CN102572774A - Network access method in multiple modes, access device and authentication device - Google Patents

Abstract

The invention discloses a method for accessing a network in multiple access modes, characterized in that the network is a network separated from an identity mark and a location mark, and the method includes: a user terminal with the identity mark of the same user passes through One or more access nodes with different location identifiers use multiple access methods to access the network, wherein the access methods correspond to the location identifiers one by one, and the multiple access methods correspond to the user's the same identity. The invention also discloses an access device and an authentication device, which are applied to a network where identity marks and position marks are separated. The present invention can realize that the user can normally access the network separated from the identity mark and the location mark by adopting multiple access modes, and each access mode can independently initiate services, and the service flows will not conflict with each other.

Description

A method for accessing a network in multiple access modes, an access device, and an authentication device

technical field

The present invention relates to the field of communication technology, in particular to a method for accessing a network in multiple access modes, an access device and an authentication device.

Background technique

In the Transmission Control Protocol/Internet Protocol (TCP/IP), which is widely used in the existing Internet, the IP address has dual functions, that is, as the position of the network interface of the communication terminal host at the network layer in the network topology The identifier is also used as the identity identifier of the network interface of the transport layer host. At the beginning of TCP/IP design, the movement of the host was not considered. However, when the host mobile becomes more and more common, the defect of semantic overload of IP address becomes more and more obvious. When the IP address of the host changes, not only the route will change, but also the identity of the communication terminal host will change, which will cause the routing load to become heavier, and the change of the host identity will lead to the interruption of applications and connections. The purpose of separating the identity identifier and the location identifier is to solve the semantic overload of the IP address in TCP/IP, the serious routing load, and the security issues, so as to separate the dual functions of the IP address and realize the mobility, multi-homing, Support for dynamic IP address redistribution, routing load reduction, and mutual visits between different network areas in the next generation Internet.

To solve the above problems, a variety of network architectures that separate identity and location identifiers have been proposed, including Host Identity Protocol (HIP) and Location Identity Separation Protocol (LISP), both of which are identity and location separation networks.

The identity and location separation network architecture shown in Figure 1 (the application number is CN200910174826.9 Chinese patent application, the application date is October 17, 2009), for the convenience of description, this user identity and location separation network will be referred to as It is SILSN (Subscriber Identifier & Locator Separation Network); SILSN includes access server (Access Service Node, ASN), user equipment (User Equipment, UE) and identity and location registration register (Identification & Locater Register, ILR), etc. Among them, the ASN is used to access the user equipment, and is responsible for realizing the access of the user equipment, as well as functions such as charging and switching, and the ILR is responsible for the user location registration and identification functions. Among them, ASN is a logical entity, which can be Serving GPRS Support Node (SGSN), Gateway GPRS Support Node (GGSN), Packet Data Service Node (Packet Data Serving Node, PDSN) and broadband access server (Broadband Remote Access Server, BRAS) and other equipment. The above-mentioned ILR can be a key management system (Key Management System, KMS), a home location register (Home Location Register, HLR), a home subscriber server (Home Subscriber Server, HSS), an authorization/authentication/billing server ( Authorization, Authentication, Accounting, AAA), and other entities that undertake end-to-end key management and negotiation functions.

In SILSN, the user is identified by the access identifier (Access Identification, AID) (used to identify the identity of the user), and the ASN is identified by the routing identifier (Route Identification, RID) (used to identify the location of the user), each Both user and ASN have their own independent AID or RID. When a user (such as UE1) in the SILSN accesses the network, it first registers its location with the ILR through the ASN (that is, registers under which ASN the UE1 is located). After UE1 registers, the ILR establishes the correspondence between the AID of the user and the RID of the accessed ASN. Afterwards, if UE1 needs to communicate with UE2, after UE1 sends a data message, ASN1 queries the ILR for the location of UE2, that is, which ASN UE2 is located under. In Figure 1, UE2 is located under ASN9. Then ASN1 sends the data message to the corresponding ASN9, and ASN9 sends the processed data message to UE2.

The above-mentioned network realizes the separation of the user's identification and location identification very well. When the user equipment moves and roams, it does not need to change the identification, which ensures the continuity of the service during the movement. Routing scalability and security have also been significantly improved.

In the original SILSN, each user equipment can only access the network in one way. However, in recent years, people have gradually become accustomed to using multiple ways to access the network. For example, some user equipment can use Wideband Code Division Multiple Access (WCDMA) and Wireless Local Area Network (WLAN) at the same time. ) and other ways to access the network to make full use of the network bandwidth, which puts forward new requirements for the SILSN, which was originally designed as a single access mode.

For existing SILSN: SILSN is not designed for multiple access methods. Therefore, when a user equipment uses multiple access methods to access the network, each user equipment can only be assigned a different AID for each access method, which is equivalent to using different access identifiers for the same user equipment. access, which violates the user requirement of the uniqueness of the access identifier.

At the same time, the same user equipment has different identities, so that when the user equipment accesses the network through multiple access methods, the maximum bandwidth of multiple access methods cannot be combined and used, and when one access link is interrupted, Seamlessly switch to another connected link. In addition, the behavior of one user device is manifested as multiple access identifiers, which is not conducive to the national security department to monitor and trace the user, and affects the security of the network.

The same problem also exists in other network architectures that separate identity identifiers and location identifiers.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method for accessing the network through multiple access methods, access equipment and authentication equipment, so that users can use a single access identifier when accessing the network through multiple access methods Access to the network realizes effective utilization of bandwidth, continuity of services during switching, and security of the network.

In order to solve the above problems, the present invention provides a method for accessing a network in multiple access modes, characterized in that the network is a network in which identity identifiers and location identifiers are separated, and the method includes:

User terminals with the identity of the same user access the network through one or more access nodes with different location identifiers using multiple access methods, wherein the access methods correspond to the location identifiers one by one, so The multiple access modes correspond to the same identity of the user.

Further, the access node has one or more location identifiers;

When the user terminal accesses the network through an access node with different location identifiers using multiple access methods, the access node has multiple location identifiers, and each access method corresponds to a location identifier;

When the user terminal accesses the network through multiple access nodes with different location identifiers using multiple access methods, each access node has a location identifier, and each access method corresponds to a location identifier of the access node; or , when the user terminal accesses the network through multiple access nodes with different location identifiers using multiple access methods, the access node has one or more location identifiers, and each access method corresponds to a location identifier.

Further, the steps for the user terminal to access the network using multiple access methods include:

The user terminal sends the identity of the user to the access node to initiate registration; and

The access node sends the user access information to the authentication node, wherein the user access information includes the identity of the user, the access mode adopted by the user terminal in this registration, and the corresponding access mode. a location identifier of the access node;

The authentication node stores the corresponding relationship of the identity, wherein the corresponding relationship includes the user's identity, an access method, and a location identifier of the access node corresponding to the access method.

Further, after the step of the access node sending the user access information to the authentication node, the method further includes:

The authentication node judges whether the corresponding relationship of the identity is stored on the authentication node according to the identity in the received user access information;

If not, execute the step of the authentication node storing the corresponding relationship of the identity;

If so, the authentication node judges whether there is a corresponding relationship of the same access mode in the corresponding relationship of the identity; if yes, replace the original corresponding relationship with the new corresponding relationship in the received user access information If there is no corresponding relationship of the identity, execute the step of saving the corresponding relationship of the identity; if not, directly execute the step of saving the corresponding relationship of the identity.

further,

The access methods include Wireless Local Area Network (WLAN), General Packet Radio Service (GPRS), Wideband Code Division Multiple Access (WCDMA), Time Division Synchronous Code Division Multiple Access (TD-SCDMA), Point-to-Point Protocol over Ethernet (PPPoE), One or more of the access modes of Worldwide Interoperability for Microwave Access (WiMAX), Long Term Evolution (LTE), and CDMA2000.

Further, the method also includes:

The user terminal sends the user's identity to the access node to initiate logout;

The access node sends the identity of the user, the location identifier of the access node and the access mode corresponding to the access node to the authentication node; and

The authentication node sets the received corresponding relationship of the access mode of the identity mark as unavailable or deletes the received corresponding relationship of the identity mark of the access mode, and completes the logout.

Further, the method also includes:

The access node sends the identity of the user to be queried to the authentication node to initiate a location query; and

The authentication node queries the location identifier corresponding to each access mode in all correspondences about the identity stored on the authentication node according to the identity, and returns all the correspondences about the identity to the access server .

Further, the network that separates the ID and the location identifier is a User Identity and Location Separation Network (SILSN); the access node is an access server (ASN), and the authentication node is an ID and location registration register ( ILR), the identity identifier is an access identifier (AID), and the location identifier is a routing identifier (RID).

In order to solve the above problems, the present invention also provides an access device, which is applied to a network where the identity identifier and the location identifier are separated. The access device includes one or more access modules, and each access module is for a location identifier. When the access device includes multiple access modules, the location identifiers of each access module are different from each other; when the access device includes one access module, the location identifier of the access module is different from other access modules in the network. The location identification of the access module of the access device is different;

The access module is configured to use the location identifier of the access module to connect the user terminal through one of the access methods when the user terminal with the identity of the same user uses multiple access methods to access the network. access to the network;

Wherein, the multiple access modes correspond to the same identity identifier of the user, and the multiple access modes correspond to the location identifier one by one.

Further, the access module includes:

a receiving unit, configured to receive a registration request carrying the user's identity that is initiated by the user terminal to the access device; and

a sending unit, configured to send the user access information to the authentication node so that the authentication node saves the user information as the corresponding relationship of the identity, wherein the user access information includes the user identity, The access method used by the user terminal in this registration and the location identifier of the access node corresponding to the access method, the correspondence includes the user's identity, the access method and all the location identifiers corresponding to the access method The location identifier of the access node.

further,

The receiving unit is further configured to receive a logout request carrying the user's identity that is initiated by the user terminal to the access device;

The sending unit is further configured to send the identity of the user, the location identifier of the access node and the access mode corresponding to the access node to the authentication node, so that the authentication node will receive the identity The corresponding relationship of the access mode identified is set to be unavailable or the corresponding relationship of the access mode of the received identification is deleted, and the logout is completed.

Further, the access device further includes a storage module, wherein:

The sending unit is further configured to send the identity of the user to be queried to the authentication node to initiate a location query; and

The receiving unit is further configured to receive the information returned to the access device after the authentication node inquires about the location identifiers corresponding to each access mode in all the corresponding relationships of the identity identifier saved thereon according to the identity identifier. All correspondences of the identity;

The storage module is configured to store all correspondences of the identity marks returned by the authentication node.

Further, the network that separates the identity identifier and the location identifier is a user identity identifier and location separation network (SILSN); the access device is an access server (ASN), and the identity identifier is an access identifier (AID) , the location identifier is a routing identifier (RID).

Further, the access device includes one of a Serving General Packet Radio Service Support Node (SGSN), a Gateway General Packet Radio Service Support Node (GGSN), a Packet Data Service Node (PDSN) and a Broadband Access Server (BRAS) .

further,

The access methods include Wireless Local Area Network (WLAN), General Packet Radio Service (GPRS), Wideband Code Division Multiple Access (WCDMA), Time Division Synchronous Code Division Multiple Access (TD-SCDMA), Point-to-Point Protocol over Ethernet (PPPoE), One or more of the access modes of Worldwide Interoperability for Microwave Access (WiMAX), Long Term Evolution (LTE), and CDMA2000.

In order to solve the above problems, the present invention also provides an authentication device, which is applied to a network where the identity mark and the location mark are separated, and the authentication device includes:

A receiving module, configured to receive user access information sent by an access node when a user terminal with the identity of the same user accesses the network through one or more access nodes with different location identifiers using multiple access methods ; Wherein, the user access information includes the identity of the user, the access mode adopted by the user terminal in this registration, and the location identification of the access node corresponding to the access mode; The access method corresponds to the same identity of the user, and the multiple access methods correspond to the location identifier one by one;

A storage module, configured to store the user information as a correspondence of the identity, wherein the correspondence includes the identity of the user, the access method, and the location identifier of the access node corresponding to the access method.

Further, the authentication device also includes a judging module, wherein:

The judging module is configured to judge whether the storage module saves the corresponding relationship of the identity according to the received identity in the user access information; if not, send a saving notification to the storage module; If so, judge whether there is a corresponding relationship of the same access mode in the corresponding relationship of the identity, if there is a corresponding relationship of the same access mode, then send a replacement notification to the storage module, if there is no corresponding relationship of the same access mode mode, then notify the storage module to save the user information as the corresponding relationship of the identity;

The storage module saves the user information as the corresponding relationship of the identity in the following manner: if receiving the saving notice from the judging module, saves the user information as the corresponding relationship of the identity; In response to a replacement notification to the judging module, the storage module replaces the original corresponding relationship of the identity with a new corresponding relationship.

Further, the access method includes wireless local area network (WLAN), general packet radio service (GPRS), wideband code division multiple access (WCDMA), time division synchronous code division multiple access (TD-SCDMA), point-to-point protocol ( One or more of PPPoE), Worldwide Interoperability for Microwave Access (WiMAX), Long Term Evolution (LTE), and CDMA2000 access methods.

Further, the receiving module is further configured to receive the user's identity identifier sent by the access node to the authentication device when the access node receives a logout request carrying the user's identity identifier initiated by the user terminal, and the access node's The location identifier and the access method corresponding to the access node; and

The storage module is further configured to set the received correspondence between the identity identifier and the access method as unavailable or delete the received correspondence corresponding to the identity identifier and the access method to complete the logout.

Further, the authentication device also includes a query module and a sending module, wherein:

The receiving module is also used to receive the location query sent by the access node with the identity of the user to be queried;

The query module is configured to query the position identifier corresponding to each access mode in all correspondences about the identity stored in the storage module according to the identity, and send all the correspondences about the identity to the sending module;

The sending module is configured to return all correspondences about the identity to the access node.

Further, the network that separates the ID and the location identifier is a User Identity and Location Separation Network (SILSN); the access node is an access server (ASN), and the authentication node is an ID and location registration register ( ILR), the identity identifier is an access identifier (AID), and the location identifier is a routing identifier (RID).

Further, the authentication device includes one of a Key Management System (KMS), a Home Location Register (HLR), a Home Subscriber Server (HSS), and an Authorization/Authentication/Accounting Server (AAA).

By adopting the technical solution of the present invention, it is possible to realize that users can normally access the network with separated identity mark and location mark by adopting multiple access modes, and each access mode can independently initiate services without mutual conflict between service flows. Moreover, when one access mode is unavailable, other access modes can be used, thereby improving service continuity. In addition, in the technical solution of the present invention, multiple access methods use the same identity, which makes network source tracing easier and improves network security.

Description of drawings

Figure 1 is a schematic diagram of the SILSN architecture;

FIG. 2 is a schematic diagram of a user terminal accessing different ASNs when a multi-access mode is adopted in the present invention;

FIG. 3 is a schematic diagram of physical integration of ASNs supporting different access modes in the present invention;

4 is a schematic diagram of the corresponding relationship between AID and RID in the ILR in the prior art;

5 is a schematic diagram of the corresponding relationship between AID and RID in the ILR in the embodiment of the present invention;

FIG. 6 is a flow chart of the user location registration process in an embodiment of the present invention;

FIG. 7 is a flow chart of the location registration process through two access methods in another embodiment of the present invention;

FIG. 8 is a flow chart of a user location logout process in an embodiment of the present invention;

Fig. 9 is the flowchart of the ASN inquiring the location of the called user terminal from the ILR according to the embodiment of the present invention;

FIG. 10 is a schematic structural diagram of an access device according to an embodiment of the present invention;

Fig. 11 is a schematic structural diagram of an authentication device according to an embodiment of the present invention.

Detailed ways

In a network where identity identifiers and location identifiers are separated, each user has two identifiers, namely: AID and RID, where AID represents the identity of the user, and RID represents the location of the user. When a user uses multiple access methods to access the network, in order to maintain the uniqueness of the user identity AID, the AID must remain unchanged, so only the RID is used to distinguish the various access methods of the user.

The present invention provides a method for a user to access a network through multiple access methods, which is applied to a network where identity marks and location marks are separated. The method includes: a user terminal with the same user identity One or more access nodes use multiple access methods to access the network, wherein the access methods correspond to the location identifiers one by one, and the multiple access methods correspond to the same identity identifier of the user .

Wherein, the access node has one or more location identifiers;

When the user terminal accesses the network through an access node with different location identifiers using multiple access methods, the access node has multiple location identifiers, and each access method corresponds to a location identifier;

When the user terminal accesses the network through multiple access nodes with different location identifiers using multiple access methods, each access node has a location identifier, and each access method corresponds to a location identifier of the access node; or

When a user terminal accesses the network through multiple access nodes with different location identifiers using multiple access methods, the access node has one or more location identifiers, and each access method corresponds to a location identifier.

The access mode in the present invention comprises: Wireless Local Area Network (WLAN), General Packet Radio Service (GPRS), Wideband Code Division Multiple Access (WCDMA), Time Division Synchronous Code Division Multiple Access (TimeDivision-Synchronous Code Division Multiple Access, TD-SCDMA ), Point-to-Point Protocol over Ethernet (PPPoE), Worldwide Interoperability for Microwave Access (WiMAX), Long Term Evolution (LTE), and CDMA2000 access methods or more.

Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined arbitrarily with each other. In the embodiment of the present invention, the SILSN is taken as an example for illustration, but the present invention is not limited thereto, and can also be applied to other networks in which identity identifiers and location identifiers are separated.

In order to distinguish multiple access methods of the same user, when the same user in SILSN uses multiple access methods to access the network, a single AID can be used as the access identifier (that is, the unique AID that identifies the user’s identity), but supports Access servers of different access modes have different RIDs. That is, different access methods must be registered under different ASNs, or different access methods must be registered through the same ASN with different RIDs. More precisely, when the same user uses different access methods to access, the accessed ASNs must have different RIDs, and the access methods correspond to the RIDs one by one.

In order to ensure that users can use different access methods to access normally, in a technical solution provided by the present invention, different access methods can only access different access servers, more strictly speaking, multiple access methods Access servers with the same RID address cannot be accessed. As shown in Figure 2, when a user accesses the network through UE1 using three access methods of WLAN, Code Division Multiple Access (CDMA) and WCDMA, the three access methods access ASN1, ASN2 and ASN3, so as to achieve access to the network through multiple access methods.

In another technical solution, in actual deployment, when a user accesses a certain operator through a user equipment, an ASN of the operator can support multiple access methods at the same time. For example, the ASN can It supports WLAN access, and can also support CDMA access, as shown in Figure 3. At this time, it only needs to have two different RIDs externally for the two access methods of the device. In this case, it can be considered that ASNs supporting different access methods can be physically combined into one.

For different access methods, when the UE registers the location of the ASN in the ILR, the RID registered in each access method must be different, so that the ILR can distinguish the real ASN of each access method.

In addition, in order to support users to access the network using multiple access methods, the present invention also improves the ILR, so that when users use multiple access methods to access the network, they can register different The corresponding relationship between AID and RID.

In the original SILSN, the ILR stores the correspondence between the user's AID and the RID of the ASN accessed by the user terminal. This correspondence is one-to-one, that is to say, each AID has a unique RID corresponding to it. .

For example: the corresponding relationship between AID and RID on the ILR of the original SILSN is:

AID1->RID4

AID2->RID5

AID3->RID5

 …

The above corresponding relationship can be expressed graphically as shown in FIG. 4 .

It can be seen that in the original solution, each AID has only one RID corresponding to it in the ILR, so when the user successively uses multiple access methods to access the network, the corresponding relationship between the AID and the RID in the ILR will be rewritten, so In this solution, each user terminal can only support one access method.

In order to support users to access the network using multiple access methods, the present invention also improves the correspondence between AID and RID in the ILR, and associates the correspondence between AID and RID with access methods, so that each AID can correspond to multiple RIDs , so that when a user uses multiple access methods to access the network, one access method will not overwrite (rewrite) the corresponding relationship between AID and RID of another access method during location registration, so that the ILR can record various The location information of the access method ensures that other users can call this user smoothly.

For example, after the user supports multiple accesses, the corresponding relationship in the ILR is as follows:

AID1->RID4, access mode 1 (=WLAN)

AID1->RID5, access mode 2 (=GPRS)

AID1->RID8, access mode 3 (=WCDMA)

AID2->RID7, access mode 1 (=WLAN)

AID3->RID4, access mode 1 (=WLAN)

AID3->RID2, access mode 3 (=WCDMA)

 …

The graphical representation of the corresponding relationship in the above ILR is shown in Figure 5.

By adopting the above solution, in the ILR, each AID can have multiple RIDs corresponding to it, and each access mode can independently register its own location, and one RID corresponds to one access mode, thus solving the problem of users using multiple RIDs. When one access mode accesses the network, various access modes cover each other, and the user can realize roaming by using multiple access modes.

When the ILR can store multiple sets of correspondences of an AID at the same time, in order to ensure that the user can use the same AID for communication when accessing through multiple access methods, the embodiments of the present invention describe user equipment registration, deregistration, and query respectively. process to solve the problem that the SILSN cannot support the same user equipment to access in multiple ways.

Embodiment 1, user location registration (also called location registration) process

In the scenario where multiple access methods are used to access the network, each user can access at different locations. In order to support the user's movement, when the user's location changes, the user's location needs to be re-modified. To avoid mutual interference when multiple access methods register locations. In this embodiment, when the user registers through the user equipment, the type of the access mode, that is, the access type, is carried at the same time. As shown in FIG. 6, the process of user equipment (UE1) registration in this embodiment includes:

Step 201: When UE1 accesses the new access server ASN1, it first initiates a location registration request to ASN1, and the location registration request carries the user's access identifier AID1;

Step 202: After receiving the location registration request from UE1, ASN1 adds the routing identifier (ie routing address) RID1 and access type of the ASN1 to the location registration request, and sends the location registration request to ILR;

Step 203: ILR extracts AID1 after receiving the location registration request sent by ASN1, searches whether there is a data record of AID1 in the local database (i.e. the database of this ILR), if no relevant record is found, then creates a new data record of AID1; If the data record is found, according to the access type in the location registration request, it is judged whether there is already a corresponding relationship between the user ID and the location ID of the same access type, that is, whether there are already AID1 and RID under the same access type If there is a corresponding relationship, replace the original corresponding relationship with the corresponding relationship between AID1 and RID1 carried in the location registration request, if there is no corresponding relationship, add the corresponding relationship between AID1 and RID1 associated with this access type, and then send to ASN1 returns a location registration response, which carries a result of successful location registration.

Step 204: After receiving the location registration response from the ILR, ASN1 sends the result to UE1 through the location registration response, and the location registration is successful.

In another embodiment, when a user needs to access multiple access servers (that is, multiple access modes), the ASN only specifies different access types. In this embodiment, two access methods are taken as examples for illustration. In this case, the location registration process of the user equipment is shown in FIG. 7, including:

Step 301: The user terminal UE1 accessing the network through WLAN initiates a location registration request. ASN1 finds that AID1 of UE1 accesses the network through WLAN, so it sets the access type of the location registration request to WLAN, and registers at this location Add RID1 to the request, and then send a location registration request to the ILR.

Step 302: When the ILR receives the location registration request sent by ASN1, it judges whether there is a location record of AID1 accessing the network through WLAN in the local database, and if so, changes the original correspondence between AID1 and RID to the current AID1 and RID Correspondence of RID1. If there is no location record in the database where the user AID1 accesses through the WLAN, a corresponding relationship between AID1 and RID1 associated with the WLAN is newly added.

Steps 303-304: ILR and ASN1 return location registration responses to ASN1 and UE1 respectively, and the location registration responses include location registration results.

Step 305: The user terminal UE1 accessing through GPRS initiates a location registration request to ASN1, and ASN1 finds that AID1 is accessed through GPRS, so it changes the access type of the location registration request to GPRS, and adds the RID1 of the access server , and then initiate a location registration request to the ILR.

Step 306: When the ILR receives the location registration request sent by ASN2, it judges whether there is a location record accessed by user AID1 through GPRS in the local database, and if so, changes the original correspondence between AID1 and RID to the current AID1 and RID Correspondence of RID2. If there is no location record of user AID1 accessing by GPRS in the local database, a corresponding relationship between AID1 and RID2 associated with GPRS is newly added.

Steps 307-308: ILR and ASN1 return location registration responses to ASN1 and UE1 respectively.

Among them, the access type indicates the type of access mode, and its value can be one of access modes such as WLAN, General Packet Radio Service (GPRS), WCDMA, LTE, and CDMA2000, or it can be represented by an enumerated type One of access methods such as WLAN, GPRS, WCDMA, LTE, and CDMA2000.

Embodiment 2, user location logout process:

In the scenario where multiple access methods are used, each access method of each user can be independently deregistered. When the user terminal UE1 initiates the deregistration process to ASN1, ASN1 will add the corresponding access type to the location deregistration request In the message, after receiving the location cancellation request message, the ILR sets the status of the corresponding access type as unavailable, so that when other users inquire about the ILR, the ILR returns that UE1 is unreachable under this access mode. The location logout process in this embodiment is shown in Figure 8, including:

Step 401: User terminal UE1 sends a location cancellation request to ASN1 to initiate a cancellation process, and the location cancellation request carries its own identity AID1.

Step 402: When ASN1 receives the location logout request sent by UE1, it adds the "access type" and "RID1" of ASN1 to the "location logout request", and sends the location logout request to the ILR.

Step 403: After the ILR receives the "location cancellation request", set the corresponding relationship between AID1 and RID1 associated with the access type stored in the ILR as unavailable, or delete the corresponding relationship between AID1 and RID1 associated with the access type, and then Notify ASN1.

Step 404: ASN1 replies a location logout response to the user terminal, and this step can be omitted.

Embodiment 3, the process of ASN querying the ILR for the location of the called user

When the ASN initiates a location query request to the ILR, if the called party uses multiple access modes at the same time, the ILR will return the corresponding relationship between the AID and the RID of the multiple access modes to the ASN. Among them, the process of the ASN querying the called user's location from the ILR is shown in Figure 9, including:

Step 501: ASN8 sends a location query request to the ILR, and the location query request carries the user's AID1;

Step 502: The ILR queries the user's access identifier in each access mode according to the AID1 carried in the location query request, and sends the corresponding relationship between the queried AID, RID and access mode by returning a location query response to the ASN8 Give ASN8.

Step 503: After receiving the location query response, the ASN records the corresponding relationship of various access modes carried.

Afterwards, the ASN can preferentially select one of the corresponding relationships to send data according to the rules set by the user or the operator (for example, WLAN access is preferentially used). If sending data through the selected correspondence fails, other correspondences can be used to send data. For example, when the data sent to UE1 cannot be successfully sent through RID1, it may be considered to continue sending through RID2. In this way, multiple access modes can be fully utilized to improve network availability and service continuity.

This embodiment also provides an access device, as shown in FIG. 10 , which is applied to a network where an identity identifier and a location identifier are separated. The access device includes one or more access modules, and each access module is for a location identifier, when the access device includes multiple access modules, the location identifiers of each access module are different from each other; when the access device includes one access module, the location identifier of the access module is different from the The location identifiers of the access modules of other access devices are different;

The access module is configured to use the location identifier of the access module to access the user terminal through one of the access methods when the user terminal with the identity of the same user uses multiple access methods to access the network network;

Wherein, the multiple access modes correspond to the same identity identifier of the user, and the multiple access modes correspond to the location identifiers one by one.

Among them, the access module includes:

The receiving unit is configured to receive a registration request carrying the user's identity that is initiated by the user terminal to the access device; and

a sending unit, configured to send the user access information to the authentication node so that the authentication node saves the user information as the corresponding relationship of the identity, wherein the user access information includes the user identity, The access method used by the user terminal in this registration and the location identifier of the access node corresponding to the access method, the correspondence includes the user's identity, the access method and all the location identifiers corresponding to the access method The location identifier of the access node.

In addition, the receiving unit is also configured to receive a logout request carrying the user's identity that is initiated by the user terminal to the access device;

The sending unit is also used to send the identity of the user, the location identifier of the access node and the access mode corresponding to the access node to the authentication node, so that the authentication node will use the received identity to access The corresponding relationship of the access mode is set as unavailable or the corresponding relationship of the received identity mark is deleted to complete the logout.

In addition, the access device also includes a storage module, wherein:

The sending unit is further configured to send the identity of the user to be queried to the authentication node to initiate a location query; and

The receiving unit is further configured to receive the information returned to the access device after the authentication node inquires about the location identifiers corresponding to each access mode in all the corresponding relationships of the identity identifier saved thereon according to the identity identifier. All correspondences of the identity;

The storage module is configured to store all corresponding relationships of the identity marks returned by the authentication node.

Wherein, the access device may be one of Serving General Packet Radio Service Support Node (SGSN), Gateway General Packet Radio Service Support Node (GGSN), Packet Data Service Node (PDSN) and Broadband Access Server (BRAS).

This embodiment also provides an authentication device, as shown in FIG. 11 , which is applied to a network where an identity identifier and a location identifier are separated, and the authentication device includes:

A receiving module, configured to receive user access information sent by an access node when a user terminal with the identity of the same user accesses the network through one or more access nodes with different location identifiers using multiple access methods ; Wherein, the user access information includes the identity of the user, the access method adopted by the user terminal in this registration and the location identifier of the access node corresponding to the access method; multiple access methods correspond to the user's With the same ID, multiple access methods correspond to location IDs one by one;

The storage module is used to save the user information as the corresponding relationship of the identity, wherein the corresponding relationship includes the user's identity, the access method and the location identifier of the access node corresponding to the access method.

The authentication device also includes a judging module, wherein:

A judging module, configured to judge whether the storage module stores the corresponding relationship of the identity according to the identity in the received user access information; if not, send a storage notification to the storage module; if yes, judge the correspondence of the identity Whether there is a corresponding relationship of the same access mode in the relationship, if there is a corresponding relationship of the same access mode, a replacement notification is sent to the storage module, if there is no corresponding relationship of the same access mode, the storage module is notified to replace the The user information is saved as the corresponding relationship of the identity;

The storage module saves the user information as the corresponding relationship of the identity in the following manner: if it receives the saving notice from the judgment module, it saves the user information as the corresponding relationship of the identity; if it receives the replacement notification of the judgment module , the storage module replaces the original correspondence of the identity with a new correspondence.

The receiving module is also used to receive the identity of the user, the location identifier of the access node and the corresponding The access method of the access node; and

The storage module is further configured to set the received correspondence between the identity identifier and the access method as unavailable or delete the received correspondence corresponding to the identity identifier and the access method to complete the logout.

The authentication device also includes a query module and a sending module, wherein:

The receiving module is also used to receive the location query sent by the access node with the identity of the user to be queried;

A query module, configured to query the location identifiers corresponding to each access mode in all correspondences about the identity stored in the storage module according to the identity, and send all correspondences about the identity to the sending module;

A sending module, configured to return all correspondences about the identity to the access node.

The authentication device includes one of a Key Management System (KMS), a Home Location Register (HLR), a Home Subscriber Server (HSS), and an Authorization/Authentication/Accounting Server (AAA).

Those skilled in the art can understand that all or part of the steps in the above method can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk or an optical disk, and the like. Optionally, all or part of the steps in the foregoing embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiments may be implemented in the form of hardware, or may be implemented in the form of software function modules. The present invention is not limited to any specific combination of hardware and software.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope described in the claims.

Claims (22)

1. the method for one kind of multiple access way access networks is characterized in that, said network is the network that identify label separates with station location marker, and this method comprises:

The user terminal that has same user's identify label adopts the plurality of access modes access network through the one or more access nodes with diverse location sign; Wherein, Said access way is corresponding one by one with said station location marker, and said plurality of access modes is corresponding to said user's same identify label.

2. the method for claim 1 is characterized in that, said access node has one or more station location markers;

When user terminal adopted the plurality of access modes access network through an access node with diverse location sign, said access node had a plurality of station location markers, every kind of corresponding station location marker of access way;

When user terminal adopted the plurality of access modes access network through a plurality of access nodes with diverse location sign, each access node had a station location marker, the station location marker of every kind of corresponding access node of access way; Perhaps, when user terminal adopted the plurality of access modes access network through a plurality of access nodes with diverse location sign, access node had one or more station location markers, every kind of corresponding station location marker of access way.

3. the method for claim 1 is characterized in that, user terminal adopts the step of plurality of access modes access network to comprise:

User terminal is initiated registration to the identify label that access node sends said user; And

Said access node sends to authentication node with user accessing information; Wherein, Said user accessing information comprises said user's identify label, the access way that user terminal adopts in this registration and corresponding to the station location marker of the said access node of this access way;

Said authentication node is preserved the corresponding relation of this identify label, and wherein said corresponding relation comprises user's identify label, access way and corresponding to the station location marker of the said access node of this access way.

4. method as claimed in claim 3 is characterized in that, said access node sends to user accessing information after the step of authentication node, and said method also comprises:

Said authentication node is judged the corresponding relation of whether preserving said identify label on this authentication node according to the identify label in the said user accessing information that receives;

If no, carry out the step that said authentication node is preserved the corresponding relation of identify label;

If have, said authentication node is judged the corresponding relation whether same access way is arranged in the corresponding relation of said identify label; If have, the step of then preserving the corresponding relation of identify label with execution with the corresponding relation of new original this identify label of corresponding relation replacement in the said user accessing information that receives; If no, then directly carry out the step of the corresponding relation of preserving identify label.

5. method as claimed in claim 3 is characterized in that,

Said access way comprises one or more in point-to-point protocol (PPPoE) on wireless lan (wlan), GPRS (GPRS), WCDMA (WCDMA), TD SDMA (TD-SCDMA), the Ethernet, micro-wave access global inter communication (WiMAX), Long Term Evolution (LTE), the CDMA2000 access way.

6. method as claimed in claim 4 is characterized in that, said method also comprises:

User terminal initiates to nullify to the identify label that access node sends the user;

Said access node is said user's identify label, the station location marker of this access node and send to authentication node corresponding to the access way of this access node; And

Said authentication node is changed to the corresponding relation of this access way of unavailable or the identify label that deletion receives with the corresponding relation of this access way of the identify label that receives, and accomplishes and nullifies.

7. like claim 4 or 6 described methods, it is characterized in that said method also comprises:

Access node with the user's that will inquire about identify label send to authentication node and initiate position enquiring; And

Said authentication node is inquired about the station location marker of preserving on this authentication node about each access way correspondence in all corresponding relations of this identify label according to this identify label, and will return to said access server about all corresponding relations of this identify label.

8. like each described method in the claim 1 to 6, it is characterized in that the network that said identify label separates with station location marker is User Identity and locator separation network (SILSN); Said access node is access server (ASN), and said authentication node is identify label and location registers register (ILR), and said identify label is for inserting identifier (AID), and said station location marker is Route Distinguisher (RID).

9. access device; It is characterized in that; Be applied to the network that identify label separates with station location marker, this access device comprises one or more AM access modules, and each AM access module is for a station location marker; When said access device comprised a plurality of AM access module, the station location marker of each AM access module was different; When said access device comprised an AM access module, the station location marker of the AM access module of other access devices was different in the station location marker of this AM access module and the network;

Said AM access module is used for when the user terminal of the identify label that has same user adopts the plurality of access modes access network, utilizes the station location marker of this AM access module that said user terminal is passed through wherein a kind of access way access network;

Wherein, said plurality of access modes is corresponding to said user's same identify label, and said plurality of access modes is corresponding one by one with said station location marker.

10. access device as claimed in claim 9 is characterized in that, said AM access module comprises:

Receiving element is used to receive the register requirement of user terminal to the identify label that carries said user of access device initiation; And

Transmitting element; Be used for user accessing information is sent to authentication node so that said authentication node saves as said user profile the corresponding relation of this identify label; Wherein, Said user accessing information comprises said user's identify label; The access way that user terminal adopts in this registration and corresponding to the station location marker of the said access node of this access way, said corresponding relation comprises user's identify label, access way and corresponding to the station location marker of the said access node of this access way.

11. access device as claimed in claim 10 is characterized in that:

Said receiving element also is used to receive the de-registration request of user terminal to the identify label that carries the user of access device initiation;

Said transmitting element; Also be used for identify label with said user; The station location marker of this access node and send to authentication node corresponding to the access way of this access node; So that said authentication node is changed to the corresponding relation of this access way of unavailable or the identify label that deletion receives with the corresponding relation of this access way of the identify label that receives, accomplishes and nullify.

12. like claim 10 or 11 described access devices, it is characterized in that said access device also comprises memory module, wherein:

Said transmitting element, also be used for the user's that will inquire about identify label send to authentication node and initiate position enquiring; And

Said receiving element; Also be used for receiving said authentication node according to this identify label inquire preserve on it about behind the corresponding station location marker of each access way of all corresponding relations of this identify label, all corresponding relations of this identify label of returning to said access device;

Said memory module is used to preserve all corresponding relations of the said identify label that said authentication node returns.

13., it is characterized in that the network that said identify label separates with station location marker is User Identity and locator separation network (SILSN) like claim 10 or 11 described access devices; Said access device is access server (ASN), and said identify label is for inserting identifier (AID), and said station location marker is Route Distinguisher (RID).

14. like claim 10 or 11 described access devices; It is characterized in that said access device comprises a kind of in service universal grouping wireless business supporting node (SGSN), ggsn (GGSN), group data service node (PDSN) and the BAS Broadband Access Server (BRAS).

15. like claim 10 or 11 described access devices, it is characterized in that,

Said access way comprises one or more in point-to-point protocol (PPPoE) on wireless lan (wlan), GPRS (GPRS), WCDMA (WCDMA), TD SDMA (TD-SCDMA), the Ethernet, micro-wave access global inter communication (WiMAX), Long Term Evolution (LTE), the CDMA2000 access way.

16. an authenticating device is characterized in that, is applied to the network that identify label separates with station location marker, said authenticating device comprises:

Receiver module is used for when the user terminal of the identify label that has same user adopts the plurality of access modes access network through the one or more access nodes with diverse location sign, receiving the user accessing information that access node sends; Wherein, said user accessing information comprises said user's identify label, the access way that user terminal adopts in this registration and corresponding to the station location marker of the said access node of this access way; Said plurality of access modes is corresponding to said user's same identify label, and said plurality of access modes is corresponding one by one with said station location marker;

Memory module is used for said user profile is saved as the corresponding relation of this identify label, and wherein said corresponding relation comprises user's identify label, access way and corresponding to the station location marker of the said access node of this access way.

17. authenticating device as claimed in claim 16 is characterized in that, said authenticating device also comprises judge module, wherein:

Said judge module is used for judging according to the identify label of the said user accessing information that receives whether said memory module preserves the corresponding relation of said identify label; If no, then send the preservation notice to said memory module; If have; Judge the corresponding relation whether same access way is arranged in the corresponding relation of said identify label; If the corresponding relation of same access way is arranged; Then send the replacement notice,, then notify said memory module said user profile to be saved as the corresponding relation of this identify label if there is not the corresponding relation of same access way to said memory module;

Said memory module is the corresponding relation that as follows said user profile is saved as this identify label: if receive the preservation notice of said judge module, then said user profile is saved as the corresponding relation of this identify label; If receive the replacement notice of said judge module, said memory module is with the corresponding relation of new original this identify label of corresponding relation replacement.

18. authenticating device as claimed in claim 16 is characterized in that,

Said access way comprises one or more in point-to-point protocol (PPPoE) on wireless lan (wlan), GPRS (GPRS), WCDMA (WCDMA), TD SDMA (TD-SCDMA), the Ethernet, micro-wave access global inter communication (WiMAX), Long Term Evolution (LTE), the CDMA2000 access way.

19. authenticating device as claimed in claim 16 is characterized in that:

Said receiver module also be used to receive access node receive that user terminal initiates carry user's identify label de-registration request the time; The said user's who sends to said authenticating device identify label, the station location marker of this access node and corresponding to the access way of this access node; And

Said memory module also is used for the corresponding relation of this access way of the identify label that receives is changed to the corresponding relation corresponding to this identify label and this access way unavailable or that deletion receives, accomplishes and nullifies.

20. like each described authenticating device in the claim 16 to 19, it is characterized in that said authenticating device also comprises enquiry module and sending module, wherein:

Said receiver module, also be used to receive access node sends have the user's that will inquire about the position enquiring of identify label;

Said enquiry module; Be used for inquiring about the station location marker that said memory module is preserved, and will send to sending module about all corresponding relations of this identify label about each access way correspondence in all corresponding relations of this identify label according to this identify label;

Said sending module is used for all corresponding relations about this identify label are returned to said access node.

21., it is characterized in that the network that said identify label separates with station location marker is User Identity and locator separation network (SILSN) like each described authenticating device in the claim 16 to 19; Said access node is access server (ASN), and said authentication node is identify label and location registers register (ILR), and said identify label is for inserting identifier (AID), and said station location marker is Route Distinguisher (RID).

22. like each described authenticating device in the claim 16 to 19, it is characterized in that,

Said authenticating device comprises a kind of in key management system (KMS), attaching position register (HLR), home subscriber server (HSS) and the mandate/authentication/accounting server (AAA).

Images