Tracing access method and system of mobile communication network

Abstract

The invention discloses a traceability access method and system of a mobile communication network. The method comprises the following steps executed by a gateway: receiving a non-3GPP (3rd Generation Partnership Project) access establishment request initiated by user equipment based on an accessed wireless access point; querying an access ID of a wireless access point of the user equipment according to the establishment request; and sending the access ID to a home server for associative storage with the corresponding position information. According to the scheme provided by the invention, the association of the access points can be realized when the non-3GPP access mobile communication network is realized, so that the accurate traceability positioning of the user equipment is realized.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a source tracing access method and system for a mobile communication network. Background Art

[0002] Non-3GPP access refers to access to the 3GPP mobile communication network core network in a way that is not based on the traditional 3GPP (3rd Generation Partnership Project) network architecture (such as LTE, UMTS, 5G, etc.). Non-3GPP access methods mainly include Wi-Fi, Bluetooth, fixed broadband, wireless LAN, satellite access, and Internet of Things access, which provide flexible network access options. Through ePDG (Evolved Packet Data Gateway) and other gateway technologies, non-3GPP access can be interconnected with the 3GPP core network.

[0003] However, when using non-3GPP methods to access the mobile communication network, there is no defined association scheme for the user device access point, and the user device cannot be traced and located through the access point, which poses security issues. This has greatly limited the large-scale promotion and application of VoWiFi. Summary of the invention

[0004] In order to solve the above problems, the present invention proposes a traceability access method and system for a mobile communication network, which can realize the association of access points when non-3GPP accesses the mobile communication network, thereby realizing accurate traceability and positioning of user equipment.

[0005] An embodiment of the present invention provides a method for tracing access to a mobile communication network, the method comprising a gateway executing the following steps:

[0006] Receiving a non-3GPP access establishment request initiated by a user equipment based on an accessed wireless access point;

[0007] Querying the access ID of the wireless access point of the user equipment according to the establishment request;

[0008] The access ID is sent to the home server and stored in association with the corresponding location information.

[0009] Preferably, the method further comprises the following steps performed by the home server:

[0010] Receiving user identification information of a user device to be queried;

[0011] Querying the access ID configured for the access point of the user equipment to be queried according to the user identification information;

[0012] The location information of the user equipment is queried in a pre-constructed address information relationship table according to the access ID.

[0013] Preferably, the method further comprises the following steps performed by the user equipment before initiating the establishment request:

[0014] Send user authentication credentials to the wireless access point;

[0015] receiving an access point authentication credential fed back by the wireless access point;

[0016] Verifying the access point authentication credential;

[0017] When the verification is passed, the local IP is obtained through the DHCP protocol, and an IPsec establishment request is sent based on the obtained gateway address.

[0018] Furthermore, the method further includes the following steps performed by the wireless access point:

[0019] After receiving the user authentication credential sent by the user equipment, sending the user authentication credential and the stored access point authentication credential to the authentication and identification server;

[0020] Checking the authentication result fed back by the authentication and identification server;

[0021] When the authentication result is successful, the access point authentication credential is fed back to the user equipment.

[0022] Furthermore, the method further comprises the following steps performed by the authentication and identification server:

[0023] Perform non-3GPP access authentication according to the user authentication credential and the access point authentication credential, and record the MAC address of the wireless access point and the user equipment;

[0024] When the access verification succeeds, the authentication result is fed back to the wireless access point.

[0025] Further, querying the access ID of the wireless access point of the user equipment according to the establishment request includes:

[0026] Extracting the local IP address of the user equipment from the establishment request;

[0027] Querying the local ARP table according to the local IP to obtain the MAC address of the user device;

[0028] Use the MAC address to initiate an access point query request to the authentication and identification server to obtain the access ID of the wireless access point.

[0029] Preferably, sending the access ID to the home server for storage in association with the corresponding location information includes:

[0030] The access ID is placed in the Cell-ID AVP field in the Diameter Authentication Request message and sent to the home server, and the home server associates and stores the Cell-ID AVP field with the corresponding location information.

[0031] Preferably, sending the access ID to the home server for storage in association with the corresponding location information includes:

[0032] The access ID is put into the Location Information field and sent to the home server, and the home server associates and stores the Location Information field with the corresponding location information.

[0033] An embodiment of the present invention further provides a method for tracing access to a mobile communication network, the method being executed by a home server and comprising:

[0034] Obtain user identification information of a user equipment that completes non-3GPP access;

[0035] Querying the access ID configured for the wireless access point of the user equipment according to the user identification information;

[0036] The location information of the user equipment is queried in a pre-constructed address information relationship table according to the access ID.

[0037] The embodiment of the present invention also provides a traceability access method and system for a mobile communication network, the method comprising the following steps performed by a gateway: receiving a non-3GPP access establishment request initiated by a user device based on an accessed wireless access point; querying the access ID of the wireless access point of the user device according to the establishment request; sending the access ID to a home server for storage in association with corresponding location information. The present application solution can realize the association of access points when non-3GPP accesses a mobile communication network, thereby realizing accurate traceability positioning of the user device. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of a method for tracing access to a mobile communication network provided by an embodiment of the present invention;

[0039] Figure 2 It is another schematic diagram of a flow chart of a method for tracing access to a mobile communication network provided by an embodiment of the present invention;

[0040] Figure 3It is another flow chart of the source tracing access method of the mobile communication network provided by the embodiment of the present invention;

[0041] Figure 4 It is a structural diagram of a terminal device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] It can be understood that the various embodiments described below can be combined or combined in a logical manner, and the embodiments of the present invention will not describe various combinations one by one.

[0044] Therefore, in view of the above-mentioned defects of the prior art, the present invention provides a traceability access method for a mobile communication network, see Figure 1 , is a flow chart of a method for tracing access to a mobile communication network provided by an embodiment of the present invention, the method comprising a gateway executing the following steps:

[0045] Step S1, receiving a non-3GPP access establishment request initiated by a user equipment based on an accessed wireless access point;

[0046] Step S2, querying the access ID of the wireless access point of the user equipment according to the establishment request;

[0047] Step S3: Send the access ID to the home server and store it in association with the corresponding location information.

[0048] In the specific implementation of this embodiment, the wireless access points of the wireless LAN are base-stationized, that is, each wireless access point is given an access ID, namely, AP ID (access point identity). The ID must be able to identify the wireless LAN where the AP is located, and the AP ID must be unique within the wireless LAN and not repeated with other AP IDs. The AP ID will be used in the Cell ID (base station identification) field and will be sent to the home server for storage, which is used for core network positioning and tracking of the UE location. Since the coverage of the AP is limited, far less than the base station coverage of the cellular mobile communication network, the indoor AP is usually only a few meters to more than ten meters. Therefore, the AP range to which the UE is connected is determined, and the location range of the UE is also determined. Putting the value of the AP ID in the Cell ID field of the authentication message does not require the addition of an additional traceability gateway, which is more compatible with the original system and saves the cost of the traceability gateway.

[0049] First, the wireless access point accessed by the user equipment sends a non-3GPP access establishment request to the gateway according to the wireless access point accessed;

[0050] It should be noted that, in this embodiment, the gateway is an evolved packet gateway ePDG, and in other embodiments, the gateway may be other gateways in the core network.

[0051] The gateway that receives the establishment request queries the access ID of the radio access network accessed by the user equipment according to the establishment request.

[0052] The gateway sends the access ID to the home server HSS, and associates the access ID with the corresponding location information for storage.

[0053] For application scenarios with high precision and safety requirements, the AP can be fixedly installed and will become invalid after removal, preventing inaccurate precision caused by AP position movement.

[0054] The present invention can obtain the access point and location information of the user equipment accessing the wireless local area network by acquiring and associating and storing the access ID of the wireless access point, with an accuracy of several meters to more than ten meters. However, some existing solutions can only obtain the location of a certain IP network segment coverage range, which is relatively broad.

[0055] In another embodiment of the present invention, the method further includes the following steps performed by the home server:

[0056] Receiving user identification information of a user device to be queried;

[0057] Querying the access ID configured for the access point of the user equipment to be queried according to the user identification information;

[0058] The location information of the user equipment is queried in a pre-constructed address information relationship table according to the access ID.

[0059] Specifically, when tracing the source of a user device, the home server HSS performs the tracing operation, see Figure 2 , is another flow chart of the tracing access method for a mobile communication network provided in an embodiment of the present invention.

[0060] Receiving user identification information of a user device to be queried;

[0061] It should be noted that user identification information includes but is not limited to IMSI, mobile phone number, etc.

[0062] The access ID configured for the access point of the user equipment to be queried is queried according to the user identification information.

[0063] Query the access point information of the UE in the HSS and obtain the AP ID. Query the access ID of the user equipment UE, that is, the AP ID, in the home server HSS.

[0064] The location information is searched in the AP ID and location information relationship table. That is, the location information is searched in the AP ID and address information relationship table using the AP ID to obtain the location information of the current UE.

[0065] The AP coverage range is limited, usually only a few meters to more than ten meters, and the signal is easily blocked by obstacles such as walls, further reducing the range. Therefore, the AP location can be regarded as the UE location with an accuracy of several meters to more than ten meters.

[0066] The application scheme of this application has a wide range of applications and many usage scenarios. Since the present invention uses a traceability method based on binding of AP ID and location information, the specific information of the AP accessed by the UE, including location information, can be queried through the AP ID. It does not need to be bound to a fixed network. In addition to being applicable to home scenarios, it can also be applied to large non-home indoor places such as shopping malls, especially indoor places without mobile communication network coverage or poor mobile signal coverage.

[0067] In another embodiment of the present invention, the method further includes the following steps performed by the user equipment before initiating the establishment request:

[0068] Send user authentication credentials to the wireless access point;

[0069] receiving an access point authentication credential fed back by the wireless access point;

[0070] Verifying the access point authentication credential;

[0071] When the verification is passed, the local IP is obtained through the DHCP protocol, and an IPsec establishment request is sent based on the obtained gateway address.

[0072] That is, the user equipment needs to be authenticated before initiating the establishment request.

[0073] Specifically, the user authentication credentials need to be sent to the wireless access point AP.

[0074] The wireless access point performs verification based on the received user authentication credentials, and feeds back the verified access point authentication credentials to the user device.

[0075] After receiving the access point authentication credential fed back by the wireless access point, the user equipment verifies the access point authentication credential.

[0076] When the verification is passed, the wireless local area network is accessed, that is, the local IP is obtained through the DHCP protocol, and an IPsec establishment request is sent based on the obtained gateway address.

[0077] Specifically, a local IP is obtained from the wireless LAN through DHCP.

[0078] After the user equipment obtains the address of the ePDG (pre-configured in the UE or obtained through DHCP) according to the definition of the 3GPP standard, it initiates an IPsec establishment request.

[0079] It should be noted that the specific authentication implementation process is an existing technical solution and will not be described in detail here.

[0080] The security of wireless LAN access is improved through two-way authentication of wireless access points and user devices. The existing solution uses WiFi network and only requires one-way authentication, which is not very secure.

[0081] In another embodiment of the present invention, the method further includes the following steps performed by the wireless access point:

[0082] After receiving the user authentication credential sent by the user equipment, sending the user authentication credential and the stored access point authentication credential to the authentication and identification server;

[0083] Checking the authentication result fed back by the authentication and identification server;

[0084] When the authentication result is successful, the access point authentication credential is fed back to the user equipment.

[0085] Specifically, when performing authentication, see Figure 3 , is another flow chart of the traceability access method for a mobile communication network provided by an embodiment of the present invention. When the method is executed, it specifically includes the following steps:

[0086] Authentication credentials: used for two-way authentication of user devices and access points, bound to the MAC address. Each user device and access point has authentication credentials pre-installed, and the authentication credentials are bound one-to-one with the device MAC address, including but not limited to digital certificates, digital signatures, etc.

[0087] AP ID: An ID that corresponds one-to-one to the MAC address of the access point. The AP ID is assigned to the access point based on the MAC address. The AP ID is unique in the entire communication system. After the access point is installed, the installation location information of the AP is recorded and bound to the AP ID. A relationship table between the AP ID and the location information is established. The AP location information can be queried through the relationship table using the AP ID.

[0088] The authentication and identification server verifies the credentials of the user equipment and access point, records the access point information of the UE, responds to the query request of the AP ID of the ePDG, returns the AP ID of the UE access point, maintains the correspondence between the AP ID and the MAC address, and pre-stores the mapping table of the MAC address and the AP ID.

[0089] Evolved Packet Gateway ePDG: In addition to supporting the functions defined by the 3GPP standard, it also adds the function of extracting the UE's MAC address from the IPSec message, and using the UE's corresponding MAC address to query the UE's access point AP ID from the authentication and identification server; at the same time, it also adds the function of filling the queried AP ID into the Cell ID field of the authentication request sent by the ePDG to the HSS for further use by the HSS and upper-layer applications.

[0090] When a user equipment UE accesses a wireless local area network, it must first send authentication credentials to a wireless access point.

[0091] The wireless access point sends its own authentication credentials and the authentication credentials of the UE to the authentication and identification server.

[0092] The authentication and identification server authenticates the authentication credentials of the UE and AP, and records the AP through which the UE accesses the local area network, and also records the MAC address of the UE for subsequent query of the UE access point information.

[0093] The authentication and identification server replies the authentication result of the authentication credential to the wireless access point.

[0094] The wireless access point checks the authentication result. If the authentication result is successful, the UE is allowed to access the wireless local area network, and the AP's own authentication credentials are sent to the user equipment UE.

[0095] The user equipment UE then verifies the authentication credentials of the AP. If the verification is successful, it accesses the wireless LAN and obtains a local IP from the wireless LAN through DHCP.

[0096] After the user equipment UE obtains the address of the ePDG (pre-configured in the UE or obtained through DHCP) according to the definition of the 3GPP standard, it initiates an IPsec establishment request.

[0097] The user equipment UE initiates an IKEv2 authentication request according to the 3GPP standard definition.

[0098] In another embodiment of the present invention, querying the access ID of the wireless access point of the user equipment according to the establishment request in step S1 includes:

[0099] Extracting the local IP address of the user equipment from the establishment request;

[0100] Querying the local ARP table according to the local IP to obtain the MAC address of the user device;

[0101] Use the MAC address to initiate an access point query request to the authentication and identification server to obtain the access ID of the wireless access point.

[0102] Specifically, the evolved packet gateway ePDG extracts the local IP address of the UE from IKEv2, and queries the local ARP table according to the local IP address to obtain the MAC address of the UE.

[0103] The evolved packet gateway ePDG uses the mac address to initiate a UE access point query request to the authentication and identification server;

[0104] The AP ID of the corresponding access point is queried according to the mac address, and the result is returned to the evolved packet gateway ePDG, thereby obtaining the access ID of the wireless access point.

[0105] In another embodiment provided by the present invention, the step S3 specifically includes:

[0106] The access ID is placed in the Cell-ID AVP field in the Diameter Authentication Request message and sent to the home server, and the home server associates and stores the Cell-ID AVP field with the corresponding location information.

[0107] During the specific implementation of this embodiment, the evolved packet gateway ePDG puts the AP ID into the Cell-ID AVP field in the DiameterAuthentication Request message and sends it to the home server HSS.

[0108] The home server HSS associates and stores the Cell-ID AVP field with the corresponding location information, and authenticates other contents according to 3GPP and IKEv2.

[0109] After the authentication is completed, the user equipment UE completes attachment to the mobile communication network core network via the wireless local area network.

[0110] Inserting the AP ID that identifies the location of the access point into the diameter AVP field related to the HSS interaction solves the problem of missing base station information when the core network accesses through non-3GPP access methods, and provides important location information for further expansion and use of the core network system.

[0111] In another embodiment provided by the present invention, the above step S3 further includes the following steps:

[0112] The access ID is put into the Location Information field and sent to the home server, and the home server associates and stores the Location Information field with the corresponding location information.

[0113] In the specific implementation of this embodiment, the Location Information field and other fields in other LTE / 5G networks used to report location information or base station information are used to send to the home server, which associates and stores the Location Information field with the corresponding location information and authenticates other content according to 3GPP and IKEv2.

[0114] After the authentication is completed, the UE completes the attachment to the mobile communication network core network via the wireless local area network.

[0115] Since the AP ID is filled into the Cell ID field or other message fields such as Location Infomation used for LTE / 5G user devices to report location information, and stored in the HSS (home server), it is compatible with the original traceability method and provides further expansion possibilities. The application solution has high compatibility with the core network and good scalability.

[0116] Another embodiment of the present invention provides a method for tracing access to a mobile communication network, see Figure 4 , is another flow chart of a method for tracing access to a mobile communication network provided by an embodiment of the present invention. The method is executed by a home server and includes the following steps:

[0117] Step S401, obtaining user identification information of a user equipment that has completed non-3GPP access;

[0118] Step S402, querying the access ID configured by the wireless access point of the user equipment according to the user identification information;

[0119] Step S403: query the location information of the user equipment in a pre-built address information relationship table according to the access ID.

[0120] Specifically, when tracing the source of the user equipment, the home server HSS performs the tracing operation, specifically:

[0121] Receiving user identification information of a user device to be queried;

[0122] It should be noted that user identification information includes but is not limited to IMSI, mobile phone number, etc.

[0123] Query the access ID configured at the access point of the user equipment to be queried according to the user identification information

[0124] Query the access point information of the UE in the HSS and obtain the AP ID. Query the access ID of the user equipment UE, that is, the AP ID, in the home server HSS.

[0125] The location information is searched in the AP ID and location information relationship table. That is, the location information is searched in the AP ID and address information relationship table using the AP ID to obtain the location information of the current UE.

[0126] The AP coverage range is limited, usually only a few meters to more than ten meters, and the signal is easily blocked by obstacles such as walls, further reducing the range. Therefore, the AP location can be regarded as the UE location with an accuracy of several meters to more than ten meters.

[0127] The application scheme of this application has a wide range of applications and many usage scenarios. Since the present invention uses a traceability method based on binding of AP ID and location information, the specific information of the AP accessed by the UE, including location information, can be queried through the AP ID. It does not need to be bound to a fixed network. In addition to being applicable to home scenarios, it can also be applied to large non-home indoor places such as shopping malls, especially indoor places without mobile communication network coverage or poor mobile signal coverage.

[0128] The mobile communication network tracing access method provided in this embodiment can execute all the steps of the mobile communication network tracing access method provided in any of the above embodiments, and the specific steps of the method are not described in detail here.

[0129] Yet another embodiment of the present invention provides a traceability access system for a mobile communication network, the system being used to implement the steps of any of the methods described in the above embodiments.

[0130] The mobile communication network tracing access system provided in this embodiment can execute all the steps and functions of the mobile communication network tracing access method provided in any of the above embodiments, and the specific functions of the system are not described in detail here.

[0131] It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for tracing access to a mobile communication network, characterized in that: The method includes the gateway performing the following steps: Receiving a non-3GPP access establishment request initiated by a user equipment based on an accessed wireless access point; Querying the access ID of the wireless access point of the user equipment according to the establishment request; The access ID is sent to the home server and stored in association with the corresponding location information.

2. The method for tracing access to a mobile communication network according to claim 1, characterized in that: The method further comprises the following steps performed by the home server: Receiving user identification information of a user device to be queried; Querying the access ID configured for the access point of the user equipment to be queried according to the user identification information; The location information of the user equipment is queried in a pre-constructed address information relationship table according to the access ID.

3. The method for tracing access to a mobile communication network according to claim 1, characterized in that: The method further includes the following steps performed by the user equipment before initiating the establishment request: Send user authentication credentials to the wireless access point; receiving an access point authentication credential fed back by the wireless access point; Verifying the access point authentication credential; When the verification is passed, the local IP is obtained through the DHCP protocol, and an IPsec establishment request is sent based on the obtained gateway address.

4. The method for tracing access to a mobile communication network according to claim 3, characterized in that: The method further comprises the following steps performed by the wireless access point: After receiving the user authentication credential sent by the user equipment, sending the user authentication credential and the stored access point authentication credential to the authentication and identification server; Checking the authentication result fed back by the authentication and identification server; When the authentication result is successful, the access point authentication credential is fed back to the user equipment.

5. The method for tracing access to a mobile communication network according to claim 4, characterized in that: The method further comprises the following steps performed by the authentication and identification server: Perform non-3GPP access authentication according to the user authentication credential and the access point authentication credential, and record the MAC address of the wireless access point and the user equipment; When the access verification succeeds, the authentication result is fed back to the wireless access point.

6. The method for tracing access to a mobile communication network according to claim 5, characterized in that: Querying the access ID of the wireless access point of the user equipment according to the establishment request includes: Extracting the local IP address of the user equipment from the establishment request; Querying the local ARP table according to the local IP to obtain the MAC address of the user device; Use the MAC address to initiate an access point query request to the authentication and identification server to obtain the access ID of the wireless access point.

7. The method for tracing access to a mobile communication network according to claim 1, characterized in that: The access ID is sent to the home server for storage in association with the corresponding location information, including: The access ID is placed in the Cell-ID AVP field in the Diameter Authentication Request message and sent to the home server, and the home server associates and stores the Cell-ID AVP field with the corresponding location information.

8. The method for tracing access to a mobile communication network according to claim 1, characterized in that: The access ID is sent to the home server for storage in association with the corresponding location information, including: The access ID is put into the Location Information field and sent to the home server, and the home server associates and stores the Location Information field with the corresponding location information.

9. A method for tracing access to a mobile communication network, characterized in that: The method is performed by a home server and includes: Obtain user identification information of a user equipment that completes non-3GPP access; Querying the access ID configured for the wireless access point of the user equipment according to the user identification information; The location information of the user equipment is queried in a pre-constructed address information relationship table according to the access ID.

10. A traceability access system for a mobile communication network, characterized in that: The system is used to implement the steps of any one of the methods described in claims 1 to 9.

Images