CN106713406A - Method and system for accessing to slice network - Google Patents

Abstract

The invention discloses a method and system for accessing to a slice network. The method comprises the steps that a resource manager receives a network slice establishment request sent by a third-party application, and sends a resource customization request to a virtual resource provider according to performance and/or function parameters carried in the establishment request; and a virtual resource provided by the virtual resource provider is received, a network slice is established for the third-party application, and identification information is distributed to the established network slice.

Description

Method and system for accessing slice network

technical field

The present invention relates to a network slice (slice) technology of a mobile network, in particular to a method and system for accessing a slice network.

Background technique

Traditional network equipment is developed and customized by equipment manufacturers based on special equipment. The introduction of new network functions and services usually means the development and deployment of new network equipment entities. New dedicated network equipment will bring more energy consumption, equipment investment, and technical reserves required for new equipment, equipment integration, and increased operation and management costs. The continuous innovation of network technology and business has drastically shortened the life cycle of network equipment based on dedicated hardware, reducing the profit growth brought about by the promotion of new services. For service providers, in order to reduce the operating costs of network deployment and business promotion, it is necessary for the future network to decouple software and hardware based on a general-purpose hardware platform, so as to extend the life cycle of equipment through software updates and upgrades, and reduce the overall cost of equipment. In addition, the deployment of new services is accelerated through the decoupling of software and hardware, which provides a strong guarantee for the rapid promotion of new services to win the market, thereby increasing the profit of service providers. It is against the above background that Network Function Virtualization (NFV, Network Function Virtualization) was proposed, which implements various network functions through software and runs on general-purpose X86 architecture servers, reduces the cost of expensive network equipment, and realizes software and hardware Decoupling and functional abstraction. Through NFV, network device functions no longer depend on dedicated hardware, resources can be fully and flexibly shared, and automatic deployment, elastic scaling, fault isolation, and self-healing are performed based on actual business needs. NFV realizes the decoupling of underlying physical devices, upper-layer operating systems, and application software, while the management and collaboration system must provide a manageable, controllable, and operable service provision environment so that basic resources can be conveniently provided to applications. The essence is to realize deployment, scheduling, operation and maintenance, and management. The NFV architecture is divided into three layers according to the network, network elements, and resources, and each layer has management and collaboration function modules. The functions of the management and collaboration layer should include: virtual machine lifecycle management, resource monitoring, virtual machine performance monitoring, fault management, virtual machine dynamic migration, load balancing, resource management, information maintenance, etc. The management and collaboration layer mainly includes an operation support system (OSS, Operation Support System), a network component management system (EMS, Element Management System), a network function virtualization orchestrator (NFVO, Network Function Virtualization Orchestrator), a virtualized infrastructure manager ( VIM, Virtualized Infrastructure Manager), Virtualized Network Function Module Manager (VNFM, Virtualized Network Function Manager).

In the NFV of the evolved packet core (EPC, Evolved Packet Core) and IP multimedia system (IMS, IP Multimedia Subsystem), the mobility management entity (MME, MobilityManagement Entity), serving gateway (S-GW, Serving GateWay) and packet Data gateway (P-GW, Packet Data Network GateWay), call session control function (CSCF, Call Session Control Function), and base stations using different wireless standards can all be virtualized. Among them, the network functional entities of EPC and IMS can be integrated in the same hardware resource pool, and the overall cost of the network can be reduced by using NFVI sharing, load-based resource allocation, automatic operation to avoid failure and recovery. In addition, functions of the base station, such as physical layer/data link layer/network layer protocol stack handling different wireless standards (such as 2G, 3G, LTE, WiMAX, etc.) can also share hardware resources in a centralized environment , realize dynamic resource allocation and reduce power consumption.

Currently, discussions on NFV in the industry focus on network management and operation, but no detailed end-to-end discussion has been initiated. How to provide business support for third-party applications is a technical problem that needs to be solved urgently.

Contents of the invention

In order to solve the above technical problems, embodiments of the present invention provide a method and system for accessing a slice network.

The method for accessing a network slice provided by an embodiment of the present invention includes:

The resource manager receives a network slice creation request forwarded by the capability exposure device or sent by a third-party application, and sends a resource customization request to the virtual resource provider according to the performance and/or function parameters carried in the creation request;

The virtual resource provided by the virtual resource provider is received, a network slice is created for the third-party application, and identification information is assigned to the created network slice.

In an embodiment of the present invention, the method further includes:

The network system sets a service template according to the virtual resources provided by the virtual resource provider, and the service template includes performance and/or function parameters;

The third-party application selects a service template, and sends the selected service template to the resource manager through the creation request.

In the embodiment of the present invention, creating a network slice for the third-party application includes:

The resource manager queries the authorization information of the third-party application, and when it is determined that the creation request is within the authorization range, creates a network slice, and writes the network identifier allocated for the network slice into a home subscriber server (HSS, Home Subscriber Server);

Create a virtual mobility management unit MME and a virtual gateway for the network slice;

Receive the subscription information of the third-party application and store the subscription information in the HSS; the subscription information at least includes the mapping relationship between the user ID and the network slice ID, and the MME to which the network slice belongs.

In an embodiment of the present invention, the method further includes:

The network slice selection device receives the access request sent by the user equipment and carries the network slice identifier, and determines the MME corresponding to the network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS addresses the server of the third-party application through the network slice identifier, and executes the authentication process.

In the embodiment of the present invention, authentication and authorization data is stored in the HSS, and data flow policy control data is stored in a policy and charging rules function (PCRF, Policy and Charging Rules Function); the method further includes:

The network slice selection device receives the access request sent by the user equipment and carries the network slice identifier, and determines the MME corresponding to the network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS authenticates the user equipment, and executes data flow policy control on services requested by the user equipment after the authentication is passed.

In the embodiment of the present invention, authentication authorization data is stored in the HSS, and data flow policy control data is stored in the PCRF; the method further includes:

The MME receives the access request sent by the user equipment, and initiates an authentication request for the user equipment to the HSS; receives the authentication response returned by the HSS, and according to the authorized network slice identifier of the user equipment carried in the authentication response, , determining the home MME of the user equipment; redirecting the access request of the user equipment to the home MME of the user equipment, and the home MME of the user equipment initiates the access request of the relevant service of the user equipment.

In the embodiment of the present invention, authentication authorization data is stored in the HSS, and data flow policy control data is stored in the PCRF; the method further includes:

The MME receives the access request sent by the user equipment, and initiates an authentication request for the user equipment to the HSS; receives the authentication response returned by the HSS, and according to the authorized network slice identifier of the user equipment carried in the authentication response, and the home MME of the user equipment, redirecting the access request of the user equipment to the home MME of the user equipment; and the home MME of the user equipment initiates the access request of the related services of the user equipment.

In the embodiment of the present invention, the resource manager includes but is not limited to Network Functions Virtualization Management and Orchestration (MANO, Network Functions Virtualization Management and Orchestration);

The functional parameters include at least one of the following parameters:

Network type, NE type, NE function module type,

The performance parameters include at least one of the following parameters:

Allows users to access quantity parameters, processing speed, storage space, quality of service.

In the embodiment of the present invention, creating a network slice for the third-party application includes:

The resource manager notifies the virtualized network function module manager VNFM to create a network function based on the function parameters;

The resource manager notifies the virtualization infrastructure manager VIM to allocate network performance resources based on the performance parameters; or

The resource manager notifies the VNFM of the function parameters and performance parameters, and the VNFM creates virtual networks, network elements and customizes corresponding function modules according to the function parameters; and notifies the VIM to allocate network performance resources according to the performance parameters.

A system for accessing a network slice, including: a resource manager, a capability opening device, and a virtual resource provider, wherein:

A virtual resource provider, used to provide virtual resources;

The resource manager is configured to receive a network slice creation request forwarded by the capability exposure device or sent by a third-party application, and send a resource customization request to the virtual resource provider according to the performance and/or function parameters carried in the creation request; and

The virtual resource provided by the virtual resource provider is received, a network slice is created for the third-party application, and identification information is assigned to the created network slice.

In the embodiment of the present invention, the system further includes: a setting unit, configured to set a service template according to the virtual resources that the virtual resource provider can provide, and the service template includes performance and/or function parameters;

The third-party application is configured to select a service template, and send the selected service template to the resource manager through the creation request.

In the embodiment of the present invention, the system further includes a Home Subscriber Server HSS;

The resource manager is further configured to query the authorization information of the third-party application, create a network slice when it is determined that the creation request is within the authorization range, and write the network identifier allocated for the network slice into the home subscriber server HSS; creating a virtual mobility management unit MME and a virtual gateway for the network slice; and

The resource manager is further configured to receive the subscription information of the third-party application and store the subscription information in the HSS; the subscription information includes at least a mapping relationship between a user identifier and the network slice identifier, and the network The MME to which the slice belongs.

In the embodiment of the present invention, the system further includes a server of a third-party application that provides services for the third-party application and a network slice selection device;

The network slice selection device is further configured to receive an access request carrying a network slice identifier sent by the user equipment, and determine an MME corresponding to a network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS addresses the server of the third-party application through the network slice identifier, and executes the authentication process.

In the embodiment of the present invention, the system further includes a policy and charging rule function PCRF and a network slice selection device;

HSS, used to store authentication and authorization data;

PCRF, used to store data flow policy control data;

The network slice selection device is further configured to receive an access request carrying a network slice identifier sent by the user equipment, and determine an MME corresponding to a network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS authenticates the user equipment, and executes data flow policy control on services requested by the user equipment after the authentication is passed.

In the embodiment of the present invention, the system further includes MME and PCRF;

HSS, used to store authentication and authorization data;

PCRF, used to store data flow policy control data;

The MME is configured to receive an access request sent by the user equipment, and initiate an authentication request for the user equipment to the HSS; receive an authentication response returned by the HSS, and, according to the authorization of the user equipment carried in the authentication response, The network slice identifier determines the user equipment's home MME; the user equipment's home MME redirects the user equipment's access request to the user equipment's home MME, and the user equipment's home MME initiates an access request for related services of the user equipment.

In the embodiment of the present invention, the system further includes MME and PCRF;

HSS, used to store authentication and authorization data;

PCRF, used to store data flow policy control data;

The MME is configured to receive an access request sent by the user equipment, and initiate an authentication request for the user equipment to the HSS; and receive an authentication response returned by the HSS, and, according to the user equipment carried in the authentication response, The authorized network slice identifier and the user equipment's home MME redirect the user equipment's access request to the user equipment's home MME; and the user equipment's home MME initiates an access request for related services of the user equipment.

In the embodiment of the present invention, the resource manager includes but not limited to network function virtualization management and orchestration MANO;

The functional parameters include at least one of the following parameters:

Network type, NE type, NE function module type,

The performance parameters include at least one of the following parameters:

Allows users to access quantity parameters, processing speed, storage space, quality of service.

In the embodiment of the present invention, the system further includes: VNFM and VIM;

The resource manager is also used to notify the VNFM to create a network function based on the function parameters; and based on the performance parameters, notify the virtualization infrastructure manager VIM to allocate network performance resources;

or

The resource manager is also used to notify the VNFM of functional parameters and performance parameters, and the VNFM creates virtual networks, network elements and customizes corresponding functional modules according to the functional parameters; and notifies the VIM to allocate network performance resources according to the performance parameters .

In the technical solution of the embodiment of the present invention, the third-party application accesses the resource manager interface, through the performance and/or function parameters provided by the third-party application, and the resource manager parses the performance and/or function parameters provided by the third-party application, and through Or -Vnfm interface to customize virtual network functions and performance; specifically, VNF-M customizes mobile network element and component functions through Ve-Vnfm interface, and customizes mobile network performance through Vi-Vnfm interface. In this way, the user equipment (UE, User Equipment) can access the service function of the VNF by accessing the service capability opening interface, realize the mobile network pipeline capability, and open the mobile service authentication capability. The third-party application provides the resource manager interface with the functions and performance parameters required by the service, thereby providing the third-party application with the relevant resources to realize the required service, and providing the third-party application with network elements such as MME and gateway to provide related services Support, so as to provide personalized services for third-party applications. The technical solutions of the embodiments of the present invention can meet various business requirements of third parties, improve the business service capabilities of operators, and save network deployment costs.

Description of drawings

FIG. 1 is a schematic flowchart of a method for accessing a network slice according to Embodiment 1 of the present invention;

FIG. 2 is a schematic flowchart of a method for accessing a network slice according to Embodiment 2 of the present invention;

FIG. 3 is a schematic flowchart of a method for accessing a network slice according to Embodiment 3 of the present invention;

FIG. 4 is a schematic flowchart of a method for accessing a network slice according to Embodiment 4 of the present invention;

FIG. 5 is a schematic flowchart of a method for accessing a network slice according to Embodiment 5 of the present invention;

FIG. 6 is a schematic flowchart of a method for accessing a network slice according to Embodiment 6 of the present invention.

detailed description

In order to understand the characteristics and technical contents of the embodiments of the present invention in more detail, the implementation of the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. The attached drawings are only for reference and description, and are not intended to limit the embodiments of the present invention.

FIG. 1 is a schematic flowchart of a method for accessing a network slice according to Embodiment 1 of the present invention. As shown in FIG. 1 , the method for accessing a network slice includes the following steps:

Step 101: The resource manager receives a network slice creation request forwarded by the capability exposure device or sent by a third-party application, and sends a resource customization request to the virtual resource provider according to the performance and/or function parameters carried in the creation request.

The technical solution of the embodiment of the present invention is mainly based on the NFV technology to realize the service provision of the mobile network, so that the function of the network element is realized through the virtualization technology, and the performance requirement of the service is guaranteed. The core concept of NFV technology is to decouple logical network functions from physical hardware devices, in order to greatly reduce the network construction and operation costs of basic telecom network operators. The specific implementation methods are: (1 ) In terms of network hardware equipment, standardize the previous physical network elements into three categories of IT equipment: large-capacity servers, large-capacity storage, and data switches; (2) In terms of network function realization, use programmable software platforms to realize virtualization network function.

In the embodiment of the present invention, the network system sets service templates for various services in advance according to the virtual resources that the virtual resource provider can provide, and the service templates include performance and/or function parameters;

The third-party application selects a service template, and sends the selected service template to the resource manager through the creation request.

In the embodiment of the present invention, the resource manager includes but is not limited to network function virtualization management and orchestration MANO;

The functional parameters include at least one of the following parameters:

Network type, NE type, NE function module type,

The performance parameters include at least one of the following parameters:

Allows users to access quantity parameters, processing speed, storage space, quality of service.

Step 102: Receive the virtual resource provided by the virtual resource provider, create a network slice for the third-party application, and assign identification information to the created network slice.

In the embodiment of the present invention, creating a network slice for the third-party application specifically includes:

The resource manager queries the authorization information of the third-party application, creates a network slice when determining that the creation request is within the scope of authorization, and writes the network identifier assigned to the network slice into the HSS;

Create a virtual MME and a virtual gateway for the network slice;

Receive the subscription information of the third-party application and store the subscription information in the HSS; the subscription information at least includes the mapping relationship between the user ID and the network slice ID, and the MME to which the network slice belongs.

Specifically, the creating a network slice for the third-party application includes:

The resource manager notifies the virtualized network function module manager VNFM to create a network function based on the function parameters;

The resource manager notifies the virtualization infrastructure manager VIM to allocate network performance resources based on the performance parameters; or

The resource manager notifies the VNFM of the function parameters and performance parameters, and the VNFM creates virtual networks, network elements and customizes corresponding function modules according to the function parameters; and notifies the VIM to allocate network performance resources according to the performance parameters.

Based on the NFV network established in steps 101 and 102, the technical solution of the embodiment of the present invention also includes:

The network slice selection device receives the access request sent by the user equipment and carries the network slice identifier, and determines the MME corresponding to the network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS addresses the server of the third-party application through the network slice identifier, and executes the authentication process.

Based on the NFV network established in steps 101 and 102, in the embodiment of the present invention, authentication authorization data is stored in the HSS, and data flow policy control data is stored in the PCRF; the technical solution of the embodiment of the present invention also includes:

The network slice selection device receives the access request sent by the user equipment and carries the network slice identifier, and determines the MME corresponding to the network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS authenticates the user equipment, and executes data flow policy control on services requested by the user equipment after the authentication is passed.

Based on the NFV network established in steps 101 and 102, in the embodiment of the present invention, authentication authorization data is stored in the HSS, and data flow policy control data is stored in the PCRF; the technical solution of the embodiment of the present invention also includes:

The MME receives the access request sent by the user equipment, and initiates an authentication request for the user equipment to the HSS; receives the authentication response returned by the HSS, and according to the authorized network slice identifier of the user equipment carried in the authentication response, , determining the home MME of the user equipment; redirecting the access request of the user equipment to the home MME of the user equipment, and the home MME of the user equipment initiates the access request of the relevant service of the user equipment.

Based on the NFV network established in steps 101 and 102, in the embodiment of the present invention, authentication authorization data is stored in the HSS, and data flow policy control data is stored in the PCRF; the technical solution of the embodiment of the present invention also includes:

The MME receives the access request sent by the user equipment, and initiates an authentication request for the user equipment to the HSS; receives the authentication response returned by the HSS, and according to the authorized network slice identifier of the user equipment carried in the authentication response, and the home MME of the user equipment, redirecting the access request of the user equipment to the home MME of the user equipment; and the home MME of the user equipment initiates the access request of the related services of the user equipment.

In the embodiment of the present invention, the user equipment (UE, User Equipment) can access the service function of the VNF by accessing the service capability opening interface, realize the mobile network pipe function, and open the mobile service authentication capability. The third-party application provides the resource manager interface with the functions and performance parameters required by the service, thereby providing the third-party application with the relevant resources to realize the required service, and providing the third-party application with MME, gateway and other network elements to provide related services Support, so as to provide personalized services for third-party applications. The technical solutions of the embodiments of the present invention can meet various business requirements of third parties, improve the business service capabilities of operators, and save network deployment costs.

The essence of the technical solutions of the embodiments of the present invention will be further clarified below through specific examples.

FIG. 2 is a schematic flowchart of a method for accessing a network slice according to Embodiment 2 of the present invention. As shown in FIG. 2 , the method for accessing a network slice in this example includes the following steps:

Step 20, third-party application contract, authorized virtual network type, virtual network parameter template, function template, performance template, etc. Among them, the function template includes the range of network element types and component types such as customized mobility management function (MM, Mobility Management), session management function (SM, Session Management), service quality (QoS, Quality of Service), etc.; the performance template includes max Forwarding bandwidth, forwarding delay index, user capacity and other parameters.

In the embodiment of the present invention, the operator sets the virtual network type, virtual network parameter template, function template, performance template, etc. in advance according to the resources it can provide, so as to provide various services for third-party applications. By signing a contract with a third-party application, the authority of the third-party application to use resources is determined.

Step 21, the third-party application sends a request for creating a network slice to the capability exposure device, the request carries a network parameter template identifier, and may also include a function template and a performance template;

In the embodiment of the present invention, the capability exposing device may be an NFV orchestrator or its interface, which is responsible for receiving network slice creation requests and service access requests from third-party applications.

Specifically, the third-party application accesses the orchestrator interface, and through the performance and/or function parameters provided by the third-party application, the orchestrator parses the performance and/or function parameters provided by the third-party application, and customizes the virtual network function and function through the Or-Vnfm interface. Performance; specifically, the VNF-M customizes mobile network element and component functions through the Ve-Vnfm interface, and customizes mobile network performance through the Vi-Vnfm interface. In this way, the third-party application can access the service function of the VNF by accessing the service capability opening interface, realize the mobile network pipeline capability, and open the mobile service authentication capability. The third-party application provides relevant resources for the third-party application to realize the required service by providing the functions and performance parameters required by the service to the orchestrator interface, and provides relevant service support by providing network elements such as MME and gateway for the third-party application , so as to provide personalized services for third-party applications.

Step 22: After receiving the creation request sent by the third-party application, the capability development device drives MANO (Network Functions Virtualization Management and Orchestration) to create a virtual network, which carries function parameters and/or performance parameters.

Step 23, MANO queries OSS for third-party authorization information, and determines whether the creation is within the scope of authorization. If not within the authorization range, end the current processing flow.

If the scope of authorization is met, the creation process is executed.

The creation process can be implemented but not limited to the following two implementations:

Method 1: NFVO notifies the VNF Manager to create network functions based on the function parameters; here, the function parameters may include: virtual network type identification parameters, network element type parameters, network element function module parameters, etc.;

NFVO notifies VIM to allocate network performance resources based on performance parameters. Here, performance parameters may include quality of service, number of users that can be accommodated, or computing and storage resources.

Method 2: NFVO notifies VNF Manager of function parameters and performance parameters. VNF Manager creates virtual networks, network elements and customizes corresponding functional modules according to functional parameters. VNF Manager notifies VIM to allocate network performance resources according to performance parameters.

Step 24, MANO creates a network slice, addresses the HSS, and writes the identifier allocated for the virtual network into the HSS, which may include the mapping relationship between the network slice identifier and the server of the third-party application. Among them, the HSS can be the HSS created by the virtual network, or the HSS of the mobile network entity;

Step 25, MANO creates MME virtual network element;

Step 26, MANO creates SGW/PGW virtual network element;

Step 27, the third-party application writes the user subscription information of the network slice created by the third party into the HSS by the capability opening device through the data transmission interface; wherein, the user subscription information includes the mapping between the user ID and the virtual network ID, and the third-party application Attribution MME information;

Step 28, the capability opening device writes the mapping relationship between the virtual network identifier and the MME to the virtual network selector.

Through the above network slicing creation, third-party applications can carry out related services.

FIG. 3 is a schematic flowchart of a method for accessing a network slice according to Embodiment 3 of the present invention. As shown in FIG. 3 , the method for accessing a network slice in this example includes the following steps:

Step 30, storing third-party application contract authentication data in the HSS, the contract authentication data including the network slice identifier;

Step 31, the UE initiates a non-access stratum (NAS, Non-Access Stratum) access request message to the network slice selection device, and the access request message carries a network slice identifier;

The embodiment of the present invention is based on the specific application of the network slice created in the embodiment shown in FIG. 2 . That is, after a network slice is created for a third-party application, how does the UE access the network slice and carry out related services. The network slice selection device may be a service access interface provided by NFV for UE.

Step 32, according to the network slice identifier, the network slice selection device or the MME determines the MME to which the virtual network belongs;

Step 33, the network slice selection device redirects the UE's access request to the MME to which the network slice accessed by the UE belongs;

Step 34, the MME initiates an authentication request of the UE to the HSS, and the authentication request carries a network slice identifier;

Step 35, the HSS addresses the server of the third-party application through the network slice identifier;

Step 36, the HSS initiates the UE authentication process;

Step 37, the authentication process of the UE is completed, and the server of the third-party application is notified of the policy controller identifier assigned to the UE;

Step 38, the MME establishes a data plane channel for the user with the server of the third-party application;

Step 39, the server of the third-party application triggers the PCRF to deliver the user data flow control policy;

In step 310, the PCRF executes the control strategy.

In the embodiment of the present invention, the UE sends a service request to the capability opening device, and the capability opening device triggers related services.

FIG. 4 is a schematic flowchart of a method for accessing a network slice according to Embodiment 4 of the present invention. As shown in FIG. 4 , the method for accessing a network slice in this example includes the following steps:

Step 40, the server of the third-party application injects user authentication and authorization data into the HSS; and the server of the third-party application injects user data flow policy control data into the PCRF;

Step 41, the UE sends a NAS access request message to the network slice selection device, and the access request message carries a network slice identifier;

Step 42, the network slice selection device judges the MME to which the network slice to which the UE belongs according to the network slice identifier;

Step 43, the network slice selection device redirects the user's access request to the home MME;

Step 44, the MME initiates a user authentication request to the HSS, and the authentication request carries a network slice identifier;

Step 45, the HSS searches for the user's subscription data according to the network slice identifier, and executes the user authentication process; after passing the authentication, executes the following steps.

Step 46, the MME initiates a channel establishment request to the S-GW and the P-GW, and establishes a data plane channel for the user;

In step 47, the S-GW and the P-GW deliver the user data flow control policy to the PCRF, and the PCRF executes the control policy.

FIG. 5 is a schematic flowchart of a method for accessing a network slice according to Embodiment 5 of the present invention. As shown in FIG. 5 , the method for accessing a network slice in this example includes the following steps:

Step 50, the server of the third-party application injects user authentication and authorization data into the HSS; and the server of the third-party application injects user data flow policy control data into the PCRF;

Step 51, the MME receives the NAS access request message sent by the UE;

Step 52, the MME initiates a user authentication request to the HSS;

Step 53, execute the user authentication process;

Step 54, the MME receives the authentication success response sent by the HSS, which carries the home network of the authorized UE and the network slice identifier to which the UE belongs;

Step 55, according to the network slice identifier, determine the MME to which the network slice belongs;

Step 56, the MME redirects the user's access request to the home MME, and the redirection request carries the user's subscription data;

Step 57, the MME to which the UE belongs initiates a channel establishment request to the S-GW and the P-GW, and establishes a data plane channel for the user;

In step 58, the S-GW and the P-GW deliver the user data flow control policy to the PCRF, and the PCRF executes the control policy.

FIG. 6 is a schematic flowchart of a method for accessing a network slice according to Embodiment 6 of the present invention. As shown in FIG. 6 , the method for accessing a network slice in this example includes the following steps:

Step 60, the server of the third-party application injects user authentication and authorization data into the HSS; and the server of the third-party application injects user data flow policy control data into the PCRF;

Step 61, the MME receives the NAS access request message sent by the UE;

Step 62, the MME initiates a user authentication request to the HSS;

Step 63, execute the user authentication process;

Step 64, the MME receives the authentication success response sent by the HSS, which carries the home network of the authorized UE, the virtual network identity to which the user belongs, and the MME identity/address;

Step 65, the MME redirects the user's access request to the home MME, and the redirection request carries the user's subscription data;

Step 66, the MME to which the UE belongs initiates a channel establishment request to the S-GW and the P-GW, and establishes a data plane channel for the user;

In step 67, the S-GW and the P-GW deliver the user data flow control strategy to the PCRF, and the PCRF executes the control strategy.

The embodiment of the present invention also describes a system for accessing sliced networks, the system includes: a resource manager, a capability opening device, and a virtual resource provider, wherein:

A virtual resource provider, used to provide virtual resources;

The resource manager is configured to receive a network slice creation request forwarded by the capability exposure device or sent by a third-party application, and send a resource customization request to the virtual resource provider according to the performance and/or function parameters carried in the creation request; and

The virtual resource provided by the virtual resource provider is received, a network slice is created for the third-party application, and identification information is assigned to the created network slice.

In an embodiment of the present invention, the system further includes:

A setting unit, configured to set a service template according to the virtual resources that can be provided by the virtual resource provider, and the service template includes performance and/or function parameters;

The third-party application is configured to select a service template, and send the selected service template to the resource manager through the creation request.

In the embodiment of the present invention, the system further includes an HSS;

The resource manager is further configured to query the authorization information of the third-party application, create a network slice when it is determined that the creation request is within the authorization range, and write the network identifier allocated for the network slice into the home subscriber server HSS; creating a virtual mobility management unit MME and a virtual gateway for the network slice; and

The resource manager is further configured to receive the subscription information of the third-party application and store the subscription information in the HSS; the subscription information includes at least a mapping relationship between a user identifier and the network slice identifier, and the network The MME to which the slice belongs.

In the embodiment of the present invention, the system further includes a server of a third-party application that provides services for the third-party application and a network slice selection device;

The network slice selection device is further configured to receive an access request carrying a network slice identifier sent by the user equipment, and determine an MME corresponding to a network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS addresses the server of the third-party application through the network slice identifier, and executes the authentication process.

In the embodiment of the present invention, the system further includes a policy and charging rule function PCRF and a network slice selection device;

HSS, used to store authentication and authorization data;

PCRF, used to store data flow policy control data;

The network slice selection device is further configured to receive an access request carrying a network slice identifier sent by the user equipment, and determine an MME corresponding to a network slice to be accessed by the user equipment according to the network slice identifier;

The determined MME initiates an authentication request to the HSS, and the HSS authenticates the user equipment, and executes data flow policy control on services requested by the user equipment after the authentication is passed.

In the embodiment of the present invention, the system further includes MME and PCRF;

HSS, used to store authentication and authorization data;

PCRF, used to store data flow policy control data;

The MME is configured to receive an access request sent by the user equipment, and initiate an authentication request for the user equipment to the HSS; receive an authentication response returned by the HSS, and, according to the authorization of the user equipment carried in the authentication response, The network slice identifier determines the user equipment's home MME; the user equipment's home MME redirects the user equipment's access request to the user equipment's home MME, and the user equipment's home MME initiates an access request for related services of the user equipment.

In the embodiment of the present invention, the system further includes MME and PCRF;

HSS, used to store authentication and authorization data;

PCRF, used to store data flow policy control data;

The MME is configured to receive an access request sent by the user equipment, and initiate an authentication request for the user equipment to the HSS; and receive an authentication response returned by the HSS, and, according to the user equipment carried in the authentication response, The authorized network slice identifier and the user equipment's home MME redirect the user equipment's access request to the user equipment's home MME; and the user equipment's home MME initiates an access request for related services of the user equipment.

In the embodiment of the present invention, the resource manager includes but not limited to network function virtualization management and orchestration MANO;

The functional parameters include at least one of the following parameters:

Network type, NE type, NE function module type,

The performance parameters include at least one of the following parameters:

Allows users to access quantity parameters, processing speed, storage space, quality of service.

In the embodiment of the present invention, the system further includes: VNFM and VIM;

The resource manager is also used to notify the VNFM to create a network function based on the function parameters; and based on the performance parameters, notify the virtualization infrastructure manager VIM to allocate network performance resources;

or

The resource manager is also used to notify the VNFM of functional parameters and performance parameters, and the VNFM creates virtual networks, network elements and customizes corresponding functional modules according to the functional parameters; and notifies the VIM to allocate network performance resources according to the performance parameters .

Those skilled in the art should understand that the system for accessing sliced networks in this embodiment of the present invention is implemented on the basis of the existing NFV network architecture, and the network architecture is exactly the same as the existing NFV network architecture. The functions and applications of the relevant network elements in the structure are redefined. The implementation functions of the above-mentioned network elements can be understood by referring to the relevant description of the method for accessing the sliced network.

The technical solutions described in the embodiments of the present invention may be combined arbitrarily if there is no conflict.

In the several embodiments provided by the present invention, it should be understood that the disclosed methods and smart devices can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or May be integrated into another system, or some features may be ignored, or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms of.

The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be fully integrated into a second processing unit, or each unit may be separately used as a unit, or two or more units may be integrated into one unit; The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention.

Claims (18)

1. it is a kind of access section network method, it is characterised in that methods described includes：

The network section that explorer receiving ability open system is forwarded or third-party application sends is created please Ask, according to the performance and/or functional parameter that are carried in the request to create, sent to virtual resource provider and provided Source customization request；

The virtual resource that the virtual resource provider provides is received, is that the third-party application establishment network is cut Piece, and be the network section allocation identification information for being created.

2. it is according to claim 1 access section network method, it is characterised in that methods described is also Including：

Network system sets service template, institute according to the virtual resource that the virtual resource provider can be provided State in service template comprising performance and/or functional parameter；

The third-party application selects service template, and by the request to create by selected service template It is sent to the explorer.

3. the method for accessing section network according to claim 1, it is characterised in that described for described Third-party application creates network section, including：

The explorer inquires about the authorization message of the third-party application, determines that the request to create is being awarded During power scope, network section is created, and will be the network identity write-in ownership signing of network section distribution Client server HSS；

For network section creates virtual mobile management unit MME, virtual gateway；

Receive the CAMEL-Subscription-Information of the third-party application and store to HSS the CAMEL-Subscription-Information；The signing Information at least includes the mapping relations of ID and network section mark, and network section is returned The MME of category.

4. it is according to claim 3 access section network method, it is characterised in that methods described is also Including：

Network section selection device receives the access request for carrying network section mark that user equipment sends, The user equipment corresponding MME of network section to be accessed is determined according to network section mark；

Authentication request is initiated to the HSS from identified MME, and is cut into slices by network by the HSS The server of mark addressing third-party application, performs identifying procedure.

5. it is according to claim 3 access section network method, it is characterised in that in HSS Be stored with Authentication Authorization data, and be stored with traffic policing control in strategy with charging rule functions PCRF Data；Methods described also includes：

Network section selection device receives the access request for carrying network section mark that user equipment sends, The user equipment corresponding MME of network section to be accessed is determined according to network section mark；

Authentication request is initiated from identified MME to the HSS, and the user is set by the HSS Standby to be authenticated, certification performs traffic policing control after passing through to the business of the user equipment requests.

6. it is according to claim 3 access section network method, it is characterised in that in HSS Be stored with Authentication Authorization data, and be stored with traffic policing control data in PCRF；Methods described is also wrapped Include：

MME receives the access request that user equipment sends, and the authentication to the user equipment is initiated to HSS Certification request；The authentication response that HSS is returned is received, according to the use carried in the authentication response The mandate network section mark of family equipment, determines that user equipment belongs to MME；Please by the access of user equipment Ask and be redirected to user equipment ownership MME, and the user equipment is initiated by user equipment ownership MME The access request of related service.

7. it is according to claim 3 access section network method, it is characterised in that in HSS Be stored with Authentication Authorization data, and be stored with traffic policing control data in PCRF；Methods described is also wrapped Include：

MME receives the access request that user equipment sends, and the authentication to the user equipment is initiated to HSS Certification request；The authentication response that HSS is returned is received, according to the use carried in the authentication response The mandate network section mark and user equipment ownership MME of family equipment, by the access request weight of user equipment It is directed to user equipment ownership MME；And the correlation of the user equipment is initiated by user equipment ownership MME The access request of business.

8. according to any one of claim 1 to 7 access section network method, it is characterised in that The explorer includes but is not limited to network function virtual management and layout MANO；

The functional parameter includes at least one of following parameter：

Network type, NE type, Network Element Function module type,

The performance parameter includes at least one of following parameter：

User is allowed to access number parameter, processing speed, memory space, service quality.

9. the method for accessing section network according to claim 8, it is characterised in that described for described Third-party application creates network section, including：

The explorer is based on functional parameter, notifies virtualization network function module manager VNFM wounds Establishing network function；

The explorer is based on performance parameter, notifies virtualized infrastructure manager VIM distribution networks Performance resource；Or

Functional parameter and performance parameter are notified VNFM by the explorer, by the VNFM according to work( Can parameter, establishment virtual network, network element and the corresponding functional module of customization；And according to performance parameter, lead to Know that VIM distributes network performance resource.

10. it is a kind of access section network system, it is characterised in that the system includes：Explorer, Ability open system and virtual resource provider, wherein：

Virtual resource provider, for providing virtual resource；

Explorer, the network sent for the forwarding of receiving ability open system or third-party application is cut into slices and is created Request is built, according to the performance and/or functional parameter that are carried in the request to create, is sent out to virtual resource provider Resources Customization is sent to ask；And

The virtual resource that the virtual resource provider provides is received, is that the third-party application establishment network is cut Piece, and be the network section allocation identification information for being created.

11. systems for accessing section network according to claim 10, it is characterised in that the system Also include：

Setting unit, the virtual resource for be can be provided according to the virtual resource provider sets business mould Plate, includes performance and/or functional parameter in the service template；

The third-party application, for selecting service template, and by the request to create by selected industry Business template is sent to the explorer.

12. systems for accessing section network according to claim 11, it is characterised in that the system Also include home signature user server HSS；

The explorer, is additionally operable to inquire about the authorization message of the third-party application, determines the establishment Request creates network section, and will be the network identity write-in of network section distribution in the scope of authority Home signature user server HSS；For network section creates virtual mobile management unit MME, void Intend gateway；And

The explorer, is additionally operable to receive the CAMEL-Subscription-Information of the third-party application and believes the signing Breath is stored to HSS；The CAMEL-Subscription-Information at least includes that ID is closed with the mapping of network section mark System, and the MME that network section belongs to.

13. systems for accessing section network according to claim 11, it is characterised in that the system Also include being provided for the third-party application server and network the section selection dress of the third-party application of business Put；

The network section selection device, the network section that carries for being additionally operable to receive user equipment transmission is identified Access request, determine that user equipment network to be accessed is cut into slices correspondence according to network section mark MME；

Authentication request is initiated to the HSS from identified MME, and is cut into slices by network by the HSS The server of mark addressing third-party application, performs identifying procedure.

14. systems for accessing section network according to claim 11, it is characterised in that the system Also include strategy with charging rule functions PCRF and network section selection device；

HSS, for storing Authentication Authorization data；

PCRF, for the traffic policing control data that is stored with；

The network section selection device, the network section that carries for being additionally operable to receive user equipment transmission is identified Access request, determine that user equipment network to be accessed is cut into slices correspondence according to network section mark MME；

Authentication request is initiated from identified MME to the HSS, and the user is set by the HSS Standby to be authenticated, certification performs traffic policing control after passing through to the business of the user equipment requests.

15. systems for accessing section network according to claim 11, it is characterised in that the system Also include MME and PCRF；

HSS, for storing Authentication Authorization data；

PCRF, for the traffic policing control data that is stored with；

MME, the access request for receiving user equipment transmission, initiates to the user equipment to HSS Authentication request；The authentication response that HSS is returned is received, is taken according in the authentication response The mandate network section mark of the user equipment of band, determines that user equipment belongs to MME；By user equipment Access request is redirected to user equipment ownership MME, and initiates the user by user equipment ownership MME The access request of the related service of equipment.

16. systems for accessing section network according to claim 11, it is characterised in that the system Also include MME and PCRF；

HSS, for storing Authentication Authorization data；

PCRF, for the traffic policing control data that is stored with；

MME, the access request for receiving user equipment transmission, initiates to the user equipment to HSS Authentication request；And, the authentication response that HSS is returned is received, should according to the authentication The mandate network section mark and user equipment ownership MME of the user equipment of middle carrying are answered, by user equipment Access request be redirected to user equipment ownership MME；And the use is initiated by user equipment ownership MME The access request of the related service of family equipment.

The system of the 17. access section network according to any one of claim 10 to 16, its feature exists In the explorer includes but is not limited to network function virtual management and layout MANO；

The functional parameter includes at least one of following parameter：

Network type, NE type, Network Element Function module type,

The performance parameter includes at least one of following parameter：

User is allowed to access number parameter, processing speed, memory space, service quality.

18. systems for accessing section network according to claim 17, it is characterised in that the system Also include：Virtualization network function module manager VNFM and virtualized infrastructure manager VIM；

The explorer, is additionally operable to based on functional parameter, notifies that VNFM creates network function；And Based on performance parameter, virtualized infrastructure manager VIM distribution network performance resources are notified；

Or

The explorer, is additionally operable to for functional parameter and performance parameter to notify VNFM, by the VNFM According to functional parameter, create virtual network, network element and customize corresponding functional module；And joined according to performance Number, notifies VIM distribution network performance resources.