Roaming access control method and device and signaling gateway

Abstract

The invention relates to the technical field of communication networks, in particular to a roaming access control method and device and a signaling gateway. The roaming access control method is applied to a signaling gateway, the signaling gateway is deployed between an HPLMN (home public land mobile network) and a VPLMN (visited public land mobile network), and the connection with a roaming access control node deployed in the VPLMN comprises the following steps: responding to an access request initiated by a target terminal through the roaming access control node corresponding to the target terminal; determining the access authority of the target terminal to the HPLMN according to the terminal identifier of the target terminal carried in the access request; and accessing the target terminal to the HPLMN or limiting the target terminal to access the HPLMN according to the access authority.

Description

Technical Field

[0001] The present application relates to the field of communication network technology, and in particular to a roaming access control method, device and signaling gateway. Background Art

[0002] In the current standard network architecture, the edge nodes of the core network undertake the important task of opening up foreign operators' roaming. These edge nodes serve as bridges connecting the network with the outside world, and their stability and efficiency directly affect the quality of cross-border communication services and user experience.

[0003] However, with the continuous development of communication technology and the increasing scale of networks, the number of edge nodes in existing networks has increased dramatically, which has brought unprecedented challenges to network management and maintenance.

[0004] Due to the large number of edge nodes and their wide distribution, the number of departments involved in maintenance and management has to increase accordingly. Each department needs to be responsible for the daily operation and maintenance of a part of the edge nodes, including equipment inspection, fault handling, performance optimization, etc. This decentralized management model not only increases management costs, but also reduces management efficiency. Summary of the invention

[0005] Based on this, it is necessary to provide a roaming access control method, device and signaling gateway that can simplify roaming access control in order to solve the above technical problems.

[0006] In a first aspect, the present application provides a roaming access control method, which is applied to a signaling gateway, where the signaling gateway is deployed between a home public land mobile network HPLMN and a visited public land mobile network VPLMN, and is connected to a roaming access control node deployed in the VPLMN, including:

[0007] In response to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, determining the access permission of the target terminal to the HPLMN according to the terminal identifier of the target terminal carried in the access request;

[0008] Based on the access rights, the target terminal is connected to the HPLMN or the target terminal is restricted from accessing the HPLMN.

[0009] In one of the embodiments, determining the access permission of the target terminal to the HPLMN according to the terminal identifier of the target terminal carried in the access request includes:

[0010] The terminal identifier of the target terminal carried in the access request is matched with the terminal identifiers of each authorized terminal in the locally stored whitelist;

[0011] If the terminal identification of the target terminal is consistent with the terminal identification of any authorized terminal in the whitelist, determining that the access right of the target terminal to the HPLMN is allowed access;

[0012] If the terminal identification of the target terminal is inconsistent with the terminal identifications of the authorized terminals in the whitelist, it is determined that the access right of the target terminal to the HPLMN is restricted access.

[0013] In one embodiment, according to the access rights, accessing the target terminal to the HPLMN or restricting the target terminal from accessing the HPLMN includes:

[0014] If the access permission is to allow access, the access request is forwarded to the HPLMN so that the HPLMN establishes communication with the target terminal;

[0015] If the access permission is restricted access, a restricted access instruction is generated and sent to the target terminal through the roaming access control node corresponding to the target terminal to restrict the target terminal from accessing the HPLMN.

[0016] In one embodiment, generating a restricted access instruction includes:

[0017] generating, according to the target network type of the communication network to which the roaming access control node corresponding to the target terminal belongs, a restricted access instruction corresponding to the target network type;

[0018] Accordingly, sending the access restriction instruction to the target terminal through the roaming access control node corresponding to the target terminal includes:

[0019] The restricted access instruction is sent to the roaming access control node corresponding to the target terminal to instruct the roaming access control node to convert the format of the restricted access instruction according to the network standard corresponding to the target network type, and send the restricted access instruction after format conversion to the target terminal.

[0020] In one of the embodiments, the roaming access control nodes deployed in the VPLMN include: a mobile switching center MSC in a second generation communication network 2G, a mobile switching center MSC in a third generation communication network 3G, a mobile management entity MME in a fourth generation communication network 4G, and at least one of an access and mobility management function AMF network element in a fifth generation communication network 5G.

[0021] In one of the embodiments, a signaling transfer point STR network element, a routing agent node DRA network element and a network storage function NRF network element are deployed in the signaling gateway.

[0022] In a second aspect, the present application further provides a roaming access control device, which is configured in a signaling gateway, the signaling gateway is deployed between a home public land mobile network HPLMN and a visited public land mobile network VPLMN, and is connected to a roaming access control node deployed in the VPLMN, including:

[0023] a response module, configured to respond to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, and determine the access rights of the target terminal to the HPLMN according to the terminal identifier of the target terminal carried in the access request;

[0024] The access control module is used to connect the target terminal to the HPLMN or restrict the target terminal from accessing the HPLMN according to the access rights.

[0025] In a third aspect, the present application further provides a signaling gateway, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0026] In response to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, determining the access permission of the target terminal to the HPLMN according to the terminal identifier of the target terminal carried in the access request;

[0027] Based on the access rights, the target terminal is connected to the HPLMN or the target terminal is restricted from accessing the HPLMN.

[0028] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0029] In response to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, determining the access permission of the target terminal to the HPLMN according to the terminal identifier of the target terminal carried in the access request;

[0030] Based on the access rights, the target terminal is connected to the HPLMN or the target terminal is restricted from accessing the HPLMN.

[0031] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0032] In response to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, determining the access permission of the target terminal to the HPLMN according to the terminal identifier of the target terminal carried in the access request;

[0033] Based on the access rights, the target terminal is connected to the HPLMN or the target terminal is restricted from accessing the HPLMN.

[0034] The above-mentioned roaming access control method, device and signaling gateway, the present application avoids the need to perform complex network configuration on each roaming access control node separately by centrally processing roaming access control on the signaling gateway. This greatly simplifies the process of roaming activation of new operators and reduces the risk of duplication of work and configuration errors. Since roaming access control is centralized on the signaling gateway rather than dispersed across various roaming access control nodes, the number of nodes to be maintained and managed is significantly reduced, reducing maintenance costs and workload. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 is an application environment diagram of a roaming access control method in an embodiment;

[0037] Figure 2 A schematic diagram of a flow chart of a roaming access control method in an embodiment;

[0038] Figure 3 A schematic diagram of a flow chart of steps for determining the access rights of a target terminal to the HPLMN in one embodiment;

[0039] Figure 4 A flowchart of steps of accessing a target terminal to a VPLMN or restricting a target terminal from accessing a VPLMN in one embodiment;

[0040] Figure 5 is an interactive schematic diagram of a roaming access control method in another embodiment;

[0041] Figure 6 is a structural block diagram of a roaming access control device in an embodiment;

[0042] Figure 7 FIG. 4 is a diagram showing the internal structure of a signaling gateway in an embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] The roaming access control method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown, the application environment includes a signaling gateway, a Home Public Land Mobile Network (HPLMN), a Visited Public Land Mobile Network (VPLMN), and a roaming access control node deployed in the VPLMN. The signaling gateway is deployed between the Home Public Land Mobile Network HPLMN and the Visited Public Land Mobile Network VPLMN, and is connected to the roaming access control node deployed in the VPLMN.

[0045] VPLMN represents the network that a mobile user accesses and uses when roaming outside the coverage area of ​​their home network. Roaming agreements between operators enable users to seamlessly access services when traveling domestically or internationally.

[0046] HPLMN refers to the network to which the user's SIM card is registered, which is also the user's "home" network or home network. This is the user's primary service provider, usually the operator that the user has signed up with. When the user leaves the coverage area of ​​the HPLMN and enters the network area of ​​another operator, the network connected is called the VPLMN, or visited network. During international roaming, the user's terminal (such as a mobile phone) will try to connect to the VPLMN network of the visited country or region. The VPLMN network will communicate with the user's HPLMN network to verify the user's identity, subscription status, roaming rights and other information. Once the verification is passed, the VPLMN network will allow the user to access its network and provide corresponding services (such as voice calls, text messages and data traffic). HPLMN stores important information about the user, such as user identity, subscription status, roaming rights, etc. When the user is roaming internationally, the VPLMN needs to access the HPLMN to obtain this information in order to verify the user's legitimacy and roaming rights. HPLMN is also responsible for handling the user's billing, billing and other matters to ensure that the user can use the roaming service normally.

[0047] Among them, the roaming access control nodes deployed in the VPLMN include: the mobile switching center (MSC) in the second-generation communication network 2G, the mobile switching center MSC in the third-generation communication network 3G, the mobility management entity (MME) in the fourth-generation communication network 4G, and the access and mobility management function (AMF) network element in the fifth-generation communication network 5G.

[0048] It is understandable that MSC is the most important equipment of the core network in the 2G network architecture, responsible for processing call establishment, maintenance and release, and managing the mobility of users in the network. It provides switching functions and faces entities such as base station sub-stations, home location registers, visitor location registers, authentication centers, mobile equipment identification registers, operation and maintenance centers, and fixed networks, thereby connecting mobile users with fixed network users and mobile users with each other. MSC is mainly responsible for call routing and switching in roaming access control. According to the destination of the call request, it communicates with other switching equipment through the core network and routes the call to the location of the target user. At the same time, MSC is also responsible for the storage and management of user data, including user identity authentication, billing, etc. These functions play a key role in roaming access control.

[0049] 3G MSC is similar to 2G MSC in function, but it is optimized and enhanced for 3G network. It is responsible for processing and switching calls and data services between mobile users, providing location information of mobile users, and communicating with other networks. In terms of roaming access control, 3G MSC is also responsible for call routing and switching, routing calls to the correct base station or network according to the user's current location information. In addition, it is also responsible for authentication and identity verification to ensure that only legitimate users can access network resources, which is an important part of ensuring network security and protecting user privacy.

[0050] MME is a network element of the control plane of the 4G core network, responsible for mobility management of the control plane, including attachment and detachment of user terminals, tracking area update, authentication, etc. It is one of the most important entities in the 4G core network. In terms of roaming access control, MME is mainly responsible for user access control and mobility management. It ensures that only legitimate users can access the network by processing user access requests and communicating with HSS (core network user database) for user verification. In addition, MME also supports network slicing, which can allocate corresponding network resources to users according to the needs of different application scenarios.

[0051] AMF is a key network element in the 5G core network, responsible for processing user equipment access requests, mobility management, and wireless resource allocation. AMF identifies the location and mobility requirements of user equipment and allocates corresponding wireless resources through signaling interaction with user equipment. In addition, it is also responsible for maintaining the connection status between user equipment and the network to ensure the continuity and stability of data transmission. In terms of roaming access control, AMF is also responsible for user access and mobility management. It ensures that only legitimate users can access the network by processing user access requests and interacting with network elements such as UDM (user data management). In addition, AMF also supports network slicing, which can allocate corresponding network resources to users according to the needs of different application scenarios. In roaming scenarios, AMF is also responsible for signaling interaction with AMFs of other networks to achieve access and mobility management of roaming users.

[0052] The signaling gateway in this embodiment is an international signaling gateway, and has roaming access control functions in the MSC in the second-generation communication network 2G, the MSC in the third-generation communication network 3G, the MME in the fourth-generation communication network 4G, and the access and AMF network elements in the fifth-generation communication network 5G.

[0053] Specifically, the signaling gateway has the function of MSC in the 2G network. The signaling gateway also supports the MSC function in the 3G network. It can handle call control, mobility management and data services in the 3G network to ensure that 3G users can communicate and exchange data smoothly. In the 4G network, the signaling gateway integrates the function of MME. MME is the core control plane network element of the 4G network, responsible for user mobility management, session management and security control, and is the key to providing efficient data services in the 4G network. For the 5G network, the signaling gateway has the roaming access control function in the AMF network element. AMF is one of the core control plane network elements of the 5G network, responsible for user access authentication, mobility management and session management. By integrating the roaming access control function of AMF, the signaling gateway can support the access and mobility management of 5G users in roaming scenarios, ensuring that users can enjoy seamless communication services worldwide.

[0054] Optionally, a signaling transfer point (Signal Transfer Point, STP) network element, a routing agent node (Diameter Routing Agent, DRA) network element and a network repository function (Network Repository Function, NRF) network element are deployed in the signaling gateway.

[0055] It can be understood that STP is a signaling point that has the function of transferring signaling messages from one signaling link to another signaling link. It is the core equipment of the No. 7 signaling network, responsible for forwarding signaling messages in the signaling network to ensure that the signaling messages can reach the destination accurately and in time.

[0056] The DRA network element plays the role of a routing agent in the communication network. It is responsible for forwarding signaling messages in the signaling network and selecting the best transmission path according to the predetermined routing strategy. DRA can optimize the transmission path of signaling messages and improve the transmission efficiency and reliability of the signaling network.

[0057] The NRF network element is one of the network functions of the 5G core network. It is responsible for managing all network functions (NFs) that support service-oriented interfaces in the 5G network. NRF supports service discovery, can receive service discovery requests from NF instances, and provide relevant NF instance information to the requester. In addition, NRF also maintains the NF profiles of available NF instances and their supported services to ensure the correct registration, update, and deregistration of network functions.

[0058] In an exemplary embodiment, Figure 2 As shown, a roaming access control method is provided, which is applied to Figure 1 The signaling gateway in the example is used to illustrate.

[0059] S201, in response to an access request initiated by a target terminal through a roaming access control node corresponding to the target terminal, determining access rights of the target terminal to a VPLMN according to a terminal identifier of the target terminal carried in the access request.

[0060] The target terminal in this embodiment is a registered overseas user, and the HPLMN, as the user's home network, stores important information about the user, such as user identity, subscription status, roaming authority, etc. When the user roams internationally, the visited network (VPLMN) needs to communicate with the HPLMN to verify the user's legitimacy and roaming authority.

[0061] Optionally, the target terminal initiates an access request through its corresponding roaming access control node. The roaming access control node is a mobile switching center (MSC) in 2G / 3G, a mobility management entity (MME) in 4G, or an access and mobility management function (AMF) network element in 5G.

[0062] Optionally, the signaling gateway determines the target terminal's access rights to the VPLMN based on the terminal identifier of the target terminal carried in the access request. The terminal identifier includes IMSI (International Mobile Subscriber Identity), IMEI (International Mobile Equipment Identity), etc. The determination of access rights involves querying the Home Location Register (HLR), the Visitor Location Register (VLR), or the corresponding user database to verify the legitimacy, subscription status, roaming agreement, etc. of the terminal.

[0063] S202: According to the access rights, the target terminal is connected to the VPLMN or the target terminal is restricted from accessing the VPLMN.

[0064] It can be understood that by querying the user information in the HPLMN, such as user identity, subscription status, roaming authority, etc., the access rights of the target terminal to the VPLMN are determined.

[0065] If the target terminal has legitimate access rights and meets all necessary roaming conditions (such as a roaming agreement has been reached, the user account status is normal, etc.), the VPLMN will allow the target terminal to access its network. After access, the target terminal can enjoy services such as voice calls, text messages, and data traffic provided by the VPLMN. If the target terminal does not have legitimate access rights, or there are other restrictive factors (such as user arrears, roaming agreements have not been reached, the terminal is blacklisted, etc.), the VPLMN will restrict the target terminal from accessing its network. Restricted access is manifested in the rejection of access requests, the provision of limited services (such as only allowing emergency calls), or the complete interruption of services.

[0066] The roaming access control node (such as MSC in 2G / 3G, MME in 4G or AMF in 5G) is responsible for receiving and forwarding the access request of the target terminal. The signaling gateway participates in the access request processing and determines the access rights according to the terminal identification (such as IMSI, IMEI). The signaling gateway communicates with the home location register (HLR), visitor location register (VLR) or the corresponding user database to verify the legitimacy, subscription status and roaming agreement of the terminal.

[0067] In the above roaming access control method, the present application avoids performing complex network configuration on each roaming access control node by centrally processing roaming access control on the signaling gateway. This greatly simplifies the process of roaming activation of new operators and reduces the risk of duplication of work and configuration errors. Since roaming access control is centralized on the signaling gateway rather than dispersed across various roaming access control nodes, the number of nodes to be maintained and managed is significantly reduced, reducing maintenance costs and workload.

[0068] In an exemplary embodiment, Figure 3As shown, according to the terminal identifier of the target terminal carried in the access request, determining the access right of the target terminal to the HPLMN includes:

[0069] S301: Perform consistency matching on the terminal identifier of the target terminal carried in the access request and the terminal identifiers of each authorized terminal in the locally stored whitelist.

[0070] It is understood that the terminal identifier is the International Mobile Subscriber Identity (IMSI) or the International Mobile Equipment Identity (IMEI), which is used to uniquely identify a terminal device. The whitelist is a predefined list containing all terminal identifiers that are authorized to access the VPLMN (Home Public Land Mobile Network). The terminal identifier in the access request is compared with the identifiers in the whitelist one by one to check whether there is consistency.

[0071] S302: If the terminal identification of the target terminal is consistent with the terminal identification of any authorized terminal in the whitelist, it is determined that the access right of the target terminal to the VPLMN is allowed access.

[0072] It is understandable that if the terminal identification of the target terminal is consistent with the terminal identification of any authorized terminal in the whitelist, the target terminal is determined to have access rights to the VPLMN as allowed. If the match is successful, it means that the target terminal is authorized, so it is allowed to access the VPLMN. This means that the target terminal can continue with the subsequent roaming access process and enjoy various services provided by the VPLMN.

[0073] S303: If the terminal identification of the target terminal is inconsistent with the terminal identifications of the authorized terminals in the whitelist, it is determined that the access right of the target terminal to the VPLMN is restricted access.

[0074] If the terminal identification of the target terminal is inconsistent with the terminal identification of each authorized terminal in the whitelist, the target terminal is determined to have restricted access to the VPLMN. If the match fails, it means that the target terminal is not authorized, so its access to the content VPLMN is restricted. This means that the target terminal's access request will be rejected, or it can only enjoy limited services (such as emergency calls).

[0075] In this embodiment, the whitelist-based access rights verification mechanism is used to determine the access rights of the target terminal to the VPLMN in an international roaming scenario, thereby ensuring the security of the network.

[0076] In an exemplary embodiment, Figure 4 As shown, according to the access rights, the target terminal is connected to the VPLMN or the target terminal is restricted from accessing the VPLMN, including:

[0077] S401: If the access permission is to allow access, the access request is forwarded to the HPLMN, so that the HPLMN completes the access registration process of the target terminal accessing the VPLMN.

[0078] It is understandable that the purpose of forwarding the access request to the HPLMN is to verify the identity, subscription status, roaming agreement, etc. of the terminal, and to ensure that all necessary information and permissions are correctly set, and to instruct the HPLMN to perform necessary signaling interaction with the VPLMN to instruct the VPLMN to allocate necessary network resources to the terminal, such as temporary mobile user identity, location area information, etc.

[0079] Once the access registration process is completed, the target terminal can use the voice calls, text messages, data traffic and other services provided by the VPLMN. At the same time, both the HPLMN and the VPLMN will update their respective records to reflect the current status and location of the target terminal.

[0080] S402: If the access permission is restricted access, a restricted access instruction is generated, and the restricted access instruction is sent to the target terminal through the roaming access control node corresponding to the target terminal to restrict the target terminal from accessing the VPLMN.

[0081] The access restriction instruction may be a rejection code. The access restriction instruction is used to inform the target terminal that its access rights are restricted and includes the reason for the rejection or the recommended follow-up operation. The access restriction instruction may be a rejection code. A rejection code is a common access restriction instruction, which is usually a standard code or message used to indicate the reason for the access rejection. For example, the rejection code indicates "the terminal is not authorized", "the roaming agreement has not been reached", "the terminal is blacklisted", etc.

[0082] Optionally, the access restriction instruction (such as a rejection code) is sent to the target terminal through a roaming access control node (such as an MSC, MME or AMF) corresponding to the target terminal. The roaming access control node is responsible for delivering the instruction to the target terminal.

[0083] After receiving the access restriction instruction, the target terminal will parse the instruction content and take corresponding actions according to the instruction. For example, if a rejection code is received, the terminal will display an error message to inform the user why the access is denied. The target terminal is restricted from accessing the VPLMN and cannot enjoy the services provided by it, such as voice calls, text messages, and data traffic.

[0084] Furthermore, in a mobile communication network, different network types (such as 2G, 3G, 4G and 5G) use different technical standards and protocols. Therefore, when it is necessary to restrict the target terminal from accessing a network (VPLMN), the generated access restriction instruction needs to be customized according to the network type. In an exemplary embodiment, generating the access restriction instruction includes: generating the access restriction instruction corresponding to the target network type according to the target network type of the communication network to which the roaming access control node corresponding to the target terminal belongs.

[0085] Optionally, according to the determined target network type, a restricted access instruction corresponding to the network type is selected. For example, for a 2G network, a specific rejection code is used; for a 5G network, another different rejection code or message format is used. According to the selected restricted access instruction template or rule, a specific restricted access instruction is generated. The generated restricted access instruction is sent to the target terminal through the roaming access control node.

[0086] It is understandable that different network formats (such as 2G, 3G, 4G, and 5G) use different technical standards, frequency bands, and protocols. By adjusting the network format, it is possible to ensure that the target terminal can communicate smoothly with the communication network where it is located, avoiding communication failures caused by format mismatch.

[0087] Correspondingly, the restricted access instruction is sent to the target terminal through the roaming access control node corresponding to the target terminal, including: sending the restricted access instruction to the roaming access control node corresponding to the target terminal to instruct the roaming access control node to convert the format of the restricted access instruction according to the network standard corresponding to the target network type, and sending the restricted access instruction after format conversion to the target terminal.

[0088] Specifically, after receiving the restricted access instruction, the roaming access control node will convert the format of the instruction according to the network standard (such as 2G, 3G, 4G, 5G) of the network where the target terminal is located. Different network standards use different signaling protocols, message formats or encoding methods, so format conversion is required to ensure that the instruction can be correctly understood by the target terminal. After the roaming access control node completes the format conversion, it sends the converted restricted access instruction to the target terminal. After receiving the instruction, the target terminal will parse the instruction content and take corresponding actions according to the instruction, such as displaying an error message, restricting certain functions, etc.

[0089] In this embodiment, format conversion can ensure that the access restriction instruction is compatible with the network standard of the network where the target terminal is located, thereby avoiding communication failure or failure to correctly understand the instruction due to standard mismatch.

[0090] In an exemplary embodiment, Figure 5As shown, a schematic diagram of an interaction process corresponding to a roaming access method is provided, specifically including:

[0091] 1. The target terminal UE initiates an access request to the roaming access control node corresponding to the target terminal.

[0092] The access request is used to request access to the VPLMN network.

[0093] 2. The roaming access control node corresponding to the target terminal forwards the access request to the signaling gateway.

[0094] 3. The signaling gateway determines the target terminal's access rights to the VPLMN.

[0095] 4. If the access permission is to allow access, the access request is forwarded to the HPLMN.

[0096] 5. If the access permission is restricted access, a restricted access instruction is generated and sent to the roaming access control node corresponding to the target terminal.

[0097] 6. The roaming access control node corresponding to the target terminal sends an access restriction instruction to the target terminal.

[0098] To restrict the target terminal from accessing the VPLMN.

[0099] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0100] Based on the same inventive concept, the embodiment of the present application also provides a roaming access control device for implementing the roaming access control method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations of one or more roaming access control device embodiments provided below can refer to the limitations of the roaming access control method above, and will not be repeated here.

[0101] In an exemplary embodiment, Figure 6As shown, a roaming access control device is provided, which is configured in a signaling gateway, and the signaling gateway is deployed between a home public land mobile network VPLMN and a visited public land mobile network VPLMN, and is connected to a roaming access control node deployed in the VPLMN, including:

[0102] A response module 11, configured to respond to an access request initiated by a target terminal through a roaming access control node corresponding to the target terminal, and determine the access rights of the target terminal to the VPLMN according to a terminal identifier of the target terminal carried in the access request;

[0103] The access control module 12 is used to access the target terminal to the VPLMN or restrict the target terminal from accessing the VPLMN according to the access rights.

[0104] In one embodiment, the access control module 12 is further used to: match the terminal identifier of the target terminal carried in the access request with the terminal identifiers of each authorized terminal in the locally stored whitelist for consistency;

[0105] If the terminal identification of the target terminal is consistent with the terminal identification of any authorized terminal in the whitelist, determining that the access right of the target terminal to the VPLMN is allowed access;

[0106] If the terminal identification of the target terminal is inconsistent with the terminal identifications of the authorized terminals in the whitelist, it is determined that the access right of the target terminal to the VPLMN is restricted access.

[0107] In one embodiment, the access control module 12 is further used to: if the access permission is to allow access, forward the access request to the VPLMN so that the HPLMNA completes the access registration process of the target terminal accessing the VPLMNA;

[0108] If the access permission is restricted access, a restricted access instruction is generated and sent to the target terminal through the roaming access control node corresponding to the target terminal to restrict the target terminal from accessing the VPLMN.

[0109] In one embodiment, the access control module 12 is further used to: generate a restricted access instruction corresponding to the target network type according to the target network type of the communication network to which the roaming access control node corresponding to the target terminal belongs;

[0110] Accordingly, sending the access restriction instruction to the target terminal through the roaming access control node corresponding to the target terminal includes:

[0111] The restricted access instruction is sent to the roaming access control node corresponding to the target terminal to instruct the roaming access control node to convert the format of the restricted access instruction according to the network standard corresponding to the target network type, and send the restricted access instruction after format conversion to the target terminal.

[0112] In one of the embodiments, the roaming access control nodes deployed in the VPLMN include: a mobile switching center MSC in a second generation communication network 2G, a mobile switching center MSC in a third generation communication network 3G, a mobile management entity MME in a fourth generation communication network 4G, and at least one of an access and mobility management function AMF network element in a fifth generation communication network 5G.

[0113] In one of the embodiments, a signaling transfer point STR network element, a routing agent node DRA network element and a network storage function NRF network element are deployed in the signaling gateway.

[0114] Each module in the above roaming access control device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of the processor in the signaling gateway in the form of hardware, or can be stored in the memory in the signaling gateway in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0115] In an exemplary embodiment, a signaling gateway is provided. The signaling gateway may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The signaling gateway includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the signaling gateway is used to provide computing and control capabilities. The memory of the signaling gateway includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the signaling gateway is used to store data of the roaming access control method. The input / output interface of the signaling gateway is used to exchange information between the processor and an external device. The communication interface of the signaling gateway is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a roaming access control method is implemented.

[0116] Those skilled in the art will understand that Figure 7The structure shown in the figure is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the signaling gateway to which the solution of the present application is applied. The specific signaling gateway may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In an exemplary embodiment, a signaling gateway is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0118] In response to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, determining the access rights of the target terminal to the VPLMN according to the terminal identifier of the target terminal carried in the access request;

[0119] According to the access rights, the target terminal is connected to the VPLMN or the target terminal is restricted from accessing the VPLMN.

[0120] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0121] In response to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, determining the access rights of the target terminal to the VPLMN according to the terminal identifier of the target terminal carried in the access request;

[0122] According to the access rights, the target terminal is connected to the VPLMN or the target terminal is restricted from accessing the VPLMN.

[0123] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0124] In response to an access request initiated by the target terminal through a roaming access control node corresponding to the target terminal, determining the access rights of the target terminal to the VPLMN according to the terminal identifier of the target terminal carried in the access request;

[0125] According to the access rights, the target terminal is connected to the VPLMN or the target terminal is restricted from accessing the VPLMN.

[0126] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0127] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0128] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0129] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A roaming access control method, characterized in that: Applied to a signaling gateway, the signaling gateway is deployed between a home public land mobile network HPLMN and a visited public land mobile network VPLMN, and is connected to a roaming access control node deployed in the VPLMN, the method comprising: In response to an access request initiated by a target terminal through a roaming access control node corresponding to the target terminal, determining, according to a terminal identifier of the target terminal carried in the access request, access rights of the target terminal to the VPLMN; According to the access permission, the target terminal is connected to the VPLMN or the target terminal is restricted from accessing the VPLMN.

2. The method according to claim 1, characterized in that The determining, according to the terminal identifier of the target terminal carried in the access request, the access permission of the target terminal to the VPLMN includes: Matching the terminal identifier of the target terminal carried in the access request with the terminal identifiers of each authorized terminal in the locally stored whitelist for consistency; If the terminal identification of the target terminal is consistent with the terminal identification of any authorized terminal in the whitelist, determining that the access right of the target terminal to the VPLMN is allowed access; If the terminal identification of the target terminal is inconsistent with the terminal identification of each authorized terminal in the white list, it is determined that the access right of the target terminal to the VPLMN is restricted access.

3. The method according to claim 1, characterized in that The step of accessing the target terminal to the VPLMN or restricting the target terminal from accessing the VPLMN according to the access permission includes: If the access permission is to allow access, forwarding the access request to the VPLMN so that the HPLMNA completes the access registration process of the target terminal accessing the VPLMNA; If the access permission is restricted access, a restricted access instruction is generated, and the restricted access instruction is sent to the target terminal through the roaming access control node corresponding to the target terminal, so as to restrict the target terminal from accessing the VPLMN.

4. The method according to claim 3, characterized in that The generating of the access restriction instruction comprises: generating, according to a target network type of a communication network to which a roaming access control node corresponding to the target terminal belongs, a restricted access instruction corresponding to the target network type; Correspondingly, the sending the access restriction instruction to the target terminal through the roaming access control node corresponding to the target terminal includes: The restricted access instruction is sent to the roaming access control node corresponding to the target terminal to instruct the roaming access control node to convert the format of the restricted access instruction according to the network standard corresponding to the target network type, and the restricted access instruction after format conversion is sent to the target terminal.

5. The method according to any one of claims 1 to 4, characterized in that The roaming access control nodes deployed in the VPLMN include: a mobile switching center MSC in a second-generation communication network 2G, a mobile switching center MSC in a third-generation communication network 3G, a mobile management entity MME in a fourth-generation communication network 4G, and at least one of an access and mobility management function AMF network element in a fifth-generation communication network 5G.

6. The method according to any one of claims 1 to 4, characterized in that The signaling gateway is deployed with a signaling transfer point STR network element, a routing agent node DRA network element and a network storage function NRF network element.

7. A roaming access control device, characterized in that: The device is configured in a signaling gateway, the signaling gateway is deployed between a home public land mobile network VPLMN and a visited public land mobile network VPLMN, and is connected to a roaming access control node deployed in the VPLMN. The device includes: a response module, configured to respond to an access request initiated by a target terminal through a roaming access control node corresponding to the target terminal, and determine, according to a terminal identifier of the target terminal carried in the access request, access rights of the target terminal to the VPLMN; The access control module is used to access the target terminal to the VPLMN or restrict the target terminal from accessing the VPLMN according to the access permission.

8. A signaling gateway, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images