Visited network access control method, device, electronic device and storage medium

Abstract

The present disclosure provides a method, device, electronic device and storage medium for access control of a visited network, and relates to the fields of network technology and security technology. The method comprises: a P‑CSCF receives a registration request sent by a user device through a visited network, and the registration request includes a visited network identifier and a user device identifier; the P‑CSCF determines whether the user device can access the P‑CSCF through the visited network based on the access control policy according to the visited network identifier and the user device identifier information; if so, the P‑CSCF allows the user device to access the P‑CSCF through the visited network; if not, the P‑CSCF returns a failure response message to the user device through the visited network. The embodiments of the present disclosure can automatically control the user to access the home network through the visited network through the P‑CSCF network element.

Description

Background Art

[0002] VoLTE (Voice over Long-Term Evolution) is a high-speed wireless communication standard for mobile phones and data terminals. It is based on the IMS (IP Multimedia Subsystem) network and uses special configuration files for the control plane and the media plane of voice services on LTE (Long Term Evolution). This allows voice services at the control plane and media plane to be transmitted as data streams in the LTE data bearer network, without the need to maintain and rely on traditional circuit switching networks.

[0003] At present, the HSS (Home Subscriber Server) of the home network is used to uniformly control international roaming access, but this approach is heavy and complex for Chinese operators with a large number of HSSs. Some overseas operators that have not signed a VoLTE roaming agreement mistakenly send the VoLTE service request signaling of roaming users back to their home IMS network due to irregular network element configuration, which has a certain impact on the IMS network of the roaming user's home.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a method, device, electronic device and storage medium for controlling access to a visited network, which at least to some extent overcome the problem that controlling the visited access through the HSS of the home network is labor-intensive and error-prone.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for controlling access to a visited network is provided, characterized by comprising:

[0008] The proxy call session control function P-CSCF receives a registration request sent by the user equipment through the visited network, wherein the registration request includes a visited network identifier and a user equipment identifier;

[0009] The P-CSCF determines, based on the access control policy, whether the user equipment can access the P-CSCF through the visited network according to the visited network identifier and the user equipment identifier information;

[0010] If so, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; if not, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0011] In one embodiment of the present disclosure, the control strategy includes:

[0012] When the visited network enables roaming services and does not need to differentiate customer groups, the P-CSCF allows user equipment to access the P-CSCF through the visited network.

[0013] In one embodiment of the present disclosure, the control strategy further includes:

[0014] When the visited network activates roaming services and needs to distinguish customer groups, and allows user equipment to access the P-CSCF, the P-CSCF allows the user equipment to access the P-CSCF through the visited network;

[0015] When the visited network activates roaming services and needs to distinguish customer groups, and does not allow user equipment to access the P-CSCF, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0016] In one embodiment of the present disclosure, the control strategy further includes:

[0017] When the visited network does not enable roaming services and does not perform roaming debugging, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0018] In one embodiment of the present disclosure, the control strategy further includes:

[0019] When the visited network does not provide roaming services and is in roaming debugging, and the user equipment is a test card, the P-CSCF allows the user equipment to access the P-CSCF through the visited network;

[0020] When the visited network does not enable roaming services and performs roaming debugging, and the user equipment is not a test card, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0021] In one embodiment of the present disclosure, the P-CSCF receives a registration request sent by a user equipment through a visited network, further comprising:

[0022] The user equipment sends a first registration request to the visited network; the registration request includes: a user equipment identifier;

[0023] The visited network receives the first registration request and sends a registration request to the P-CSCF.

[0024] In one embodiment of the present disclosure, before the P-CSCF receives a registration request sent by the user equipment through the visited network, the method further includes:

[0025] Acquire login information of a user device logging into a visited network, wherein the login information includes an identifier of the visited network;

[0026] According to the login information, the home network where the P-CSCF is located sends the user subscription data to the visited network;

[0027] The user equipment establishes connections with the visited network and the home network.

[0028] In one embodiment of the present disclosure, the visited network identifier includes: a mobile country code and a mobile network code.

[0029] According to another aspect of the present disclosure, there is also provided a visited network access control device, including:

[0030] A registration request module, the P-CSCF receives a registration request sent by a user equipment through a visited network, wherein the registration request includes a visited network identifier and a user equipment identifier;

[0031] An access judgment module, wherein the P-CSCF judges whether the user equipment can access the P-CSCF through the visited network based on the visited network identifier and the user equipment identifier information and based on the access control policy;

[0032] Access permission module: P-CSCF allows user equipment to access P-CSCF through the visited network;

[0033] Failure response module: P-CSCF returns failure response information to the user equipment through the visited network.

[0034] According to another aspect of the present disclosure, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned visited network access control methods by executing the executable instructions.

[0035] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the visited network access control method described above is implemented.

[0036] The present disclosure provides a method, device, electronic device and storage medium for access control of a visited network, including: a P-CSCF receives a registration request sent by a user device through a visited network, the registration request including a visited network identifier and a user device identifier; the P-CSCF determines whether the user device can access the P-CSCF through the visited network based on the visited network identifier and the user device identifier information and based on the access control policy; if so, the P-CSCF allows the user device to access the P-CSCF through the visited network; if not, the P-CSCF returns a failure response message to the user device through the visited network. The user can be automatically controlled to access the home network through the visited network through the P-CSCF network element.

[0037] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0039] Figure 1 A flow chart of a visited network access control method according to an embodiment of the present disclosure is shown;

[0040] Figure 2 A flow chart of a user equipment login connection method in an embodiment of the present disclosure is shown;

[0041] Figure 3 A flow chart of a method for a P-CSCF to receive a registration request sent by a user equipment through a visited network in an embodiment of the present disclosure is shown;

[0042] Figure 4 A flow chart of a method for performing access control through an international bureau P-CSCF in an embodiment of the present disclosure is shown;

[0043] Figure 5 A schematic diagram of an access control strategy in an embodiment of the present disclosure is shown;

[0044] Figure 6 A flowchart of an optional visited network access control method in an embodiment of the present disclosure is shown;

[0045] Figure 7 A schematic diagram of a visited network access control device in an embodiment of the present disclosure is shown; and

[0046] Figure 8A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0047] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0048] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0049] For ease of understanding, several terms involved in the present disclosure are explained below:

[0050] VoLTE (Voice over Long-Term Evolution) is a high-speed wireless communication standard for mobile phones and data terminals. It is based on the IMS (IP Multimedia Subsystem) network and uses special configuration files for the control plane and the media plane of voice services on LTE (Long Term Evolution).

[0051] SIP (Session initialization Protocol) is a multimedia communication protocol developed by IETF (Internet Engineering Task Force).

[0052] APN (Access Point Name) is a parameter that users must configure when accessing the Internet through their mobile phones. It determines the access method used by the user's mobile phone to access the network.

[0053] QoS (Quality of Service) refers to a network's ability to use various basic technologies to provide better service capabilities for specified network communications.

[0054] PDN (Public Data Network) is a communication network that provides data communication services to the public.

[0055] MCC (Mobile Country Code) consists of three digits and is used to identify a country, but a country can be assigned multiple MCCs.

[0056] The MNC (Mobile Network Code) consists of two to three digits; together with the MCC, it uniquely identifies a mobile network provider.

[0057] MME (Mobility Management Entity) is responsible for the positioning and paging process of mobile user equipment.

[0058] The HSS (Home Subscriber Server) supports the main user database of the IMS network entity used to handle calls or sessions.

[0059] SGW (Serving GateWay) is responsible for signaling-plane related functions such as mobility management and user access control, as well as forwarding user data.

[0060] PGW (PDN GateWay) provides user session management and bearer control, data forwarding, IP address allocation, and non-3GPP user access functions. It is the anchor point for 3GPP access and non-3GPP access to the public data network PDN.

[0061] 3GPP access refers to the wireless access technology from the 3GPP standard family; non-3GPP access refers to the wireless access technology outside the 3GPP standard family.

[0062] CSCF (Call Session Control Function) is the core of the IMS network and is mainly responsible for processing signaling control during multimedia call sessions.

[0063] The present exemplary implementation is described in detail below with reference to the accompanying drawings and embodiments.

[0064] The embodiment of the present disclosure provides a method for controlling access to a visited network, which can be executed by any electronic device with computing and processing capabilities.

[0065] Figure 1A flow chart of a visited network access control method according to an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the visited network access control method provided in the embodiment of the present disclosure includes the following steps:

[0066] S102, the proxy call session control function P-CSCF receives a registration request sent by the user equipment through the visited network, where the registration request includes a visited network identifier and a user equipment identifier.

[0067] In one embodiment, the visited network identifier includes but is not limited to a mobile country code MCC and a mobile network code MNC; the user equipment identifier includes but is not limited to an IMPI.

[0068] It should be noted that VoLTE (Voice over Long-Term Evolution) is a high-speed wireless communication standard for mobile phones and data terminals. It is based on the IMS (IP Multimedia Subsystem) network and uses special configuration files for the control plane and the media plane of voice services on LTE (Long Term Evolution). This enables the voice services at the control plane and media plane to be transmitted as data streams in the LTE data bearer network, without the need to maintain and rely on the traditional circuit switching network.

[0069] In one embodiment, the registration request includes but is not limited to an IMS registration request, and IMS registration is now taken as an example for introduction; the P-CSCF receives the IMS registration request sent by the user equipment through the visited network, and implements the use of the VoLTE service after the IMS registration.

[0070] S104, the P-CSCF determines whether the user equipment can access the P-CSCF through the visited network based on the visited network identifier and the user equipment identifier information and the access control policy.

[0071] S106: If yes, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; if no, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0072] In the above embodiment, the P-CSCF determines whether the user equipment can access the P-CSCF through the visited network based on the access control policy according to the visited network identification and the user equipment identification information, and can implement control of roaming users accessing the home network through the visited network at a single point on the P-CSCF, thereby reducing workload and improving accuracy.

[0073] In one embodiment, the control strategy includes:

[0074] When the visited network enables roaming services and does not need to differentiate customer groups, the P-CSCF allows user equipment to access the P-CSCF through the visited network;

[0075] When the visited network activates roaming services and needs to distinguish customer groups, and allows user equipment to access the P-CSCF, the P-CSCF allows the user equipment to access the P-CSCF through the visited network;

[0076] When the visited network activates roaming services and needs to distinguish customer groups, and does not allow user equipment to access the P-CSCF, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0077] It should be noted that roaming service means that a user can leave the home network where he is registered and enter a network in another service area and continue to use his mobile phone for communication; the home network is the mobile communication network to which the mobile user device belongs to activate telecommunications services; the visited network is the mobile communication network that the mobile user device attempts to log in and obtain services when roaming.

[0078] It should be noted that whether the visited network has roaming services and whether it needs to distinguish customer groups is determined based on the visited network identifier; when the visited network has roaming services, the visited network does not need to distinguish customer groups, and the P-CSCF allows user equipment to access the P-CSCF through the visited network; when the visited network has roaming services, the visited network needs to distinguish customer groups, and whether the P-CSCF allows user equipment to access the P-CSCF through the visited network is determined based on the user equipment identifier.

[0079] It should be noted that P-CSCF allows user equipment to access P-CSCF through the visited network. Then P-CSCF sends the relevant SIP registration message and completes the subsequent IMS registration. After the IMS registration is completed, VoLTE calls can be made. When the user tries to call for the first time, the user equipment sends a REGISTER message to P-CSCF through the visited network. The service call session control function S-CSCF learns that the user information is not in the database and returns a 401 Unauthorized query message to the user equipment, which contains the token required for security authentication. The user equipment encrypts the user ID and password according to the security authentication token and reports it to the S-CSCF again with a REGISTER message. The S-CSCF decrypts the user information in the REGISTER message, and after authentication is legal, registers the user information in the database and returns a response message 200 OK to the user equipment to complete the registration.

[0080] It should be noted that SIP (Session initialization Protocol) is a multimedia communication protocol developed by IETF (Internet Engineering Task Force).

[0081] It should be noted that the P-CSCF returns a failure response message to the user equipment through the visited network; the failure response message is a 403 Forbidden response, in which the value of the Warning header field carried is Roaming Restricted.

[0082] In another embodiment, the control strategy further comprises:

[0083] When the visited network does not enable roaming services and does not perform roaming debugging, the P-CSCF returns a failure response message to the user equipment through the visited network;

[0084] When the visited network does not provide roaming services and is in roaming debugging, and the user equipment is a test card, the P-CSCF allows the user equipment to access the P-CSCF through the visited network;

[0085] When the visited network does not enable roaming services and performs roaming debugging, and the user equipment is not a test card, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0086] It should be noted that roaming debugging refers to the joint debugging of roaming services by the home network and the visited network; user equipment includes but is not limited to mobile phone cards and phone cards; test cards refer to user equipment in test status.

[0087] It should be noted that the P-CSCF identifies the visited network logged in by the user according to the mobile country code MCC and the mobile network code MNC carried in the PANI header field utran-cell-id-3gpp parameter value in the registration message.

[0088] In the above embodiment, based on the information of the visited network and the user equipment, the user equipment is controlled to access the P-CSCF through the visited network, and the roaming user can be controlled to access the home network through the visited network at a single point on the P-CSCF, thereby reducing the workload and improving the accuracy.

[0089] In one embodiment of the present disclosure, Figure 2 A flow chart of a user device login connection method in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, before the P-CSCF receives the registration request sent by the user equipment through the visited network, the method further includes:

[0090] S202, obtaining login information of a user device logging into a visited network, where the login information includes a visited network identifier;

[0091] S204: Based on the login information, the home network where the P-CSCF is located sends the user subscription data to the visited network.

[0092] S206: The user equipment establishes connections with the visited network and the home network.

[0093] It should be noted that the user subscription data includes the access point name APN and corresponding service quality QoS parameters.

[0094] In the above embodiment, according to the obtained visited network identifier, the home network where the P-CSCF is located sends the user subscription data to the visited network, and the user equipment quickly establishes a PDN connection with the visited network and the home network.

[0095] In one embodiment of the present disclosure, Figure 3 A flow chart of a method for a P-CSCF to receive a registration request sent by a user equipment through a visited network in an embodiment of the present disclosure is shown. Figure 3 As shown, the P-CSCF receives a registration request sent by the user equipment through the visited network, and also includes:

[0096] S302, the user equipment sends a first registration request to the visited network; the registration request includes: a user equipment identifier;

[0097] S304: The visited network receives the first registration request and sends a registration request to the P-CSCF.

[0098] It should be noted that the first registration request and the registration request include but are not limited to the IMS registration request; in the IMS registration, a SIP signaling bearer with QCI=5 is first established; then the IMS registration is performed, and when the IMS registration is completed, a VoLTE call can be made; when the user tries to call for the first time, the user equipment sends a REGISTER message to the P-CSCF through the visited network; the S-CSCF learns that the user information is not in the database, and returns a 401Unauthorized query message to the user equipment, which contains the token required for security authentication; the user equipment encrypts the user ID and password according to the security authentication token, and reports it to the S-CSCF again with a REGISTER message; the S-CSCF decrypts the user information in the REGISTER message, and after authentication is legal, registers the user information in the database, and returns a response message 200OK to the user equipment to complete the registration.

[0099] In one embodiment of the present disclosure, Figure 4 A flow chart of a method for performing access control through an international bureau P-CSCF in an embodiment of the present disclosure is shown. Figure 4 As shown, this can be achieved by following the steps below:

[0100] S402, the user equipment initiates an IMS registration request in the visited network;

[0101] In one embodiment, the user equipment initiates an IMS registration request in the visited network, and the international bureau P-CSCF determines whether to allow the user to perform IMS registration through the visited network based on the PANI header field value in the received SIP registration message and the IMPI of the user equipment.

[0102] It should be noted that the international bureau P-CSCF obtains the carried mobile country code MCC and mobile network code MNC according to the PANI header field utran-cell-id-3gpp parameter value in the SIP registration message to identify the visited network logged in by the user.

[0103] S404, the international bureau P-CSCF determines whether the user equipment can access the international bureau P-CSCF through the visited network based on the MCC, MNC and IMPI and the access control policy; if so, the international bureau P-CSCF allows the user equipment to access the international bureau P-CSCF through the visited network; then the international bureau P-CSCF releases the relevant SIP messages and continues to process subsequent business processes.

[0104] S406, the international P-CSCF determines whether the user equipment can access the international P-CSCF through the visited network based on the MCC, MNC and IMPI and the access control policy; if not, the international P-CSCF returns a 403 Forbidden response to the user equipment through the visited network, in which the Warning header field value carried is Roaming Restricted.

[0105] In one embodiment of the present disclosure, Figure 5 A schematic diagram of an access control strategy in an embodiment of the present disclosure is shown. Figure 5 As shown, the strategy includes the following steps:

[0106] S502, obtaining the MCC, MNC and IMPI of the visited network;

[0107] S504, determining whether the visited network has opened the VoLTE roaming service;

[0108] S506, when the visited network has opened the VoLTE roaming service, determining whether the visited network needs to distinguish customer groups;

[0109] S508, when the visited network has opened the VoLTE roaming service and needs to distinguish customer groups, determine whether the user's IMPI allows access to the home network;

[0110] S510, when the visited network does not enable the VoLTE roaming service, determining whether the visited network performs a VoLTE roaming test;

[0111] S512, when the visited network has not activated the VoLTE roaming service and the VoLTE roaming test is performed, determining whether the user's IMPI is a test card;

[0112] S514: when the visited network has opened the VoLTE roaming service and does not need to distinguish customer groups;

[0113] Or when the visited network has enabled VoLTE roaming service and needs to differentiate customer groups, and the user's IMPI allows access to the home network;

[0114] Or when the visited network does not have VoLTE roaming service activated and VoLTE roaming test is performed, and the user's IMPI is a test card;

[0115] The P-CSCF of the international bureau releases the SIP message to complete the subsequent VoLTE service process.

[0116] S516: When the visited network has activated the VoLTE roaming service and needs to distinguish customer groups, and the user's IMPI does not allow access to the home network;

[0117] Or when the visited network does not support VoLTE roaming service and VoLTE roaming test is not performed;

[0118] Or when the VoLTE roaming service is not enabled in the visited network and a VoLTE roaming test is performed, and the user's IMPI is not a test card;

[0119] The international bureau P-CSCF denies user access and returns a 403 response.

[0120] Figure 6 FIG. 1 shows an optional flow chart of a visited network access control method in an embodiment of the present disclosure; in this embodiment, an overseas operator does not sign a VoLTE roaming agreement with a home operator of a roaming user as an example. Figure 6 As shown, the following steps are included:

[0121] S602, the user equipment of the roaming user attempts to log in to the 4G network of the overseas operator; wherein, the home server HSS sends the user's subscription data to the mobility management entity MME, the subscription data including the access point name APN of the data service and the corresponding service quality QoS parameters.

[0122] It should be noted that the 4G network includes network elements such as MME (Mobility Management Entity), SGW (Serving GateWay), PGW (PDN GateWay), and HSS (HomeSubscriber Server); MME and SGW belong to the visited network; PGW, HSS and CSCF (Call Session Control Function) belong to the home network.

[0123] It should be noted that the MME is responsible for the positioning and paging process of mobile user equipment, and selects an SGW for a user equipment when the user equipment is initialized and connected to the visited network; the MME authenticates a user by interacting with the HSS and assigns a temporary identity to the user.

[0124] It is important to note that the HSS supports the main user database of the IMS network entity used to process calls or sessions; it contains user profiles, performs authentication and authorization of users, and can provide information about the user's physical location;

[0125] It should be noted that APN (Access Point Name) is a parameter that users must configure when accessing the Internet through their mobile phones. It determines the access method used by the user's mobile phone to access the network; QoS (Quality of Service) refers to a network's ability to use various basic technologies to provide better service capabilities for specified network communications.

[0126] It should be noted that SGW is responsible for connecting to the 3GPP wireless access network on the user plane and forwarding user plane data. PGW provides user session management and bearer control, data forwarding, IP address allocation, and non-3GPP user access functions. It is the anchor point for 3GPP access and non-3GPP access to the public data network PDN. 3GPP access refers to the wireless access technology from the 3GPP standard family. For example, the mobile phones of my country Mobile and China Unicom are 3GPP access technologies. Non-3GPP access refers to wireless access technologies outside the 3GPP standard family, such as China Telecom's CDMA access technology and popular WiFi access technology. If the mobile terminal is non-3GPP access, it can bypass the MME network element and SGW network element, but must pass through the PGW network element to access the PDN.

[0127] It should be noted that CSCF is the core of the IMS network; it is mainly responsible for processing signaling control during multimedia call sessions; it manages user authentication of the IMS network, IMS bearer plane QoS, cooperates with other network entities to control SIP sessions, as well as service negotiation and resource allocation.

[0128] It should be noted that the contract data does not include the APN of the IMS service.

[0129] S604, the user equipment completes the creation of the PDN connection and corresponding bearer of the data service;

[0130] S606, the user equipment requests to create a PDN connection for the IMS service; when the MME fails to obtain the APN for the IMS service from the HSS due to irregular configuration, the user equipment still creates the PDN connection and the default bearer for the IMS service.

[0131] It should be noted that PDN (Public Data Network) is a communication network that provides data communication services to the public. It is composed of switches, network control centers, user access equipment, communication lines and other facilities. Each user on the network can communicate with other users on the Internet, and the public data network is responsible for transparent and error-free transmission of data between them.

[0132] It should be noted that bearers include but are not limited to default bearers and dedicated bearers; the default bearer is a user bearer for data and signaling that meets the default QoS; the default bearer can be simply understood as a bearer that provides best-effort IP connection, which is established when the PDN link is established and destroyed when the PDN link is removed, providing users with permanent online IP transmission services; dedicated bearer: a dedicated bearer is established based on the establishment of the PDN link, in order to provide certain specific QoS transmission requirements that cannot be met by the default bearer; generally, the QoS requirements of a dedicated bearer are higher than those of the default bearer.

[0133] S608, the user equipment attempts to log in to the IMS network carried on the 4G network and sends a registration message to the CSCF;

[0134] S610, after receiving the registration message, the CSCF obtains the MCC, MNC and IMPI of the visited network, and determines whether the user can access the IMS network from the visited network according to the access control policy;

[0135] S612: The user cannot access the IMS network from the visited network, so a response message is returned to deny the user access.

[0136] It should be noted that the value of the Warning header field in the response message is Roaming Restricted.

[0137] Based on the same inventive concept, the present disclosure also provides a visited network access control device, such as the following embodiment. Figure 1-3 The visited network access control method shown is similar, so the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0138] Figure 7 A schematic diagram of a visited network access control device in an embodiment of the present disclosure is shown. Figure 7 As shown, the visited network access control device 7 includes: a registration request module 701, an access determination module 702, an access permission module 703 and a failure response module 704;

[0139] Registration request module 701, P-CSCF receives a registration request sent by a user equipment through a visited network, the registration request including a visited network identifier and a user equipment identifier;

[0140] Access determination module 702, the P-CSCF determines whether the user equipment can access the P-CSCF through the visited network based on the visited network identification and the user equipment identification information and the access control policy;

[0141] Access permission module 703, P-CSCF allows user equipment to access P-CSCF through the visited network;

[0142] In the failure response module 704, the P-CSCF returns a failure response message to the user equipment via the visited network.

[0143] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0144] Refer to the following Figure 8 The electronic device 800 according to this embodiment of the present disclosure is described. Figure 8 The electronic device 800 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0145] like Figure 8As shown, the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 may include but are not limited to: at least one processing unit 810, at least one storage unit 820, and a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810).

[0146] The storage unit stores a program code, and the program code can be executed by the processing unit 810, so that the processing unit 810 executes the steps described in the above "Exemplary Method" section of this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 810 can execute the following steps of the above method embodiment: the P-CSCF receives a registration request sent by the user equipment through the visited network, and the registration request includes the visited network identifier and the user equipment identifier; the P-CSCF determines whether the user equipment can access the P-CSCF through the visited network based on the access control policy according to the visited network identifier and the user equipment identifier information; if so, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; if not, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0147] The processing unit 810 may also perform the following steps of the above method embodiment: when the visited network activates roaming service and does not need to distinguish customer groups, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; when the visited network activates roaming service and needs to distinguish customer groups, and allows the user equipment to access the P-CSCF, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; when the visited network activates roaming service and needs to distinguish customer groups, and does not allow the user equipment to access the P-CSCF, the P-CSCF returns a failure response message to the user equipment through the visited network; when the visited network does not activate roaming service and does not perform roaming debugging, the P-CSCF returns a failure response message to the user equipment through the visited network; when the visited network does not activate roaming service and performs roaming debugging, and the user equipment is a test card, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; when the visited network does not activate roaming service and performs roaming debugging, and the user equipment is not a test card, the P-CSCF returns a failure response message to the user equipment through the visited network.

[0148] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0149] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0150] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0151] The electronic device 800 may also communicate with one or more external devices 840 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or communicate with any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 850. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0152] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0153] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0154] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0155] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0156] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0157] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0158] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0159] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0160] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0161] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for controlling access to a visited network, characterized in that: include: The proxy call session control function P-CSCF receives an IMS registration request sent by the user equipment through the visited network, wherein the IMS registration request includes a visited network identifier and a user equipment identifier; The P-CSCF determines, based on the access control policy, whether the user equipment can access the P-CSCF through the visited network according to the visited network identifier and the user equipment identifier information, wherein the visited network identifier is used to determine whether the visited network has opened a roaming service and whether it needs to distinguish customer groups. When the visited network has opened a roaming service and the visited network needs to distinguish customer groups, the P-CSCF determines, based on the user equipment identifier, whether the user equipment is allowed to access the P-CSCF through the visited network; If so, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; if not, the P-CSCF returns a failure response message to the user equipment through the visited network.

2. The visited network access control method according to claim 1, characterized in that: The control strategy includes: When the visited network enables roaming services and does not need to differentiate customer groups, the P-CSCF allows user equipment to access the P-CSCF through the visited network.

3. The visited network access control method according to claim 2, characterized in that: The control strategy also includes: When the visited network activates roaming services and needs to distinguish customer groups, and allows user equipment to access the P-CSCF, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; When the visited network activates roaming services and needs to distinguish customer groups, and does not allow user equipment to access the P-CSCF, the P-CSCF returns a failure response message to the user equipment through the visited network.

4. The visited network access control method according to claim 2, characterized in that: The control strategy also includes: When the visited network does not enable roaming services and does not perform roaming debugging, the P-CSCF returns a failure response message to the user equipment through the visited network.

5. The visited network access control method according to claim 4, characterized in that: The control strategy also includes: When the visited network does not provide roaming services and is in roaming debugging, and the user equipment is a test card, the P-CSCF allows the user equipment to access the P-CSCF through the visited network; When the visited network does not enable roaming services and performs roaming debugging, and the user equipment is not a test card, the P-CSCF returns a failure response message to the user equipment through the visited network.

6. The visited network access control method according to claim 1, characterized in that: The P-CSCF receives an IMS registration request sent by the user equipment through the visited network, further comprising: The user equipment sends a first IMS registration request to the visited network; the first IMS registration request includes: a user equipment identifier; The visited network receives the first IMS registration request, and sends the IMS registration request to the P-CSCF.

7. The visited network access control method according to claim 1, characterized in that: Before the P-CSCF receives the IMS registration request sent by the user equipment through the visited network, the method further includes: Acquire login information of a user device logging into a visited network, wherein the login information includes an identifier of the visited network; According to the login information, the home network where the P-CSCF is located sends the user subscription data to the visited network; The user equipment establishes connections with the visited network and the home network.

8. The visited network access control method according to any one of claims 1 to 7, characterized in that: The visited network identifier includes: a mobile country code and a mobile network code.

9. A visited network access control device, characterized in that: include: A registration request module, the P-CSCF receives an IMS registration request sent by a user equipment through a visited network, wherein the IMS registration request includes a visited network identifier and a user equipment identifier; an access judgment module, wherein the P-CSCF judges whether the user equipment can access the P-CSCF through the visited network based on the access control policy according to the visited network identifier and the user equipment identifier information, wherein the visited network identifier is used to judge whether the visited network has opened a roaming service and whether it needs to distinguish customer groups. When the visited network has opened a roaming service and the visited network needs to distinguish customer groups, the P-CSCF judges whether the user equipment is allowed to access the P-CSCF through the visited network based on the user equipment identifier; Access permission module: P-CSCF allows user equipment to access P-CSCF through the visited network; Failure response module: P-CSCF returns failure response information to the user equipment through the visited network.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the visited network access control method according to any one of claims 1 to 8 by executing the executable instructions.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the visited network access control method according to any one of claims 1 to 8 is implemented.

Images