CN1642076A - A method for obtaining user identification by packet data gateway in wireless local area network - Google Patents

Abstract

The invention provides a method for obtaining user ID at packet data gateway in wireless local area network, which is characterized in that AAA server obtains the permanent user ID information of the user according to the request authentication information containing temporary user ID information sent by PDG, and sends the authorization information containing the permanent user ID information to PDG, thus PDG obtains the permanent user ID information of WLAN user. And then, the PDG stores the obtained permanent user identity identification information and the tunnel identification information of the user terminal in a correlation manner, so that the PDG manages the WLAN user terminal, such as charging and/or access control for the user. The invention is simple to realize and has good compatibility with the prior related flow.

Description

A method for obtaining user identification by packet data gateway in wireless local area network

technical field

The present invention relates to the field of wireless access technology, in particular to a method for a packet data gateway (PDG, Packet Data Gateway) in a wireless local area network to obtain a user identity.

Background technique

With the development of society, users have higher and higher requirements for wireless access rate. Since WLAN (Wireless Local Area Network) can provide high-speed wireless data access in a small area, it is widely used. Wireless local area network includes a variety of different technologies. A technical standard that is widely used at present is IEEE 802.11b, which uses the 2.4GHz frequency band, and the maximum data transmission rate can reach 11Mbps. IEEE 802.11g and Bluetooth (Bluetooth) technology are also used in this frequency band. , Among them, the highest data transmission rate of 802.11g can reach 54Mbps. Other wireless LAN technologies, such as IEEE 802.11a and ETSI BRAN Hiperlan2, use the 5GHz frequency band, and the highest transmission rate can reach 54Mbps.

Although there are many different WLAN radio access technologies, most WLANs use Internet Protocol (IP) packet data packets for data transmission. For a wireless IP network, the specific WLAN access technology adopted is generally transparent to the upper layer IP, and its basic structure is to use the access point (AP) to complete the wireless access of the user terminal, and control and connect the device through the network The composed IP transmission network carries on the data transmission.

With the rise and development of WLAN technology, WLAN and various wireless mobile communication networks, such as: global mobile communication (GSM) system, code division multiple access (CDMA) system, wideband code division multiple access (WCDMA) system, time division duplex -The intercommunication between synchronous code division multiple access (TD-SCDMA) system and CDMA2000 system is becoming the focus of current research. In the 3rd Generation Partnership Project (3GPP) standardization organization, user terminals can be connected to the Internet (Internet) and intranet (Intranet) through the WLAN access network, and can also be connected to the 3GPP system through the WLAN access network. network or the access network of the 3GPP system.

FIG. 1 is a schematic diagram of a networking structure for intercommunication between a WLAN system and a 3GPP system in a roaming situation. When a WLAN user terminal is roaming, it is connected to the 3GPP access network via the WLAN access network. Since some entities in the 3GPP access network are interconnected with corresponding entities in the 3GPP home network, for example: 3GPP authentication in the 3GPP access network Authorization and accounting (AAA) proxy and 3GPP authentication, authorization and accounting (AAA) server in the 3GPP home network; wireless LAN access gateway (WAG) in the 3GPP access network and packet data gateway (PDG) in the 3GPP home network, etc. , therefore, the access of the WLAN user terminal to the home network of the 3GPP is realized. The shaded part in the figure is the 3GPP Packet Switching (PS) domain service, that is, the interworking scenario 3 (Scenario3) service in the 3GPP network.

FIG. 2 is a schematic diagram of a networking structure for intercommunication between a WLAN system and a 3GPP system in a non-roaming condition. When a WLAN user terminal accesses locally, it is directly connected to a 3GPP home network via a WLAN access network. The shaded part in the figure is the 3GPP Packet Switching (PS) domain service, that is, the Scenario3 service in the 3GPP home network.

Referring to Figure 1 and Figure 2, in the 3GPP system, it mainly includes Home Subscriber Server (HSS)/Home Location Register (HLR), 3GPP AAA Server, 3GPP AAA Agent, WAG, Packet Data Gateway, Charging Gateway (CGw )/Charging Information Collection System (CCF) and Online Charging System (OCS). The user terminal, the WLAN access network and all entities of the 3GPP system together constitute a 3GPP-WLAN interactive network, which can be used as a wireless local area network service system. Among them, the 3GPP AAA server is responsible for user authentication, authorization and billing, collects billing information sent by the WLAN access network and transmits it to the billing system; Packet Data Gateway (PDG) is responsible for accessing user data from the WLAN The network is transmitted to the 3GPP network or other packet networks; the billing system mainly receives and records the user billing information from the network, and the OCS instructs the network to periodically transmit the online billing information according to the billing situation of the online billing user, and performs statistics and control .

If a WLAN user terminal wishes to access the Internet/Intranet, it must send an access request message containing its own permanent user identity information, such as the International Mobile Subscriber Identity (IMSI), to the AAA server (AS) through the WLAN access network for Basic access authentication and authorization. After passing the access authentication and authorization of the AS, the WLAN user terminal can access the Internet/Intranet through the WLAN access network. The permanent user identity is unique to each user.

During the basic access authentication and authorization process, the AS assigns a temporary user ID to the WLAN user terminal to be applied for access, and the WLAN user who passes the authentication uses the temporary user ID instead of the permanent user ID to communicate. Alternatively, the AS may also assign a temporary user ID to the user in the subsequent re-authentication process or service authentication process, or update the temporary user ID in the subsequent re-authentication process or service authentication process.

If the WLAN user terminal authorized by the basic access authentication wishes to access the PS domain service of 3GPP, it can further apply to the 3GPP home network for the service of interworking scenario 3 (Scenario3), namely:

The WLAN user terminal obtains the PDG address that can provide the service requested by the user in the 3GPP packet network from the domain name resolution server (DNS), and sends a tunnel establishment request message containing temporary user identity information to the PDG, and the PDG forwards the received request message Perform authentication processing for AS. After completing the authentication process on the WLAN user terminal, the AS authorizes the user to access the PS domain service of 3GPP through the PDG. At this time, the PDG that receives the request is responsible for allocating the tunnel identifier, establishing the tunnel connection, and providing the required services to the WLAN user terminal that initiated the application.

The defect of the existing solution is that: the PDG has no process of obtaining the permanent user identity of the WLAN user. Therefore, when the PDG communicates with the WLAN terminal, it does not know the real identity of the user, so it cannot realize the control services related to the permanent identity of the user, such as billing the user or performing access control on the user.

Contents of the invention

In view of this, the purpose of the present invention is to provide a method for the PDG in a wireless local area network to obtain the user identity, so that the PDG can obtain the permanent user identity information of the WLAN user.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

A method for obtaining a user identity by a packet data gateway in a wireless local area network, the method comprising the following steps:

a. The AAA server assigns temporary user identity information to the user, and simultaneously saves the corresponding relationship between the user's permanent user identity and the temporary user identity;

b. When the AAA server receives the message from the PDG that includes the temporary user identity information of the user applying for the service and requests the user to authenticate the user, it will perform authentication processing on the user terminal. If the authentication is successful, then according to step a The relationship obtains the permanent user identity information of the user, and after sending a successful authorization message containing the permanent user identity information to the PDG, step c is performed, and if the authentication is unsuccessful, the AAA server directly sends a failure message to the PDG;

c. After receiving the message in step b, the PDG saves the permanent user identity information of the user.

Preferably, after the PDG in step c receives the message in step b, it further includes: the PDG allocates tunnel identification information to the authenticated user terminal, and saves the user's permanent user identity information and the tunnel identification information After the association information of the user terminal is established, a tunnel for communication with the user terminal is established.

Preferably, after the PDG in step c receives the message in step b, it further includes: after the PDG assigns tunnel identification information to the authenticated user terminal, it determines whether there is permanent user identity information of the user locally, and if there is , then directly save the permanent user identity information of the user and the associated information of the tunnel identity information, and then establish a tunnel for communication with the user terminal; otherwise, first save the permanent user identity information of the user, and then save the After associating information between the permanent user identity information of the user and the tunnel identification information, a tunnel for communication with the user terminal is established.

Preferably, when the tunnel communicating with the user terminal is removed, the method further includes: the PDG deletes the association information between the permanent user identity information and the tunnel identity information.

Preferably, the method further includes: PDG judging whether there is associated information between the permanent user identification information and one or more tunnel identification information, if so, not doing any processing, otherwise deleting the permanent user identification information.

Preferably, the method further includes: the PDG obtains the permanent user identity information of the user according to the tunnel identification information, and implements charging or access control for the user terminal.

Preferably, the permanent user identity information is an International Mobile Subscriber Identity (IMSI).

In the present invention, the AAA server obtains the permanent user identity information of the user according to the request authentication message containing the temporary user identity information sent by the PDG, and sends the authorization message containing the permanent user identity information to the PDG, thereby The PDG is made to acquire the permanent user identity information of the WLAN user. Furthermore, the PDG associates and saves the acquired permanent user identity information with the tunnel identity information of the user terminal, so that the PDG implements management on the WLAN user terminal, such as implementing charging and/or access control for the user. The invention is simple to implement and has good compatibility with the existing related processes.

Description of drawings

FIG. 1 is a schematic diagram of a networking structure for intercommunication between a WLAN system and a 3GPP system in the case of roaming;

FIG. 2 is a schematic diagram of the networking structure of the intercommunication between the WLAN system and the 3GPP system in the case of non-roaming;

Fig. 3 shows the flowchart of applying the PDG of the present invention to obtain permanent user identity information;

Fig. 4 is a schematic diagram showing the association of permanent user identification information with more than one tunnel identification information.

Detailed ways

In order to make the technical solution of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

The idea of the present invention is: the AAA server assigns the temporary user identity information to the user, and saves the corresponding relationship between the permanent user identity and the temporary user identity of the user at the same time; After the request for identification information authenticates the user's identity, the user terminal is authenticated. If the authentication is successful, the permanent user identity information of the user is obtained according to the corresponding relationship in step a, and the permanent user identity information is sent to the PDG containing the permanent After the successful authorization message of the user identity information, the permanent user identity information of the user is saved by the PDG, if the authentication is unsuccessful, the AAA server directly sends a failure message to the PDG;

Fig. 3 is a flow chart of obtaining permanent user identity information by applying the PDG of the present invention.

Step 301, the WLAN user sends an access request message containing its own permanent user identity information, such as IMSI, to the AAA server through the WLAN access network to perform basic access authentication, and the AS assigns a temporary user to the user terminal that has passed the basic access authentication Identity information, and save the corresponding relationship between the user's permanent user identity and temporary user identity;

The AS may assign a temporary user ID to the user during the basic access authentication process, or, the AS may assign a temporary user ID to the user during the subsequent re-authentication process or service authentication process, or, in the subsequent re-authentication process or service authentication process authentication process to update the temporary user identity.

Step 302, after the WLAN user authorized by the basic access authentication obtains the address of the PDG providing the requested service from the DNS, it sends a tunnel establishment request message containing its own temporary user identity information to the PDG;

Step 303, the PDG sends to the AAA server an authentication request message containing the temporary user identity information of the applicant, so as to request the AAA server to authenticate and authorize the user terminal;

Step 304, the AAA server performs authentication processing on the user terminal specified by the PDG, if the authentication is successful, then execute step 305, if the authentication is not successful, the AAA server directly sends a failure response message to the PDG, and ends the process;

Step 305, the AAA server obtains the permanent user identity information of the user according to the corresponding relationship saved in step 301, and sends a successful authorization message containing the permanent user identity information to the PDG, allowing the applying user terminal to pass through the PDG applied for. access business;

Step 306, after the PDG receives the authorization message from the AAA server, it distributes tunnel identification and other information related to tunnel establishment to the user terminal, and judges whether the permanent user identity information of the user is saved locally, and if so, directly saves the user terminal After the associated information of the user's permanent user identity information and the tunnel identity information, execute step 307; otherwise, first save the user's permanent user identity information, and then save the user's permanent user identity information and the After the associated information of the tunnel identification information, execute step 307;

Since a PDG may support multiple services, a WLAN user terminal may have multiple tunnel connections with a PDG, that is, a WLAN user's permanent user ID may be associated with multiple tunnel IDs at the same time; as shown in Figure 4 , the permanent user ID 1 of one user is associated with the tunnels whose tunnel IDs are 1, 2, and 3 of a certain PDG at the same time, and the permanent user ID 2 of another user is associated with the tunnels whose tunnel IDs are 4 and 5 of the PDG at the same time ;

Step 307, the PDG establishes a tunnel for communicating with the user terminal;

Step 308, during the service communication process, the PDG obtains the permanent user identity information of the user according to the tunnel identification information in the service information of the user terminal, and implements services related to the permanent user identity, such as charging the user terminal , and or access control etc.

The so-called realization of charging means that when a user terminal uses one or more services of a certain PDG, that is, one or more tunnels, the PDG realizes the corresponding relationship between the tunnel ID and the user's permanent identity. Billing for all application services.

The so-called implementation of access control refers to the realization of more detailed control by the PDG for a certain type of business. Usually, the AAA server provided by the operator is limited to checking whether the user terminal has subscribed to the service, and does not perform a more detailed check. The application of the present invention enables the PDG to check more detailed information on the user terminal. For example, when a WLAN user terminal subscribes to a certain game service, the AAA server will authorize the user to access the PDG that provides the game service after checking that the user has indeed ordered the game service. A PDG usually provides multiple game services, and the user generally only orders one of them. One or several of the WLAN users, the PDG can judge whether the WLAN user can participate in a certain game through the user's permanent user identity, and realize the control.

In addition, when a user finishes using a tunnel and removes it, the PDG will delete the association information between the tunnel ID and the permanent user ID. When the PDG finds that a permanent user ID has no associated tunnel ID information, the PDG The permanent user identification information will be deleted.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the scope of the present invention. within the scope of protection.

Claims (7)

1, the method for obtaining user identification sign of packet data interface in a kind of WLAN (wireless local area network) is characterized in that this method may further comprise the steps:

A, aaa server distribute casual user's identification information to the user, preserve the permanent user identity sign of this user terminal and the corresponding relation of casual user's identify label simultaneously;

B, when aaa server receive from the request that comprises application service-user casual user identification information of PDG this user is carried out the message of authentication after, this user terminal is carried out authentication processing, if authentication success, then obtain this user's permanent user identity identification information according to the described corresponding relation of step a, and after the PDG transmission comprises the successful authorization messages of permanent user identity identification information, execution in step c, if authentication is unsuccessful, then aaa server directly sends failure to PDG;

After c, PDG receive the described message of step b, preserve this user's permanent user identity identification information.

2, method according to claim 1, it is characterized in that, after the described PDG of step c receives the described message of step b, further comprise: PDG distributes tunnel identification information to this user terminal by authentication, and after preserving the related information of this user's permanent user identity identification information and described tunnel identification information, set up the tunnel that communicates with user terminal.

3, method according to claim 1, it is characterized in that, after the described PDG of step c receives the described message of step b, further comprise: after PDG distributes tunnel identification information to this user terminal by authentication, judge the local permanent user identity identification information whether this user is arranged, if have, after then directly preserving the related information of this user's permanent user identity identification information and described tunnel identification information, set up the tunnel that communicates with user terminal, otherwise, earlier this user's permanent user identity identification information is preserved, after preserving the related information of this user's permanent user identity identification information and described tunnel identification information again, set up the tunnel that communicates with user terminal.

According to claim 2 or 3 described methods, it is characterized in that 4, after the described tunnel that communicates with user terminal was removed, this method further comprised: the related information of PDG deletion permanent user identity identification information and described tunnel identification information.

5, method according to claim 4, it is characterized in that, this method further comprises: PDG judges permanent user identity identification information relevant information whether and between one or more tunnel identification informations, if, then be left intact, otherwise delete this permanent user identity identification information.

6, according to claim 2 or 3 described methods, it is characterized in that this method further comprises: PDG obtains user's permanent user identity identification information according to tunnel identification information, realizes the charging to this user, or access control.

7, method according to claim 1 is characterized in that, described permanent user identity identification information is international mobile subscriber identity IMSI.

Images