WO2014022993A1 - Tunnel forwarding method, apparatus, device and system - Google Patents

Abstract

Provided are a tunnel forwarding method, apparatus, device and system, which relate to the field of communications. The method comprises: receiving a tunnel establishment request, the tunnel establishment request comprising tunnel endpoint information and a tunnel forwarding rule; and indicating at least one gateway to establish a tunnel with an application server corresponding to the tunnel endpoint information, and issuing the tunnel forwarding rule to the gateway, so that the gateway forwards the data conforming to the tunnel forwarding rule to the application server using the tunnel. According to the tunnel establishment request, the present invention indicates the corresponding gateway to establish a tunnel with the application server to enable the gateway to selectively forward data to the application server according to the tunnel forwarding rule, thereby solving the technical problem that the data of UE granularity cannot be distinguished and forwarded in existing tunnel forwarding methods, and achieving the effect that a gateway can distinguish the data for different UE and forward same to the application server.

Description

 Tunnel forwarding method, device, device and system

 The present invention relates to the field of communications, and in particular, to a tunnel forwarding method, apparatus, device, and system. Background technique

 UE (User Equipment) is often based on EPC (Evolved Packet Core), and the PDN network includes the Internet (Internet), Intranet (intranet). ISP (Internet Service Provider, Internet Service Provider), etc.

 Please refer to FIG. 1, which shows a schematic flowchart of a tunnel forwarding method in the prior art. The network element or network involved in the method includes: a UE, an MME (Mobility Management Entity), a SGW (Serving Gateway), a PGW (PDN Gateway, PDN Gateway), and a PDN network. The MME, the SGW, and the PGW are all network elements in the EPC mobile packet domain network, and the network elements in the EPC mobile packet domain network may further include an eNB (Evolved Node B, evolved Node B), and a Home Subscriber Server (HSS). Server), etc. (not specifically shown). The process of the UE accessing the PDN network through the EPC mobile packet domain network and forwarding the data by using the tunnel is as follows: Step 101: The PGW pre-establishes a tunnel with a specific type of network in the PDN network, where the specific type of network may be an intranet, where The purpose of the tunnel is to meet the security or routing requirements of a specific type of network. For the Internet in the PDN network, the PGW usually accesses directly without establishing a tunnel.

 Step 102: The UE sends a PDN connection setup request to the MME, where the PDN connection setup request carries the APN.

(Access point name), within the EPC mobile packet domain network, use APN to distinguish which network the UE wants to connect to. For example, APN1 indicates that the UE wants to connect to the intranet; APN2 indicates that the UE wants to connect to the Internet; Step 103, MME cooperates with HSS (not shown) performing a subscription check on the UE, checking whether the UE is allowed to access the network corresponding to the APN, and the APN is an APN in the PDN connection establishment request; if allowed, selecting the PGW according to the APN, and further selecting according to the selected The PGW selects the corresponding SGW, and then sends a create session request message to the SGW, where the create session request message carries the above APN;

 Step 104: The SGW forwards a create session request message to the PGW.

Step 105: The PGW determines, according to the foregoing APN, which network the UE is connected to. If it is connected to the Internet, the PGW directly allocates an IP address to the UE from the local address pool. If it is connected to a specific type of network, the PGW needs to be associated with the specific a type of network performs signaling interaction, and allocates an IP address to the UE from an address pool of the specific type of network; Step 106: The PGW returns a create session response message to the SGW, where the create session response message carries the foregoing IP address.

 Step 107: The SGW forwards a create session response message to the MME.

 Step 108: The MME returns a PDN connection setup response message to the UE, where the PDN connection setup response message carries the foregoing IP address.

 Step 109: The UE accesses the PDN network according to the foregoing IP address. If the PDN network is the Internet, the packet sent by the UE is directly routed to the Internet. If the PDN network is a specific type of network, the packet sent by the UE passes through step 101. The established tunnel is forwarded to a specific type of network.

 The tunnels in the existing tunnel forwarding method are established based on different types of PDN networks, and different service flows in the same type of PDN network (such as online payment services with high security requirements and low security requirements) Service, etc.) cannot be distinguished, and different policies are used for forwarding. Data sent by different UEs accessing the same type of PDN network cannot be distinguished, and different policies are used for forwarding. Summary of the invention

 The embodiments of the present invention provide a tunnel forwarding method, apparatus, device, and system, in order to solve the problem that the data of the service granularity or the UE granularity cannot be differentiated and forwarded in the existing tunnel forwarding method. The technical solution is as follows:

 In one aspect, a tunnel forwarding method is provided, where the method includes:

 Receiving a tunnel establishment request, where the tunnel establishment request includes tunnel endpoint information and a tunnel forwarding rule;

 Instructing the at least one gateway to establish a tunnel with the application server corresponding to the tunnel endpoint information, and delivering the tunnel forwarding rule to the gateway, so that the gateway forwards the data that meets the tunnel forwarding rule to the tunnel by using the tunnel to The application server.

 Further, the tunnel establishment request further includes range indication information, where the at least one gateway establishes a tunnel with the application server corresponding to the tunnel endpoint information, and sends the tunnel forwarding rule to the gateway, specifically:

 Selecting at least one gateway in a range that is indicated by the range indication information;

 And indicating that the selected gateway establishes a tunnel with the application server, and sends the tunnel forwarding rule to the gateway.

 Further, when the tunnel forwarding rule is to forward data of the specified user equipment to the application server, the at least one gateway instructs the application server corresponding to the tunnel endpoint information to establish a tunnel, and delivers the tunnel forwarding rule. After the gateway, it also includes:

Directing the designated user device to connect to the gateway. Further, the guiding the designated user equipment to connect to the gateway includes:

 Instructing the home subscriber server HSS to modify the subscription data of the specified user equipment, and modifying each access point name APN of the specified user equipment to be associated with the gateway, so that the mobility management entity MME is configured according to the modified subscription data. And guiding the specified user equipment to connect to the gateway;

 Or, the HSS is instructed to modify the subscription data of the specified user equipment, and the APN of the specified user equipment is replaced by a specific APN, and the specific APN is associated with the gateway, so that the MME boots the information according to the modified subscription data. Designating a user equipment to connect to the gateway;

 Or, indicating that the base station connected to the designated user equipment routes data of the specified user equipment to the gateway.

 Further, the tunnel establishment request further includes a tunnel type, and when the tunnel type is a security tunnel, the at least one gateway is configured to establish a tunnel with the application server corresponding to the tunnel endpoint information, and specifically includes:

 And transmitting authentication information to the gateway and the application server, respectively, so that the gateway and the application server complete mutual authentication when establishing a tunnel according to the authentication information.

 In another aspect, a tunnel forwarding device is provided, the device comprising:

 a request receiving module, configured to receive a tunnel establishment request, where the tunnel establishment request includes tunnel endpoint information and a tunnel forwarding rule;

 a tunnel establishment module, configured to: at least one gateway establishes a tunnel with an application server corresponding to the tunnel endpoint information, and sends the tunnel forwarding rule to the gateway, so that the gateway will meet the data of the tunnel forwarding rule. Forwarding to the application server using the tunnel.

 Further, the tunnel establishment request further includes range indication information, and the tunnel establishment module specifically includes: a gateway selection unit and a tunnel establishment unit;

 The gateway selection unit is configured to select at least one gateway that belongs to the range indicated by the range indication information, where the tunnel establishment unit is configured to indicate that the selected gateway establishes a tunnel with the application server, and sends the tunnel The tunnel forwarding rule is sent to the gateway.

 Further, when the tunnel forwarding rule is to forward the data of the specified user equipment to the application server, the tunnel forwarding device further includes:

 And a connection guiding module, configured to guide the specified user equipment to connect to the gateway.

 Further, the connection guiding module specifically includes:

 a first indicating unit, a second indicating unit or a third indicating unit;

The first indication unit is configured to indicate that the home subscriber server HSS modifies the subscription data of the specified user equipment, and that each access point name APN of the specified user equipment is modified to be associated with the gateway, so as to be mobility. Tube The physical entity MME directs the specified user equipment to connect to the gateway according to the modified subscription data. The second indication unit is configured to instruct the HSS to modify the subscription data of the specified user equipment, and replace the designated user. The APN of the device is a specific APN, and the specific APN is associated with the gateway, so that the MME directs the specified user equipment to connect to the gateway according to the modified subscription data.

 The third indication unit is configured to indicate that the base station connected to the designated user equipment routes data of the specified user equipment to the gateway.

 Further, the tunnel establishment request further includes a tunnel type. When the tunnel type is a security tunnel, the tunnel establishment module specifically includes:

 Authentication sending unit;

 The authentication sending unit is configured to send authentication information to the gateway and the application server, respectively, so that the gateway and the application server complete mutual authentication when establishing a tunnel according to the authentication information.

 In another aspect, an application server is provided, including:

 a request sending module, configured to send a tunnel establishment request, where the tunnel establishment request includes at least tunnel endpoint information and a tunnel forwarding rule;

 The tunnel endpoint information corresponds to an application server to be tunneled;

 The tunnel forwarding rule includes forwarding data of the specified user equipment to the application server, and forwarding the data of the application server to the application server.

 Further, the tunnel establishment request further includes a tunnel type and/or range indication information;

 The tunnel type includes a normal tunnel or a secure tunnel;

 The range indication information is used to indicate a range to which the gateway belongs.

 In another aspect, a home subscriber server is provided, including:

 And an indication receiving module, configured to receive an indication of the tunnel forwarding device, where the indication includes identifier information of the specified user equipment;

 a data modification module, configured to modify the subscription data of the specified user equipment according to the indication received by the indication receiving module;

 The modification includes: modifying each access point name of the specified user equipment, the APN is associated with the designated gateway;

Or, replacing the APN of the specified user equipment with a specific APN, where the specific APN is associated with the designated gateway. Further, the home subscriber server further includes: a connection determining module and a data pushing module; the connection determining module is configured to determine whether the specified user equipment has accessed other gateways, and the other gateways are not The application server establishes a gateway for the tunnel; The data pushing module is configured to: when the determination result of the connection determining module is YES, push the modified subscription data of the data modification module to the mobility management entity.

 On the other hand, a tunnel forwarding system is provided, and the system includes the tunnel forwarding device provided by the foregoing technical solution, the application server provided by the foregoing technical solution, and/or the home subscriber server provided by the foregoing technical solution.

 The beneficial effects of the technical solutions provided by the embodiments of the present invention are:

 The tunnel is established according to the tunnel establishment request, and the corresponding gateway is instructed to establish a tunnel with the application server, and the tunnel forwarding rule is sent to the gateway, so that the gateway can selectively forward the data to the application server according to the tunnel forwarding rule, thereby solving the existing tunnel forwarding method. The technical problem that the service granularity or the UE granularity data cannot be distinguished and forwarded is that the gateway can forward the data to different application flows or different UEs to the application server. DRAWINGS

 In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described. It is obvious that the drawings in the following description are only some embodiments of the present invention. Other drawings may also be obtained from those of ordinary skill in the art in view of the drawings.

 1 is a flowchart of a method for tunnel forwarding in the prior art;

 2 is a flowchart of a method for tunnel forwarding method according to Embodiment 1 of the present invention;

 3 is a flowchart of a method for tunnel forwarding method according to Embodiment 2 of the present invention;

 4 is a flowchart of a method for tunnel forwarding method according to Embodiment 3 of the present invention;

 5 is a flowchart of a method for tunnel forwarding provided by Embodiment 4 of the present invention;

 6 is a flowchart of a method for tunnel forwarding provided by Embodiment 5 of the present invention;

 7 is a structural block diagram of a tunnel forwarding apparatus according to Embodiment 6 of the present invention;

 8 is another structural block diagram of a tunnel forwarding apparatus according to Embodiment 6 of the present invention;

 9 is a block diagram showing still another structure of a tunnel forwarding apparatus according to Embodiment 6 of the present invention;

 10 is a block diagram showing still another structure of a tunnel forwarding apparatus according to Embodiment 6 of the present invention;

 11 is a block diagram showing still another structure of a tunnel forwarding apparatus according to Embodiment 6 of the present invention;

 12 is a block diagram showing the structure of an application server according to Embodiment 7 of the present invention;

 13 is a structural block diagram of a home subscriber server according to Embodiment 8 of the present invention;

 14 is another structural block diagram of a home subscriber server according to Embodiment 9 of the present invention;

Figure 15 is a block diagram showing the structure of a tunnel forwarding system according to Embodiment 10 of the present invention. detailed description

 The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

 Embodiment 1

 Referring to FIG. 2, a flowchart of a method for tunnel forwarding provided by Embodiment 1 of the present invention is shown. The tunnel forwarding method may be performed by a logical entity network element: a tunnel forwarding network element, and the tunnel forwarding network element may be deployed in a physical control network element such as an MME. The tunnel forwarding method may specifically include:

 Step 201: Receive a tunnel establishment request, where the tunnel establishment request includes tunnel endpoint information and a tunnel forwarding rule. The tunnel forwarding network element receives a tunnel establishment request sent by the application server A, where the tunnel establishment request includes tunnel endpoint information and a tunnel forwarding rule. The tunnel endpoint information corresponds to the application server to be tunneled, and is usually the application server A that sends the tunnel establishment request. In some cases, the tunnel establishment request may also be sent by the application server A, but the tunnel endpoint information corresponds to the application server B, that is, the application server corresponding to the tunnel endpoint information may be different from the application server that sends the tunnel establishment request.

 Tunnel forwarding rules are used to indicate which data needs to be forwarded in the established tunnel. In some cases, the tunnel forwarding rule is: forwarding the data of the specified user equipment to the application server; in other cases, the tunnel forwarding rule is: forwarding the destination address to the application server data to the application server.

 The tunnel establishment request may also include a tunnel type and range indication information. The tunnel type includes an ordinary tunnel or a security tunnel. The common tunnel may be an IP in IP tunnel, an IP in GRE (generic route encapsulation) tunnel, or a Layer 2 Tunneling Protocol (L2TP) tunnel. The tunnel may be an IPSEC (Internet Protocol Security) tunnel or the like. The range indication information is used to indicate the scope of the gateway.

 Step 202: Instruct the at least one gateway to establish a tunnel with the application server corresponding to the tunnel endpoint information, and send a tunnel forwarding rule to the gateway, so that the gateway forwards the data conforming to the tunnel forwarding rule to the application server by using the tunnel.

 After receiving the tunnel establishment request sent by the application server, the tunnel forwarding network element instructs one, two or more gateways to establish a tunnel with the application server corresponding to the tunnel endpoint information, and the gateway may be a PGW. Before the tunnel is established between the gateway and the application server, the tunnel forwarding NE needs to send the tunnel forwarding rule to the gateway at the same time. At this point, the gateway can forward the data conforming to the tunnel forwarding rule to the application server using the established tunnel.

In summary, the tunnel forwarding method provided in this embodiment indicates that the gateway establishes a tunnel with the application server according to the tunnel establishment request, and the tunnel forwarding rule is sent to the gateway, so that the gateway can selectively forward according to the tunnel forwarding rule. Data to the application server, which solves the problem that the existing tunnel forwarding method cannot be used for service granularity or UE granularity. The technical problem of distinguishing and forwarding data reaches the effect that the gateway can forward the data to different application flows or different UEs to the application server. On the other hand, in this embodiment, the tunnel is established by the PGW and the application server A, instead of the UE establishing a tunnel with the application server A. Therefore, for the UE, the UE does not need to establish a tunnel with the application server A. There is no need to deal with higher processing tasks, consume more mobile communication resources (the encapsulation of tunnel messages requires more wireless communication resources) and pay higher power consumption. Embodiment 2

 Assume that the implementation scenario is as follows: UE1 and UE2 access the Internet through PGW1 and PGW2 respectively. When the e-commerce website on the Internet wants all UEs in a certain area to access the application server of the website, it can be forwarded through a secure tunnel to enhance security.

 Referring to FIG. 3, a flowchart of a method for tunnel forwarding provided by Embodiment 2 of the present invention is shown. The tunnel forwarding method may specifically include:

 Step 301: The application server A sends a tunnel establishment request to the tunnel forwarding network element, where the tunnel establishment request includes a tunnel type, tunnel endpoint information, and a tunnel forwarding rule.

 In this embodiment, the tunnel type is: an IPSEC tunnel;

 The tunnel endpoint information corresponds to the application server to be tunneled, specifically the IP address of the application server A that sends the tunnel establishment request.

 The tunnel forwarding rule is as follows: The forwarding destination address is the data of the application server A to the application server.

 If the e-commerce website wants the data of the UE of a certain area (such as Beijing) to be forwarded, the tunnel establishment request also includes the range indication information (Beijing).

 Step 302: The tunnel forwarding network element sends a tunnel establishment request response information to the application server A, where the tunnel establishment request response information carries the authentication information.

 After receiving the tunnel establishment request sent by the application server A, the tunnel forwarding network element sends the tunnel establishment request response information to the application server A. Since the security tunnel (IPSEC tunnel) is established in this embodiment, the tunnel forwarding network element needs to carry the authentication information in the tunnel establishment request response information, so as to send the authentication information to the application server A.

 In other words, if the tunnel type to be established is a secure tunnel, the tunnel forwarding network element acts as an entity trusted by the gateway and the application server, and needs to send authentication information to the gateway and the application server respectively, so that the gateway and the application server complete the tunnel according to the authentication information. Mutual authentication.

Step 303: The tunnel forwarding network element selects at least one PGW according to the range indication information, and sends the tunneling indication information to the selected PGW. The tunneling indication information includes a tunnel type, a tunnel endpoint information, a tunnel forwarding rule, and authentication information. If the tunnel establishment request does not include the range indication information, the tunnel forwarding network element may select all PGWs that may establish a connection with the application server A.

 If the tunnel establishment request includes the range indication information, the tunnel forwarding network element may select all the PGWs that may be connected to the application server A in the range indicated by the range indication information, for example, the range indication information is Beijing, and the tunnel forwarding network element selects All PGWs in Beijing that may be connected to Application Server A. In this example, PGW1 and PGW2 are described as the selected PGW.

 Then, the tunnel forwarding network element sends the tunneling indication information to the PGW1 and the PGW2, where the tunneling indication information includes the tunnel type, the tunnel endpoint information, the tunnel forwarding rule, and the authentication information.

 Step 304: The PGW1 and the PGW2 establish an IPSEC tunnel with the application server A according to the tunnel indication information. The PGW1 and the PGW2 establish an IPSEC tunnel with the application server A according to the tunnel type and the tunnel endpoint information. During the establishment of the IPSEC tunnel, the PGW and the application server A use the authentication information delivered by the tunnel forwarding NE to complete the authentication. The authentication information may be a certificate or a shared key. At the same time, PGW1 and PGW2 respectively save the tunnel forwarding rules.

 Step 305: UE1 establishes a PDN connection through PGW1, and UE2 establishes a PDN connection through PGW2.

 UE1 acts as a user under PGW1 and establishes a PDN connection through PGW1.

 As the user under PGW2, UE2 establishes a PDN connection through PGW2, and the process of establishing a PDN connection can refer to related steps in the background art.

 Step 306: PGW1 and PGW2 forward the data conforming to the tunnel forwarding rule with the tunnel established between the application server A and the application server A.

 When the UE1 or the UE2 accesses the application server A, the PGW1 and the PGW2 can receive the related data packet, and determine that the data packet complies with the tunnel forwarding rule. At this time, PGW1 and PGW2 can forward the data packet to the application server A by using the tunnel established between the application server and the application server A.

In summary, the tunnel forwarding method provided in this embodiment indicates that the gateway establishes a tunnel with the application server according to the tunnel establishment request, and the tunnel forwarding rule is sent to the gateway, so that the gateway can selectively forward according to the tunnel forwarding rule. The data is applied to the application server, which solves the technical problem that the existing tunnel forwarding method cannot distinguish and forward the data of the service granularity, and achieves the effect that the gateway can forward the different service flows to the application server. On the other hand, for the application server A, multiple UEs connected to the same PGW can share a tunnel of the PGW to itself, without requiring each UE to establish a tunnel with the application server A, and also reduce the tunnel. The number of management and the number of maintenance reduces the load. Embodiment 3 Assume that the implementation scenario is as follows: The UE belongs to an employee in the enterprise. The UE needs to access the intranet of the enterprise through the tunnel, and needs to access the Internet. The enterprise hopes that the data of the UE accessing the Internet is also accessed through the tunnel of the intranet. Forward.

 Referring to FIG. 4, a flowchart of a method for tunnel forwarding provided by Embodiment 3 of the present invention is shown. The tunnel forwarding method may include:

 Step 401: The application server A sends a tunnel establishment request to the tunnel forwarding network element, where the tunnel establishment request includes a tunnel type, tunnel endpoint information, and a tunnel forwarding rule.

 In this embodiment, the tunnel type is: IP in IP tunnel;

 The tunnel endpoint information corresponds to the application server to be tunneled, specifically the IP address of the application server A that sends the tunnel establishment request, and the application server A is the server in the intranet;

 The tunnel forwarding rule is: Forward all data of the specified UE to the application server A.

 Step 402: The tunnel forwarding network element selects at least one PGW, and sends the tunneling indication information to the selected PGW, where the tunneling indication information includes a tunnel type, a tunnel endpoint information, and a tunnel forwarding rule.

 The tunnel forwarding network element may select one or more PGWs that specify that the UE may establish a PDN connection. Specifically, for a PGW with similar access functions in each area, the tunnel forwarding network element only needs to select one PGW in the area.

 Then, the tunnel forwarding network element sends the tunnel establishment indication information to the selected PGW, where the tunnel establishment indication information includes the tunnel type, the tunnel endpoint information, and the tunnel forwarding rule.

 Step 403: The selected PGW establishes an IP in IP tunnel with the application server A according to the tunneling indication information. The selected PGW establishes an IP in IP tunnel with the application server A according to the tunnel type and the tunnel endpoint information. At the same time, the selected PGW saves the tunnel forwarding rules.

 It should be noted that, when the designated UE is in a certain area, the PGW selected when accessing the PDN is not necessarily the PGW selected by the tunnel forwarding network element. To this end, the tunnel forwarding network element needs to direct the designated UE to connect to the selected gateway. In this embodiment, the tunnel forwarding network element may instruct the HSS to modify the subscription data of the designated UE, and modify each APN of the designated UE to be associated with the selected PGW, so that the MME guides the specified UE connection according to the modified subscription data. To the selected PGW.

 Step 404: The tunnel forwarding network element sends an indication for modifying the subscription data to the HSS, where the indication carries the identifier information of the designated UE and the identifier information of the selected PGW.

 The identifier information of the designated UE may be an IMSI (International Mobile Subscriber Identification Number). The identification information of the designated UE can be obtained from a tunnel forwarding rule.

 The identification information of the selected PGW may be the IP address of the PGW.

After receiving the indication of the tunnel forwarding network element, the HSS may modify each APN of the designated UE to be associated with the selected one. PGW.

 Step 405: The specified UE sends an attach request to the MME.

 The attach request may carry the APN. If not, the APN may be processed according to the default APN in the subscription data. In addition, the attach request usually carries the IMSI of the designated UE.

 Step 406: The MME acquires subscription data of the designated UE from the HSS.

 After receiving the attach request, the MME obtains the subscription data of the designated UE from the HSS. In this process, the MME may use the IMSI of the designated UE to initiate a subscription data acquisition request to the HSS, so that the HSS returns the subscription data of the designated UE.

 Step 407: The HSS returns, to the MME, the subscription data that the specified UE is modified.

 The HSS returns the subscription data of the specified UE to the MME, and the modified subscription data includes an APN that is selected by the UE, and a PGW associated with each APN. The PGW here is usually the PGW selected by the tunnel forwarding network element.

 Step 408: The MME sends a create session request message to the PGW in the modified subscription data.

 The create session request message includes the IMSI and the APN of the designated UE, and the APN may be the APN that the designated UE carries in the attach request. Although the APN has no practical effect in the subsequent steps of this embodiment, the content is retained in order to make the changes to the prior art as small as possible. It is important to realize that the APN may not be included in the Create Session Request message.

 Step 409: The PGW allocates an address to the application server A according to the IMSI of the specified UE.

 After receiving the Create Session Request message sent by the MME, the PGW can determine that the current UE is the designated UE according to the IMSI and the tunnel forwarding rule of the specified UE. To this end, the PGW to Application Server A assigns an address to the designated UE.

 That is, when the PGW determines that the current UE is the designated UE, it does not assign an address to the designated UE in the address pool corresponding to the APN according to the normal mode; instead, the APN information is ignored, and the address is directly assigned to the designated UE at the application server A. .

 Step 410: The PGW returns a create session response message to the MME, where the create session response message carries the assigned address.

 Step 411: The MME returns an attach response to the designated UE, where the attach response carries the address allocated by the PGW. Thereafter, the designated UE can complete the PDN access by using the address allocated by the PGW, and access the PDN network.

 Step 412: The PGW receives the data packet of the specified UE, and forwards the data packet that meets the tunnel forwarding rule by using the tunnel established between the application server and the application server A.

When the data packet sent by the UE is sent to the PGW, the PGW can determine that the data packet complies with the tunnel forwarding rule according to the source address of the data packet, and then use the tunnel established between the data packet and the application server A. Forward. In summary, the tunnel forwarding method provided in this embodiment indicates that the gateway establishes a tunnel with the application server according to the tunnel establishment request, and the tunnel forwarding rule is sent to the gateway, so that the gateway can selectively forward according to the tunnel forwarding rule. The data is applied to the application server, which solves the technical problem that the existing tunnel forwarding method cannot distinguish and forward the data of the UE granularity, and achieves the effect that the gateway can forward the data of different UEs to the application server. On the other hand, by establishing only a small number of PGWs to establish a tunnel with the application server A, and simultaneously modifying the HSS subscription data to guide the designated UE to connect to the selected PGW, so that the number of tunnels that the application server A needs to maintain and manage is reduced to less. Embodiment 4

 It is assumed that the implementation scenario is as follows: The UE belongs to an employee in the enterprise. The UE needs to access the intranet of the enterprise through the tunnel, and needs to access the Internet. The enterprise hopes that the data of the UE accessing the Internet is also connected to the tunnel through the intranet. To forward.

 However, different from the third embodiment, before the gateway establishes a tunnel with the application server, the UE has accessed the PDN network through a PGW.

 Referring to FIG. 5, a flowchart of a method for tunnel forwarding provided by Embodiment 4 of the present invention is shown. The tunnel forwarding method may include:

 Step 501: The application server A sends a tunnel establishment request to the tunnel forwarding network element, where the tunnel establishment request includes a tunnel type, tunnel endpoint information, and a tunnel forwarding rule.

 In this embodiment, the tunnel type is: an IP in GRE tunnel;

 The tunnel endpoint information corresponds to the application server to be tunneled, specifically the IP address of the application server A that sends the tunnel establishment request, and the application server A is the server in the intranet;

 The tunnel forwarding rule is: Forward all data of the specified UE to the application server A.

 Step 502: The tunnel forwarding network element selects at least one PGW, and sends the tunneling indication information to the selected PGW, where the tunneling indication information includes a tunnel type, tunnel endpoint information, and a tunnel forwarding rule.

 The tunnel forwarding network element may select one or more PGWs that specify that the UE may establish a PDN connection. Specifically, for a PGW with similar access functions in each area, the tunnel forwarding network element only needs to select one PGW in the area. In this embodiment, PGW1 is used as the selected gateway to describe;

 Then, the tunnel forwarding network element sends a tunnel establishment indication information to the PGW1, where the tunnel establishment indication information includes a tunnel type, tunnel endpoint information, and a tunnel forwarding rule.

 Step 503: The PGW1 establishes an IP in GRE tunnel with the application server A according to the tunnel indication information.

PGW1 establishes an IP in GRE tunnel with application server A according to the tunnel type and tunnel endpoint information. At the same time, PGW1 Save the tunnel forwarding rules.

 It should be noted that, when the designated UE is in a certain area, the PGW selected when accessing the PDN is not necessarily the PGW selected by the tunnel forwarding network element. To this end, the tunnel forwarding network element needs to direct the designated UE to connect to the selected gateway. In this embodiment, the tunnel forwarding network element may instruct the HSS to modify the subscription data of the designated UE, and modify the APN of the designated UE to be a specific APN, and the specific APN is associated with the PGW1, so that the MME guides the designated UE according to the modified subscription data. Connect to PGW1.

 Another point to be explained is: Since the designated UE has established a PDN connection with the PGW2 in advance, the tunnel forwarding network element needs to send the modified subscription data to the HSS after the HSS is instructed to modify the subscription data of the designated UE. The MME, so that the MME first deactivates the existing connection of the designated UE, and redirects the designated UE to connect to the PGW1 according to the modified subscription data.

 Step 504: The tunnel forwarding network element sends an indication for modifying the subscription data to the HSS, where the indication carries the identifier information of the specified UE and the specific APN.

 The identifier information of the designated UE may be IMSI. The identification information of the designated UE can be obtained from a tunnel forwarding rule.

 The specific APN is the APN associated with PGW1. In the present embodiment, APN2 is used as a specific APN.

 After receiving the indication of the tunnel forwarding network element, the HSS may replace the APN in the subscription data of the specified UE as APN2; Step 505, the HSS determines whether the specified UE has accessed other gateways, and the other gateways are gateways that do not establish a tunnel with the application server; If yes, proceed to step 506;

 After the HSS modifies the subscription data of the specified UE, the HSS can determine that the UE has accessed the PGW2.

 Step 506, the HSS actively sends the modified subscription data to the MME;

 The modified subscription data includes the IMSI and APN2 of the designated UE;

 Step 507: The MME deactivates the existing connection between the designated UE and the PGW2, and instructs the designated UE to re-establish the connection.

 After receiving the modified subscription data sent by the HSS, the MME may deactivate the existing connection between the designated UE and the PGW2 according to the IMSI of the designated UE included in the modified subscription data.

 Step 508, the specified UE resends the attach request,

 The attachment request may carry APN1. Since the process of replacing the APN is not visible to the UE, this attach request still carries APN1.

Step 509: The MME selects to PGW1 by using APN2, and initiates a create session request message to PGW1. After receiving the attach request, the MME can select PGW1 according to APN2, and then to PGW1, because only PGW1 after tunnel establishment provides support of APN2. Initiate a create session request message. The create session request message It includes the IMSI and APN2 of the specified UE.

 Step 510: The PGW1 selects an application server A to allocate an address to the designated UE according to the APN2, and then returns a corresponding session creation message to the MME, where the corresponding message of the creation session carries the allocated address.

 Step 511: The MME returns an attach response to the designated UE, where the attach response carries the address allocated by the PGW1. Thereafter, the designated UE can complete the PDN access by using the address allocated by the PGW1, and access the PDN network. Step 512: The PGW1 receives the data packet of the specified UE, and forwards the data packet that meets the tunnel forwarding rule by using the tunnel established between the application server and the application server A.

 When the data packet sent by the specified UE is sent to the PGW1, the PGW1 can determine that the data packet complies with the tunnel forwarding rule according to the source address of the data packet, and then use the tunnel established between the data packet and the application server A. Forward.

 In summary, the tunnel forwarding method provided in this embodiment indicates that the gateway establishes a tunnel with the application server according to the tunnel establishment request, and the tunnel forwarding rule is sent to the gateway, so that the gateway can selectively forward according to the tunnel forwarding rule. The data is applied to the application server, which solves the technical problem that the existing tunnel forwarding method cannot distinguish and forward the data of the UE granularity, and achieves the effect that the gateway can forward the data of different UEs to the application server. On the other hand, the tunnel control network element determines whether the designated UE has accessed the PDN by using other gateways, and then deactivates the connection to the selected PDN, so that even if the designated UE has accessed the PDN, the specified UE can still be guided to pass. The selected PGW accesses the PDN, thereby utilizing the established tunnel to forward the effect of the data of the designated UE. Embodiment 5

 The above embodiments have been described based on the EPC packet domain network architecture, but the tunnel forwarding method described above can also be used to control and forward separate mobile packet network architectures. The so-called control and forwarding separation means that the forwarding network element only processes data packets, and forwards the flow table to generate signaling, and other such as IP address allocation and PDN connection establishment are handled by the control network element.

 Referring to FIG. 6, a flowchart of a method for tunnel forwarding provided by Embodiment 5 of the present invention is shown. In this embodiment, the tunnel forwarding network element is implemented in the controller and the router is used as the gateway. The tunnel forwarding method may specifically include:

 Step 601: The application server A sends a tunnel establishment request to the controller, where the tunnel establishment request includes a tunnel type, tunnel endpoint information, and a tunnel forwarding rule.

 In this embodiment, the tunnel type is: an L2TP tunnel;

 The tunnel endpoint information corresponds to the application server to be tunneled, specifically the IP address of the application server A that sends the tunnel establishment request, and the application server A is the server in the intranet;

The tunnel forwarding rule is: Forward all data of the specified UE to the application server A. Step 602: The controller selects at least one router, and indicates, by using a flow table, the router to establish a tunnel flow table to the application server by using a flow table.

 The controller may choose to specify one or more routers for which the UE may establish a PDN connection. Specifically, for a router with similar access functions in each area, the tunnel forwarding network element only needs to select one router in the area.

 Then, the controller instructs the router to establish a tunnel flow table to the application server through the flow table to the selected router. Step 603, the router establishes a tunnel to the application server A;

 Specifically, the router can establish an L2TP tunnel to Application Server A.

 Step 604: The UE sends a PDN connection establishment request to the controller, where the PDN connection establishment request carries the APN information. The PDN connection establishment request usually further includes the IMSI of the UE.

 Step 605: The controller ignores the APN information, and selects the application server A to allocate an address for the UE.

 The controller may determine, according to the IMSI and the tunnel forwarding rule of the UE, that the UE is the designated UE. At this time, the controller ignores the APN information in the PDN connection establishment request, and selects an address from the address pool of the application server A to the UE.

 Step 606: The controller returns a PDN connection setup response to the UE, where the PDN connection setup response carries the assigned address.

 Step 607: The controller indicates, by using a flow table, the eNB connected to the UE, and forwards the data of the UE to the router. This step, that is, the process in which the controller directs the UE to connect to the router.

 Step 608: The controller instructs the router through the flow table, and forwards the data of the UE to the application server A through the tunnel. In summary, the tunnel forwarding method provided in this embodiment is configured to instruct the corresponding gateway to establish a tunnel with the application server according to the tunnel establishment request, so that the gateway can selectively forward data to the application server according to the tunnel forwarding rule, thereby solving the existing The technical problem that the UE granular data cannot be distinguished and forwarded in the tunnel forwarding method is that the gateway can forward the data of different UEs to the application server. Embodiment 6

 Please refer to FIG. 7, which is a structural block diagram of a tunnel forwarding apparatus according to Embodiment 6 of the present invention. The tunnel forwarding device can include a request receiving module 720 and a tunnel establishment module 740.

 The request receiving module 720 is configured to receive a tunnel establishment request, where the tunnel establishment request includes tunnel endpoint information and a tunnel forwarding rule.

 The tunnel establishment module 740 is configured to instruct the at least one gateway to establish a tunnel with the application server corresponding to the tunnel endpoint information received by the request receiving module 720, and send a tunnel forwarding rule to the gateway, so that the gateway forwards the data conforming to the tunnel forwarding rule by using the tunnel. To the application server.

If the request receiving module 720 receives the tunnel establishment request and further includes range indication information, the tunnel establishment module 740 It may specifically include: a gateway selection unit 742 and a tunnel establishment unit 744, as shown in FIG. The gateway selection unit 742 is configured to select at least one gateway that belongs to the range indicated by the range indication information. The tunnel establishment unit 744 is configured to instruct the selected gateway to establish a tunnel with the application server, and send a tunnel forwarding rule to the gateway.

 If the tunnel forwarding rule received by the request receiving module 720 is to forward the data of the specified user equipment to the application server, the tunnel forwarding device further includes: a connection guiding module 760, as shown in FIG. The connection boot module 760 is configured to direct the specified user equipment to connect to the gateway selected by the tunnel establishment module 740 to establish a tunnel with the application server.

 The connection guiding module 760 may specifically include: a first indicating unit 762a, a second indicating unit 762b, or a third indicating unit 762c, as shown in FIG. The first indication unit 762a is configured to instruct the home subscriber server HSS to modify the subscription data of the specified user equipment, and modify each access point name APN of the specified user equipment to be associated with the gateway, so that the mobility management entity MME is modified according to the The subscription data is used to guide the specified user equipment to connect to the gateway; the second indication unit is configured to instruct the HSS to modify the subscription data of the specified user equipment, replace the APN of the specified user equipment with a specific APN, and the specific APN is associated with the gateway, so that the MME can modify the The subsequent subscription data is used to guide the designated user equipment to connect to the gateway; the third indication unit is configured to indicate that the base station connected to the designated user equipment routes the data of the designated user equipment to the gateway.

 If the tunnel establishment request received by the request receiving module 720 further includes a tunnel type, when the tunnel type is a secure tunnel, the tunnel establishment module 740 may further include: an authentication sending unit 746, as shown in FIG. The authentication sending unit 746 is configured to separately send authentication information to the gateway and the application server, so that the gateway and the application server complete mutual authentication when establishing the tunnel according to the authentication information.

 In summary, the tunnel forwarding apparatus provided in this embodiment indicates that the gateway establishes a tunnel with the application server according to the tunnel establishment request, so that the gateway can selectively forward data to the application server according to the tunnel forwarding rule, thereby solving the existing The technical problem that the UE granular data cannot be distinguished and forwarded in the tunnel forwarding method is that the gateway can forward the data of different UEs to the application server. Example 7

 Please refer to FIG. 12, which is a structural block diagram of an application server according to Embodiment 7 of the present invention. The application server includes: a request sending module 120.

 The request sending module 120 is configured to send a tunnel establishment request, where the tunnel establishment request includes at least tunnel endpoint information and a tunnel forwarding rule. The tunnel endpoint information corresponds to the application server to be tunneled; the tunnel forwarding rule includes forwarding the data of the specified user equipment to the application server, and forwarding the data of the application server to the application server.

 The tunnel establishment request may further include a tunnel type and/or range indication information;

Tunnel types include ordinary tunnels or secure tunnels. The range indication information is used to indicate the scope of the gateway.

 In summary, the application server provided in this embodiment sends a tunnel establishment request, so that the tunnel forwarding network element instructs the corresponding gateway to establish a tunnel with the application server according to the tunnel establishment request, so that the gateway can selectively select the tunnel according to the tunnel forwarding rule. The data is forwarded to the application server, which solves the technical problem that the existing tunnel forwarding method cannot distinguish and forward the data of the UE granularity, and achieves the effect that the gateway can forward the data of different UEs to the application server. Example eight

 Please refer to FIG. 13, which is a structural block diagram of a home subscriber server according to Embodiment 8 of the present invention. The home subscriber server includes: an indication receiving module 132 and a data modification module 134.

 The indication receiving module 132 is configured to receive an indication of the tunnel forwarding device, where the indication includes the identification information of the specified user equipment.

 The data modification module 134 is configured to modify the subscription data of the specified user equipment according to the indication received by the indication receiving module 132. The modification includes: modifying each access point name of the specified user equipment, the APN is associated with the designated gateway; or, replacing the APN of the specified user equipment with a specific APN, and the specific APN is associated with the designated gateway.

 The home subscriber server further includes: a connection determination module 136 and a data push module 138, as shown in FIG. The connection determining module 136 is configured to determine whether the specified user equipment has access to other gateways, and the other gateways are gateways that do not establish a tunnel with the application server. The data pushing module 138 is configured to: when the determination result of the connection determining module 136 is yes, The modified subscription data of the data modification module 134 is pushed to the mobility management entity.

 In summary, the home subscriber server provided in this embodiment modifies the subscription data of the specified user equipment according to the indication of the tunnel forwarding device, so that the designated user equipment can always connect to the gateway selected by the tunnel forwarding device, and the solution is resolved. The technical problem that the data of the UE granularity cannot be distinguished and forwarded in the existing tunnel forwarding method is achieved, and the effect that the gateway can forward the data of different UEs to the application server is achieved. Example nine

Please refer to FIG. 15, which is a structural block diagram of a tunnel forwarding system according to Embodiment 9 of the present invention. The tunnel forwarding system includes the tunnel forwarding device 700 provided in Embodiment 7, the application server 800 provided in Embodiment 8, and/or the Home Subscriber Server 900 provided in Embodiment 9. It should be noted that, when the tunnel forwarding device, the application server, the home subscriber server, and the tunnel forwarding system provided by the foregoing embodiments use the tunnel to forward data, only the division of the foregoing functional modules is used for example, and the actual application is performed. In the above, the above function assignment can be completed by different functional modules according to requirements, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the tunnel forwarding device, the application server, the home subscriber server, and the tunnel forwarding system provided by the foregoing embodiments are the same as the embodiment of the tunnel forwarding method. For details, refer to the method embodiment, and details are not described herein. A person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium. The storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are within the spirit and scope of the present invention, should be included in the protection of the present invention. Within the scope.

Claims

claims 1. A tunnel forwarding method, characterized in that the method includes: Receive a tunnel establishment request, where the tunnel establishment request includes tunnel endpoint information and tunnel forwarding rules; Instruct at least one gateway to establish a tunnel with the application server corresponding to the tunnel endpoint information, and deliver the tunnel forwarding rule to the gateway, so that the gateway forwards data that conforms to the tunnel forwarding rule using the tunnel to The application server. 2. The tunnel forwarding method according to claim 1, wherein the tunnel establishment request further includes range indication information, which instructs at least one gateway to establish a tunnel with the application server corresponding to the tunnel endpoint information, and downloads Send the tunnel forwarding rules to the gateway, specifically including: Select at least one gateway belonging to the range indicated by the range indication information; Instruct the selected gateway to establish a tunnel with the application server, and deliver the tunnel forwarding rule to the gateway. 3. The tunnel forwarding method according to claim 1, wherein when the tunnel forwarding rule is to forward data of a designated user equipment to the application server, the indicated at least one gateway corresponds to the tunnel endpoint information. After the application server establishes the tunnel and delivers the tunnel forwarding rule to the gateway, it also includes: Direct the designated user equipment to connect to the gateway. 4. The tunnel forwarding method according to claim 3, characterized in that: guiding the designated user equipment to connect to the gateway specifically includes: Instruct the home user server HSS to modify the subscription data of the designated user equipment, and modify each access point name APN of the designated user equipment to be associated with the gateway, so that the mobility management entity MME can modify the subscription data according to the modified subscription data. to guide the designated user equipment to connect to the gateway; Or, instruct the HSS to modify the subscription data of the designated user equipment and replace the APN of the designated user equipment with a specific APN, and the specific APN is associated with the gateway, so that the MME can guide the MME according to the modified subscription data. Designate user equipment to connect to the gateway; Or, instruct the base station connected to the designated user equipment to route the data of the designated user equipment to the gateway. 5. The tunnel forwarding method according to any one of claims 1 to 4, characterized in that the tunnel establishment request further includes a tunnel type, and when the tunnel type is a secure tunnel, the indication is that at least one gateway is connected to the tunnel. The application server corresponding to the tunnel endpoint information establishes the tunnel, including: Authentication information is sent to the gateway and the application server respectively, so that the gateway and the application server complete mutual authentication when establishing a tunnel based on the authentication information. 6. A tunnel forwarding device, characterized in that the device includes: A request receiving module, configured to receive a tunnel establishment request, where the tunnel establishment request includes tunnel endpoint information and tunnel forwarding rules; A tunnel establishment module, configured to instruct at least one gateway to establish a tunnel with the application server corresponding to the tunnel endpoint information, and deliver the tunnel forwarding rules to the gateway, so that the gateway will forward data that conforms to the tunnel forwarding rules. Use the tunnel to forward to the application server. 7. The tunnel forwarding device according to claim 6, wherein the tunnel establishment request further includes range indication information, and the tunnel establishment module specifically includes: gateway selection unit and tunnel establishment unit; The gateway selection unit is used to select at least one gateway belonging to the range indicated by the range indication information; the tunnel establishment unit is used to instruct the selected gateway to establish a tunnel with the application server, and issue The tunnel forwards the rules to the gateway. 8. The tunnel forwarding device according to claim 6, wherein when the tunnel forwarding rule is to forward data of a designated user equipment to the application server, the tunnel forwarding device further includes: A connection guidance module, configured to guide the specified user equipment to connect to the gateway. 9. The tunnel forwarding device according to claim 8, wherein the connection guidance module specifically includes: a first indication unit, a second indication unit or a third indication unit; The first instruction unit is used to instruct the home user server HSS to modify the subscription data of the designated user equipment, and modify each access point name APN of the designated user equipment to be associated with the gateway to facilitate mobility. The management entity MME guides the designated user equipment to connect to the gateway according to the modified subscription data; The second instruction unit is used to instruct the HSS to modify the subscription data of the designated user equipment, replacing the The APN of the designated user equipment is a specific APN, and the specific APN is associated with the gateway, so that the MME guides the designated user equipment to connect to the gateway according to the modified subscription data; The third instructing unit is used to instruct the base station connected to the designated user equipment to route the data of the designated user equipment to the gateway. 10. The tunnel forwarding device according to any one of claims 6 to 9, characterized in that the tunnel establishment request further includes a tunnel type, and when the tunnel type is a secure tunnel, the tunnel establishment module specifically includes: Authentication sending unit; The authentication sending unit is configured to send authentication information to the gateway and the application server respectively, so that the gateway and the application server complete mutual authentication when establishing a tunnel based on the authentication information. 11. An application server, characterized by including: A request sending module, configured to send a tunnel establishment request, which at least includes tunnel endpoint information and tunnel forwarding rules; Wherein, the tunnel endpoint information corresponds to the application server to which the tunnel is to be established; The tunnel forwarding rules include forwarding data of a designated user equipment to the application server, and forwarding data whose target address is the application server to the application server. 12. The application server according to claim 11, the tunnel establishment request further includes tunnel type and/or range indication information; The tunnel types include ordinary tunnels or safety tunnels; The range indication information is used to indicate the range to which the gateway belongs. 13. A home user server, characterized by including: An instruction receiving module, configured to receive instructions from the tunnel forwarding device, where the instructions include identification information of the designated user equipment; A data modification module, configured to modify the contract data of the designated user equipment according to the instruction received by the instruction receiving module; Wherein, the modification includes: modifying each access point name APN of the designated user equipment to be associated with a designated gateway; or, replacing the APN of the designated user equipment with a specific APN, and the specific APN is associated with the designated gateway. 14. The home user server according to claim 13, characterized in that the home user server further includes: a connection judgment module and a data push module; The connection determination module is used to determine whether the designated user equipment has accessed other gateways, and the other gateways are gateways that have not established a tunnel with the application server; The data push module is configured to push the subscription data modified by the data modification module to the mobility management entity when the judgment result of the connection judgment module is yes. 15. A tunnel forwarding system, characterized in that the system includes the tunnel forwarding device according to any one of claims 6 to 10, the application server according to claims 11 to 12, and/or the application server according to claim 13 or the home user server described in 14.