，以及该UE的本地IP地址与漫游信息的对应关系，获取该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的HSS，可以用于执行本发明上述各方法实施例中HSS所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图8为本发明ePDG实施例二的结构示意图，如图8所示，本实施例的ePDG可以包括接收器41、发送器42、存储器43以及分别与接收器41、发送器42、存储器43连接的处理器44。处理器44可以是一个通用中央处理器(英文：Central Processing Unit，简称：CPU)，微处理器，特定应用集成电 路(英文：application-specific integrated circuit，简称：ASIC)，或一个或多个用于控制本发明方案程序执行的集成电路。
存储器43可以是非易失性存储器(Non-volatile Memory)，只读存储器(简称：read-only memory，简称：ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(简称：random access memory，简称：RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(英文：Electrically Erasable Programmable Read-Only Memory，简称：EEPROM)、只读光盘(英文：Compact Disc Read-Only Memory，简称：CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
其中，存储器43用于存储执行本发明UE的非可信WLAN接入控制方法的程序代码，处理器44用于调用存储器43中存储的程序代码，用于执行如下操作：
通过接收器41接收UE发送的IPSec隧道建立请求，该IPSec隧道建立请求包括该UE的本地IP地址，该WLAN为该UE的拜访地WLAN，该ePDG为该UE的归属地ePDG；
根据该UE的本地IP地址，获取该UE的漫游信息；
通过发送器42向AAA服务器发送该UE的漫游信息；
通过接收器41接收该AAA服务器发送的该UE接入该ePDG的判决结果，该UE接入该ePDG的判决结果为允许该UE接入该ePDG或者禁止该UE接入该ePDG；
根据该UE接入该ePDG的判决结果，对该UE的非可信WLAN接入进行控制。
可选地，处理器44用于根据该UE的本地IP地址，获取该UE的漫游信息，包括：处理器44，用于根据该UE的本地IP地址，以及该本地IP地址与漫游信息的对应关系，获取该UE的漫游信息。
可选地，该UE的漫游信息包括该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的ePDG，可以用于执行本发明上述各方法实施例中ePDG所执 行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图9为本发明AAA服务器实施例二的结构示意图，如图9所示，本实施例的AAA服务器可以包括：发送器51、接收器52、存储器53以及分别与发送器51、接收器52、存储器53连接的处理器54。处理器54可以是一个通用CPU，微处理器，ASIC，或一个或多个用于控制本发明方案程序执行的集成电路。
存储器53可以是非易失性存储器，ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是EEPROM、CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
其中，存储器53用于存储执行本发明UE的非可信WLAN接入控制方法的程序代码，处理器54用于调用存储器53中存储的程序代码，用于执行如下操作：
获取该UE的漫游信息；
通过发送器51向HSS发送该UE的漫游信息，以使该HSS根据该UE的漫游信息获取该UE接入ePDG的判决结果，该ePDG为该UE的归属地ePDG；
通过接收器52接收该HSS发送的该UE接入该ePDG的判决结果；
通过发送器51向该ePDG发送该UE接入该ePDG的判决结果；其中，该UE接入该ePDG的判决结果为允许该UE接入该ePDG或者禁止该UE接入该ePDG。
可选地，处理器54用于获取该UE的漫游信息，包括：处理器54通过接收器52接收该ePDG发送的该UE的漫游信息；或者，处理器54通过接收器52接收该ePDG发送该UE的本地IP地址，以及根据该UE的本地IP地址，获取该UE的漫游信息。
可选地，处理器54用于获取该UE的漫游信息，包括：处理器54通过接收器52接收该WLAN的接入设备发送的该UE的漫游信息；或者，处理器54通过接收器52接收该WLAN的接入设备发送的该UE的本地IP地址，以及根据该UE的本地IP地址，获取该UE的漫游信息。
可选地，处理器54用于根据该UE的本地IP地址，获取该UE的漫游信 息，包括：处理器54，用于根据该UE的本地IP地址，以及该本地IP地址与漫游信息的对应关系，获取该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的AAA服务器，可以用于执行本发明上述各方法实施例中AAA服务器所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图10为本发明HSS实施例二的结构示意图，如图10所示，本实施例的HSS可以包括：发送器61、存储器62以及分别与发送器61、存储器62连接的处理器63。处理器63可以是一个通用CPU，微处理器，ASIC，或一个或多个用于控制本发明方案程序执行的集成电路。
存储器62可以是非易失性存储器，ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是EEPROM、CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
其中，存储器62用于存储执行本发明UE的非可信WLAN接入控制方法的程序代码，处理器63用于调用存储器62中存储的程序代码，用于执行如下操作：
获取该UE的漫游信息；以及根据使用该UE的用户的签约数据与该UE的漫游信息，获取该UE接入ePDG的判决结果，该ePDG为该UE的拜访地ePDG，该UE接入该ePDG的判决结果为允许该UE接入该ePDG或者禁止该UE接入该ePDG；
通过发送器61向AAA服务器发送该UE接入该ePDG的判决结果，以使该AAA服务器将该UE接入该ePDG的判决结果转发至该ePDG，使得该ePDG根据该UE接入该ePDG的判决结果对该UE的非可信WLAN接入进行控制。
可选地，本实施例的HSS还可以包括接收器64。处理器63用于获取该UE的漫游信息，包括：处理器63，用于通过接收器64接收该AAA服务器发送该UE的漫游信息，或者，处理器63，用于通过接收器64接收该AAA服务器发送的该UE的本地IP地址，以及根据该UE的本地IP地址，获取该UE的漫游信息。
可选地，处理器63用于根据该UE的本地IP地址，获取该UE的漫游信息，包括：处理器63，用于根据该UE的本地IP地址，以及该UE的本地IP地址与漫游信息的对应关系，获取该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、所述UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的HSS，可以用于执行本发明上述各方法实施例中HSS所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图11为本发明WLAN的接入设备实施例一的结构示意图，如图11所示，本实施例的WLAN的接入设备可以包括：处理单元71和发送单元72，其中，在第一种可行的实现方式中，处理单元71，用于当UE接入该WLAN时，为该UE分配本地IP地址，该WLAN为该UE的拜访地WLAN；发送单元72，用于向AAA服务器发送该UE的本地IP地址。
在第二种可行的实现方式中，处理单元71，用于当UE接入该WLAN时，获取该UE的漫游信息，该WLAN为该UE的拜访地WLAN；发送单元72，用于向AAA服务器发送该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的公共陆地移动网络PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的WLAN的接入设备，可以用于执行本发明上述各方法实施例中WLAN的接入设备所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图12为本发明WLAN的接入设备实施例二的结构示意图，如图12所示，本实施例的WLAN的接入设备可以包括：发送器81、存储器82以及分别与发送器81、存储器82连接的处理器83。处理器83可以是一个通用CPU，微处理器，ASIC，或一个或多个用于控制本发明方案程序执行的集成电路。
存储器82可以是非易失性存储器，ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是EEPROM、CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。
其中，存储器82用于存储执行本发明UE的非可信WLAN接入控制方法的程序代码，处理器83用于调用存储器82中存储的程序代码，用于执行如下操作：
当该UE接入该WLAN时，为该UE分配本地IP地址；向AAA服务器发送该UE的本地IP地址。或者，
当该UE接入该WLAN时，获取该UE的漫游信息；通过发送器81向AAA服务器发送该UE的漫游信息。
可选地，该UE的漫游信息包括：该UE接入的PLMN的标识、该UE所处地域的标识、该WLAN的标识中的至少一个。
本实施例的WLAN的接入设备，可以用于执行本发明上述各方法实施例中WLAN的接入设备所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
图13为本发明UE的非可信WLAN接入控制***实施例的结构示意图，如图13所示，本实施例的***包括：ePDG10、AAA服务器20、HSS30、UE40和WLAN的接入设备50，该WLAN为该UE的拜访地WLAN；其中，ePDG10可以采用图5或图8所示装置实施例的结构，其对应地，可以执行本发明上述各方法实施例中ePDG所执行的技术方案，其实现原理和技术效果类似，此处不再赘述；AAA服务器20可以采用图6或图9所示装置实施例的结构，其对应地，可以执行本发明上述各方法实施例中AAA服务器所执行的技术方案，其实现原理和技术效果类似，此处不再赘述；HSS30可以采用图7或图10所示装置实施例的结构，其对应地，可以执行本发明上述各方法实施例中HSS所执行的技术方案，其实现原理和技术效果类似，此处不再赘述；WLAN的接入设备50可以采用图11或图12所示装置实施例的结构，其对应地，可以执行本发明上述各方法实施例中WLAN的接入设备所执行的技术方案，其实现原理和技术效果类似，此处不再赘述。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (31)

  1. 一种用户设备UE的非可信无线局域网WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，其特征在于，包括：
    演进分组数据网关ePDG接收UE发送的互联网协议安全IPSec隧道建立请求，所述IPSec隧道建立请求包括所述UE的本地IP地址，所述ePDG为所述UE的归属地ePDG；
    所述ePDG根据所述UE的本地IP地址，获取所述UE的漫游信息；
    所述ePDG向认证授权计费AAA服务器发送所述UE的漫游信息；
    所述ePDG接收所述AAA服务器发送的所述UE接入所述ePDG的判决结果，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；
    所述ePDG根据所述UE接入所述ePDG的判决结果，对所述UE的非可信WLAN接入进行控制。
  2. 根据权利要求1所述的方法，其特征在于，所述ePDG根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：
    所述ePDG根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述UE的漫游信息包括所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  4. 一种用户设备UE的非可信无线局域网WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，其特征在于，包括：
    认证授权计费AAA服务器获取所述UE的漫游信息；
    所述AAA服务器向归属签约数据服务器HSS发送所述UE的漫游信息，以使所述HSS根据所述UE的漫游信息获取所述UE接入演进分组数据网关ePDG的判决结果，所述ePDG为所述UE的归属地ePDG；
    所述AAA服务器接收所述HSS发送的所述UE接入所述ePDG的判决结果；
    所述AAA服务器向所述ePDG发送所述UE接入所述ePDG的判决结果；
    其中，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG 或者禁止所述UE接入所述ePDG。
  5. 根据权利要求4所述的方法，其特征在于，所述AAA服务器获取所述UE的漫游信息，包括：
    所述AAA服务器接收所述ePDG发送的所述UE的漫游信息；或者，
    所述AAA服务器接收所述ePDG发送所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
  6. 根据权利要求4所述的方法，其特征在于，所述AAA服务器获取所述UE的漫游信息，包括：
    所述AAA服务器接收所述WLAN的接入设备发送的所述UE的漫游信息；或者，
    所述AAA服务器接收所述WLAN的接入设备发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述AAA服务器根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：
    所述AAA服务器根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
  8. 根据权利要求4-7任意一项所述的方法，其特征在于，所述UE的漫游信息包括：所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  9. 一种用户设备UE的非可信无线局域网WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，其特征在于，包括：
    归属签约数据服务器HSS获取所述UE的漫游信息；
    所述HSS根据使用所述UE的用户的签约数据与所述UE的漫游信息，获取所述UE接入演进分组数据网关ePDG的判决结果，所述ePDG为所述UE的拜访地ePDG，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；
    所述HSS向认证授权计费AAA服务器发送所述UE接入所述ePDG的判决结果，以使所述AAA服务器将所述UE接入所述ePDG的判决结果转发至所述ePDG，使得所述ePDG根据所述UE接入所述ePDG的判决结果对所述UE的非可信WLAN接入进行控制。
  10. 根据权利要求9所述的方法，其特征在于，所述HSS获取所述UE的漫游信息，包括：
    所述HSS接收所述AAA服务器发送所述UE的漫游信息，或者，
    所述HSS接收所述AAA服务器发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
  11. 根据权利要求10所述的方法，其特征在于，所述HSS根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：
    所述HSS根据所述UE的本地IP地址，以及所述UE的本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
  12. 根据权利要求9-11任意一项所述的方法，其特征在于，所述UE的漫游信息包括：所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  13. 一种用户设备UE的非可信无线局域网WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，其特征在于，包括：
    当所述UE接入所述WLAN时，所述WLAN的接入设备为所述UE分配本地互联网协议IP地址；
    所述WLAN的接入设备向认证授权计费AAA服务器发送所述UE的本地IP地址。
  14. 一种用户设备UE的非可信无线局域网WLAN接入控制方法，所述WLAN为所述UE的拜访地WLAN，其特征在于，包括：
    当所述UE接入所述WLAN时，所述WLAN的接入设备获取所述UE的漫游信息；
    所述WLAN的接入设备向认证授权计费AAA服务器发送所述UE的漫游信息。
  15. 根据权利要求14所述的方法，其特征在于，所述UE的漫游信息包括：所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  16. 一种演进分组数据网关ePDG，其特征在于，包括：
    接收单元，用于接收UE发送的互联网协议安全IPSec隧道建立请求，所述IPSec隧道建立请求包括所述UE的本地IP地址，所述ePDG为所述UE 的归属地ePDG；
    处理单元，用于根据所述UE的本地IP地址，获取所述UE的漫游信息；
    发送单元，用于向认证授权计费AAA服务器发送所述UE的漫游信息；
    所述接收单元，还用于接收所述AAA服务器发送的所述UE接入所述ePDG的判决结果，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；
    所述处理单元，还用于根据所述UE接入所述ePDG的判决结果，对所述UE的非可信无线局域网WLAN接入进行控制，所述WLAN为所述UE的拜访地WLAN。
  17. 根据权利要求16所述的ePDG，其特征在于，所述处理单元用于根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述处理单元，用于根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
  18. 根据权利要求16或17所述的ePDG，其特征在于，所述UE的漫游信息包括所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  19. 一种认证授权计费AAA服务器，其特征在于，包括：
    处理单元，用于获取所述UE的漫游信息；
    发送单元，用于向归属签约数据服务器HSS发送所述UE的漫游信息，以使所述HSS根据所述UE的漫游信息获取所述UE接入演进分组数据网关ePDG的判决结果，所述ePDG为所述UE的归属地ePDG；
    接收单元，用于接收所述HSS发送的所述UE接入所述ePDG的判决结果；
    所述发送单元，还用于向所述ePDG发送所述UE接入所述ePDG的判决结果；
    其中，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG。
  20. 根据权利要求19所述的AAA服务器，其特征在于，所述处理单元用于获取所述UE的漫游信息，包括：所述处理单元，用于接收所述ePDG发送的所述UE的漫游信息；或者，所述处理单元，用于接收所述ePDG发 送所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
  21. 根据权利要求19所述的AAA服务器，其特征在于，所述处理单元用于获取所述UE的漫游信息，包括：所述处理单元，用于接收所述WLAN的接入设备发送的所述UE的漫游信息；或者，所述处理单元，用于接收所述WLAN的接入设备发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
  22. 根据权利要求20或21所述的AAA服务器，其特征在于，所述处理单元用于根据所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述处理单元，用于根据所述UE的本地IP地址，以及所述本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
  23. 根据权利要求19-22任意一项所述的AAA服务器，其特征在于，所述UE的漫游信息包括：所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  24. 一种归属签约数据服务器HSS，其特征在于，包括：
    处理单元，用于获取所述UE的漫游信息；以及根据使用所述UE的用户的签约数据与所述UE的漫游信息，获取所述UE接入演进分组数据网关ePDG的判决结果，所述ePDG为所述UE的拜访地ePDG，所述UE接入所述ePDG的判决结果为允许所述UE接入所述ePDG或者禁止所述UE接入所述ePDG；
    发送单元，用于向认证授权计费AAA服务器发送所述UE接入所述ePDG的判决结果，以使所述AAA服务器将所述UE接入所述ePDG的判决结果转发至所述ePDG，使得所述ePDG根据所述UE接入所述ePDG的判决结果对所述UE的非可信WLAN接入进行控制。
  25. 根据权利要求24所述的HSS，其特征在于，所述处理单元用于获取所述UE的漫游信息，包括：所述处理单元，用于接收所述AAA服务器发送所述UE的漫游信息，或者，所述处理单元，用于接收所述AAA服务器发送的所述UE的本地IP地址，以及根据所述UE的本地IP地址，获取所述UE的漫游信息。
  26. 根据权利要求25所述的HSS，其特征在于，所述处理单元用于根据 所述UE的本地IP地址，获取所述UE的漫游信息，包括：所述处理单元，用于根据所述UE的本地IP地址，以及所述UE的本地IP地址与漫游信息的对应关系，获取所述UE的漫游信息。
  27. 根据权利要求24-26任意一项所述的HSS，其特征在于，所述UE的漫游信息包括：所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  28. 一种无线局域网WLAN的接入设备，其特征在于，包括：
    处理单元，用于当用户设备UE接入所述WLAN时，为所述UE分配本地互联网协议IP地址，所述WLAN为所述UE的拜访地WLAN；
    发送单元，用于向认证授权计费AAA服务器发送所述UE的本地IP地址。
  29. 一种无线局域网WLAN的接入设备，其特征在于，包括：
    处理单元，用于当用户设备UE接入所述WLAN时，获取所述UE的漫游信息，所述WLAN为所述UE的拜访地WLAN；
    发送单元，用于向认证授权计费AAA服务器发送所述UE的漫游信息。
  30. 根据权利要求29所述的WLAN的接入设备，其特征在于，所述UE的漫游信息包括：所述UE接入的公共陆地移动网络PLMN的标识、所述UE所处地域的标识、所述WLAN的标识中的至少一个。
  31. 一种用户设备UE的非可信无线局域网WLAN接入控制***，其特征在于，包括：UE、如权利要求16-18任意一项所述的演进分组数据网关ePDG、如权利要求19-23任意一项所述的认证授权计费AAA服务器、如权利要求24-27任意一项所述的归属签约数据服务器HSS、如权利要求28-30任意一项所述的WLAN的接入设备，所述WLAN为所述UE的拜访地WLAN。
PCT/CN2014/095142 2014-12-26 2014-12-26 用户设备的非可信无线局域网接入控制方法、设备和*** WO2016101267A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2014/095142 WO2016101267A1 (zh) 2014-12-26 2014-12-26 用户设备的非可信无线局域网接入控制方法、设备和***
CN201480034276.XA CN105934918B (zh) 2014-12-26 2014-12-26 用户设备的非可信无线局域网接入控制方法、设备和***

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/095142 WO2016101267A1 (zh) 2014-12-26 2014-12-26 用户设备的非可信无线局域网接入控制方法、设备和***

Publications (1)

Publication Number Publication Date
WO2016101267A1 true WO2016101267A1 (zh) 2016-06-30

Family

ID=56148994

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095142 WO2016101267A1 (zh) 2014-12-26 2014-12-26 用户设备的非可信无线局域网接入控制方法、设备和***

Country Status (2)

Country Link
CN (1) CN105934918B (zh)
WO (1) WO2016101267A1 (zh)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080107119A1 (en) * 2006-11-08 2008-05-08 Industrial Technology Research Institute Method and system for guaranteeing QoS between different radio networks
CN102340766A (zh) * 2010-07-23 2012-02-01 中兴通讯股份有限公司 归属网络获取拜访网络中网元信息的方法及***
WO2013063783A1 (zh) * 2011-11-03 2013-05-10 华为技术有限公司 一种数据安全通道的处理方法及设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101577909B (zh) * 2008-05-05 2011-03-23 大唐移动通信设备有限公司 非3gpp接入***信任类型的获取方法、***及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080107119A1 (en) * 2006-11-08 2008-05-08 Industrial Technology Research Institute Method and system for guaranteeing QoS between different radio networks
CN102340766A (zh) * 2010-07-23 2012-02-01 中兴通讯股份有限公司 归属网络获取拜访网络中网元信息的方法及***
WO2013063783A1 (zh) * 2011-11-03 2013-05-10 华为技术有限公司 一种数据安全通道的处理方法及设备

Also Published As

Publication number Publication date
CN105934918B (zh) 2020-06-02
CN105934918A (zh) 2016-09-07

Similar Documents

Publication Publication Date Title
US9800563B2 (en) Method and device for processing data security channel
EP3376819B1 (en) Ue, mme, ue communication control method, and mme communication control method
JP6628295B2 (ja) 認証されていないユーザのための３ｇｐｐ進化型パケットコアへのｗｌａｎアクセスを介した緊急サービスのサポート
US10420056B2 (en) UE, MME, communication control method of UE, and communication control method of MME
CN106031105B (zh) 针对epc的受信任wlan访问的过载控制
KR101880149B1 (ko) 로컬 ｉｐ 접속 서비스들에 접속하는 사용자 단말 지원 방법 및 이를 위한 장치
KR101613895B1 (ko) 신뢰된 비 3gpp 액세스 네트워크를 통해 접속된 사용자 장비에 대하여 3gpp hplmn에서 서비스 전달 플랫폼에 의해 전달된 서비스들에 대한 액세스의 허용
WO2007019771A1 (en) An access control method of the user altering the visited network, the unit and the system thereof
WO2013016968A1 (zh) 一种接入方法、***及移动智能接入点
WO2006002601A1 (fr) Procede pour l'etablissement de la connexion de session par les utilisateurs de reseau local sans fil
CN107466465B (zh) 使用互联网密钥交换消息来配置活动性检查
KR101734166B1 (ko) 모바일 네트워크에 액세스하는 방법, 장치, 및 시스템
WO2016155012A1 (zh) 一种无线通信网络中的接入方法、相关装置及***
WO2009000124A1 (fr) Procede de selection de passerelle dans un reseau sans fil
CN108616805B (zh) 一种紧急号码的配置、获取方法及装置
WO2018058680A1 (zh) 一种本地业务授权方法及相关设备
EP2269405A2 (en) Restricting handover of a mobile station
WO2018058365A1 (zh) 一种网络接入授权方法、相关设备及***
WO2018058691A1 (zh) 一种建立公用数据网连接的方法及相关设备
US9629179B2 (en) Method and device for processing local access connection
TWI516151B (zh) 通訊方法與通訊系統
JP6577052B2 (ja) アクセスポイント名許可方法、アクセスポイント名許可装置、およびアクセスポイント名許可システム
WO2017129101A1 (zh) 路由控制方法、装置及***
WO2014079325A1 (zh) 一种移动终端使用漫游本地业务的方法、***及装置
CN101483929B (zh) 非3gpp接入网关获知与策略决策实体交互方式的方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14908835

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14908835

Country of ref document: EP

Kind code of ref document: A1