WO2013044759A1

WO2013044759A1 - Seaming service shunt control implementation method, system and device

Info

Publication number: WO2013044759A1
Application number: PCT/CN2012/081755
Authority: WO
Inventors: 刘国燕; 朱春晖
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-09-26
Filing date: 2012-09-21
Publication date: 2013-04-04
Also published as: CN103024738A

Abstract

Disclosed is a seaming service shunt control implementation method, including: a decision network element deciding whether to permit access to an evolved packet core (EPC) according to whether to permit access to the EPC, and/or whether to permit access to EPC capability indication, and/or a local policy as subscribed; and an execution network element executing the operation of service access according to the decision whether to permit access to the EPC. Also disclosed are a seaming service shunt control implementation system and device. The present invention enables a decision to be made on whether UE performs seaming service shunt according to the wish of the UE, the wish of a trustworthy non-3GPP access network (TNAN) and the wish of the mobile network.

Description

Method, system and device for realizing seamed business shunt control

The invention relates to the field of mobile communications, and in particular to a method, system and device for implementing a service split control with seams. Background technique

The Evolved Packet System (EPS) of the 3rd Generation Partnership Project (3GPP) is evolved by Evolved Universal Terrestrial Radio Access Network (E-UTRAN), mobile The Mobility Management Entity (MME), the Serving Gateway (S-GW), the Packet Data Network Gateway (P-GW), and the Home Subscriber Server (HSS) are formed.

The EPS supports interworking with non-3GPP systems, as shown in Figure 1, where interworking with non-3GPP systems is implemented through the S2a/b/c interface, and the P-GW acts as an anchor between 3GPP and non-3GPP systems. In the system architecture diagram of EPS, non-3GPP system access is divided into untrusted non-3GPP access and trusted non-3GPP access; wherein, untrusted non-3GPP access requires evolved packet data gateway (Evolved Packet Data Gateway) , ePDG) is connected to the P-GW, the interface between the ePDG and the P-GW is S2b; the trusted non-3GPP access can be directly connected to the P-GW through the S2a interface, and the S2a interface uses the PMIP protocol for information exchange; in addition, the S2c interface Provides user plane-related control and mobility support between User Equipment (UE) and P-GW. The supported mobility management protocol is dual-stack mobile IPv6 (Moblie IPv6 Support for Dual Stack Hosts and Routers, DSMIPv6), which can be used for untrusted non-3GPP and trusted non-3GPP access.

Wireless Local Area Network (WLAN) can be trusted Or the untrusted non-3GPP system accesses the EPS, which involves the interworking problem of non-3GPP systems and mobile convergence that many operators pay attention to.

Due to the diverse needs of users, users access multiple services at the same time, and the resource requirements of these services are different. If all the terminals access the 3GPP core network through the WLAN network or the 3GPP access system, the data traffic load of the core network is increased, and the limited network resources are occupied by multiple services, and the services with high QoS requirements may not be guaranteed. Quality, for example: Best Effort (BE) services such as the Internet, the QoS requirements are not very high, and the services such as voice have very high QoS requirements. The above two types of services obtain the same bandwidth. The bandwidth is sufficient for the BE service, but may not meet the requirements of services such as voice, resulting in poor transmission quality or even business failure of voice-type services. Therefore, when the mobile terminal accesses the EPS through the WLAN, it is necessary to effectively split the service, as shown in FIG. 2 .

As the technology of WLAN is continuously enhanced, some operators also believe that it can be used as a trusted non-3GPP system. Therefore, the interconnection and interworking problem of UE accessing EPS through trusted WLAN is gradually being paid attention to and researched. Among them, the scene of seamed business diversion control is also regarded as one of the research priorities.

Currently, in the S2a scenario, the scheme related to the service splitting of the UE is still under study, and there is no specific solution. Some key issues need to be considered, such as: The factors that determine whether the UE performs the split traffic is multi-faceted, including the willingness of the UE, the trusted non-3 GPP IP access network (TNAN) network. It is more appropriate for the operator's willingness and the willingness of the mobile network operator, and on which network element the UE is sewn. Summary of the invention

In view of this, the main object of the present invention is to provide a method, system and device for implementing a service split control according to a UE, and according to the will of the UE, the will of the TNAN network, and the willingness of the mobile network to comprehensively determine whether the UE performs a slotted service. Diversion.

In order to achieve the above object, the technical solution of the present invention is achieved as follows: The present invention provides a method for implementing a slotted service offload control, comprising: determining, by a decision network element, whether to allow access to an evolved packet core network (EPC), and/or whether to allow access to an EPC capability indication, and/or Or a local policy to determine whether to allow access to the EPC;

The performing network element performs the operation of the service access according to whether the decision is allowed to access the EPC. In the foregoing solution, when the determining network element is an access control device (AC) or a broadband network gateway (BNG) supporting the AC function, the method further includes: obtaining, by the AC or the BNG, whether the subscription is allowed to access the EPC. , for:

In the Extensible Authentication Protocol (EAP) authentication process, after the authentication, authorization, and accounting (AAA) server obtains the authentication and key agreement protocol (ΑΚΑ') vector, the contract is obtained from the home subscriber server (HSS). Whether to allow access to the EPC;

The AAA server sends the subscribed EPC to the AC/BNG through an EAP Request/AKA' Challenge (EAP-REQ/AKA'-Challenge) message in the EAP authentication process.

In the foregoing solution, before the EAP authentication, the method further includes: obtaining, by the AC or the BNG, a service set identifier (SSID) accessed by the UE, that is, an access point device (AP) or a home gateway supporting the AP function ( RG) determining the SSID accessed by the UE according to the medium access control layer (MAC) address of the accessed UE and the local MAC mapping relationship, and notifying the AC or BNG.

In the above solution, the method further includes: determining, by the AC or the BNG, whether to allow access to the EPC capability indication according to the SSID and/or the local policy.

In the foregoing solution, when the determining network element is an AAA server, the method further includes: obtaining, by the AAA server, whether the EPC capability indication is allowed to be accessed, where:

The AC or the BNG determines whether the EPC capability indication is allowed to be accessed according to the SSID and/or the local policy, and sends the EAP-RES/Identity message in the EAP authentication process to the AAA server; or

The AC or BNG sends the SSID through the EAP-RES/Identity message in the EAP authentication process. And sending to the AAA server, the AAA server determining, according to the SSID and/or the local policy, whether to allow access to the EPC capability indication.

In the above solution, before the AAA server obtains the EPC capability indication, the method further includes: acquiring the SSID by the AC or the BNG, as follows:

The AP or the RG determines the SSID accessed by the UE according to the MAC address of the accessed UE and the local MAC mapping relationship, and notifies the AC or the BNG.

In the above solution, the method further includes: after obtaining the AKA' vector in the EAP authentication process, the AAA server obtains, from the HSS, whether the subscription is allowed to access the EPC.

In the above solution, the decision network element determines whether to allow access to the EPC according to whether the subscription is allowed to access the EPC, and/or whether to allow access to the EPC capability indication, and/or the local policy: when the subscription is allowed to access When the EPC and the EPC capability indication are different, the determining network element, according to the local policy, whether to allow access to the EPC or whether to allow access to the EPC capability indication as the decision whether to allow access to the EPC .

In the above solution, whether the subscription is allowed to access the EPC, or whether the access to the EPC capability indication is allowed, or whether the decision is allowed to access the EPC is: allowing service offloading, denying service offloading, and accessing the EPC, And refuse to divert traffic but allow access to any of the three EPCs.

In the above solution, the determining whether the access to the EPC is allowed to be offloaded, the performing network element includes: an AAA server, a UE, and an AC or a BNG;

Correspondingly, the performing the operation of performing the service access by the network element includes:

The AAA server replies to the EAP-Success message that the EAP authentication succeeds to the UE, and performs a registration process of the UE to the HSS;

After the EAP authentication succeeds, when the AC or the BNG receives the message that the UE requests to allocate an IP address, the AC or the BNG allocates a local IP address to the UE, and performs a split service split.

In the foregoing solution, the determining whether to allow access to the EPC is to deny traffic offloading and accessing In the EPC, the execution network element includes: an AAA server and a UE;

After performing the AKA and AKA'-Notification process, the AAA server replies to the UE with an EAP-Failure message that the EAP authentication failed.

In the foregoing solution, the determining whether the accessing of the EPC is to allow the traffic to be offloaded but the access to the EPC is allowed, the executing network element includes: an AAA server, a UE, and an AC or a BNG;

After the EAP authentication succeeds, the AC/BNG triggers the UE to access the EPC.

The present invention also provides an implementation system for a slotted service offload control, comprising: a decision network element and an execution network element, wherein:

Determining whether to allow access to the EPC according to whether the contracted access to the EPC, and/or whether to allow access to the EPC capability indication, and/or the local policy;

The execution network element is configured to perform an operation of the service access according to whether the determined access to the EPC is allowed.

In the foregoing solution, the determining network element includes: an AC or a BNG, configured to obtain whether the subscription is allowed to access the EPC, and is further configured to acquire an SSID accessed by the UE, and determine, according to the SSID and/or the local policy, Whether to allow access to the EPC capability indication.

In the foregoing solution, the determining network element includes: an AAA server, configured to obtain the indication of whether the EPC capability is allowed to be accessed, and whether the subscription is allowed to access the EPC.

In the above solution, the determining network element is further configured to: when the subscription is allowed to access the EPC and the permission to access the EPC capability indication is different, according to the local policy, whether the subscription is allowed to access the EPC or Whether to allow access to the EPC capability indication as the decision whether to allow access to the EPCo In the foregoing solution, when determining whether to allow access to the EPC to allow traffic to be offloaded, the executing network element includes: an AAA server, a UE, and an AC or a BNG;

An AAA server, configured to reply to the UE with an EAP-Success message that the EAP authentication succeeds, and perform a registration process of the UE to the HSS;

After the EAP authentication is successful, the AC or the BNG is configured to allocate a local IP address to the UE and perform a split service split when receiving a message requesting the UE to allocate an IP address.

In the foregoing solution, the determining whether the access to the EPC is allowed to be used for the traffic distribution and the access to the EPC, the performing network element includes: an AAA server and a UE;

After the AAA server and the UE perform the AKA'-Notification process, the AAA server replies to the UE with an EAP-Failure message that the EAP authentication fails.

In the foregoing solution, the determining whether the access to the EPC is allowed to be used for the service to be diverted but the EPC is allowed to be accessed, the execution network element includes: an AAA server, a UE, and an AC or a BNG;

After the EAP authentication is successful, the AC or BNG is triggered to access the EPC.

The present invention also provides an apparatus for implementing a service split control, including: an obtaining module, configured to obtain whether a subscription is allowed to access an evolved packet core network (EPC), and/or whether an EPC capability indication is allowed to be accessed. , and / or local strategy;

a decision module, configured to determine whether to allow access to the EPCo according to whether the subscription is allowed to access an evolved packet core network (EPC), and/or whether to allow access to an EPC capability indication, and/or a local policy

In the above solution, the acquiring module includes: an AC or a BNG sub-module, configured to obtain whether the subscription is allowed to access the EPC, and is further configured to acquire an SSID accessed by the UE, and determine according to the SSID and/or the local policy. Whether to allow access to the EPC capability indication.

In the above solution, the obtaining module includes: an AAA server submodule, configured to acquire Whether to allow access to the EPC capability indication; also for obtaining whether the subscription is allowed to access the EPC. In the above solution, the decision module is further configured to: when the subscription is allowed to access the EPC and the permission to access the EPC capability indication is different, according to the local policy, whether the subscription is allowed to access the EPC or whether Allow access to the EPC capability indication as the decision whether to allow access to the EPCo

In the foregoing solution, the determining module is further configured to determine whether to allow the access EPC to be any one of the following three types: allowing traffic offloading, denying traffic offloading and accessing the EPC, and denying traffic offloading but allowing access to the EPC.

The method and system for implementing the slotted service offload control proposed by the present invention, the decision network element determines whether to allow access according to whether the subscription is allowed to access the EPC, and/or whether to allow access to the EPC capability indication, and/or the local policy EPC; where: whether the contracted access to the EPC is the willingness of the mobile network, whether the access to the EPC capability indication is allowed, is the willingness of the UE and the TNAN network, and the local policy is the willingness of the TNAN network or the mobile network, thus achieving According to the will of the UE, the willingness of the TNAN network, and the willingness of the mobile network, comprehensively decide whether the UE performs the slotted service offload (ie, whether to allow access to the EPC), or decides whether the UE performs according to the will of the TNAN network or the will of the mobile network. Sewing business diversion. DRAWINGS

1 is a network structure diagram of interworking between a 3GPP network and a non-3GPP network in the prior art; FIG. 2 is a schematic diagram of a structure in which a UE accesses an EPC and performs slotted service offload through a WLAN S2a interface;

3 is a flowchart of a method for implementing a service split control of a slot according to an embodiment of the present invention; FIG. 4 is a flowchart of a method for implementing a service split control with slotted according to a second embodiment of the present invention; FIG. 6 is a schematic structural diagram of an implementation system of a service split control according to the present invention. DETAILED DESCRIPTION The basic idea of the method for implementing the slotted service offload control provided by the present invention is: whether the decision network element allows access to the EPC according to the subscription, and/or whether to allow access to the EPC capability indication, and/or the local policy, Determining whether to allow access to the EPC; performing the operation of the service access according to whether the network element is allowed to access the EPC according to the decision.

Whether the above-mentioned contracting is allowed to access the EPC may also be referred to as a contracted slotted service offloading permission; whether to allow access to the EPC capability indication may also be referred to as a slotted service offloading capability indication; determining whether to allow access to the EPC may also be called In order to determine whether there is a segregated business diversion.

The implementation of the above scheme can be roughly divided into the following two situations:

1. When the decision network element is an Access Controller (AC) or a Broadband Network Gateway (BNG) that supports AC functions:

Whether the AC or BNG obtains the contract to allow access to the EPC is:

In the process of the Authenticated Authentication Protocol (EAP) authentication, the AAA server obtains the authentication and key agreement protocol (ΑΚΑ') vector, and obtains whether the contract is allowed to access the EPC to the HSS;

The AAA server, through the EAP request /AKA in the EAP authentication process, challenges ( EAP-REQ/AKA'-Challenge ) message whether the signed access is allowed to be sent to the AC/BNG.

Before EAP authentication, the AC or BNG needs to obtain the Service Set Identifier (SSID) of the UE access, which is: an access point device (AP) or an AP gateway-enabled home gateway (Residential Gateway, RG) determining the SSID accessed by the UE according to the medium access control layer (MAC) address of the accessed UE and the local MAC mapping relationship, and notifying the AC or the BNG;

Further, the AC or BNG determines whether to allow access to the EPC capability indication based on the SSID and/or the local policy.

After that, the AC or BNG can be allowed to access the EPC according to the contract, and/or The access EPC capability indication, and/or local policy determines whether access to the EPC is allowed.

2. When the decision network element is an AAA server:

There are two ways for the AAA server to obtain access to EPC capability indications:

First, the AP or the RG determines the SSID accessed by the UE according to the MAC address of the accessed UE and the local MAC mapping relationship, and notifies the AC or the BNG; the AC or the BNG determines whether to allow access to the EPC according to the SSID and/or the local policy. Instruct, and send the EAP-RES/Identity message in the EAP authentication process to the AAA server;

The AP or the RG determines the SSID that the UE accesses according to the MAC address of the accessed UE and the local MAC mapping relationship, and informs the AC or BNG; the AC or BNG passes the EAP-RES/Identity message in the EAP authentication process to the SSID. Sended to the AAA server, the AAA server determines whether to allow access to the EPC capability indication based on the SSID and/or the local policy.

The AAA server obtains whether the subscription is allowed to access the EPC. In the EAP authentication process, after the AAA server obtains the AKA' vector, the AAA server obtains the contract from the HSS to allow access to the EPC.

The AAA server can then decide whether to allow access to the EPC based on whether the subscription is allowed to access the EPC, and/or whether access to the EPC capability indication, and/or local policy is allowed.

For the two scenarios of the above-mentioned decision network element: Specifically, the decision network element determines whether the access to the EPC is allowed to be: when the subscription is allowed to access the EPC and the access EPC capability indication is not the same, the decision network element is based on the local The policy determines whether to allow access to the EPC or whether to allow access to the EPC capability indication as a decision whether to allow access to the EPC.

In some cases, the decision network element may also decide whether to allow access to the EPC according to whether the subscription is allowed to access the EPC or whether to allow access to the EPC capability indication, that is, whether the decision network element directly permits the access to the EPC. Or whether to allow access to the EPC capability indication as a decision whether to allow access to the EPCo

Whether the contract is allowed to access the EPC, or whether to allow access to the EPC capability indication, or whether to allow access to the EPC, is: Allow traffic to be diverted, refuse traffic diversion, and access EPC and Reject traffic splitting but allow access to any of the three EPCs.

When the service is allowed to be offloaded, the performing network element includes: an AAA server, a UE, and an AC or a BNG; and the performing the operation of the network element to perform the service access includes: the AAA server returns an EAP-Success message that the EAP authentication succeeds to the UE, and performs the UE to the HSS. After the EAP authentication succeeds, when the AC or the BNG receives the message that the UE requests to allocate an IP address, the UE allocates a local IP address and performs a split service split.

The operation network element includes: an AAA server and a UE; and the performing the operation of the network element to perform the service access includes: After performing the AKA, -Notification process, the AAA server returns the EAP of the EAP authentication failure to the UE. Failure message.

The operation network element includes: an AAA server, a UE, and an AC or a BNG. The operation of performing the network element to perform the service access includes: the AAA server replies to the EAP-Success that the EAP authentication succeeds to the UE. The message, and the registration process of the UE is performed to the HSS; after the EAP authentication succeeds, the AC/BNG triggers the UE to access the EPC.

The solution of the present invention will be described below by way of specific embodiments.

Embodiment 1 This embodiment is a specific description of the above case 1. As shown in Figure 3, the control flow of the seamed business distribution includes:

Step 301: The UE selects an SSID access according to the wireless mechanism of the WLAN, and accesses the corresponding AP/RG (the AP or the RG supporting the AP function, and if it is an AP, the corresponding AC, if it is the RG, the corresponding BNG).

In step 302, the AP/RG can know the SSID accessed by the UE according to the Medium Access Control Layer (MAC) address of the UE and the local MAC mapping relationship, and notify the AC of the SSID accessed by the UE by using a message. BNG. Specifically, the Control and Provisioning of Wireless Access Points (CAPWAP) message may be extended to carry the SSID accessed by the UE, or a special message may be added to send the SSID accessed by the UE. Step 303: The AC/BNG, as an Extensible Authentication Protocol (EAP) Authenticator, triggers an EAP authentication process to the UE, and first sends an EAP Request/Identity (EAP-REQ/Identity) message to the UE.

Step 304: The UE returns an EAP Response/Identity (EAP-RES/Identity) message to the AC/BNG.

Step 305: The AC/BNG sends an EAP-RES/Identity message to the AAA server through an Authentication, Authorization, and Accounting (AAA) proxy.

Step 306, the AAA server sends an EAP request/ΑΚΑ' identity (EAP-REQ/AKA'-Identity) message to the AC/BNG through the AAA proxy, and the AC/BNG forwards the message to the UE;

The UE returns an EAP Response / AKA, Identity (EAP-RES/AKA'-Identity) message to the AC/BNG, and the AC/BNG sends the message to the AAA server through the AAA proxy.

Step 307: After receiving the EAP-RES/AKA'-Identity message, the AAA server requests an authentication and Key Agreement (AKA') vector from the HSS. At this time, the HSS first determines the AAA server registered by the UE. Whether the AAA server requesting the vector is the same, if yes, the HSS returns a vector to the AAA server; if not, the HSS returns a vector to the AAA server registered by the UE.

Step 308: After obtaining the AKA' vector, the AAA server obtains the information about the UE subscription from the HSS, which mainly includes: whether the subscription is allowed to access the EPC, and the HSS carries the information to the AAA server through the return profile message.

Step 309: The AAA server sends an EAP Request/ΑΚΑ' Challenge (EAP-REQ/AKA, -Challenge) message to the AC/BNG through the AAA proxy, where the bearer is allowed to access the EPC; the AC/BNG will EAP-REQ/AKA The -Challenge message is sent to the UE. In this case, the EAP-REQ/AKA'-Challenge message can carry the subscription to allow access to the EPC (in this case, the UE does not allow access to the EPC for processing the subscription), or not carry.

In addition, after AC/BNG receives the EAP-REQ/AKA'-Challenge message, it is based on the contract. Whether to allow access to the EPC, and/or the SSID and/or local policy accessed by the UE, whether to allow access to the EPCo

It should be noted that whether access to the EPC is allowed includes the following three cases: Allowing traffic to be offloaded; Denying traffic offloading and accessing the EPC; Denying traffic offloading but allowing access to the EPC. The above three cases can be represented by corresponding values, for example: 1 means that the service is allowed to be offloaded; 2 means that the service is offloaded and accesses the EPC; and 3 means that the service is offloaded but allowed to access the EPC. Of course, it can also be represented by defining other forms of values.

In addition, the AC/BNG decides whether to allow access to the EPC according to whether the contracted access to the EPC, and/or the SSID and/or local policy of the UE access is allowed:

The AC/BNG can decide whether to allow access to the EPC according to whether the subscription is allowed or not, and whether the subscription is allowed to access the EPC as the final decision whether to allow access to the EPC;

The AC/BNG can also be determined according to the SSID of the UE access. For example, the AC/BNG is configured with the SSID corresponding to the three conditions of the EPC. The AC/BNG can know the SSID according to the SSID accessed by the UE. Whether the access to the EPC is allowed, may be referred to as whether to allow access to the EPC capability indication; whether the AC/BNG directly allows access to the EPC capability indication as the final decision whether to allow access to the EPC;

The AC/BNG can also be determined according to whether the subscription is allowed to access the EPC, whether the access to the EPC capability indication and the local policy are allowed, for example: when the subscription is allowed to access the EPC and whether the access to the EPC capability indication conflict is allowed (ie, no The same can be performed according to the configuration of the AC/BNG local policy, whether the contracted access to the EPC is allowed as the decision result, or whether the access to the EPC capability indication is allowed as the decision result.

AC/BNG can also decide whether to allow access to EPC based on local policies.

Step 310: The UE returns an EAP Response/ΑΚΑA Challenge (EAP-RES/AKA'-Challenge) message to the AC/BNG, and the AC/BNG carries the determined EPC-RES/AKA'-Challenge message to allow access to the EPC. Send to AAA service through AAA proxy Device.

The AAA server performs the corresponding service access operation processing according to whether it is allowed to access the EPC, and can be divided into the following three situations:

scene 1 :

In step 311-312, if the decision is made to allow access to the EPC to allow traffic to be offloaded, the AAA server replies with an EAP-Success message (EAP success message) to the UE, indicating that the EAP authentication is successful. Moreover, the AAA server performs a registration process of the UE to the HSS, and the AAA server saves the access session information related to the UE.

Step 313: After the EAP authentication succeeds, when the AC/BNG receives the message that the UE requests to allocate an IP address, the AC/BNG allocates an IP address to the UE according to the decision whether to allow access to the EPC (allowing traffic splitting), and performs an IP address locally. Sewing business diversion.

Scene 2:

Step 311: If the deciding whether to allow the access EPC to deny the traffic offloading and accessing the EPC, the AKA, the notification (AKA, -Notification) process is performed between the AAA server and the UE, and the AAA server may notify the UE through the process. The result of the failure.

Step 312: After performing the AKA, -Notification process, the AAA server replies to the UE with an EAP-Failure message (EAP failure message).

At this point, the UE is terminated because the EAP authentication fails.

This scenario may occur when a malicious UE requests an SSID that only allows traffic to be offloaded or accesses the EPC. However, the contracted traffic offload indication is exactly the opposite of what is requested, and therefore, the EAP authentication fails.

Scene 3:

In steps 311 312, the AAA server replies with an EAP-Success message to the UE, indicating that the EAP authentication is successful, if the EPC is allowed to access the EPC to allow the traffic to be diverted. Moreover, the AAA server performs the registration process of the UE to the HSS, and the AAA server guarantees The access session information related to the UE is stored.

Step 313: After the EAP authentication succeeds, the AC/BNG triggers the UE to access the EPC. Embodiment 2 This embodiment is a specific description of the above case 2. As shown in Figure 4, the implementation process of the seamed traffic distribution control includes:

Step 401: The UE selects an SSID access according to the wireless mechanism of the WLAN, and accesses the corresponding AP/RG.

Step 402: The AP/RG can know the SSID accessed by the UE according to the MAC address of the UE and the local MAC mapping relationship, and notify the AC/BNG of the SSID accessed by the UE by using a message.

The AC/BNG determines whether to allow access to the EPC capability indication based on the SSID accessed by the UE. Steps 403 to 404 are the same as steps 303 to 304, and are not described herein again.

Step 405: After receiving the EAP-RES/Identity message sent by the UE, the AC/BNG carries the EPC capability indication in the message, and sends the EPC capability indication to the AAA server through the AAA proxy.

Steps 406 to 407 are the same as steps 306 to 307, and are not described herein again.

Step 408: After obtaining the AKA' vector, the AAA server obtains the information about the UE subscription from the HSS, including: whether the subscription is allowed to access the EPC, and the HSS carries the information to the AAA server through the return profile message.

Further, the AAA server decides whether to allow access to the EPC according to whether the subscription allows access to the EPC, and/or whether access to the EPC capability indication and/or local policy decision is allowed.

The AAA server can decide whether to allow access to the EPC according to whether the subscription is allowed, and whether the subscription is allowed to access the EPC as the final decision whether to allow access to the EPC;

The AAA server may also decide whether to allow access to the EPC capability indication according to whether to allow access to the EPC capability indication, and whether to allow access to the EPC capability indication as a final decision whether to allow access to the EPC;

The AAA server can also decide whether to allow access to the EPC, whether to allow access to the EPC capability indication, and the local policy. Specifically: when the subscription is allowed to access the EPC and whether access to the EPC capability indication conflict is allowed (ie, no The same), according to the AAA server The related configuration of the local policy is performed, whether the contracted access to the EPC is allowed as the decision result, or whether the access to the EPC capability indication is allowed as the decision result.

The AAA server can also decide whether to allow access to the EPC based on the local policy.

Step 409, the AKA, -Challenge process is completed between the AAA server and the UE. specific:

The AAA server sends an EAP-REQ/AKA'-Challenge message to the AC/BNG through the AAA proxy, which carries the decision to allow access to the EPC. AC/BNG will

The EAP-REQ/AKA'-Challenge message is sent to the UE. In this case, the EAP-REQ/AKA'-Challenge message can carry the decision whether to allow access to the EPC. In this case, the UE does not allow access to the EPC. It can be processed or not.

The UE returns an EAP-RES/AKA'-Challenge message to the AC/BNG, AC/BNG will

The EAP-RES/AKA'-Challenge message is sent to the AAA server through the AAA proxy.

The subsequent process is the same as scenario 1, scenario 2, or scenario 3, and is not mentioned here.

In the third embodiment, as shown in FIG. 5, the process is basically the same as the process in FIG. 4, and the difference is: in step 505, after receiving the EAP-RES/Identity message sent by the UE, the AC/BNG carries the UE access message in the message. SSID, instead of whether to allow access to EPC capability indications.

Correspondingly, in step 508, after the AAA server obtains whether the subscription is allowed to access the EPC, the AAA server decides whether to allow access to the EPC according to whether the subscription is allowed to access the EPC, and/or the SSID and/or the local policy accessed by the UE, specifically of:

The AAA server can also be determined according to the SSID of the UE access. For example, the AAA server locally configures the SSID corresponding to the three conditions for accessing the EPC. The AAA server can know whether the SSID is allowed according to the SSID accessed by the UE. The case of accessing the EPC may be referred to as whether to allow access to the EPC capability indication; the AAA server directly determines whether to allow access to the EPC capability indication as the final decision whether to allow access to the EPC; The AAA server can also make decisions according to whether the subscription is allowed to access the EPC, whether to allow access to the EPC capability indication, and the local policy, for example: when the subscription is allowed to access the EPC and whether the access to the EPC capability indication conflict is allowed (ie, not the same) According to the configuration of the local policy of the AAA server, whether the contracted access to the EPC is allowed as the decision result, or whether the access to the EPC capability indication is allowed as the decision result.

The above embodiment is mainly described for the AP/RG as the bridge mode. The same applies to the scenario where the AP/RG is in the route mode. In this case, the AP/RG replaces the AC/BNG to perform the corresponding operations, including: EAP certifiers, as well as decision-making operations that allow for the segregation of business.

In order to implement the above method, the present invention further provides a system for implementing a service split control with a seam, as shown in FIG. 6, comprising: a decision network element and an execution network element, where:

a decision network element, configured to determine whether to allow access to the EPC according to whether the contract is allowed to access the EPC, and/or whether to allow access to the EPC capability indication, and/or the local policy;

The operation network element is configured to perform an operation of accessing the service according to whether the access is allowed to access the EPC. The decision network element includes: AC or BNG, which is used to obtain whether the subscription is allowed to access the EPC; and is used to obtain the SSID accessed by the UE, and determine whether to allow access to the EPC capability indication according to the SSID and/or the local policy.

The decision network element includes: an AAA server, configured to obtain whether to allow access to the EPC capability indication; and also used to obtain whether the subscription is allowed to access the EPC.

The decision network element is further configured to: when the subscription is allowed to access the EPC and whether the access to the EPC capability indication is different, according to the local policy, whether the subscription is allowed to access the EPC or whether the access to the EPC capability indication is allowed is determined. Whether to allow access to the EPC.

When determining whether to allow access to the EPC to allow traffic to be offloaded, the executing network element includes: an AAA server, a UE, and an AC or BNG;

An AAA server, configured to reply to the EAP-Success message that the EAP authentication succeeds to the UE, and Performing a registration process of the UE to the HSS;

Determining whether to allow access to the EPC to deny traffic and access the EPC, the execution network element includes: an AAA server and a UE;

Determining whether to allow access to the EPC to deny traffic but allow access to the EPC, the execution network element includes: an AAA server, a UE, and an AC or BNG;

The present invention also provides an apparatus for implementing a service split control of a slot. Preferably, the apparatus is applicable to the decision network element described above, and the apparatus includes:

An obtaining module, configured to obtain whether the subscription is allowed to access an evolved packet core network (EPC), and/or whether to allow access to an EPC capability indication, and/or a local policy;

The decision module is configured to determine whether to allow access to the EPC according to whether the contracted access to the evolved packet core network (EPC), and/or whether to allow access to the EPC capability indication, and/or the local policy.

Preferably, the obtaining module includes: an AC or BNG sub-module, configured to obtain whether the subscription is allowed to access the EPC; and is further configured to acquire an SSID accessed by the UE, and determine whether to allow access to the EPC capability indication according to the SSID and/or the local policy. .

Or,

The obtaining module includes: an AAA server sub-module, configured to obtain whether to allow access to the EPC capability indication, and also used to obtain whether the subscription is allowed to access the EPC. The decision module is further configured to: when the subscription is allowed to access the EPC and whether the access EPC capability indication is different, according to the local policy, whether the subscription is allowed to access the EPC or whether the access to the EPC capability indication is allowed as the decision is Allow access to the EPC.

The decision module is also used to determine whether to allow access to the EPC in any of the following three types: Allow traffic offload, Deny traffic offload and access EPC, and Deny traffic offload but allow access to EPC.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

A method for implementing a service split control of a slotted service, comprising: determining, by a decision network element, whether to allow access to an evolved packet core network (EPC), and/or whether to allow access to an EPC capability indication, And/or local policy to determine whether to allow access to the EPC;

The performing network element performs the operation of the service access according to whether the decision is allowed to access the EPC.

The method for implementing a service split control according to claim 1, wherein the method is: when the decision network element is an access control device (AC) or a broadband network gateway (BNG) supporting an AC function, the method The method further includes: obtaining, by the AC or the BNG, whether the subscription is allowed to access the EPC, where:

The method for implementing the serviced traffic distribution control according to claim 2, wherein before the EAP authentication, the method further comprises: obtaining, by the AC or the BNG, a service set identifier (SSID) accessed by the UE. , for:

The access point device (AP) or the AP function-enabled home gateway (RG) determines the SSID accessed by the UE according to the medium access control layer (MAC) address of the accessed UE and the local MAC mapping relationship, and informs the AC or BNG.

The method for implementing the serviced traffic distribution control according to claim 3, wherein the method further comprises: determining, by the AC or BNG, whether to allow access to the EPC according to the SSID and/or the local policy. Instructions.

5. The method for implementing a service split control according to claim 1, wherein: When the determining network element is an AAA server, the method further includes: obtaining, by the AAA server, whether the EPC capability indication is allowed to be accessed, where:

The AC or the BNG determines whether to allow access to the EPC capability indication according to the SSID and/or the local policy, and sends the EAP-RES/Identity message in the EAP authentication process to the AAA server; or

The AC or BNG sends the SSID to the AAA server through the EAP-RES/Identity message in the EAP authentication process, and the AAA server determines whether the EPC capability indication is allowed to be accessed according to the SSID and/or the local policy.

The method for implementing the serviced traffic distribution control according to claim 5, wherein before the AAA server obtains the indication of whether the EPC capability is allowed to be accessed, the method further includes: acquiring the SSID by the AC or the BNG. , for:

The method for implementing the service split control according to claim 5 or 6, wherein the method further comprises: after the AAA server obtains the AKA' vector, obtaining the contract from the HSS in the EAP authentication process. Whether to allow access to the EPC.

8. The method for implementing slotted traffic offload control according to claim 1, wherein the decision network element is allowed to access the EPC according to the subscription, and/or whether to allow access to the EPC capability indication, and/or the local policy. , decide whether to allow access to the EPC as:

When the signing is allowed to access the EPC and the access to the EPC capability indication is not the same, the determining network element, according to the local policy, whether the contracted access to the EPC or the access to the EPC capability indication is allowed Whether the decision allows access to the EPC.

The method for implementing the serviced traffic distribution control according to claim 8, wherein whether the subscription is allowed to access the EPC, or whether the access to the EPC capability indication is allowed, or whether the decision is allowed Access to the EPC, as follows: Allow traffic to be offloaded, refuse traffic splitting and pick up Enter EPC, and reject traffic splitting but allow access to EPC.

The implementation method of the slotted service offloading control according to claim 9, wherein the performing network element includes: an AAA server, a UE, and an AC, if the determined access to the EPC is allowed to be offloaded. Or BNG;

The implementation method of the slotted service offloading control according to claim 9, wherein the determining the accessing EPC is to deny the traffic offloading and accessing the EPC, the executing network element comprises: an AAA server And UE;

The method for implementing the service-sharing control of the slotted service according to claim 9, wherein, when the determining whether the access EPC is allowed to be used for the traffic-distribution but the access to the EPC is allowed, the executing network element includes: Server, UE, and AC or BNG;

A system for implementing a service split control with a seam, comprising: a decision network element and an execution network element, wherein:

The decision network element is configured to allow access to the EPC according to the subscription, and/or whether to allow access Entering an EPC capability indication, and/or a local policy, determining whether to allow access to the EPC; and the executing network element, configured to perform an operation of the service access according to the determined whether to allow access to the EPC.

The implementation system of the slotted service traffic distribution control according to claim 13, wherein the decision network element comprises: an AC or a BNG, configured to obtain whether the subscription is allowed to access the EPC; The SSID accessed by the UE, and determining whether to allow access to the EPC capability indication according to the SSID and/or the local policy.

The implementation system of the slotted service offloading control according to claim 13, wherein the decision network element comprises: an AAA server, configured to acquire whether the EPC capability indication is allowed to be accessed, and is also used to obtain a subscription Whether to allow access to the EPC.

The implementation system of the slotted service offload control according to claim 14 or 15, wherein the decision network element is further configured to: when the subscription is allowed to access the EPC, and whether the access is allowed When the EPC capability indications are different, according to the local policy, whether the subscription is allowed to access the EPC or whether the access EPC capability indication is allowed as the decision is allowed to access the EPC.

17. The system for implementing split service split control according to claim 16, wherein:

Determining whether to allow access to the EPC to allow traffic to be offloaded, the execution network element includes: an AAA server, a UE, and an AC or BNG;

18. The system for implementing a split traffic split control according to claim 16, wherein: Determining whether to allow access to the EPC to deny traffic and access the EPC, the performing network element includes: an AAA server and a UE;

19. The system for implementing a service split control according to claim 16 wherein:

Determining whether to allow access to the EPC to deny traffic but to allow access to the EPC, the executing network element includes: an AAA server, a UE, and an AC or BNG;

A device for implementing a service split control, comprising: an obtaining module, configured to obtain whether a subscription is allowed to access an evolved packet core network (EPC), and/or whether access to an EPC is allowed. Indication, and/or local policy;

The device for implementing the service-sharing control according to claim 20, wherein the acquiring module comprises: an AC or BNG sub-module, configured to obtain whether the subscription is allowed to access the EPC; Obtaining an SSID accessed by the UE, and determining, according to the SSID and/or the local policy, whether to allow access to the EPC capability indication.

The apparatus for implementing the service-sharing control according to claim 20, wherein the obtaining module comprises: an AAA server sub-module, configured to obtain whether the EPC capability indication is allowed to be accessed; Whether the contract is allowed to access the EPC.

23. The apparatus for implementing a service split control according to claim 21 or 22, The determining module is further configured to: when the subscription is allowed to access the EPC and the permission to access the EPC capability indication is different, according to the local policy, whether the subscription is allowed to access the EPC or whether Allow access to the EPC capability indication as the decision whether to allow access to the EPCo

The device for implementing the traffic distribution control according to claim 23, wherein the decision module is further configured to determine whether the access EPC is allowed to be any one of the following three types: , Denying traffic offloading and accessing the EPC and denying traffic offloading but allowing access to the EPC.