CN102714843A - Service access control method, device and user equipment - Google Patents

Abstract

The present invention relates to a service access control method, device and user equipment. The service access control method includes: the access control node obtains the access network selection policy of the service data flow; the access control node sends the access network selection policy to the user equipment; the access control node determines the user equipment transmission service data flow When the access network does not conform to the access network of the access network selection policy, the access of the service data flow is controlled. In the service access control method, device, and user equipment of the embodiments of the present invention, the access control node on the network side obtains the access network selection policy of the service data flow, and the service data transmitted by the user equipment according to the access network selection policy After the flow selects the access network, the access control node can determine whether the access network selected by the user equipment conforms to the access network selected by the access network selection policy, and control the selection when the user equipment does not perform access according to the access network selection policy. An access network that complies with the access network selection policy.

Description

Service access control method, device and user equipment

technical field

The present invention relates to the field of communication technologies, and in particular to a service access control method, device, and user equipment. Background of the invention

Currently, the 3GPP (The 3rd Generation Partnership Project, 3rd Generation Partnership Project) protocol supports UE (User Equipment, user equipment) accessing a 3GPP system and a non-3GPP system at the same time, that is, the UE can pass through the access network of the 3GPP system and The access network of the non-3GPP system is connected to the same PDN (Packet Data Network, packet data network) via the same P-GW (Packet Data Network Gateway, PDN Gateway, packet data network service gateway). In this way, different service data streams in the same PDN connection can be distributed in the 3GPP system and the non-3GPP system, and the UE can select which network the service data stream is transmitted according to a certain strategy, making full use of the advantages of bandwidth and tariff of different access networks . For example, the ANDSF (Access Network Discovery and Selection Function) solution proposed in the 3GPP protocol: The ANDSF entity sends the access network selection policy of the service data flow to the UE, and the UE selects the policy according to the access network to perform access network selection.

However, in the ANDSF scheme, the access selection control right of the service data flow is at the UE, and the network side cannot verify whether the UE performs access according to the access network selection strategy, and when the UE does not perform access according to the access network selection strategy, The network side cannot exercise control over access selection. Contents of the invention

The purpose of the present invention is to provide a service access control method, device, and user equipment, so as to realize the control of service data streams when the access network through which the user equipment transmits service data streams does not conform to the access network selection policy of the access network. access control.

On the one hand, an embodiment of the present invention provides a service access control method, the method comprising:

The access control node obtains the access network selection strategy of the service data flow;

The access control node sends the access network selection policy to the user equipment;

When the access control node determines that the access network through which the user equipment transmits the service data flow does not conform to the access network selected by the access network selection policy, the access control node performs an operation on the access of the service data flow control.

Correspondingly, an embodiment of the present invention provides a service access control device, the device includes:

a first obtaining unit, configured to obtain an access network selection strategy for a service data flow;

a first sending unit, configured to send the access network selection policy to the user equipment;

The first control unit is configured to control the access of the service data stream when determining whether the access network through which the user equipment transmits the service data stream complies with the access network of the access network selection policy.

On the other hand, an embodiment of the present invention provides a service access control method, the method including:

The user equipment determines the binding relationship between the service data flow and the current access network according to the access network selection policy, the access network selection policy is sent by the control node, or is sent by the access network discovery and selection function ANDSF, or is pre-configured on said user equipment; When the access network through which the user equipment transmits the service data flow does not conform to the access network selection policy, the user equipment receives the instruction notification sent by the access control node, and selects an access network that meets the access network selection policy for the service data flow. The access network of the network selection policy.

Correspondingly, an embodiment of the present invention provides a user equipment, where the user equipment includes:

The fourth binding unit is configured to determine the binding relationship between the service data flow and the current access network according to the access network selection policy, the access network selection policy is sent by the control node, or is discovered and obtained by the access network select the function ANDSF to send, or pre-configure on the user equipment;

The second control unit is configured to receive an instruction notification sent by the access control node when the access control node determines that the access network through which the user equipment transmits the service data flow does not conform to the access network of the access network selection policy , select an access network conforming to the access network selection strategy for the service data flow.

In the service access control method, device, and user equipment according to the embodiments of the present invention, the access control node on the network side obtains the access network selection policy of the service data flow, and the user equipment transmits it according to the access network selection policy After the service data flow selects the access network, the access control node can determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, Controlling selection of an access network conforming to the access network selection policy. Brief description of the drawings

FIG. T is a schematic flow diagram of a service access control method according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of the configuration of a service access control device according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a configuration of a service access control device according to another embodiment of the present invention;

FIG. 4 is a schematic flowchart of a service access control method according to another embodiment of the present invention;

FIG. 5 is a schematic diagram of a configuration of a user equipment according to an embodiment of the present invention;

FIG. 6 is a flow diagram 1 of an access control method according to another embodiment of the present invention;

FIG. 7 is a second schematic flow diagram of a service access control method according to another embodiment of the present invention;

FIG. 8 is a third schematic flow diagram of a service access control method according to another embodiment of the present invention;

FIG. 9 is a fourth schematic flow diagram of a service access control method according to another embodiment of the present invention;

FIG. 10 is a fifth schematic flow diagram of a service access control method according to another embodiment of the present invention;

FIG. 11 is a schematic flow diagram of a service access control method VI according to another embodiment of the present invention.

FIG. 12 is the seventh flow diagram of the service access control method according to another embodiment of the present invention. Modes of Carrying Out the Invention

As shown in FIG. 1, an embodiment of the present invention provides a service access control method, the method including:

Step 11. The access control node obtains the access network selection policy of the service data flow.

Step 12. The access control node sends the access network selection policy to the user equipment.

Step 13: When the access control node determines that the access network through which the user equipment transmits the service data flow does not comply with the access network selection policy, the access control node controls the access of the service data flow.

The access control node in the service access control method in the embodiment of the present invention may be a P-GW packet data network gateway, and the UE (using User equipment) can be connected to the same PDN (packet data network) connection through the access network of the 3GPP system and the access network of the non-3GPP system through the same P-GW packet data network service gateway, that is, the service in the same PDN connection The data flow can be distributed in two different access networks.

The access network of the 3GPP system may include: UTRAN (UMTS Terrestrial Radio Access Network, UMTS Terrestrial Radio Access Network), or E-UTRAN (Evolved-UMTS Terrestrial Radio Access Network, Evolved Terrestrial Radio Access Network), or GERAN (GSM EDGE Radio Access Network, GSM EDGE Wireless Access Network), etc.

The access network of the non-3GPP system may include: WLAN (Wireless Local Area Networks, wireless local area network), HRPD (High Rate Packet Data, high-speed packet data) access network, and so on.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network.

Specifically, in step 11, the access control node obtains the access network selection policy of the service data flow, where the access network selection policy may include: service data flow information, access network type information, and binding policy information, where the service The data flow information may include a business data flow template (Traffic Flow Template, TFT);

Binding policy information can include:

Priority binding strategy: The service data flow indicated by the service data flow information is preferentially bound to the access network indicated by the access network type information;

Or, prohibit the binding policy: prohibit the service data flow indicated by the service data flow information from binding the access network indicated by the access network type information;

Or, allow the binding policy: allow the service data flow indicated by the service data flow information to be bound with the access network indicated by the access network type information.

Optionally, the service data flow template TFT can be extended with access network type information and binding policy information, and the access network selection strategy can be implemented through the service data flow template TFT extension.

The service data flow can be bound with the access network through the selection strategy of the access network. The binding relationship between the service data flow and the access network can be stored in the access control node and/or the binding cache of the user equipment.

Exemplarily, according to the above-mentioned access network selection strategy, the flow binding list shown in Table 1 below can be obtained, wherein each service data flow (indicated by the Flow ID flow identifier) has a TFT (Traffic Flow Template, business data flow template), and point to an access network (indicated by the Binding ID binding identifier).

Table 1

Optionally, in step 11, the access control node obtains the access network selection policy of the service data flow, which may be implemented in the following manner: The access control node obtains the PCC ( Policy Control and Charging, policy control and charging) rule, the PCC rule carries the access network selection policy; specifically, the user equipment accesses the current access network, and the user equipment initiates a certain service on the current access network, P - The GW requests the PCRF entity to obtain the access network selection policy corresponding to the service data flow of the service, and the PCRF entity carries the access network selection policy corresponding to the service data flow in the PCC rule and sends it to the P-GW, so that the P-GW obtains Access network selection strategy; or, the PGW can obtain the access network selection strategy corresponding to each service data flow during a PCC rule interaction process with the PCRF entity, and send the access network selection strategy corresponding to the currently initiated service to the P -GVV, so that the P-GW obtains the access network selection policy.

Alternatively, the access control node obtains the access network selection policy of the service data flow through local pre-configuration.

The service access control method of the embodiment of the present invention, after step 11 and before step 12, may further include: According to the priority binding policy, when the current access network of the user equipment to initiate the service is the access network indicated by the access network type information network, the access control node binds the service data flow to the current access network; or, the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the access control node binds the service data flow The flow is bound to the current access network, and further, when the access control node detects that another access network that the user equipment accesses at the same time is the access network indicated by the access network type information, the access control node sends the service data The flow is bound to the access network indicated by the access network type information, that is, the access control node initiates an IP flow mobility (IP flow mobility) process;

Or, according to the binding prohibition policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the access control node prohibits binding the service data flow to the current access network; otherwise, When the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the access control node binds the service data flow to the current access network;

Or, according to the allowed binding policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the access control node binds the service data flow to the current access network; otherwise, when When the current access network of the user equipment is not the access network indicated by the access network type information, the access control node prohibits binding the service data flow to the current access network.

Optionally, the access control node may store the binding relationship between the service data flow and the access network in the flow binding list of the access control node. According to the flow binding list, the access control node can determine the access network for transmitting data to the user equipment.

Specifically, in step 12, the access control node sends the access network selection policy to the user equipment, which may be implemented in the following ways, but not limited to the following ways-use GTP (GPRS Tunneling protocol GPRS, tunneling protocol) in the 3GPP system, then The access control node can send the access network selection strategy to the user equipment through the Create Session Response (session establishment response) message during the process of establishing the PDN connection;

Or, using the DSMIPv6 (Dual Stack Mobile Internet Protocol Version 6, Dual Stack Mobile Internet Protocol Version 6) protocol in the non-3GPP system, the access control node can pass the (Binding Acknowledgment) binding response message during the establishment of the PDN connection Issue the access network selection policy to the user equipment;

Or, using the PMIP (Proxy Mobile IP, Proxy Mobile IP) protocol in the non-3GPP system, the access control node can send and receive the Proxy Binding Acknowledgment (proxy binding response message) during the establishment of the PDN connection. The network access selection policy is given to the user equipment.

In addition, in some cases, when the user equipment initiates a service data flow, even if the service data flow is bound to a corresponding access network, the user equipment may not transmit the service data flow according to the access network bound to the access network, so , the access control node needs to be able to control the access of the service data flow, specifically, including - the access control node determines that the current access network for the user equipment to transmit the service data flow complies with the access network of the access network selection policy, Situations where service data flow is allowed to be transmitted on the current access network;

Or, the access control node determines that the current access network where the user equipment transmits the service data flow does not conform to the access network of the access network selection policy, and controls the access of the service data flow. That is the situation of step 13 above.

Specifically, the access control node determines that the current access network on which the user equipment transmits the service data flow conforms to the access network of the access network selection strategy, and allows the service data flow to be transmitted on the current access network, which may include:

According to the priority binding policy, when the current access network for the user equipment to transmit the service data flow conforms to the access network of the access network selection policy, the access control node binds the service data flow sent by the user equipment to the current access network, allowing The service data flow is transmitted on the current access network; or, according to the binding prohibition policy, when the current access network where the user equipment transmits the service data flow is not the access network indicated by the access network type information, the access control node connects the user equipment The transmitted service data flow is bound to the current access network, allowing the service data flow to be transmitted on the current access network;

Or, according to the allowed binding policy, when the current access network where the user equipment transmits the service data flow is the access network indicated by the access network type information, the access control node binds the service data flow transmitted by the user equipment to the current access network network, allowing service data flow to be transmitted on the current access network.

Specifically, when the access control node in step 13 determines that the current access network used by the user equipment to transmit the service data flow does not conform to the access network of the access network selection policy, the access control node controls the access of the service data flow, which may include:

According to the priority binding policy, the access control node detects that the user equipment has accessed the access network indicated by the access network type information, but the current access network on which the user equipment transmits the service data stream is not the one indicated by the access network type information. When accessing the network, the access control node binds the service data flow switching to the access network indicated by the access network type information; specifically, the access control node binds the service data flow switching to the access network indicated by the access network type information Network access can be understood as the IP flow mobility (IP flow mobility) process initiated by the access control node, the user equipment and the access control node re-execute the binding of the service data flow and the access network, see the description below;

Or, according to the binding prohibition policy, when the current access network for the user equipment to transmit the service data flow is the access network indicated by the access network type information, the access control node prevents the service data flow transmitted by the user equipment, and sends an instruction to notify the user Device business data flow is blocked;

Or, according to the allowed binding policy, when the current access network where the user equipment transmits the service data flow is not the access network indicated by the access network type information, the access control node prevents the service data flow transmitted by the user equipment, and sends an indication notification User equipment service data flow is blocked.

At this time, in order to facilitate the understanding of the present invention, it is further explained from the perspective of the user equipment, after the user equipment receives the indication notification sent by the access control node, it includes:

The user equipment cancels the binding of the service data flow and the current access network;

The user equipment selects an access network for the service data flow according to the access network selection policy, and if the current access network selection policy does not meet If there is an omitted access network, the user equipment discards the service data flow.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network. As shown in FIG. 2, corresponding to the service access control method of the above-mentioned embodiment, an embodiment of the present invention provides a service access control device, and the device includes:

The first obtaining unit 21 is configured to obtain the access network selection policy of the service data flow.

The first sending unit 22 is configured to send the access network selection policy to the user equipment.

The first control unit 23 is configured to control the access of the service data stream when it is determined that the access network through which the user equipment transmits the service data stream does not conform to the access network of the access network selection policy.

The access control device for the service in the embodiment of the present invention may be an access control node, such as a P-GW packet data network gateway. The UE can connect to the same PDN through the same P-GW packet data network service gateway through the access network of the 3GPP system and the access network of the non-3GPP system.

In the service access control device according to the embodiment of the present invention, by obtaining the access network selection policy of the service data flow, after the user equipment root selects the access network for the service data flow it transmits, the access control node can determine the user equipment selection Whether the access network conforms to the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, control selection of an access network conforming to the access network selection policy.

Specifically, the access network selection policy can be understood by referring to the same content in the foregoing embodiments. For the binding relationship between the service data flow and the access network, refer to the flow binding list shown in Table 1 in the above embodiment, and details are not repeated here.

As shown in FIG. 3, specifically, the first acquiring unit 21 may include:

The first obtaining subunit 31 is configured to obtain a PCC policy control and charging rule from the PCRF policy charging rule functional entity, where the PCC rule carries the access network selection policy of the service data flow.

Or, the second obtaining subunit 32 is configured to obtain the access network selection policy of the service data flow through local pre-configuration.

As shown in FIG. 3, the device for access control of services in the embodiment of the present invention may further include:

The first binding unit 34 is configured to bind the service data flow to the current access network when the current access network where the user equipment initiates the service is the access network indicated by the access network type information according to the priority binding policy. or, the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, and the service data flow is bound to the current access network, when it is detected that another access network that the user equipment simultaneously accesses When the access network is the access network indicated by the access network type information, the service data flow is bound to the access network indicated by the access network type information, that is, the access control node initiates an IP flow mobility (IP flow mobility) process.

Or, the second binding unit 35 is configured to prohibit the user equipment from binding the service data flow to the current access network; conversely, when the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, bind the service data flow to the current access network.

Or, the third binding unit 36 is configured to, according to the allowed binding policy, when the current access network where the user equipment initiates the service is the access network When the access network indicated by the type information is used, the service data flow is bound to the current access network; otherwise, when the current access network of the user equipment is not the access network indicated by the access network type information, the user equipment is prohibited from linking the The service data flow is bound to the current access network.

Optionally, the access control node may store the binding relationship between the service data flow and the access network in the flow binding list. As shown in FIG. 3, specifically, the first sending unit 22 may include:

The first sending subunit 37 is configured to send the access network selection strategy to user equipment.

Or, the second sending subunit 38 is used for using DSMIPv6 (Dual Stack Mobile Internet Protocol Version

6. In the dual-stack mobile Internet protocol version 6) protocol system, the access control node sends the access network selection policy to the user equipment through a Binding Acknowledgment (binding response) message during the establishment of the PDN connection.

Alternatively, the third sending subunit 39 is configured to, in a system using the PMIP (Proxy Mobile IP, Proxy Mobile IP) protocol, the access control node pass the Proxy Binding Acknowledgment (proxy binding response message) during the process of establishing the PDN connection ) message to deliver the access network selection policy to the user equipment.

In addition, in some cases, when the user equipment initiates a service data flow, even if the service data flow is bound to a corresponding access network, the user equipment may not transmit the service data flow according to the access network bound to the access network, so , the access control node needs to be able to control the access of the service data stream. Specifically, as shown in FIG. 3, the access control node determines that the current access network used by the user equipment to transmit the service data stream does not conform to the access network selection When accessing the network of the strategy, the first control unit 23 may include:

The first control subunit 310 is configured to detect that the user equipment has accessed the access network indicated by the access network type information according to the priority binding policy, but the current access network through which the user equipment transmits the service data stream is not the access network When the access network indicated by the type information is used, the service data flow switching is bound to the access network indicated by the access network type information; specifically, the access control node binds the service data flow switching to the access network The access network indicated by the network access type information can be understood as an IP flow mobility (IP flow mobility) process initiated by the access control node, and the user equipment and the access control node re-execute the binding of the service data flow and the access network.

Or, the second control subunit 311 is configured to prevent the service data flow transmitted by the user equipment when the current access network for the user equipment to transmit the service data flow is the access network indicated by the access network type information according to the binding prohibition policy, And send an indication to notify the user equipment that the service data flow is blocked.

Or, the third control subunit 312 is configured to block the service data transmitted by the user equipment when the current access network where the user equipment transmits the service data flow is not the access network indicated by the access network type information according to the allowed binding policy flow, and send an indication to notify the user equipment that the service data flow is blocked.

When the access control node determines that the current access network used by the user equipment to transmit the service data stream conforms to the access network of the access network selection policy, the service access control device in the embodiment of the present invention may further include:

The fourth control subunit 313 is configured to bind the service data flow sent by the user equipment to the current access network when the current access network through which the user equipment transmits the service data flow conforms to the access network selection policy according to the priority binding policy, Allow service data flow to be transmitted on the current access network.

Or, the fifth control subunit 314 is configured to, according to the binding prohibition policy, when the current access network of the user equipment to transmit the service data flow is not the access network indicated by the access network type information, the service data flow transmitted by the user equipment Bind to the current access network to allow services The data flow is transmitted on the current access network.

Or, the sixth control subunit 315 is configured to, according to the allowed binding policy, when the current access network for the user equipment to transmit the service data flow is the access network indicated by the access network type information, the service data transmitted by the user equipment The flow is bound to the current access network, allowing service data flow to be transmitted on the current access network.

In order to better understand the service access control apparatus and its configuration in the embodiment of the present invention, reference may be made to the corresponding content of the service access control method in the above embodiment, which will not be repeated here.

In the service access control device of the embodiment of the present invention, the access control node on the network side obtains the access network selection policy of the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network. As shown in FIG. 4, an embodiment of the present invention provides a service access control method, including:

Step 41. The user equipment determines the binding relationship between the service data flow and the current access network according to the access network selection policy. The access network selection policy is sent by the control node, or by the access network discovery and selection function ANDSF, or in advance configured on the user device.

Step 42. When the access network through which the user equipment transmits the service data stream does not conform to the access network selection policy, the user equipment receives the instruction notification sent by the access control node, and selects the service data stream that conforms to the access network selection policy access network.

The access control node in the service access control method of the embodiment of the present invention can be a P-GW packet data network gateway, and the UE can be grouped through the same P-GW through the access network of the 3GPP system and the access network of the non-3GPP system. The data network service gateway is connected to the same PDN.

In the service access control method according to the embodiment of the present invention, the access control node obtains the access network selection strategy of the service data flow, and the user equipment selects the access network for the service data flow it transmits according to the access network selection strategy, Furthermore, the access control node can determine whether the access network selected by the user equipment conforms to the access network selected by the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the control selection conforms to the access network selection policy access network.

Specifically, the access network selection strategy can be understood by referring to the same content in the above embodiment, and the binding relationship between the service data flow and the access network can refer to the flow binding list shown in Table 1 of the above embodiment, and then The access network that the ingress control node determines that the user equipment transmits the service data stream does not comply with the access network selection policy can be understood by referring to the same content in the foregoing embodiments, and details are not repeated here.

Specifically, the access network selection strategy in step 41 may include:

Using GTP (GPRS Tunneling protocol GPRS, tunneling protocol) in the 3GPP system, the user equipment can receive the access network selection policy issued by the access control node through the Create Session Response (session establishment response) message during the establishment of the PDN connection ;

Or, using the DSMIPv6 (Dual Stack Mobile Internet Protocol Version 6, dual stack mobile Internet protocol version 6) protocol in the non-3GPP system, the user equipment can receive an acceptance through a (Binding Acknowledgment) binding response message during the establishment of the PDN connection. The access network selection policy issued by the access control node;

Or, using the PMIP (Proxy Mobile IP, Proxy Mobile IP) protocol in the non-3GPP system, the user equipment point can In the process of establishing the PDN connection, the access network selection policy issued by the access control node is received through the Proxy Binding Acknowledgment (proxy binding response message).

Optionally, the service access control method in the embodiment of the present invention may further include:

The user equipment obtains the access network selection policy from the ANDSF access network discovery and selection functional entity;

The user equipment sends the access network selection policy to the access control node, so that the access network selection policy updates the locally set access network selection policy.

Step 41 The user equipment determines the binding relationship between the service data flow and the current access network according to the access network selection strategy, which may include:

According to the priority binding policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the user equipment binds the service data flow to the current access network; or, the user equipment initiates the service. The current access network is not the access network indicated by the access network type information. The user equipment binds the service data flow to the current access network. When the user equipment detects that another access network that it simultaneously accesses is an access network the access network indicated by the type information, the user equipment binds the service data flow to the access network indicated by the access network type information, or, when the user equipment detects that the access network indicated by the access network type information can be accessed, Then the user equipment accesses the access network indicated by the access network type information, and binds the service data flow to the access network indicated by the access network type information, that is, the user equipment initiates an IP flow mobility (IP flow mobility) process; specifically , due to reasons such as changes in the access network, the user equipment may be able to access the access network indicated by the access network type information, then the user equipment initiates the IP flow movement process, and the user equipment and the access control node re-execute the service data flow and access net binding;

Or, according to the binding prohibition policy, when the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the user equipment binds the service data flow to the current access network network; when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the user equipment does not bind the service data flow, and the user equipment initiates a reselection access;

Or, according to the allowed binding policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the user equipment binds the service data flow to the current access network ; When the current access network of the user equipment is not the access network indicated by the access network type information, the user equipment does not bind the service data flow, and the user equipment initiates a reselection for access.

Wherein, the user equipment initiates a reselection access, which can be understood as a process in which the user equipment reselects another access network for access according to the current access network environment, and initiates a service.

Optionally, the user equipment may store the binding of the service data flow and the access network in the flow binding list of the user equipment.

Subsequently, the user equipment initiates a service data flow. If the service data flow does not have a corresponding access network binding (access network binding can refer to the flow binding list of the user equipment), the user equipment discards the service data and can initiate a new Optionally, the user equipment may indicate to the application program the error type of the discarded data. If the service data flow has a corresponding access network binding, the user equipment binds the service data flow to the access network according to the access network binding.

In some cases, the user equipment initiates a service data flow, even if the service data flow has a corresponding access network binding, but the user equipment may not transmit the service data flow according to the access network bound to the access network, corresponding to, In the above embodiment, when the access control node determines that the access network used by the user equipment to send the service data flow does not comply with the access network selection policy, the access control node prevents the service data flow transmitted by the user equipment, and sends an instruction to notify the user equipment of the service data flow flow is blocked; at this point, step 42 user equipment receives access control Selecting an access network conforming to the access network selection strategy for the service data flow from the instruction notification sent by the access control node may include: the user equipment receives the instruction notification sent by the access control node, and the instruction notification indicates that the service data flow sent by the user equipment is blocked; The user equipment cancels the binding of the service data flow and the current access network;

The user equipment selects an access network for the service data flow according to the access network selection policy.

Specifically, the user equipment cancels the binding of the service data flow and the current access network, and according to the access network selection strategy, if there is currently an access network that meets the access network selection strategy, the user equipment binds the service data flow to the access network that meets the access network selection strategy. The access network binding of the network selection strategy, if there is no access network that meets the access network selection strategy, the user equipment discards the service data flow.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network. As shown in FIG. 5, corresponding to the service access control method of the foregoing embodiment, the embodiment of the present invention provides a user equipment, including: a fourth binding unit 51, configured to determine a service data flow according to an access network selection policy The binding relationship with the current access network, the access network selection policy is sent by the control node, or sent by the access network discovery and selection function ANDSF, or pre-configured on the user equipment.

The second control unit 52 is configured to receive an instruction notification sent by the access control node when the access network through which the user equipment transmits the service data flow does not conform to the access network selection policy, and select an access network that meets the access network selection policy for the service data flow. The access network of the network selection policy.

The access control node in the service access control method of the embodiment of the present invention can be a P-GW packet data network gateway, and the UE can be grouped through the same P-GW through the access network of the 3GPP system and the access network of the non-3GPP system. The data network service gateway is connected to the same PDN.

In the service access control method according to the embodiment of the present invention, the access control node obtains the access network selection strategy of the service data flow, and the user equipment selects the access network for the service data flow it transmits according to the access network selection strategy, Furthermore, the access control node can determine whether the access network selected by the user equipment conforms to the access network selected by the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, control the selection of the access network conforming to the access network Select the access network for the policy.

Specifically, the access network selection strategy can be understood by referring to the same content in the above embodiment, and the binding relationship between the service data flow and the access network can refer to the flow binding list shown in Table 1 of the above embodiment, and then The access network that the ingress control node determines that the user equipment transmits the service data stream does not comply with the access network selection policy can be understood by referring to the same content in the foregoing embodiments, and will not be repeated here.

Specifically, the fourth binding unit 51 may include:

The first receiving subunit is configured to use GTP (GPRS Tunneling protocol GPRS, tunneling protocol) in the 3GPP system, and the user equipment can receive the access control node through a Create Session Response (session establishment response) message during the establishment of the PDN connection Delivered access network selection policy.

Alternatively, the second receiving subunit is configured to use a DSMIPv6 (Dual Stack Mobile Internet Protocol Version 6, Dual Stack Mobile Internet Protocol Version 6) protocol in a non-3GPP system, and the user equipment may pass (Binding Acknowledgment) The binding response message receives the access network selection policy issued by the access control node. Alternatively, the third receiving subunit is configured to use the PMIP (Proxy Mobile IP, Proxy Mobile IP) protocol in the non-3GPP system, and the user equipment point may pass the Proxy Binding Acknowledgment (proxy binding response message during the establishment of the PDN connection ) to receive the access network selection policy issued by the access control node.

Optionally, when the user equipment in this embodiment of the present invention sends the access network selection policy by the access network discovery and selection function ANDSF entity, it may also include:

The second obtaining unit is configured to obtain the access network selection policy from the ANDSF entity.

a second sending unit, configured to send the access network selection policy to the access control node, so that the access network selection policy updates a locally set access network selection policy.

Specifically, the fourth binding unit 51 may include:

The first binding subunit is configured to bind the service data flow to the current access network when the current access network where the user equipment initiates the service is the access network indicated by the access network type information according to the priority binding policy. or, the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the user equipment binds the service data flow to the current access network, and when the user equipment detects that it simultaneously accesses The other access network is the access network indicated by the access network type information, then the user equipment binds the service data flow to the access network indicated by the access network type information, or, when the user equipment detects that the access network If the access network indicated by the type information can be accessed, the user equipment accesses the access network indicated by the access network type information, and binds the service data flow to the access network indicated by the access network type information, that is, the user equipment initiates an IP flow mobility (IP flow mobility) process; specifically, due to reasons such as changes in the access network, the user equipment may be able to access the access network indicated by the access network type information, and the user equipment initiates an IP flow mobility process, The user equipment and the access control node re-execute the binding of the service data flow and the access network.

Or, the second binding subunit is configured to prohibit the user equipment from binding the service data flow to The current access network, the user equipment initiates a re-selection access; on the contrary, when the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the user equipment binds the service data flow to the current access network into the network.

Or, the third binding subunit is configured to, according to the allowed binding policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the user equipment binds the service data flow to the current access network Conversely, when the current access network of the user equipment is not the access network indicated by the access network type information, the user equipment is prohibited from binding the service data flow to the current access network, and the user equipment initiates a reselection of the access network. enter.

Specifically, the second control unit 52 may include an instruction notification receiving subunit, configured to receive an instruction notification sent by the access control node, where the instruction notification indicates that the service data flow sent by the user equipment is blocked.

The cancel subunit is used to cancel the binding of the service data flow and the current access network.

The access control subunit is configured to select an access network for a service data flow according to an access network selection policy.

Specifically, the user equipment cancels the binding of the service data flow and the current access network, and according to the access network selection strategy, if there is currently an access network that meets the access network selection strategy, the user equipment binds the service data flow to the access network that meets the access network selection strategy. The access network binding of the network selection strategy, if there is no access network that meets the access network selection strategy, the user equipment discards the service data flow.

In order to better understand the user equipment and its configuration in this embodiment of the present invention, you can refer to the access controller of the service in the above embodiment The corresponding content of the law will not be repeated here.

For the user equipment in the embodiment of the present invention, the access control node on the network side obtains the access network selection policy of the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node can determine the selection strategy of the user equipment. Whether the access network conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls to select the access network conforming to the access network selection policy. As shown in FIG. 6, the access control method of the service of the embodiment of the present invention is described by combining UE (user equipment) and P-GW, including:

61. The UE establishes a PDN connection through the current access network, and the P-GW obtains the access network selection policy of the service data flow, and the P-GW determines the binding relationship between the service data flow and the access network according to the access network selection policy, such as The service data flow is bound to the current access network, or the service data flow is not bound to the current access network, or the service data flow is bound to the current access network, and there is a priority access network (referring to the priority binding policy indication access network), service data flow switching is required.

62. The P-GW sends the access network selection policy of the service data flow to the UE, and the UE determines the binding relationship between the service data flow and the access network according to the access network selection policy, such as binding the service data flow to the current access network , or, the service data flow is not bound to the current access network, or, the service data flow is bound to the current access network, and when there is a priority access network, the service data flow needs to be switched.

63. The UE initiates a service data flow, and if the service data flow is not bound to a corresponding access network, the UE discards the service data,

The UE can initiate re-selection access; if the service data flow has a corresponding access network binding, the UE binds the service data flow to the access network according to the access network binding; if the UE detects that there is still a priority access network , then the UE accesses the priority access network, and binds the service data flow to the priority access network.

64. The P-GW detects whether the current access network where the UE transmits the service data flow conforms to the access network selection policy. If the current access network of the UE is an access network that is not prohibited or allowed by the access network selection policy, P- The GW binds the service data flow to the current access network, that is, allows the transmission of the service data flow in the current access network; if the P-GW detects that the UE is also connected to the priority access network, the P-GW will Switch to the priority access network; If the P-GW detects that the current access network of the UE is an access network that is prohibited or not allowed by the access network selection policy, the P-GW sends a blocking indication to the UE, telling the UE that it is not allowed Transmit the service data flow in the current access network.

65. After receiving the blocking instruction, the UE selects other access networks for access according to the access network selection policy, and discards the service data flow if there is no other access network available.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network. As shown in FIG. 7, the embodiment of the present invention takes the UE (user equipment) as an example to connect to the PDN through the access network of the 3GPP system to illustrate that the UE establishes a PDN connection, and the P-GW obtains the PCC rule carrying the access network selection policy. , and deliver it to the UE, and the UE and the P-GW perform a process of binding the service data flow with the access network according to the access network selection policy.

71. The UE sends a PDN Connectivity Request (PD connection request) message to the MME (Mobility Management Entity, mobility management network element), including APN (Access Point Name, access point name), PDN Type (PDN type), PCO (Protocol Configuration Options, protocol configuration item) and other information.

72. The MME sends a Create Session Request (session establishment request) message to the S-GW (Serving Gateway, serving gateway), which includes the UE identifier, P-GW address, PDN address, PDN Type, PCO, APN-AMBR (APN-AMBR (APN- Aggregate Maximum Bit Rate, Aggregate Maximum Bit Rate), and carries information such as QoS (Quality of Service, Quality of Service) by default.

73. The S-GW creates a new entry in its EPS (Evolved Packet System, evolved packet system) bearer table, and sends a Create Session Request message to the P-GW, which includes the UE identifier, S-GW address and TEID ( Tuunel Endpoint Identifier, tunnel endpoint identifier), APN and other information.

74. If there is dynamic PCC rule configuration, P-GW sends Indication of IP-CAN Session Establishment

(IP Connectivity Access Network session Establishment, IP connection access network session establishment indication) message, which includes UE identifier, APN, IP-CAN (IP Connectivity Access Network session, IP connection access network session) type and other information, also includes information for IP address assigned by UE.

75. Optionally, the PCRF interacts with the ANDSF, and the PCRF obtains an access network selection policy.

76. The PCRF sends an Acknowledge IP-CAN Session Establishment (IP connection access network session establishment response) message to the P-GW, which includes the PCC rule carrying the access network selection policy.

77. The P-GW creates a new entry in its EPS bearer context table, and according to the received PCC rule carrying the access network selection policy, binds the service data flow with the access network according to the access network selection policy. And, the P-GW sends a Create Session Response (session establishment response) message to the S-GW, which includes the PCC rule carrying the access network selection policy.

Optionally, the PCC rule including the access network selection policy may be statically configured on the P-GW.

78. The S-GW sends a Create Session Response message to the MME, which includes a service data flow template TFT carrying an access network selection policy.

79. The MME sends a PDN Connectivity Accept (PDN connection confirmation) message, which includes the service data flow template TFT carrying the access network selection policy, and forwards it to the UE via the eNodeB (Evolved Node B, evolved Node B). The UE binds the service data flow with the access network according to the relevant access network selection policy in the service data flow template TFT.

Subsequently, the UE sends the service data stream. If the service data stream is not bound to the corresponding access network, the UE discards the service data. Optionally, the UE may indicate to the application program the error type of the discarded data. If the service data flow has a corresponding access network binding, the UE binds the service data with the access network according to the access network binding.

Subsequently, if the connection status of the access network changes, in the embodiment shown in FIG. 7, the WLAN system can be connected, and the UE detects that there is a service data flow that needs to be preferentially accessed to the WLAN system, and the UE initiates an IP flow mobility (IP flow mobility) process, the UE and the P-GW re-execute the binding between the IP service data flow and the access network. Afterwards, the UE sends the data of this service data flow, which will be forwarded from the WLAN to the P-GW. Later, when the connection status of the access network changes, such as the WLAN system is no longer available, the UE checks the access network selection policy, initiates the IP flow mobility process, and the UE and the P-GW re-execute the IP service data flow and the access network In the binding between the UEs, the UE sends the data of the service data flow, which will be forwarded from the access network of the 3GPP system to the P-GW.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection policy of the service data flow, After the user equipment selects the access network for the service data flow it transmits, the access control node can determine whether the access network selected by the user equipment conforms to the access network selected by the access network selection policy, and if the user equipment does not follow the access network When selecting a policy to perform access, the access control node controls the selection of an access network that conforms to the access network selection policy. As shown in FIG. 8, in this embodiment of the present invention, the UE has simultaneously accessed a 3GPP system and a non-3GPP system as an example. During the process of establishing a certain PDN connection, the network side detects that there is data transmission of a certain service, but The UE does not bind the service data flow with the corresponding access network according to the access network selection policy, that is, the service data flow is transmitted from the non-preferred access network to the network side, and the network side initiates IP flow mobility (IP flow mobility) The process notifies the UE to re-execute the process of binding the service data flow with the access network.

81. The UE has access to a 3GPP system and a non-3GPP system at the same time, and uses a PDN connection in these two systems at the same time. There are multiple flow bindings between UE and HA (Home Agent, Home Agent).

82. The HA detects or receives an indication that a service data flow selects a non-preferred access network indicated by the access network selection strategy, such as the access network selection strategy indicates that the priority access network of the service is a non-3GPP access network, but, The UE is currently using the 3GPP access network to perform the service, and the HA sends a Flow Binding Indication (Flow Binding Indication) message to the UE, updates the routing rules, and instructs the non-3GPP access network to perform the service. The Flow Binding Indication message includes an access network selection strategy, HoA (Home Address, home address), BID (Binding ID, binding identifier) and FID (Flow ID, flow identifier), where FID identifies an existing service data flow, and BID The access network that this service data flow needs to access is identified, that is, the preferred access network.

83. If the HA function is implemented on the P-GW, the P-GW sends an Indication of IP-CAN Session Modification (IP Connectivity Access Network session, IP connection access network session modification indication) message to the PCRF, and provides updated routing rules to The PCRF and the PCF store the updated mapping relationship between the routing address and the access network.

84. The UE sends a Flow Binding Acknowledgment (flow binding confirmation) message to the HA, indicating that the updated routing rule is accepted.

85. Based on the Indication of IP-CAN Session Modification message, the PCRF sends relevant QoS rules to the BBERF (Bearing Binding and Event Report Function, bearer binding and event report function) entity of the non-3GPP system, providing GW control session and QoS rules provision (gateway control session and QoS rules) provision process.

86. For a service data flow switched to a non-3GPP system, the 3GPP system initiates a resource release or modification process.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network. As shown in FIG. 9, the embodiment of the present invention takes the UE to initiate a resource request process in the 3GPP access network according to the access network selection policy obtained from ANDSF as an example, to illustrate that the UE indicates the service data flow to be modified and the required access The network side decides whether to accept the UE's request according to the access network selection policy in the received or locally saved PCC rules, and performs the corresponding resource modification process, and in this process, the received access network The network selection policy is delivered to the UE.

91. The UE initiates a resource request process in the 3GPP system, and the requested operation includes adding, modifying or deleting. If UE sends Request Bearer Resource Modification (Request for Bearer Resource Modification) message to MME, which includes a description of the service data flow to be modified and the access network to be accessed.

92. The MME sends the received information to the Bearer Resource Command (Bearer Resource Command) message. 93. The S-GW sends the Bearer Resource Command to the P-GW.

94. If dynamic PCC rules are configured, the P-GW will initiate the IP-CAN Session Modification process and request a new

PCC rules, including access network selection policies for service data flows.

95. If the resource request is accepted, the P-GW initiates a bearer activation process, or a bearer modification process, or a bearer deletion process according to the requested operation in the message sent by the UE. During this process, the PGW sends the received access network selection policy to the UE.

96. If the P-GW interacts with the PCRF in step 94, the P-GW notifies the PCRF at this time whether the new PCC rule is executed, and completes the IP-CAN session modification process.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network. As shown in FIG. 10 , in this embodiment of the present invention, the UE initiates the DSMIPv6 process according to the access network selection policy obtained from the ANDSF as an example to illustrate that the UE indicates the network side access network selection policy, and the network side updates the locally stored access network selection strategy process.

101. The UE accesses a non-3GPP system. There are multiple flow bindings between user equipment and HA.

102. The UE sends a Binding Update (binding update) message to the HA to update the routing rules. The message includes the access network selection policy, HoA, BID and FID, where the FID identifies the existing service data flow, and the BID identifies the service data flow. Priority access to the system.

103. If the HA function is implemented on the P-GW, the P-GW sends an Indication of IP-CAN Session Modification (IP-CAN Session Modification Indication) message to the PCRF, and provides an updated routing rule to the PCRF, and the PCRF stores the updated routing address and Mapping relationships between access systems.

104. The PCRF sends an Acknowledge IP-CAN Session Modification (IP-CAN Session Modification Response) message to the P-GW, which may include updated PCC rules.

105. The HA sends a Binding Acknowledgment (binding confirmation) message to the UE, indicating that the updated routing rules are accepted.

106. Based on the IP-CAN Session Modification (IP-CAN session modification) message, the PCRF sends the relevant QoS rules to the BBERF of the target non-3GPP system, and provides the process through the GW control session and QoS rules provision (gateway control session and QoS rules) .

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, access control The node controls to select the access network that conforms to the access network selection policy. As shown in FIG. 11, in the embodiment of the present invention, the UE accesses the 3GPP system. After the network side obtains the access network selection policy, the network side dynamically detects that the UE's binding of service data to the access network does not comply with the access network selection policy. As an example, it is described that the network side blocks the service data and is modifying the binding between the service data and the access network.

111. The UE establishes a PDN connection, and the P-GW obtains the access network selection policy for the service data flow.

112. The P-GW detects the access network selection strategy, and determines whether the service data flow is bound to an access network that does not comply with the access network selection strategy. If it exists, the P-GW prevents the data of this service data flow from being transmitted in this access network. For example, a service data flow is bound to the 3GPP E-UTRAN system, but according to the access network selection policy, the E-UTRAN system is a prohibited access type for this service data flow, then the P-GW blocks the data of this service data flow Transmitted in the E-UTRAN system.

113. The UE uploads uplink data.

114. The P-GW sends a blocking indication to the UE, informing the UE that the data of the service data flow is not allowed to be transmitted in the E-UTRAN system, and modifies the binding of the service data flow and the access network according to the access network selection policy. Optionally, the P-GW can use the bearer update process to notify the UE that the data of this service data flow is not allowed to be transmitted in the E-UTRAN system, for example, the P-GW sends an Update Bearer Request (bearer update request) message to the S-GW, the message includes a block (block) indication to the UE.

115. The S-GW forwards the Update Bearer Request message to the MME.

116. The MME sends a Downlink NAS Transport (downlink NAS transmission, Non-Access-Stratum, non-access stratum) message to the eNodeB, which includes an instruction to modify the binding of the service data flow to the access network and to the UE.

117. The eNodeB sends a Direct Transfer (direct transfer) message to the UE, which includes modifying the binding of the service data flow with the access network and an indication to the UE of blocking.

118. The UE updates the binding of the service data flow on it with the access network, and sends a Direct Transfer message to the eNodeB.

119. The eNodeB sends a NAS (downlink NAS transmission) response message to the MME, including the bearer identifier.

1120. The MME sends an Update Bearer Response (bearer update response) message to the S-GW.

1121. The S-GW sends an Update Bearer Response (bearer update response) message to the P-GW.

Afterwards, the UE transmits the service data flow on this access network again, and the UE will receive a blocking instruction issued by the P-GW, so the UE selects other access networks to access according to the access network selection policy. If there is no other access network currently If network access is optional, the service data is discarded and the upper-layer application program is notified.

It should be noted that: the step of the bearer update process can be paralleled with step 114, and the P-GW can also send the blocking indication to the UE through other messages.

As shown in FIG. 12, in this embodiment of the present invention, the UE accesses a non-3GPP system. After the network side obtains the access network selection policy, the network side dynamically detects that the UE's binding of service data to the access network does not comply with the access network selection policy. The policy is taken as an example, indicating that the network side blocks the service data and is modifying the binding between the service data and the access network.

121. The UE establishes a PDN connection, and the P-GW obtains an access network selection policy.

122. The P-GW detects the access network selection strategy, and determines whether the service data flow is bound to an access network that does not comply with the access network selection strategy. If it exists, the P-GW prevents the data of this service data flow from being transmitted in this access network. If there is a business data flow Binding with a non-3GPP WLAN system, but the WLAN system is a prohibited access type for this service data flow, and the P-GW prevents the data of this service data flow from being transmitted in the WLAN system.

123. The UE oh transmits uplink data.

124. The P-GW sends a blocking indication to the UE, informing the UE that it is not allowed to transmit the data of this service data flow in the WLAN system.

The P-GW can notify the UE through the binding update process, for example, the P-GW sends a Flow Binding Indication (flow binding indication) message to the UE, which carries the service data flow identifier FID, access technology indication BID, and block indication.

125. The UE receives the block indication, and sends a Flow Binding Acknowledgment (flow binding confirmation) message to the P-GW. Afterwards, the UE transmits the service data flow on this access network again, and the UE will receive a blocking instruction issued by the P-GW, so the UE selects other access networks to access according to the access network selection policy. If there is no other access network currently If network access is optional, the service data is discarded and the upper-layer application program is notified.

It should be noted that: the steps of the binding update process can be paralleled with step 124, and the P-GW can also send the blocking indication to the UE through other messages.

In the service access control method of the embodiment of the present invention, the access control node on the network side obtains the access network selection strategy for the service data flow, and after the user equipment selects an access network for the service data flow it transmits, the access control node may Determine whether the access network selected by the user equipment conforms to the access network of the access network selection policy, and when the user equipment does not perform access according to the access network selection policy, the access control node controls the selection of the access network that conforms to the access network selection policy. into the network. Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be realized by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium. The program During execution, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory. ROM) or a random access memory (Random Access Memory, RAM), etc.

Claims (18)

Rights request 1. A service access control method, characterized in that the method includes: The access control node obtains the access network selection strategy of the service data flow; The access control node sends the access network selection policy to the user equipment; When the access control node determines that the access network through which the user equipment transmits the service data flow does not conform to the access network selected by the access network selection policy, the access control node performs an operation on the access of the service data flow control. 2. The service access control method according to claim 1, wherein the access control node obtains the access network selection strategy of the service data flow, including: The access control node obtains PCC policy control and charging rules from the PCRF policy charging rule functional entity, and the PCC rules carry the access network selection policy of the service data flow; Or, the access control node obtains the access network selection policy of the service data flow through local pre-configuration; wherein, the access control node includes a P-GW packet data network gateway. 3. The service access control method according to claim 1, wherein the access network selection policy includes: service data flow information, access network type information, and binding policy information, wherein the service The data flow information includes a business data flow template, and the binding policy information includes: Priority binding strategy: the service data flow indicated by the service data flow information is preferentially bound to the access network indicated by the access network type information; Or, prohibiting the binding policy: prohibiting the service data flow indicated by the service data flow information from being bound to the access network indicated by the access network type information; Or, allow the binding policy: allow the service data flow indicated by the service data flow information to be bound with the access network indicated by the access network type information. 4. The service access control method according to claim 3, characterized in that, after the access control node obtains the access network selection policy of the service data flow, before sending the access network selection policy to the user equipment, The method also includes: According to the priority binding policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the access control node binds the service data flow to the current access network; or, the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, and the access control node binds the service data flow to For the current access network, when the access control node detects that another access network simultaneously accessed by the user equipment is the access network indicated by the access network type information, the access control node sets the The service data flow is bound to the access network indicated by the access network type information; Or, according to the binding prohibition policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the access control node does not bind the service data flow; when the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the access control node binds the service data flow to the current access network; Or, according to the allowed binding policy, when the current access network of the user equipment is not the access network indicated by the access network type information, the access control node does not bind the service data flow; when the current access network where the user equipment initiates the service is When the access network is indicated by the access network type information, the access control node binds the service data flow to the current access network. 5. The service access control method according to claim 3, wherein the access control node determines that the access network through which the user equipment transmits the service data flow does not comply with the access network selection policy. When accessing the network, the access control node controls the access of the service data flow, including: According to the priority binding policy, the access control node detects that the user equipment has accessed the access network indicated by the access network type information, but the current access network through which the user equipment transmits the service data stream If it is not the access network indicated by the access network type information, the access control node binds the service data flow handover to the access network indicated by the access network type information; or, according to the binding prohibition policy, when the current access network for the user equipment to transmit the service data flow is the access network indicated by the access network type information, the access control node prevents the user equipment from transmitting service data flow, and send an indication to notify the user equipment that the service data flow is blocked; Or, according to the allowed binding policy, when the current access network for the user equipment to transmit the service data flow is not the access network indicated by the access network type information, the access control node prevents the user equipment from the transmitted service data flow, and send an indication to notify the user equipment that the service data flow is blocked. 6. A service access control device, characterized in that the device includes: a first obtaining unit, configured to obtain an access network selection strategy for a service data flow; a first sending unit, configured to send the access network selection policy to the user equipment; The first control unit is configured to determine that the access network through which the user equipment transmits the service data flow does not conform to the access network of the access network selection policy, and control the access of the service data flow. 7. The service access control device according to claim 6, wherein the first obtaining unit includes: a first obtaining subunit, configured to obtain the PCC policy control from the PCRF policy charging rule functional entity and a charging rule, where the PCC rule carries an access network selection policy for the service data flow; Or, the second obtaining subunit is configured to obtain the access network selection policy of the service data flow through local pre-configuration. 8. The service access control device according to claim 6, wherein D., the access network selection policy includes: service data flow information, access network type information, and binding policy information, wherein the The service data flow information includes a service data flow template, and the binding policy information includes: Priority binding strategy: the service data flow indicated by the service data flow information is preferentially bound to the access network indicated by the access network type information; Or, prohibiting the binding policy: prohibiting the service data flow indicated by the service data flow information from being bound to the access network indicated by the access network type information; Or, allow the binding policy: allow the service data flow indicated by the service data flow information to be bound with the access network indicated by the access network type information. 9. The service access control device according to claim 8, further comprising: The first binding unit is configured to, according to the preferential binding policy, when the current access network where the user equipment initiates a service is the access network indicated by the access network type information, the access control node will The service data flow is bound to the current access network; or, the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the access control node will The service data flow is bound to the current access network, and when the access control node detects that another access network simultaneously accessed by the user equipment is the access network indicated by the access network type information, The access control node binds the service data flow to the access network indicated by the access network type information; Or, the second binding unit is configured to, according to the binding prohibition policy, when the current access network where the user equipment initiates a service is the access network indicated by the access network type information, the access control The node does not bind the service data flow; when the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the access control node binds the service data flow Bind to the current access network; Or, the third binding unit is configured to, according to the allowed binding policy, when the current access network of the user equipment is not the access network indicated by the access network type information, the access control The node does not bind the service data flow; when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the access control node binds the service data flow to the current access network. 10. The service access control device according to claim 8, wherein the first control unit includes: a first control subunit, configured to control the access according to the priority binding policy The node detects that the user equipment has accessed the access network indicated by the access network type information, but the current access network where the user equipment transmits service data streams is not the access network indicated by the access network type information When connecting to a network, the access control node binds the switching of the service data flow to the access network indicated by the access network type information; Or, the second control subunit is configured to: according to the binding prohibition policy, when the current access network for the user equipment to transmit the service data flow is the access network indicated by the access network type information, the access The control node blocks the service data flow transmitted by the user equipment, and sends an instruction to notify the user equipment that the service data flow is blocked Jh; Or, the third control subunit is configured to, according to the allowed binding policy, when the current access network where the user equipment transmits the service data flow is not the access network indicated by the access network type information, the access network The ingress control node blocks the service data flow transmitted by the user equipment, and sends an indication to notify the user equipment that the service data flow is blocked. 11. The service access control device according to claim 6, wherein the service access control device comprises a P-GW packet data network gateway. 12. A service access control method, characterized in that the method comprises: The user equipment determines the binding relationship between the service data flow and the current access network according to the access network selection policy, the access network selection policy is sent by the control node, or is sent by the access network discovery and selection function ANDSF, or is pre-configured On the user equipment; when the access network through which the user equipment transmits the service data flow does not conform to the access network selected by the access network selection policy, the user equipment receives the instruction notification sent by the access control node, and is The service data flow selects the access network that conforms to the access network selection strategy. 13. The service access control method according to claim 12, wherein the access network selection policy includes: service data flow information, access network type information, and binding policy information, wherein the service The data flow information includes a business data flow template, and the binding policy information includes: Priority binding strategy: the service data flow indicated by the service data flow information is preferentially bound to the access network indicated by the access network type information; Or, prohibit binding policy: prohibit the service data flow indicated by the service data flow information and the access network type information indicated access network for binding; Or, allow the binding policy: allow the service data flow indicated by the service data flow information to be bound with the access network indicated by the access network type information. 14. The service access control method according to claim 13, wherein the user equipment determines the binding relationship between the service data flow and the current access network according to the access network selection strategy, including: According to the priority binding policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the user equipment binds the service data flow to the the current access network; or, the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, and the user equipment binds the service data flow to the current access network network access, when the user equipment detects that another access network that it simultaneously accesses is the access network indicated by the access network type information, the user equipment binds the service data flow to the The access network indicated by the access network type information, or, when the user equipment detects that the access network indicated by the access network type information can be accessed, the user equipment accesses the access network type information The indicated access network, binding the service data flow to the access network indicated by the access network type information; Or, according to the binding prohibition policy, when the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, the user equipment binds the service data flow to the current access network; when the current access network where the user equipment initiates a service is the access network indicated by the access network type information, the user equipment does not bind the service data flow, the The user equipment initiates reselection access; Or, according to the allowed binding policy, when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the user equipment binds the service data flow to The current access network; when the current access network of the user equipment is not the access network indicated by the access network type information, the user equipment does not bind the service data flow, and the user equipment initiates Select Access again. 15. The service access control method according to claim 13, wherein the user equipment receives the instruction notification sent by the access control node, and selects an access network selection strategy for the service data flow. The access network includes - the user equipment receiving an instruction notification sent by the access control node, the instruction notification indicating that the service data flow sent by the user equipment is blocked; The user equipment cancels the binding of the service data flow and the current access network; The user equipment selects an access network for the service data flow according to the access network selection policy. 16. A user equipment, characterized in that the user equipment includes: The fourth binding unit is configured to determine the binding relationship between the service data flow and the current access network according to the access network selection policy, the access network selection policy is sent by the control node, or is discovered and obtained by the access network select the function ANDSF to send, or pre-configure on the user equipment; The second control unit is configured to receive an instruction notification sent by the access control node when the access control node determines that the access network through which the user equipment transmits the service data flow does not conform to the access network of the access network selection policy , select an access network conforming to the access network selection strategy for the service data flow. 17. The user equipment according to claim 16, wherein the access network selection policy includes: service data flow information, access network type information, and binding policy information, wherein the service data flow information includes business data flow template, the Binding policy information includes: Priority binding strategy: the service data flow indicated by the service data flow information is preferentially bound to the access network indicated by the access network type information; Or, prohibiting the binding policy: prohibiting the service data flow indicated by the service data flow information from being bound to the access network indicated by the access network type information; Or, allow the binding policy: allow the service data flow indicated by the service data flow information to be bound with the access network indicated by the access network type information. 18. The user equipment according to claim 17, characterized in that, the fourth binding unit may include: The first binding subunit is configured to, according to the preferential binding policy, when the current access network where the user equipment initiates a service is the access network indicated by the access network type information, the user equipment will binding the service data flow to the current access network; or, the current access network where the user equipment initiates the service is not the access network indicated by the access network type information, and the user equipment binds the service The data stream is bound to the current access network, and when the user equipment detects that another access network that it simultaneously accesses is the access network indicated by the access network type information, the user equipment will The service data flow is bound to the access network indicated by the access network type information, or when the user equipment detects that the access network indicated by the access network type information can be accessed, the user equipment accessing the access network indicated by the access network type information, and binding the service data flow to the access network indicated by the access network type information; Or, the second binding subunit is configured to, according to the binding prohibition policy, when the current access network where the user equipment initiates a service is not the access network indicated by the access network type information, the user The device binds the service data flow to the current access network; when the current access network where the user equipment initiates the service is the access network indicated by the access network type information, the user equipment does not bind determining the service data flow, the user equipment initiates a reselection access; Or, the third binding subunit is configured to, according to the allowed binding policy, when the current access network where the user equipment initiates a service is the access network indicated by the access network type information, the user equipment Bind the service data flow to the current access network; when the current access network of the user equipment is not the access network indicated by the access network type information, the user equipment does not bind the Service data flow, the user equipment initiates reselection access. 19. The user equipment according to claim 16, wherein the second control unit includes: an indication notification receiving unit, configured to receive an indication notification sent by the access control node, where the indication notification indicates that the service data flow sent by the user equipment is prevented; A cancel unit, configured to cancel the binding of the service data flow and the current access network; an access control unit, configured to select an access network for the service data flow according to the access network selection policy.