WO2013178138A1 - Method and identity information server for obtaining access identifier of terminal - Google Patents

Abstract

A method for obtaining an access identifier (AID) of a terminal comprises: setting an identity information server (IIS) in a network, initially storing an AID of a terminal in the network in the IIS, and establishing a mutual connection between IISs; when the terminal accesses from a visited network in a roaming manner, and when a visited IIS queries the AID of the terminal from a visited service access service router (ASR) of the terminal, querying the AID of the terminal from a home IIS of the terminal; and the visited IIS receiving the AID of the terminal that is returned by the home IIS of the terminal. According to the method, the AID of the terminal can be obtained when the terminal roams, so that the terminal can access the visited network.

Description

 Method for obtaining access identifier of terminal and identity information server

Technical field

 The present invention relates to the field of mobile communications, and in particular, to a method for acquiring an access identifier of a terminal and an identity information server. Background technique

 As we all know, in the IP Internet, if a terminal wants to access the IP Internet, it must apply for a valid IP address from the network. The IP address has a dual attribute that represents both the identity of the user and the location of the network topology in which the user is located. When a user obtains an IP address in a topology (for example, under an access gateway), the IP address can only be used in the topology (for example, it can only be used within the scope of one access gateway) . This is certainly not a problem for fixed terminals, but for mobile terminals, the above IP address becomes an invalid address after the terminal moves from the scope of one access gateway to another. At this point, the terminal must re-acquire a new IP address from the new topology. In this way, the continuity of the IP-based upper layer service cannot be guaranteed. For example, if the end user is making an IP call, the call will be broken.

 To solve this problem, the industry has proposed a series of solutions, such as mobile IP (Mobile IP)-based technology, GTP-based technology. However, these technologies have some generally recognized problems, such as routing roundabouts, single points of failure, and so on. On the one hand, routing detours will waste the carrier's transmission bearer resources, which is not conducive to cost saving. On the other hand, it increases the delay of sending and receiving IP data packets between MN (mobile terminal) and CN (communication peer), which is not conducive to improving users. The service experience; on the other hand, it increases the possibility that the terminal's IP packet encounters network congestion when it is transmitted on the network, causing the terminal service to be blocked or even impossible to implement (for example, real-time services such as voice, video, online games, etc.).

At present, the industry begins to study the method based on identity location separation. The purpose of this method is to solve the routing detour problem while resolving the IP address after the terminal crosses the access gateway. Referring to FIG. 1, the network logical structure of the method mainly includes an Access Service Router (ASR) and an Identity Location Register (ILR). The ASR is connected to the access network under it, and is mainly responsible for accessing the user terminal; the ILR mainly stores the "identity-location" correspondence of the terminal. In this method, a fixed access identifier needs to be configured for the end user. (Access Identity, AID for short), used to identify the identity of the user. The AID is stored in the ILR. When the user terminal accesses the network, the ASR queries the ILR to obtain the AID of the terminal, and sends the AID to the terminal.

 In an actual deployed network, there are often multiple carriers, and there are roaming agreements between these carriers. That is, Carrier B allows the terminals of Carrier A to access through their own networks and provide corresponding networks to the terminals. service. In the above method based on identity location separation, the AID of the end user is stored in the ILR of the home operator of the user. As shown in the example of FIG. 2, the user terminal A is the subscriber of the operator A (ie, the operator A is the home operator of the terminal A), and at this time, the user's AID is stored in the identity location register A (IRR-A). ). When the terminal roams to the carrier B (ie, the visited carrier) and accesses through the access service router B (ASR-B), the ASR-B cannot obtain the AID of the terminal. Because there is no record of the user in the ILR-B of the operator B, there is no AID information of the user. Therefore, in the foregoing method based on identity location separation, when a terminal roams, even if there is a roaming agreement between the home operator and the current visited operator, the terminal cannot obtain the AID of the terminal user. Network access.

Summary of the invention

 The invention provides a method for acquiring an access identifier of a terminal and an identity information server, which can obtain an access identifier of the terminal in the case that the terminal roams.

 To solve the above technical problem, an embodiment of the present invention provides a method for acquiring an access identifier of a terminal, including:

 Setting up an identity information server (IIS) in the network, initially storing an access identifier (AID) of the terminal in the network in IIS, and establishing interconnections between the IISs;

 When the terminal roams from the visited network, the visited IIS queries the terminal's home IIS for the terminal's AID when the terminal's visited service access service router (ASR) queries the terminal's AID; and

 The visited IIS receives the AID of the terminal returned by the home IIS of the terminal. The method also includes:

Initially save the identifier used by the terminal for access authentication in IIS, and use the terminal's AID and terminal. Associated with the identity of the access authentication;

 The step of the visited IIS querying the AID of the terminal to the home IIS of the terminal includes: the visited IIS is informed of the visited service ASR when receiving the identifier used by the terminal sent by the visited service ASR to access the authentication Querying the AID of the terminal;

 The visited IIS sends the received identifier of the terminal for access authentication to the home IIS of the terminal, and queries the AID of the terminal;

 The step of the visited IIS receiving the AID of the terminal returned by the home IIS of the terminal includes: the visited IIS receiving the identifier returned by the home IIS of the terminal according to the identifier used by the terminal for access authentication AID. The method further includes: the visited IIS querying the terminal IIS to the terminal

Before the AID, determining, according to the identifier used by the terminal for access authentication, whether the terminal belongs to the local network, and determining, when the terminal does not belong to the local network, determining the home IIS of the terminal, to query the home ns The AID of the terminal.

 Each IIS is directly connected to each other or connected through one or more border gateways;

 When the IIS is connected through the one or more border gateways, the border gateway between the IISs completes the interaction between the IISs according to the identifier used by the terminal for access authentication.

 Each IIS interacts based on a Remote Authentication Dial-In User Service (RADIUS) message or a Diameter message.

 In a Long Term Evolution (LTE) network, a Packet Data Network Gateway (P-GW) is used as an ASR; IIS is deployed on an Authentication, Authorization, and Accounting (AAA) server connected to the P-GW, and AAA in the network The servers are connected to each other; or IIS is deployed on a mobility management entity (MME) connected to the P-GW, and the MMEs in the network are connected to each other; or

 In the third generation mobile communication (3G) network, the gateway general packet radio service support node (GGSN) is used as the ASR; the IIS is deployed on the AAA server connected to the GGSN, and the AAA servers in the network are connected to each other; or Deploy IIS on the home location register (HLR) connected to the GGSN, and connect the HLRs in the network to each other; or deploy IIS on the home subscription server (HSS) connected to the GGSN, and connect the HSSs in the network to each other. Connect; or,

In a fixed network, the Broadband Remote Access Server (BRAS) is used as the ASR, and IIS is deployed in Connect to the BRAS on the AAA server and connect the AAA servers in the network to each other. An embodiment of the present invention further provides a method for saving an access identifier of a terminal, including: establishing an interconnection between each identity location register (ILR) in the network;

 When the terminal roams from the visited network, the visited ILR receives the access identifier (AID) and the route identifier (RID) of the terminal sent by the visited service access service router (ASR) of the terminal, where the AID Querying from the visited location information server (IIS) by the visited service ASR; the RID is allocated by the visited service ASR to the terminal after querying the AID;

 The visited ILR sends the AID and the RID of the terminal to the home ILR of the terminal, so that the home ILR saves the correspondence between the AID and the RID of the terminal. The method further includes: before the AID and the RID of the terminal are sent to the home ILR of the terminal, determining, according to the AID of the terminal and the pre-configured information, whether the terminal belongs to the local network, and if not, determining the location Determining whether the terminal belongs to the local network, if not, according to the identity of the terminal, or determining whether the terminal belongs to the local network according to the identifier of the terminal that is sent by the ASR and the RID. The internet.

 Each ILR is directly connected to each other or connected through one or more border gateways;

 When the ILR is connected by the one or more border gateways, the border gateway between the ILRs completes the interaction between the ILRs according to the AID of the terminal or the identifier used by the terminal for access authentication. The method also includes:

 After the terminal switches the ASR, the visited ILR receives the RID reassigned by the target ASR to which the terminal is handed over;

 After the terminal does not belong to the local network and determines the home network of the terminal, the visited ILR updates the RID re-allocated by the target ASR to the terminal to the home ILR of the terminal. The method also includes:

When the communication peer (CN) of the terminal sends a data packet to the terminal, the ILR in the network where the CN is located is used to determine the location information of the terminal when the service ASR of the CN queries the location information of the terminal. If the AID-RID correspondence of the terminal is not saved, the AID of the terminal is sent to the home ILR of the terminal to query the RID of the terminal;

 The ILR in the network where the CN is located receives the RID of the terminal that the home ILR of the terminal queries and returns locally according to the received AID. The method further includes: when the terminal retires or releases the IP address, the visited ILR sends the AID of the terminal to the home ILR of the terminal, and notifies the home ILR to delete the RID of the terminal.

 Each ILR interacts based on a Remote Authentication Dial-In User Service (RADIUS) message or a Diameter message.

 In a Long Term Evolution (LTE) network, a Packet Data Network Gateway (P-GW) is used as an ASR, and an ILR is deployed on an Authentication, Authorization, and Accounting (AAA) server connected to the P-GW, and AAA in the network. The servers are connected to each other; or the ILRs are deployed on a mobility management entity (MME) connected to the P-GW, and the MMEs in the network are connected to each other; or

 In the third generation mobile communication (3G) network, the gateway general packet radio service support node (GGSN) is used as the ASR, the ILR is deployed on the AAA server connected to the GGSN, and the AAA servers in the network are connected to each other; or The ILR is deployed on the home location register (HLR) connected to the GGSN, and the HLRs in the network are connected to each other; or the ILR is deployed on a home subscription server (HSS) connected to the GGSN, and the HSSs in the network are mutually connected. Connect; or,

 In the fixed network, the Broadband Remote Access Server (BRAS) is used as the ASR, the ILR is deployed on the AAA server connected to the BRAS, and the AAA servers in the network are connected to each other. An embodiment of the present invention further provides an identity information server, including: a data storage unit, an information interaction unit, and an information query unit, where:

The data storage unit is configured to initially save an access identifier (AID) of a terminal in a network; the information interaction unit is configured to establish an interconnection between each identity information server (IIS); the information query unit is configured to When the terminal is roaming access, when the visited service access router (ASR) of the terminal queries the AID of the terminal, the information interaction unit searches the home IIS of the terminal for the AID of the terminal, and receives the home IIS of the terminal. The AID of the returned terminal. The data storage unit is further configured to initially save the identifier used by the terminal for access authentication, and associate the AID of the terminal with the identifier used by the terminal for access authentication;

 The information querying unit is configured to query and receive the AID of the terminal by: when receiving the identifier used by the terminal sent by the visited service ASR to access the authentication, it is known that the visited service ASR is to be Querying the AID of the terminal, and sending the received identifier of the terminal for access authentication to the home IIS of the terminal, by using the information interaction unit to query the home IIS of the terminal for the AID of the terminal, and receiving The AID returned by the home IIS of the terminal according to the identifier used by the terminal for access authentication.

 The information querying unit is further configured to determine, according to the identifier used by the terminal for access authentication, whether the terminal belongs to the local network before the home IIS of the terminal queries the AID of the terminal, and the terminal does not belong to the terminal. At the local network, the home IIS of the terminal is determined to query the home ns for the AID of the terminal.

 The information querying unit is further configured to, after receiving the identifier sent by the terminal sent by the other identity information server for access authentication, query the corresponding data from the data storage unit according to the identifier used by the terminal for access authentication. AID, and return the queried AID to the corresponding identity information server. An embodiment of the present invention further provides an identity location register, including an information interaction unit, a data storage unit, and an information update unit, where:

 The information interaction unit is configured to establish an interconnection between respective identity location registers (ILRs) in the network;

 The data storage unit is configured to receive and save an access identifier (AID) and a route identifier (RID) of the terminal sent by the visited service access service router ASR of the terminal when the terminal roams access, where the AID is The visited service ASR is queried from the visited identity information server (IIS); the RID is allocated by the visited service ASR to the terminal after querying the AID;

 The information updating unit is configured to pass the AID of the terminal by the information interaction unit

The RID is sent to the home ILR of the terminal, so that the home ILR saves the correspondence between the AID and the RID of the terminal.

The information updating unit is further configured to send the AID and the RID of the terminal to the terminal Before the ILR, determine whether the terminal belongs to the local network according to the AID of the terminal and the pre-configured information, and if not, determine the home network of the terminal; or send the AID and the RID according to the visited service ASR. The identifier used by the terminal for access authentication determines whether the terminal belongs to the local network. If not, determines the home network of the terminal.

 The data storage unit is further configured to: after the terminal switches the ASR, receive the RID that the target ASR switched by the terminal is reassigned by the terminal;

 The information updating unit is further configured to update the RID reassigned by the target ASR to the terminal to the home ILR of the terminal after the terminal does not belong to the local network and determine the home network of the terminal.

 The information update unit is further configured to send the AID of the terminal to the home ILR of the terminal when the terminal retires or releases the IP address, and notify the home ILR to delete the RID of the terminal.

In summary, the present invention saves the AID of the terminal by setting the identity information server, and connects the identity information servers to each other for interaction of the AID of the terminal, so that in the method based on the identity location separation, when the terminal roams, The AID of the terminal can be obtained, so that the terminal can access the visited network. BRIEF abstract

 1 is an architectural diagram of an identity location separation network in the related art;

 2 is a schematic diagram of a terminal roaming in an identity location separated network in the related art;

 3 is an architectural diagram of a system for acquiring an access identifier of a terminal according to the present invention;

 4 is a flowchart of Embodiment 1 of a method for acquiring an access identifier of a terminal according to the present invention; FIG. 5 is a flowchart of a method for acquiring an access identifier of a terminal in a terminal handover manner according to the present invention; FIG. 7 is a flowchart of Embodiment 3 of a method for obtaining an access identifier of a terminal according to the present invention; FIG. 8 is a flowchart of a method for acquiring an access identifier of a terminal according to the present invention; Schematic diagram

9 is a schematic diagram of a method of the present invention applied to a 3G network; 10 is a schematic diagram of a method of the present invention applied to a fixed network;

 11 is an architectural diagram of an identity information server of the present invention;

 Figure 12 is a block diagram of the identity location register of the present invention.

Preferred embodiment of the invention

 Different from the related identity location separation technology, in the present embodiment, a dedicated identity information server (Identity Information Server, hereinafter referred to as IIS) is used to save the AID of the terminal user. As shown in Figure 3, Carrier A has its own Identity Server A (IIS-A), and Carrier B has its own IIS-B. Preferably, IIS records both the identity used by the end user for access authentication and the AID of the user, and associates the two. The identifier used by the terminal user for access authentication generally includes an International Mobile Subscriber Identity (IMSI), a Network Access Identifier (NAI), and the like. In order to support the roaming access of the end user, a signaling interface (shown in Figure 3) needs to be added between the visited operator's IIS (visited IIS) and the home operator's IIS (home IIS). The function is to pass the end user's access identifier (AID) between the visited IIS and the home IIS.

 It is worth noting that the IIS of the visited operator can establish a directly connected interface with the IMS of the home carrier, or can indirectly establish an interface through one or more border gateways. That is, the visited operator and the home operator's IIS establish an interface with the above-mentioned border gateways, and the interaction between the two IISs is completed by the transit of the border gateway. The general role of the border gateway is to protect the data security of both operators and to be free from attacks. It is worth noting that the border gateway here can be generally referred to as Border IIS (B-IIS), Gateway IIS (G-IIS) or Proxy IIS (P-IIS).

In order to support the home operator of the terminal, the location information of the terminal can also be grasped. Preferably, a signaling interface is added between the visited operator's ILR (visited ILR) and the home operator's ILR (home ILR). Similarly, the ILR of the visited operator can establish a directly connected interface with the home operator's ILR, or can indirectly establish an interface through one or more border gateways. Correspondingly, the border gateway can be generally referred to as Border ILR (B-ILR for short), Gateway ILR (G-ILR for short) or Proxy ILR (P-ILR for short). ). As shown in FIG. 3, the operator B is the visited operator of the terminal A, and the operator A is the home carrier of the terminal A. An interface is established between IIS-A of carrier A and IIS-B of carrier B. If terminal A roams access from carrier B, it accesses through access service router B (ASR-B). ASR-B requests the AID of the terminal from IIS-B. At this time, IIS-B can obtain the AID of terminal A from IIS-A through the above interface, and send it to the terminal. In this way, the problem that the terminal cannot be accessed by the roaming operator can be solved.

Example 1

 FIG. 4 shows a first embodiment of the present embodiment, which is a process in which a terminal accesses a network and obtains an access identifier (AID) of the terminal from the network, and specifically includes the following steps:

 Step 401: The terminal roams to the visited operator, and accesses the network of the visited operator, and attaches to the access service router (ASR). At this time, the ASR is the service ASR of the terminal (ie, the visited service) ASR ) ;

 Generally, the service ASR obtains the identifier used by the terminal for access authentication in this step, such as the above-mentioned IMSI, NAI, or User Name. Based on the user name mentioned above, the network first performs access authentication on the terminal user, and then performs subsequent processes after the access authentication is passed.

 Step 402: The ASR (located at the visited operator) queries the visited identity information server (IIS) for the AID of the terminal user, and carries the identifier of the obtained terminal for access authentication; Step 403: Visiting the IIS After the above request, it is preferred to determine whether the user belongs to the local network;

 The visited IIS can make a judgment according to the identifier used by the terminal for access authentication (that is, the identifier used by the user of the terminal for access authentication, and the following is expressed as the identifier used by the terminal for access authentication). . In this embodiment, since it is assumed that the user is currently accessing the visited operator, the visited IIS needs to further determine the home operator of the terminal user, and generally visits according to the identifier used by the terminal for access authentication. IIS can determine the home operator of the terminal. Preferably, depending on the configuration information, the visited IIS can also determine the home IIS of the terminal.

Step 404: The visited IIS sends a message to the home IIS (located in the home operator of the terminal user) of the terminal user, and queries the AID of the terminal, where the message carries the identifier used by the terminal to access the authentication; Step 405: After receiving the foregoing request, the home IIS preferably first verifies that the request message is from a legal requester, and then locally queries the corresponding identifier according to the identifier used by the terminal for access authentication.

AID, and return a response message to the visited IIS, carrying the AID;

 Step 406: Visiting IIS returns the queried AID to the ASR;

 Step 407: The ASR sends the foregoing AID to the terminal, and the identity of the terminal is configured locally at the terminal.

 The subsequent terminal uses the AID as its own IP address for communication with the outside world.

 Step 408: After obtaining the AID of the terminal, the ASR further allocates a route identifier (RID, also referred to as a location identifier) to the terminal.

 Step 409: The ASR (the ASR is the ASR of the visited operator) updates the RID of the terminal to the ILR (visited ILR) of the visited operator, carries the AID of the terminal user, and the allocated RID, and preferably carries the above The identifier used by the terminal to access the authentication;

 Step 410: The visited ILR saves the AID-RID correspondence of the terminal locally, and sends a message to the home ILR of the terminal, and carries the corresponding relationship of the AID-RID;

 Preferably, the visited ILR can determine that the terminal corresponding to the AID is not attributable to the operator. The visited ILR can determine, according to the AID and the pre-configured information, that the AID does not belong to the operator, and can determine the operator to which the AID belongs; or, the visited ILR is used for access according to the terminal that is preferably carried in step 409. The identifier of the authentication determines that the corresponding AID does not belong to the carrier, and can determine the operator to which the AID belongs.

 Step 411: After the home ILR obtains the foregoing information, the corresponding relationship of the AID-RID of the terminal is saved locally;

 At this time, the home operator of the terminal can also obtain the current location information of the terminal. The home ILR returns a response message to the visited ILR.

 Step 412: The visited ILR returns a response message to the ASR.

 It should be noted that, in step 410, the visited ILR may also not record the terminal.

The AID-RID corresponds to the relationship, and the AID-RID of the terminal is directly sent to the home ILR of the terminal user, and only the home ILR stores the AID-RID correspondence of the terminal.

The problems of the prior art can be solved by the method of the above embodiment of the present invention. When the terminal roams When the ASR of the visited carrier accesses the network, it can also obtain its own AID and use the AID as its own source address to communicate with the outside world.

 It should be noted that in the description of the present embodiment, the visited IIS and the home IIS are directly interacted with each other. As mentioned above, the visited IIS and the home IIS can communicate with each other through one or more border gateways (such as B-IIS, G-IIS or P-IIS mentioned above), and the border gateway can also be based on the above terminal. The identity used for access authentication determines which next hop border gateway or home IIS should be sent the corresponding message (as described in step 403). Similarly, the visited ILR and the home ILR may also be interworked through one or more border gateways (such as B-ILR, P-ILR, G-ILR), and the border gateway may follow the method described in step 410. According to the AID or the identifier used by the terminal user for access authentication, it is determined which next-hop border gateway or home ILR should be sent to the corresponding message.

As shown in FIG. 5, when the terminal switches the current ASR, that is, the source ASR is switched to the target ASR, the target ASR needs to allocate a new RID to the terminal, and simultaneously update the AID of the terminal saved in the ILR. The -RID correspondence includes the following steps:

 Step 501-502: After the terminal switches from the source ASR to the target ASR, the target ASR allocates a new RID to the terminal.

 Step 503: The target ASR sends an update message to the visited ILR, and carries the AID of the terminal and the newly allocated RID, and preferably also carries the identifier used by the terminal for access authentication, because the target ASR is also located in the network of the visited carrier.

 Step 503 is the same principle as step 409.

 Step 504: In the same step 410, the visited ILR determines that the terminal user is not the home operator, and after determining the home operator of the user, sends a message to the home ILR of the terminal, and carries the mapping relationship of the AID-RID;

 Steps 505-506: Same as steps 411-412.

Example 2:

FIG. 6 shows a second embodiment of the present invention, and it is still assumed that the terminal accesses the network at the visited operator. That is, the current service ASR of the terminal is located at the visited operator.

 Step 601: The communication peer end (CN) of the terminal sends a data packet to the terminal, and the destination IP address of the data packet is set to the AID of the terminal, and the data packet first reaches the service ASR (CN-ASR) of the CN;

 Step 602: When the CN-ASR cannot find the location information of the terminal locally, query the location information of the terminal to the ILR in the carrier domain where the CN-ASR is located, and query the AID of the message carrying terminal; assume that the carrier where the CN-ASR is located Not the home operator of the terminal.

 Step 603: It is assumed that the ILR in the carrier domain where the CN-ASR is located cannot locally query the RID information of the terminal, and as described in step 410, the ILR can determine that the AID does not belong to the present according to the AID and the pre-configured information. The operator, and the operator that can determine the AID belongs to; Step 604: The foregoing ILR sends a request to the home ILR of the terminal, and carries the AID of the terminal to request the RID information of the terminal;

 Step 605: After the local ILR queries the RID information of the terminal according to the AID, the ILR returns a response message in the carrier domain where the CN-ASR is located, and carries the AID-RID information of the terminal.

 Step 606: After receiving the response message, the ILR in the carrier domain where the CN-ASR is located carries the terminal RID information in the response message and returns it to the CN-ASR.

 Step 607: The CN-ASR sends the foregoing data packet according to the location information of the terminal.

 It is worth noting that the operator where the CN-ASR is located may be the visited operator of the terminal. At this time, as described in Embodiment 1, the visited ILR can save the AID-RID relationship of the terminal, and the CN-ASR can directly query the related information in the visited ILR; otherwise, the method of the above step of Embodiment 2 is required. , to the relevant information related to the ILR query. The operator in which the CN-ASR is located may also be different from the visited carrier where the terminal is currently located. In this case, the location information of the terminal needs to be queried according to the method in the foregoing embodiment.

Example 3:

FIG. 7 shows a third embodiment of the present invention. It is still assumed that the terminal accesses the network at the visited operator, that is, the current service ASR of the terminal is located at the visited operator. When the terminal exits the network, you need to clear the terminal. The location information of the terminal that is stored in the ILR includes the following steps.

 Step 701: The current service ASR of the terminal receives an indication that the terminal retires or releases the IP address. Step 702: The ASR sends a message to the ILR (visited ILR) in the local domain (that is, the visited operator domain of the terminal) to delete The location information of the terminal, where the AID of the carrying terminal, and preferably the identifier of the terminal for access authentication;

 Step 703: After receiving the above message, the visited ILR first deletes the AID-RID mapping relationship of the terminal locally, and according to the method of step 410, the visited ILR can determine that the local domain is the visited domain of the terminal (ie, the visited place). And determining the home domain of the terminal, the visited ILR sending a message to the home ILR of the terminal, for deleting the location information of the terminal, carrying the AID of the terminal, and preferably carrying the identifier of the terminal for access authentication;

 Step 704: The home ILR deletes the locally saved related information, and returns a response message to the visited -ILR.

 Step 705: Visit - ILR returns a response message to the above ASR.

It is worth noting that in the actual network deployment, the IIS described in this embodiment can be deployed on an Authentication, Authorization and Accounting (AAA) server, and a Home Location Register (referred to as a Home Location Register). HLR) or Home Subscriber Server (HSS), that is, IIS as a functional module of these network elements, or these network elements themselves have the function of IIS. Thus, these network elements can be used to directly replace the "identity information server" in the above embodiments. For example, replacing the "home identity information server" with the "home authentication authentication accounting server" and the "visit authentication authentication accounting server" with the "visiting location authentication information server" is the same. At this time, the visited place - IIS and the IIS can interact with each other through the AAA protocol, including the RADIUS (Remote Authentication Dial In User Service) protocol and the Diameter protocol.

For example, the visited IIS uses the Access-Request message defined by the RADIUS protocol, and the carrying terminal is used to access the authentication identifier to request the AID information in the terminal from the home IIS. Accordingly, the home IIS uses the Access-Accept message to answer the visited IIS, and carries The AID of the terminal. If there is no corresponding record in the home IIS (for example, the terminal user does not sign the AID), then the home IIS can visit the IIS. Returns an Access-Reject message. At this time, the ASR of the visited place will preferably reject the terminal access. The visited IIS can also use the AA-Request defined by the Diameter protocol to request the AID information of the terminal from the home IIS, and carry the identifier used by the terminal for access authentication; the home IIS uses the AA-Answer to answer the visited IIS, and carries the AID information of the terminal. Or carry an error indication (for example, the end user does not sign the AID). If the visited IIS receives the AA-Answer message carrying the error indication, the ASR preferably rejects the terminal access to the network.

By the same token, in the actual network deployment, the ILR in this embodiment can also be deployed on the AAA server, the HLR, or the HSS, that is, the ILR functions as a functional module of the network elements, or the network elements themselves have the ILR. Features. Thus, these network elements can be used to directly replace the "identity location register" in the above embodiments. For example, replacing the "home identity location register" with the "home authentication location accounting register" and the "visit authentication authority accounting server" with the "home authentication authentication accounting server", the principle is the same. At this time, the visited ILR and the home ILR can also interact through the AAA protocol, including the RADIUS protocol and the Diameter protocol.

 For example, the visited ILR uses the Accounting-Request message defined by the RADIUS protocol, carries the AID and RID information of the terminal, and updates the RID information of the terminal to the home ILR. In the initial update, you can use the Accounting-Request[start] (that is, the type of the request is start) to update the above information to the home ILR; the subsequent update (for example, the terminal switches the ASR, the new ASR assigns a new terminal) When the RID is later, use Accounting-Request[interim]; When the location information of the terminal is deleted, the visited ILR sends an Accounting-Request[stop] to the home ILR. When the home ILR receives the Accounting-Request message of type stop, the RID information of the terminal is deleted. Correspondingly, the ILR uses the Accounting-Response [start], Accounting-Response [interim], and Accounting-Response [stop] responses to the visited ILR. As described in the second embodiment, when the ILR of the carrier domain where the CN-ASR is located queries the terminal's home ILR for the RID of the terminal, the ILR can query the home ILR by using the newly defined message in the RADIUS protocol.

The visited ILR can also use the Accounting-Request message defined by the Diameter protocol to carry the AID and RID information of the terminal, and update the RID information of the terminal to the home ILR; accordingly, the home ILR responds to the visited ILR by using the Accounting-Answer. The visited ILR can use the Disconnect-Peer-Request or Abort-Session-Request message to carry the AID of the terminal. Indicates that the home ILR deletes the RID information of the terminal; correspondingly belongs to the ILR using the Disconnect-Peer- Answer or Abort-Session- Answer to answer the ILR „I port implementation 1” column 2, when the CN-ASR is located in the carrier domain When the ILR queries the terminal's home ILR for the RID of the terminal, the ILR can query the home-ILR using the newly defined message in the Diameter protocol. Example 4:

 FIG. 8 is a fourth embodiment of the present embodiment, and specifically applies the content of the present embodiment to an LTE (Long Term Evolution) network. In an LTE network, a terminal is first connected to an S-GW (Serving Gateway) through a wireless connection, and then connected to a P-GW (Packet Data Network Gateway) through an S-GW. Here, the P-GW has the ASR function described above, and is referred to as P-GW (ASR).

 The network is divided into the visited operator of the terminal (operator B in the figure) and the home carrier (operator A in the figure), assuming that the terminal is currently connected in the network of the operator of the visited place, and the network is allocated for the terminal. The P-GW (ASR) is also located in the visited operator domain. The P-GW (ASR) interfaces with the ILR in the visited operator domain (i.e., the visited ILR above) and the IIS in the visited carrier domain (i.e., the visited IIS above). At the same time, there is an interface between the visited ILR and the ILR (ie, the above-mentioned home ILR) in the home carrier domain of the terminal, and there is also an interface between the visited IIS and the IIS in the home carrier domain of the terminal (ie, the home IIS above). . As described above, the interfaces described herein may be directly connected or indirectly connected through an intermediate border gateway or the like.

 The methods described in the foregoing Embodiments 1 to 3 of the present embodiment are all applicable to the LTE network described herein, and only need to replace the ASR of the previous embodiment with the P-GW (ASR) described herein, and the source ASR, The target ASR is replaced by the source P-GW (ASR) and the target P-GW (ASR). Similarly, as mentioned above, both the ILR and IIS can be located on the AAA server connected to the P-GW (ASR) (eg, connected to the P-GW (ASR) via the SGi interface). The principle is the same and will not be described again.

In addition, the LTE network further includes an MME (Mobility Management Entity), which functions to save the mobility context of the terminal. At this time, the above IIS, ILR may also be located on the MME, or the MME itself has IIS and / or ILR functions. At this time, the MME located in the visited domain is the visited MME, and the MME located at the home is the home MME. An indirect or direct interface is established between the visited MME and the home MME.

Example 5

 Fig. 9 is a fifth embodiment of the present embodiment, and specifically the content of the present embodiment is applied to a GPRS (General Packet Radio Service) network. In the GPRS network, the terminal first connects to the SGSN (Serving GPRS Support Node) wirelessly, and then connects to the GGSN (Gateway GPRS Support Node, Gateway General Packet Radio Service Support Node) through the SGSN. Here, the GGSN has the ASR function described above, and is denoted as GGSN (ASR).

 With the principle of the fourth embodiment, the network is divided into the visited operator of the terminal (the operator B in the figure) and the home carrier (the operator A in the figure), and the terminal is currently connected to the operator of the visited place. In the network, and the GGSN (ASR) allocated by the network for the terminal is also located in the visited operator domain. The GGSN (ASR) interfaces with the ILR in the visited carrier domain (ie, the visited ILR above) and the IIS in the visited carrier domain (ie, the visited IIS above). At the same time, there is an interface between the visited ILR and the ILR in the home carrier domain of the terminal (ie, the home ILR above), and there is also an interface between the visited IIS and the IIS in the home carrier domain of the terminal (ie, the home IIS above). . As described above, the interfaces described herein may be directly connected or indirectly connected through an intermediate border gateway or the like.

 The methods described in the foregoing Embodiments 1 to 3 of the present invention can be applied to the GPRS network described herein, and only need to replace the ASR of the previous embodiment with the GGSN (ASR) described herein, and replace the source ASR and the target ASR with The source GGSN (ASR) and the target GGSN (ASR) can be used. Similarly, as mentioned above, both the ILR and IIS can be located on the AAA server connected to the GGSN (ASR) (eg, connected to the GGSN (ASR) via the Gi interface). The principle is the same and will not be described again.

 In addition, the GPRS network also includes an HLR or HSS, which is used to store information such as subscriptions of end users. At this time, as mentioned above, IIS and ILR can also be located on the HLR/HSS. The HLR/HSS in the visited domain is the visited-HLR/HSS, and the HLR/HSS located in the visited domain is the attribution-HLR/HSS.

Example 6 FIG. 10 is a sixth embodiment of the present embodiment, specifically applying the content of the present embodiment to a fixed network

(such as xDSL). In the fixed network, the terminal is connected to the BRAS (Broadband Remote Access Server) through the Subscriber Line and the DSLAM (Digital Subscriber Line Access Multiplexer). Here BRAS has the ASR function described above, which is denoted as BRAS (ASR).

 The fixed network is generally managed in a sub-area, such as area A and area B as shown in FIG. The home area of the terminal is area A, and it is assumed that the terminal is currently connected in its visited area (ie, area B). It should be noted that the area A and the area B are the same as the carrier A and the operator B mentioned above, so that the figure 10 can also be regarded as a roaming scene. Assuming that the BRAS currently connected to the terminal is also located in the visited area, the BRAS (ASR) has an interface with the ILR of the visited area (i.e., the visited ILR above) and the IIS in the visited area (ie, the visited IIS above). At the same time, the visited ILR has an interface with the ILR in the home zone of the terminal (i.e., the above-mentioned home ILR), and there is also an interface between the visited IIS and the IIS in the home zone of the terminal (ie, the home IIS above). As described above, the interfaces described herein may be directly connected or indirectly connected through an intermediate border gateway or the like.

 The methods described in the foregoing Embodiments 1 to 3 of the present invention can be applied to the fixed network described herein, and only need to replace the ASR of the previous embodiment with the BRAS (ASR) described herein, and replace the source ASR and the target ASR with The source BRAS (ASR) and the target BRAS (ASR) are sufficient. Also, as mentioned above, both the ILR and IIS can be located on the AAA server connected to the BRAS (ASR). The principle is the same and will not be repeated.

As shown in FIG. 11, the embodiment further provides an identity information server, including: a data storage unit, an information interaction unit, and an information query unit, where:

 The data storage unit is set to initially save the AID of the terminal in the network where the network is located;

 The information interaction unit is configured to establish an interconnection between the IISs;

 The information querying unit is configured to query the AID of the terminal to the home IIS of the terminal through the information interaction unit when the terminal accesses the AID of the terminal, and receives the AID of the terminal returned by the home IIS of the terminal. .

The data storage unit is further configured to initially save the identifier used by the terminal for access authentication, and the terminal The AID is associated with an identifier used by the terminal to access the authentication;

 The information querying unit is configured to: when receiving the identifier of the terminal used by the visited service ASR for access authentication, knowing that the visited service ASR is to query the AID of the terminal, and using the received terminal for access authentication The home IIS sent to the terminal is identified to query the AID of the terminal through the information interaction unit, and receives the AID returned by the home IIS of the terminal and queried according to the identifier used by the terminal for access authentication.

 The information querying unit is further configured to determine whether the terminal belongs to the local network according to the identifier used by the terminal for access authentication before querying the AID of the terminal to the home IIS of the terminal, and determine the home IIS of the terminal when the terminal does not belong to the local network. To query the AID of the terminal to the home IIS.

 The information querying unit is further configured to: after receiving the identifier sent by the terminal sent by the other identity information server for access authentication, query the corresponding AID from the data storage unit according to the identifier used by the terminal for access authentication, and The queried AID is returned to the corresponding identity information server.

As shown in FIG. 12, the embodiment further provides an identity location register, including: an information interaction unit, a data storage unit, and an information update unit, where:

 The information interaction unit is configured to establish an interconnection between the ILRs in the network;

 The data storage unit is configured to receive and save the AID and RID of the terminal sent by the visited service ASR of the terminal when the terminal roams access, and the AID is obtained by the visited service ASR from the visited IIS; the RID is inquired by the visited service ASR. After the AID, assign to the terminal;

 The information updating unit is configured to send the AID and the RID of the terminal to the home ILR of the terminal through the information interaction unit, so that the home ILR saves the correspondence between the AID and the RID of the terminal.

 The information update unit is further configured to determine whether the terminal belongs to the local network according to the AID of the terminal and the pre-configured information before transmitting the AID and the RID of the terminal to the home ILR of the terminal, and if not, determine the home network of the terminal; The destination service ASR sends the AID and the RID to send the AID and the RID to determine whether the terminal belongs to the local network. If not, the home network of the terminal is determined.

The data storage unit is further configured to: after the terminal switches the ASR, receive the RID that the target ASR switched by the terminal is reassigned to the terminal; The information updating unit is further configured to update the RID reassigned by the target ASR to the terminal to the home ILR of the terminal after the terminal does not belong to the local network and determine the home network of the terminal.

 The information update unit is further configured to send the AID of the terminal to the home ILR of the terminal when the terminal retires or releases the IP address, and notifies the home ILR to delete the RID of the terminal.

Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device so that they may be stored in the storage device by the computing device, or they may be separately fabricated into individual integrated circuit modules, or Multiple modules or steps are made into a single integrated circuit module. Thus, the invention is not limited to any particular combination of hardware and software.

 The above is only a preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are intended to be included within the scope of the present invention.

Industrial Applicability Compared with the related art, the present invention saves the AID of the terminal by setting the identity information server, and connects the identity information servers to each other for interaction of the AID of the terminal, so that in the method based on identity location separation, when the terminal When roaming occurs, the AID of the terminal can be obtained, so that the terminal can access the visited network.

Claims

claims 1. A method of obtaining the access identification of a terminal, including: Set up an identity information server (IIS) in the network, initially save the access identification (AID) of the terminal in the network in the IIS, and establish mutual connections between the IISs; When the terminal roams and accesses from the visited network, the visited IIS queries the terminal's home IIS for the terminal's AID when querying the terminal's visited service access service router (ASR); and The visited IIS receives the AID of the terminal returned by the home IIS of the terminal. 2. The method of claim 1, further comprising: Initially save the terminal's identification used for access authentication in IIS, and associate the terminal's AID with the terminal's identification used for access authentication; The step of the visited IIS querying the terminal's home IIS for the terminal's AID includes: The visited IIS learns the visited service ASR when receiving the terminal's identification used for access authentication sent by the visited service ASR. Query the AID of the terminal; and The visited IIS sends the received identification of the terminal used for access authentication to the home IIS of the terminal, and queries the terminal's AID; The step of the visited IIS receiving the AID of the terminal returned by the home IIS of the terminal includes: the visited IIS receiving the AID returned by the home IIS of the terminal and queried based on the identifier of the terminal used for access authentication. AID. 3. The method of claim 2, further comprising: Before querying the terminal's home IIS for the terminal's AID, the visited IIS determines whether the terminal belongs to the local network based on the terminal's identification used for access authentication. If the terminal does not belong to the local network At this time, determine the home IIS of the terminal, so as to query the home IIS for the AID of the terminal. 4. The method of claim 1, wherein, Each IIS is connected directly or through one or more border gateways; When the IISs are connected through the one or more border gateways, the border gateways between the IISs complete the interaction between the IISs according to the identifier used by the terminal for access authentication. 5. The method of claim 1, wherein, Each IIS interacts with each other based on Remote Authentication Dial-in Access User Service (RADIUS) messages or Diameter messages. 6. The method of claim 1, wherein, In the Long Term Evolution (LTE) network, use the Packet Data Network Gateway (P-GW) as the ASR; deploy IIS on the Authentication, Authorization and Accounting (AAA) server connected to the P-GW, and set the AAA in the network Servers are connected to each other; or, IIS is deployed on the mobility management entity (MME) connected to the P-GW, and the MMEs in the network are connected to each other; or, In the third generation mobile communication (3G) network, use the Gateway General Packet Radio Service Support Node (GGSN) as the ASR; deploy IIS on the AAA server connected to the GGSN, and connect the AAA servers in the network to each other; or, Deploy IIS on the home location register (HLR) connected to the GGSN, and connect the HLRs in the network to each other; or, deploy IIS on the home subscription server (HSS) connected to the GGSN, and connect the HSSs in the network to each other. connection; or, In a fixed network, use the Broadband Remote Access Server (BRAS) as the ASR, deploy IIS on the AAA server connected to the BRAS, and connect the AAA servers in the network to each other. 7. A method of saving the access identification of a terminal, including: Establish interconnections between identity location registers (ILRs) in the network; When the terminal roams and accesses from the visited network, the visited ILR receives the terminal's access identifier (AID) and routing identifier (RID) sent by the terminal's visited access service router (ASR), where the AID The visited service ASR queries and obtains it from the visited identity information server (IIS); the RID is assigned to the terminal by the visited service ASR after querying the AID; and The visited ILR sends the terminal's AID and RID to the terminal's home ILR, so that the home ILR saves the corresponding relationship between the terminal's AID and RID. 8. The method of claim 7, further comprising: Before sending the terminal's AID and RID to the terminal's home ILR, the visited ILR determines whether the terminal belongs to the local network based on the terminal's AID and preconfigured information. If not, determines the terminal's home network. ; Or determine whether the terminal belongs to the local network based on the identification of the terminal used for access authentication sent by the visited service ASR while sending the AID and RID. If not, determine the home network of the terminal. 9. The method of claim 7, wherein, Each ILR is connected directly or through one or more border gateways; When the ILRs are connected through the one or more border gateways, the border gateways between the ILRs complete the interaction between the ILRs based on the AID of the terminal or the identification used by the terminal for access authentication. 10. The method of claim 7, further comprising: After the terminal switches the ASR, the visited ILR receives the RID reassigned by the terminal to the target ASR to which the terminal switches; and After the terminal does not belong to the local network and determines the home network of the terminal, the visited ILR updates the RID reassigned by the target ASR to the terminal's home ILR. 11. The method of claim 7, further comprising: When the communication counterpart (CN) of the terminal sends a data message to the terminal, the ILR in the network where the CN is located queries the location information of the terminal in the serving ASR of the CN. If it is determined that the location information is not saved locally. If there is a corresponding relationship between the AID-RID of the terminal, the AID of the terminal is sent to the home ILR of the terminal to query the RID of the terminal; and The ILR in the network where the CN is located receives the RID of the terminal that is locally queried and returned by the terminal's home ILR based on the received AID. 12. The method of claim 7, further comprising: When the terminal logs off the network or releases the IP address, the visited ILR sends the terminal's AID to the terminal's home ILR, and notifies the home ILR to delete the terminal's RID. 13. The method of claim 7, wherein, The ILRs interact with each other based on Remote Authentication Dial-in Access User Service (RADIUS) messages or Diameter messages. 14. The method of claim 7, wherein, In the Long Term Evolution (LTE) network, the packet data network gateway (P-GW) is used as the ASR, the ILR is deployed on the authentication, authorization and accounting (AAA) server connected to the P-GW, and the AAA in the network is The servers are connected to each other; or, the ILR is deployed on the mobility management entity (MME) connected to the P-GW, and the MMEs in the network are connected to each other; or, In the third generation mobile communication (3G) network, use the Gateway General Packet Radio Service Support Node (GGSN) as the ASR, deploy the ILR on the AAA server connected to the GGSN, and connect the AAA servers in the network to each other; or, Deploy the ILR on the home location register (HLR) connected to the GGSN, and connect the HLRs in the network to each other; alternatively, deploy the ILR on the home subscription server (HSS) connected to the GGSN, and connect the HSSs in the network to each other. connection; or, In the fixed network, the Broadband Remote Access Server (BRAS) is used as the ASR, the ILR is deployed on the AAA server connected to the BRAS, and the AAA servers in the network are connected to each other. 15. An identity information server, including: a data storage unit, an information interaction unit and an information query unit, wherein: The data storage unit is configured to initially store the access identification (AID) of the terminal in the network; the information interaction unit is configured to establish mutual connections between identity information servers (IIS); the information query unit is configured to When the terminal roams and accesses, when the visited service access service router (ASR) of the terminal queries the terminal's AID, the information exchange unit queries the terminal's home IIS for the terminal's AID, and receives the terminal's home IIS. The AID of the returned terminal. 16. The identity information server as claimed in claim 15, wherein, The data storage unit is also configured to initially save the identification used by the terminal for access authentication, and associate the AID of the terminal with the identification used by the terminal for access authentication; The information query unit is configured to query and receive the AID of the terminal in the following manner: when receiving the identification of the terminal used for access authentication sent by the visited service ASR, learn that the visited service ASR requires Query the AID of the terminal and use the received terminal's tag for access authentication. The identification is sent to the home IIS of the terminal, so as to query the terminal's home IIS through the information exchange unit for the terminal's AID, and receive the AID returned by the terminal's home IIS according to the terminal for access authentication. Identifies the AID queried. 17. The identity information server as claimed in claim 16, wherein, The information query unit is also configured to query the terminal's home IIS for the terminal's Before AID, determine whether the terminal belongs to the local network based on the identification used by the terminal for access authentication. When the terminal does not belong to the local network, determine the home IIS of the terminal to query the home ns. AID of the terminal. 18. The identity information server as claimed in claim 16, wherein, The information query unit is also configured to, after receiving the identification of the terminal used for access authentication sent by other identity information servers, query the corresponding information from the data storage unit according to the received identification of the terminal used for access authentication. AID, and returns the queried AID to the corresponding identity information server. 19. An identity location register, including an information interaction unit, a data storage unit and an information update unit, wherein: The information interaction unit is configured to establish interconnections between identity location registers (ILRs) in the network; The data storage unit is configured to receive and store the terminal's access identification (AID) and routing identification (RID) sent by the terminal's visited service access service router ASR when the terminal roams and accesses, and the AID is composed of The visited service ASR is obtained by querying the visited identity information server (IIS); the RID is assigned to the terminal by the visited service ASR after querying the AID; The information update unit is configured to send the AID and RID of the terminal to the home ILR of the terminal through the information interaction unit, so that the home ILR saves the corresponding relationship between the AID and RID of the terminal. 20. The identity location register as claimed in claim 19, wherein, The information update unit is also configured to determine whether the terminal belongs to the local network based on the terminal's AID and preconfigured information before sending the terminal's AID and RID to the terminal's home ILR. If it does not belong, determine the home network of the terminal; or determine whether the terminal belongs to the local network based on the identification of the terminal sent by the visited service ASR when sending the AID and RID while sending the AID and RID. If it does not belong, determine whether the terminal belongs to the local network. Determine the home network of the terminal. 21. The identity location register as claimed in claim 19, wherein, The data storage unit is also configured to receive the target ASR that the terminal switches to after the terminal switches the ASR, which is the RID reassigned by the terminal; The information update unit is also configured to update the RID reassigned by the target ASR to the terminal's home ILR after the terminal does not belong to the local network and the terminal's home network is determined. 22. The identity location register as claimed in claim 19, wherein, The information update unit is also configured to send the AID of the terminal to the home ILR of the terminal when the terminal logs off the network or releases the IP address, and notifies the home ILR to delete the RID of the terminal.