Patent Grant
10623405
This application is the U.S. national phase of PCT Application No. PCT/CN2014/088868 filed Oct. 17, 2014, which claims priority to Chinese Application No. 201410271224.6 filed Jun. 17, 2014, the disclosures of which are incorporated in their entirety by reference herein.
The present disclosure relates to the field of communication, and more particularly to a communication system and an access authentication method and system based on such a communication system.
In the past more than 20 years, a mobile communication technology has been rapidly developed to bring enormous influence to lifestyles and workstyles of people and each aspect such as politics and economy of the society. The human society enters an efficient information age, and service application requirements of each aspect explosively increase to bring great challenges to each aspect such as a frequency, technology and operation of a wireless mobile bandwidth system.
A 5th-Generation (5G) mobile communication technology-based mobile wideband system may become a wireless mobile communication system oriented to a requirement of the human information society after 2020, and it is a network integrating multiple services and multiple technologies, and makes technology evolutions and innovations to meet continuous development requirements of various services such as data and connections in the future and improve user experiences.
Along with improvement of a bandwidth and capability of a wireless mobile communication system, mobile Internet and Internet of things applications oriented to individuals and industries are rapidly developed, and great changes in a mobile communication related industrial ecology may be made. A wireless mobile communication technology and a computer and information technology may be crossed and integrated more closely and deeply, and integrated circuits, device processes, software technologies and the like may also be continuously and rapidly developed to support development of the future 5G mobile wideband industry.
From future 5G vision analysis made according to social responsibilities and functions, terminal users, service applications, network operation and the like, key capability requirements on 5G are concluded from a technical perspective as follows.
Requirement 1: traffic is increased by 1,000 times and unit area throughput is remarkably improved. The industry predicts that total global mobile data traffic may be 1,000 times total mobile data traffic in 2010 till 2020 on the basis of an increase trend of mobile communication network data traffic in recent years. This requires a throughput capability of a unit area, particularly a throughput capability in busy time, to also be improved by 1,000 times to reach more than 100 Gbps/km2.
Requirement 2: the number of connected devices is increased by 100 times. A range of future 5G network users is greatly expanded, and along with rapid development of the Internet of things, the industry predicts that the number of connected devices in 2020 may reach 50-100 billion. This requires the number of devices supported in a unit coverage area to be greatly increased, and the number of devices connected through a 5G mobile network in a unit area in some scenarios reaches 10 billion/km2, and is increased by 100 times compared with 4th-Generation (4G).
Requirement 3: a delay is shorter and reliability is higher. A 5G network is required to provide an experience of always being online for a user and meet requirements of more high-value scenarios such as industrial control and emergency communication. This requires a user-plane delay and a control-plane delay to be further reduced and shortened by 5-10 times to human response limits, for example: 5 ms (touch response), compared with 4G and really provide the experience of always being online on one hand. On the other hand, some services related to life and significant property safety of people require end-to-end reliability to be improved to 99.999% and even 100%.
an Evolved Universal Terrestrial Radio Access Network (E-UTRAN): arranged to realize all wireless functions related to an evolved network;
a Mobility Management Entity (MME): responsible for control-plane mobility management, including, but not limited to: user context and mobility state management and temporary user identifier allocation;
a Serving Gateway (S-GW): a user-plane entity responsible for user-plane data route processing;
a Packet Data Network Gateway (PDN GW or P-GW): responsible for a gateway function of access of User Equipment (UE) to a Packet Data Network (PDN),
herein it shall be illustrated that the P-GW and the S-GW may be integrated in a physical entity;
a Serving General Packet Radio Service Supporting Node (SGSN);
a Policy and Charging Rule Function (PCRF): arranged to be a policy control decision and flow-based charging control function; and
a Home Subscriber Server (HSS): arranged to store user subscription information.
However, for a future 5G network, the abovementioned network architecture mainly has the following shortcomings.
In an existing EPC architecture, services are all integrated in the MME for control, and service access is required to be controlled by the MME, so that a processing delay of service access is prolonged. Therefore, access of high-capacity 5G equipment brings great impact on a centralized MME management mode. In addition, each network element in an existing architecture model adopts a tunnel-connection-based technology, which is unfavorable for distributed dynamic management.
The present disclosure provides a communication system and an access authentication method and system based on such a communication system, so as to at least solve the problems of complexity and longer processing delay of an access authentication manner provided in the related technology.
According to an aspect of the present disclosure, a communication system is provided.
The communication system according to the embodiment of the present disclosure includes: a context generation function entity, arranged to generate a user context and store the generated user context in a context database matched with the context generation function entity; and a service access control function entity, arranged to acquire the user context from the context database and authenticate, by adopting the user context, a terminal initiating an access request.
Alternatively, the system further includes a service data source function entity, arranged to provide a data source for generating the user context for the context generation function entity.
Alternatively, the system further includes: the service processing function entity; the service access control function entity is further arranged to identify the access request initiated by the terminal, permit the terminal to send service data and forward the service data received from the terminal to the service processing function entity; and the service processing function entity is arranged to perform service processing on the service data.
According to another aspect of the present disclosure, an access authentication method based on the abovementioned communication system is provided.
The access authentication method according to the embodiment of the present disclosure includes that: a service access control function entity receives an access request message from a terminal, herein the access request message contains identification information of a terminal user; and the service access control function entity acquires a user context according to the identification information, and performs access authentication on the terminal by adopting the user context.
Alternatively, the step that the service access control function entity acquires the user context includes that: the service access control function entity sends a request message of acquiring the user context to a context database, herein the request message contains the identification information; and the service access control function entity receives a response message from the context database, herein the response message contains the user context corresponding to the identification information.
Alternatively, after the step that the service access control function entity receives the response message from the context database, the method further includes that: the context database determines a service access control function entity to be accessed by the terminal, the service access control function entity being adjacent to the service access control function entity; and the context database sends the user context to the adjacent service access control function entity.
Alternatively, the step that the service access control function entity acquires the user context includes that: the service access control function entity sends a request message of acquiring the user context to one or more service access control function entities and the context database respectively, the one or more service access control function entities being adjacent to the service access control function entity, herein the request message contains the identification information; and the service access control function entity stores the user context corresponding to the identification information in a first received response message, and discards user contexts in other response messages.
Alternatively, the step that the service access control function entity acquires the user context includes that: the service access control function entity sends a request message of acquiring the user context to the context database, herein the request message contains the identification information, and the request message is forwarded to an adjacent service access control function entity through the context database under the condition that the context database finds that the user context is stored in the adjacent service access control function entity; and the service access control function entity receives a response message from the adjacent service access control function entity, herein the response message may contain the user context corresponding to the identification information.
Alternatively, the step that the service access control function entity performs access authentication on the terminal by adopting the user context includes that: the service access control function entity judges whether to permit access of the terminal or not by adopting the user context; and if YES, the service access control function entity returns an access acknowledgement message to the terminal.
Alternatively, after the step that the service access control function entity performs access authentication by adopting the user context, the method further includes that: the service access control function entity receives an updating request message from the context database, herein the updating request message is arranged to update the user context; and the service access control function entity forwards the updating request message to an adjacent service access control function entity which has acquired the user context from the service access control function entity.
Alternatively, after the step that the service access control function entity forwards the updating request message, the method further includes that: the service access control function entity judges whether the terminal is currently in an inactive state or not and whether a time length for which the terminal is in the inactive state exceeds a preset threshold value or not; if YES, the user context is directly deleted; and if NO, the user context is updated according to the updating request message.
Alternatively, after the step that the service access control function entity performs access authentication on the terminal by adopting the user context, the method further includes that: the service access control function entity receives a service request message from the terminal; and the service access control function entity identifies the service request message, and selects a service processing function entity for the terminal according to the user context and capability information of the user, wherein the service processing function entity serves for the terminal.
Alternatively, after the step that the service access control function entity selects the service processing function entity for the terminal, the method further includes that: the service access control function entity receives a service data message from the terminal, and inserts the user context into the service data message; and the service access control function entity sends the service data message to the service processing function entity.
Alternatively, after the step that the service access control function entity sends the service data message to the service processing function entity, the method further includes that: the service processing function entity extracts the user context from the service data message; and the service processing function entity performs service processing on the service data message by adopting the user context and a preset service processing logic.
Alternatively, after the step that the service access control function entity performs access authentication on the terminal by adopting the user context, the method further includes that: the service access control function entity receives a service request message from the terminal; the service access control function entity identifies the service request message, and selects a service processing function entity for the terminal according to the user context and capability information of the terminal, wherein the service processing function entity serves for the terminal; and the service access control function entity sends the user context to the service processing function entity.
Alternatively, after the step that the service access control function entity sends the user context to the service processing function entity, the method further includes that: the service access control function entity receives a service data message from the terminal, and inserts associated information of the user context into the service data message; and the service access control function entity sends the service data message to the service processing function entity.
Alternatively, after the step that the service access control function entity sends the service data message to the service processing function entity, the method further includes that: the service processing function entity extracts the associated information from the service data message; the service processing function entity acquires context information according to the associated information; and the service processing function entity performs service processing on the service data message by adopting the user context and a preset service processing logic.
Alternatively, after the step that the service access control function entity selects the service processing function entity for the terminal, the method further includes that: the service access control function entity receives a service data message from the terminal, and inserts associated information of the user context into the service data message; and the service access control function entity sends the service data message to the service processing function entity.
Alternatively, after the step that the service access control function entity sends the service data message to the service processing function entity, the method further includes that: the service processing function entity extracts the associated information from the service data message; the service processing function entity acquires the user context from the context database according to the associated information; and the service processing function entity performs service processing on the service data message by adopting the user context and a preset service processing logic.
Alternatively, after the step that the service access control function entity selects the service processing function entity for the terminal, the method further includes that: the service access control function entity does not forward the service data message through the service processing function entity under the condition of determining that it is unnecessary to perform service processing on the service data message through the service processing function entity.
According to another aspect of the present disclosure, an access authentication system based on the abovementioned communication system is provided.
The access authentication method and system according to the embodiment of the present disclosure includes: a service access control function entity; the service access control function entity includes: a first receiving module, arranged to receive an access request message from a terminal, herein the access request message contains identification information of a terminal user; and an authentication module, arranged to acquire a user context according to the identification information, and by adopting the user context, perform access authentication on the terminal.
Alternatively, the authentication module includes: a first sending unit, arranged to send a request message of acquiring the user context to a context database, herein the request message contains the identification information; and a first receiving unit, arranged to receive a response message from the context database, herein the response message contains the user context corresponding to the identification information.
Alternatively, the abovementioned system further includes: the context database; the context database includes: a determination module, arranged to determine a service access control function entity to be accessed by the terminal, the service access control function entity being adjacent to the service access control function entity; and a first sending module, arranged to send the user context to the adjacent service access control function entity.
Alternatively, the authentication module may include: a second sending unit, arranged to send a request message of acquiring the user context to one or more service access control function entities and the context database respectively, the one or more service access control function entities being adjacent to the service access control function entity, herein the request message contains the identification information; and a processing unit, arranged to store the user context corresponding to the identification information in a first received response message, and discard user contexts in other response messages.
Alternatively, the authentication module may include: a third sending unit, arranged to send a request message of acquiring the user context to the context database, herein the request message contains the identification information, and the request message is forwarded to an adjacent service access control function entity through the context database under the condition that the context database finds that the user context is stored in the adjacent service access control function entity; and a second receiving unit, arranged to receive a response message from the adjacent service access control function entity, herein the response message contains the user context corresponding to the identification information.
Alternatively, the authentication module includes: a judgment unit, arranged to judge whether to permit access of the terminal or not by adopting the user context; and a feedback unit, arranged to return an access acknowledgement message to the terminal if output of the judgment unit is YES.
Alternatively, the service access control function entity further includes: a second receiving module, arranged to receive an updating request message from the context database, herein the updating request message is arranged to update the user context; and a forwarding module, arranged to forward the updating request message to an adjacent service access control function entity which has acquired the user context from the service access control function entity.
Alternatively, the service access control function entity m further includes: a judgment module, arranged to judge whether the terminal is currently in an inactive state or not and whether a time length for which the terminal is in the inactive state exceeds a preset threshold value or not; a deletion module, arranged to directly delete the user context when output of the judgment module is YES; and an updating module, arranged to update the user context according to the updating request message when the output of the judgment module is NO.
Alternatively, the service access control function entity further includes: a third receiving module, arranged to receive a service request message from the terminal; and a first identification module, arranged to identify the service request message, and select a service processing function entity for the terminal according to the user context and capability information of the user, wherein the service processing function entity serves for the terminal.
Alternatively, the service access control function entity further includes: a fourth receiving module, arranged to receive a service data message from the terminal, and insert the user context into the service data message; and a second sending module, arranged to send the service data message to the service processing function entity.
Alternatively, the system further includes: the service processing function entity; the service processing function entity may include: a first extraction module, arranged to extract the user context from the service data message; and a first processing module, arranged to perform service processing on the service data message by adopting the user context and a preset service processing logic.
Alternatively, the service access control function entity further includes: a fifth receiving module, arranged to receive a service request message from the terminal; a second identification module, arranged to identify the service request message, and select a service processing function entity for the terminal according to the user context and capability information of the terminal, wherein the service processing function entity serves for the terminal; and a third sending module, arranged to send the user context to the service processing function entity.
Alternatively, the service access control function entity further includes: a sixth receiving module, arranged to receive a service data message from the terminal, and insert associated information of the user context into the service data message; and a fourth sending module, arranged to send the service data message to the service processing function entity.
Alternatively, the service processing function entity further includes: a second extraction module, arranged to extract the associated information from the service data message; a first acquisition module, arranged to acquire context information according to the associated information; and a second processing module, arranged to perform service processing on the service data message by adopting the user context and a preset service processing logic.
Alternatively, the service access control function entity may further include: a seventh receiving module, arranged to receive a service data message from the terminal, and insert associated information of the user context into the service data message; and a fifth sending module, arranged to send the service data message to the service processing function entity.
Alternatively, the service processing function entity further includes: a third extraction module, arranged to extract the associated information from the service data message; a second acquisition module, arranged to acquire the user context from the context database according to the associated information; and a third processing module, arranged to perform service processing on the service data message by adopting the user context and a preset service processing logic.
Alternatively, the service access control function entity further includes: a fourth processing module, arranged not to forward the service data message through the service processing function entity under the condition of determining that it is unnecessary to perform service processing on the service data message through the service processing function entity.
According to the embodiment of the present disclosure, the context generation function entity is arranged to generate the user context and store the generated user context in the context database matched with the context generation function entity; the service access control function entity is arranged to acquire the user context from the context database and authenticate the terminal initiating the access request by adopting the user context, so that the problems that the access authentication manner provided in the related technology is comparatively complex and the processing delay is comparative higher are solved, thereby achieving the effects that the access authentication manner is simpler and the access delay is shorter.
The drawings described here are adopted to provide a further understanding to the present disclosure, and constitute a part of the present disclosure. Schematic embodiments of the present disclosure and descriptions thereof are adopted to explain the present disclosure and not intended to constitute improper limits to the present disclosure. In the drawings:
The present disclosure will be described below with reference to the drawings and embodiments in detail. It shall be illustrated that the embodiments in the present disclosure and characteristics in the embodiments may be freely combined under the condition of no conflicts.
An access authentication manner provided in the related technology is comparatively complex and the processing delay is higher. By adopting the system shown in
Alternatively, as shown in
Alternatively, as shown in
As an alternative embodiment of the present disclosure,
(1) The service data source function entity is mainly responsible for providing a data source for the context generation function entity.
(2) The context generation function entity and the context database are mainly responsible for collecting and summarizing service data source data related to a user and converting it into a user-based context data format or file understood by a service, and when a user terminal accesses a network, are responsible for pushing user context data or file to a user access or an adjacent service access control function entity, herein the abovementioned user context may include, but not limited to, the following information:
1) service subscription information of the user (for example: a service the user has subscribed);
2) QoS information of the user (for example: guaranteed bandwidth and maximum and minimum bandwidth information subscribed by the user);
3) user level information (for example: user priority information);
4) accounting information of the user;
5) behavioral habit information of the user;
6) security authorization and authentication information of the user;
7) service routing policy information of the user; and
8) third-party management information.
(3) The service access control function entity:
(4) The service processing function entity is responsible for performing service processing on a received data message according to the user context information notified by the service access control function entity and a preset service processing logic.
Step S702: a service access control function entity receives an access request message from a terminal, herein the access request message contains identification information of a terminal user; and
Step S704: the service access control function entity acquires a user context according to the identification information, and performs access authentication on the terminal by adopting the user context.
Alternatively, in Step S704, the operation that the service access control function entity acquires the user context may include the following operation:
Step S1: the service access control function entity sends a request message of acquiring the user context to a context database, herein the request message contains the identification information; and
Step S2: the service access control function entity receives a response message from the context database, herein the response message contains the user context corresponding to the identification information.
Step S802: the terminal sends an access request message to the service access control function entity, herein the access request message contains the identification information of the user;
Step S804: the service access control function entity checks whether there exists valid user context data or file or not, context validity being judged according to a valid state in the context, for example: a valid lifecycle or other state information of the context, and if YES, Step S810 is directly executed;
Step S806: if it is found that there does not exist any valid context, the service access control function entity sends a request message of acquiring the user context to the context database, herein the request message contains the identification information of the user;
Step S808: the context database records address information of the service access control function entity acquiring the context, and inserts a user context message to return the user context to the service access control function entity; and
Step S810: the service access control function entity may authenticate access of the user terminal according to the user context information, and returns an access acknowledgement to the terminal if permitting the user terminal to access.
Alternatively, after the operation that the service access control function entity receives the response message from the context database in Step S2, the method may further include the following steps:
Step S3: the context database determines a service access control function entity to be accessed by the terminal, the service access control function entity being adjacent to the service access control function entity; and
Step S4: the context database sends the user context to the adjacent service access control function entity.
Step S902: the terminal sends an access request message to the service access control function entity, herein the access request message contains the identification information of the user;
Step S904: the service access control function entity checks whether there exists valid user context data or file or not, context validity being judged according to a valid state in the context, for example: a valid lifecycle or other state information of the context, and if YES, Step 910 is directly executed;
Step S906: if it is found that there does not exist any valid context, the service access control function entity sends a request message of acquiring the user context to the context database, herein the request message contains the identification information of the user;
Step S908: the context database records address information of the service access control function entity acquiring the context, and inserts a user context message to return the user context to the service access control function entity;
Step S910: the service access control function entity may authenticate access of the user terminal according to the user context information, and returns an access acknowledgement to the terminal if permitting the user terminal to access;
Step S912: the context database senses a behavior characteristic of the user, and if finding that the user terminal is a high-mobility terminal or another factor, the context database determines to actively push the user context data or file to an adjacent service access control function entity accessed by the user to make it is unnecessary for the service access control function entity to acquire the context from the context database when the user moves to the adjacent service access control function entity; and
Step S914: the context database notifies and pushes the user context data or file to the adjacent service access control function entity for the service access control function entity to store the context.
Alternatively, the operation that the service access control function entity acquires the user context in Step S704 may include the following operation:
Step S5: the service access control function entity sends a request message of acquiring the user context to one or more service access control function entities and the context database respectively, the one or more service access control function entities being adjacent to the service access control function entity, herein the request message contains the identification information; and
Step S6: the service access control function entity stores the user context corresponding to the identification information in a first received response message, and discards user contexts in other response messages.
Step S1002: the terminal sends an access request message to service access control function entity 1, herein the access request message contains the identification information of the user;
Step S1004: service access control function entity 1 checks whether there exists valid user context data or file or not, and if YES, Step 1016 is directly executed;
Step S1006a-Step S1006c: in order to increase a user context acquisition speed of service access control function entity 1, service access control function entity 1 simultaneously sends a context acquisition request to adjacent service access control function entity 2 and adjacent service access control function entity 3, and simultaneously sends the context acquisition request to the context database;
Step S1008: adjacent service access control function entity 2 judges that there exists a valid user context after receiving the request, and then returns user context data or file to service access control function entity 1, and service access control function entity 1 stores first received context information;
Step S1010: service access control function entity 3 judges that there does not exist any valid user context after receiving the request, and discards the abovementioned request;
Step S1012: the context database may also return a user context to service access control function entity 1 after receiving the request;
Step S1014: service access control function entity 1 determines that the context information has been acquired after receiving the context information returned by the context database, and discards the context information; and
Step S1016: service access control function entity 1 may authenticate access of the user terminal according to the user context information, and returns an access acknowledgement to the terminal if permitting the user terminal to access.
Alternatively, the operation that the service access control function entity acquires the user context in Step S704 may include the following steps:
Step S7: the service access control function entity sends a request message of acquiring the user context to the context database, herein the request message contains the identification information, and the request message is forwarded to an adjacent service access control function entity through the context database under the condition that the context database finds that the user context is stored in the adjacent service access control function entity; and
Step S8: the service access control function entity receives a response message from the adjacent service access control function entity, herein the response message contains the user context corresponding to the identification information.
Step S1102: the terminal sends an access request message to the service access control function entity, herein the access request message contains the identification information of the user;
Step S1104: the service access control function entity checks whether there exists valid user context data or file or not, and if YES, Step 1114 is directly executed;
Step S1106: if finding that there does not exist any valid context, the service access control function entity sends a request message of acquiring the user context to the context database, herein the request message contains the identification information of the user;
Step S1108: the context database finds that the user context requested by the service access control function entity exists in its adjacent service access control function entity;
Step S1110: the context database forwards (or reorients) the request message to the adjacent service access control function entity;
Step S1112: the adjacent service access control function entity determines that there exists a valid user context after receiving the abovementioned request message, and then returns the user context data or file to the service access control function entity, and the service access control function entity stores the received user context information; and
Step S1114: the service access control function entity may authenticate access of the user terminal according to the user context information, and returns an access acknowledgement to the terminal if permitting the user terminal to access.
In a alternative implementation process, the operation that the service access control function entity performs access authentication on the terminal by adopting the user context in Step S704 may include the following operation:
Step S9: the service access control function entity judges whether to permit access of the terminal or not by adopting the user context; and
Step S10: if YES, the service access control function entity returns an access acknowledgement message to the terminal.
Alternatively, after the operation that the service access control function entity performs access authentication by adopting the user context in Step S704, the method may further include the following operation:
Step S11: the service access control function entity receives an updating request message from the context database, herein the updating request message is arranged to update the user context; and
Step S12: the service access control function entity forwards the updating request message to an adjacent service access control function entity which has acquired the user context from the service access control function entity.
Alternatively, after the operation that the service access control function entity forwards the updating request message in Step S12, the method may further include the following steps:
Step S13: the service access control function entity judges whether the terminal is currently in an inactive state or not and whether a time length for which the terminal is in the inactive state exceeds a preset threshold value or not;
Step S14: if YES, the user context is directly deleted; and
Step S15: if NO, the user context is updated according to the updating request message.
Step S1202: the context database senses that the user context has changed or gotten invalid;
Step S1204: the context database acquires the address information of the service access control function entity acquiring the user context according to a record, and then sends a context updating request message to the service access control function entity, herein the context updating request message may contain the latest user context;
Step S1206: the service access control function entity finds that an adjacent service access control function entity once acquired the user context as well;
Step S1208: the service access control function entity sends the context updating request message to the adjacent service access control function entity;
Step S1210: the service access control function entity checks to find that the user terminal corresponding to the user context is in the inactive state, and if time for which the user terminal is kept inactive in the service access control function entity has exceeded the preset threshold value, deletes the stored user context, otherwise continues executing Step S1212; and
Step S1212: the service access control function entity updates the user context of the context database.
It shall be illustrated that Step S1212 is an optional step, and if the user context has been included or the context database has indicated that the context is invalid in Step S1204, Step S1212 is not required to be executed any more.
Alternatively, after the operation that the service access control function entity performs access authentication on the terminal by adopting the user context in Step S704, the method may further include the following operation:
Step S16: the service access control function entity receives a service request message from the terminal; and
Step S17: the service access control function entity identifies the service request message, and selects a service processing function entity for the terminal according to the user context and capability information of the user, wherein the service processing function entity serves for the terminal.
Alternatively, after the operation that the service access control function entity selects the service processing function entity for the terminal in Step S17, the method may further include the following operation:
Step S18: the service access control function entity receives a service data message from the terminal, and inserts the user context into the service data message; and
Step S19: the service access control function entity sends the service data message to the service processing function entity.
Alternatively, after the operation that the service access control function entity sends the service data message to the service processing function entity in Step S19, the method may further include the following steps:
Step S20: the service processing function entity extracts the user context from the service data message; and
Step S21: the service processing function entity performs service processing on the service data message by adopting the user context and a preset service processing logic.
Step S1302: the terminal initiates a service request message, herein the service request message contains information such as an identifier of the user and an initiated service type;
Step S1304: the service access control function entity performs authentication and authorization on a service initiated by the user terminal;
Step S1306: the service access control function entity identifies the service initiated by the user, and selects a service processing function entity which serves for a current service of the user according to subscription information in the user context and capability information of the terminal;
Step S1308: the service access control function entity returns a service request acknowledgement message to the user terminal if the service request of the user passes authentication;
Step S1310: the user terminal sends a service data message to a network;
Step S1312: the service access control function entity inserts context information corresponding to the user into the received service data message;
Step 1314: the service access control function entity forwards the service data message to the abovementioned selected service processing function entity;
Step S1316: the service processing function entity acquires the user context information inserted into the service data message, and performs service processing on the received service data message according to a preset service processing logic; and
Step S1318: the service processing function entity forwards the processed service data message to a next hop.
Alternatively, after the operation that the service access control function entity performs access authentication on the terminal by adopting the user context in Step S704, the method may further include the following operation:
Step S22: the service access control function entity receives a service request message from the terminal;
Step S23: the service access control function entity identifies the service request message, and selects a service processing function entity for the terminal according to the user context and capability information of the terminal, wherein the service processing function entity serves for the terminal; and
Step S24: the service access control function entity sends the user context to the service processing function entity.
Alternatively, after the operation that the service access control function entity sends the user context to the service processing function entity in Step S24, the method may further include the following operation:
Step S25: the service access control function entity receives a service data message from the terminal, and inserts associated information of the user context into the service data message; and
Step S26: the service access control function entity sends the service data message to the service processing function entity.
Alternatively, after the operation that the service access control function entity sends the service data message to the service processing function entity in Step S26, the method may further include the following steps:
Step S27: the service processing function entity extracts the associated information from the service data message;
Step S28: the service processing function entity acquires context information according to the associated information; and
Step S29: the service processing function entity performs service processing on the service data message by adopting the user context and a preset service processing logic.
Step S1402: the terminal initiates a service request message, herein the service request message contains information such as an identifier of the user and an initiated service type;
Step S1404: the service access control function entity performs authentication and authorization on a service initiated by the user terminal;
Step S1406: the service access control function entity identifies the service initiated by the user, and selects a service processing function entity which serves for a current service of the user according to subscription information in the user context and capability information of the terminal;
Step S1408: the service access control function entity returns a service request acknowledgement message to the user terminal if the service request of the user passes authentication;
Step S1410: the service access control function entity transmits the user context information to the selected service processing function entity;
Step S1412: the user terminal sends a service data message to a network;
Step S1414: the service access control function entity inserts context associated information, for example: context identification information, corresponding to the user into the received service data message;
Step S1416: the service access control function entity forwards the service data message to the abovementioned selected service processing function entity;
Step S1418: the service processing function entity acquires the user context associated information in the service data message, associates the obtained user context information according to the user context associated information, and performs service processing on the received service data message according to a preset service processing logic; and
Step S1420: the service processing function entity forwards the processed service data message to a next hop.
Alternatively, after the operation that the service access control function entity selects the service processing function entity for the terminal in Step S17, the method may further include the following steps:
Step S30: the service access control function entity receives a service data message from the terminal, and inserts associated information of the user context into the service data message; and
Step S31: the service access control function entity sends the service data message to the service processing function entity.
Alternatively, after the operation that the service access control function entity sends the service data message to the service processing function entity in Step S31, the method may further include the following operation:
Step S32: the service processing function entity extracts the associated information from the service data message;
Step S33: the service processing function entity acquires the user context from the context database according to the associated information; and
Step S34: the service processing function entity performs service processing on the service data message by adopting the user context and a preset service processing logic.
Step S1502: the terminal initiates a service request message, herein the service request message contains information such as an identifier of the user and an initiated service type;
Step S1504: the service access control function entity performs authentication and authorization on a service initiated by the user terminal;
Step S1506: the service access control function entity identifies the service initiated by the user, and selects a service processing function entity which serves for a current service of the user according to subscription information in the user context and capability information of the terminal;
Step S1508: the service access control function entity returns a service request acknowledgement message to the user terminal if the service request of the user passes authentication;
Step S1510: the user terminal sends a service data message to a network;
Step S1512: the service access control function entity inserts context associated information, for example: context identification information, corresponding to the user into the received service data message;
Step S1514: the service access control function entity forwards the service data message to the abovementioned selected service processing function entity;
Step S1516: the service processing function entity acquires the user context information from the context database according to the context associated information in the service data message;
Step S1518: the service processing function entity performs service processing on the received service data message according to a preset service processing logic; and
Step S1520: the service processing function entity forwards the processed service data message to a next hop.
Alternatively, after the operation that the service access control function entity selects the service processing function entity for the terminal in Step S17, the method may further include the following step:
Step S35: the service access control function entity does not forward the service data message through the service processing function entity under the condition of determining that it is unnecessary to perform service processing on the service data message through the service processing function entity.
Step S1602: the terminal initiates a service request message, herein the service request message contains information such as an identifier of the user and an initiated service type;
Step S1604: the service access control function entity performs authentication and authorization on a service initiated by the user terminal;
Step S1606: the service access control function entity identifies a service initiated by the user, and selects a service processing function entity which serves for the current service of the user according to subscription information in the user context and capability information of the terminal,
herein the service access control function entity finds that the current service initiated by the user is not required to be processed by the service processing function entity in the alternative embodiment;
Step S1608: the service access control function entity returns a service request acknowledgement message to the user terminal if the service request of the user passes authentication;
Step S1610: the user terminal sends a service data message to a network; and
Step S1612: the service access control function entity considers that it is unnecessary for the service processing function entity to process the received service data message, and then forwards the service data message to the Internet or a destination server.
Alternatively, the authentication module 102 may include: a first sending unit (not shown in the figure), arranged to send a request message of acquiring the user context to a context database, herein the request message contains the identification information; and a first receiving unit (not shown in the figure), arranged to receive a response message from the context database, herein the response message may contain the user context corresponding to the identification information.
Alternatively, as shown in
Alternatively, the authentication module 102 may include: a second sending unit (not shown in the figure), arranged to send a request message of acquiring the user context to one or more service access control function entities and the context database respectively, the one or more service access control function entities being adjacent to the service access control function entity, herein the request message contains the identification information; and a processing unit (not shown in the figure), arranged to store the user context corresponding to the identification information in a first received response message, and discard user contexts in other response messages.
Alternatively, the authentication module 102 may include: a third sending unit (not shown in the figure), arranged to send a request message of acquiring the user context to the context database, herein the request message contains the identification information, and the request message is forwarded to an adjacent service access control function entity through the context database under the condition that the context database finds that the user context is stored in the adjacent service access control function entity; and a second receiving unit (not shown in the figure), arranged to receive a response message from the adjacent service access control function entity, herein the response message contains the user context corresponding to the identification information.
Alternatively, the authentication module 102 may include: a judgment unit (not shown in the figure), arranged to judge whether to permit access of the terminal or not by adopting the user context; and a feedback unit (not shown in the figure), arranged to return an access acknowledgement message to the terminal if output of the judgment unit is YES.
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
Alternatively, as shown in
From the above, it can be seen that the abovementioned embodiment achieves the following technical effects (it shall be illustrated that these effects are effects which may be achieved by some alternative embodiments): by adopting the technical solutions provided by the embodiment of the present disclosure, the problems that the access authentication manner is comparatively complex and the processing delay is higher provided in the related technology are solved, thereby achieving the effects the access authentication manner is simple and the access delay is lower.
Apparently, those skilled in the art should know that each of the abovementioned modules or each of the abovementioned steps of the present disclosure may be implemented by a universal computing device, and the modules or steps may be concentrated on a single computing device or distributed on a network formed by a plurality of computing devices, and may alternatively be implemented by program codes executable for the computing devices, so that the modules or steps may be stored in a storage device for execution with the computing devices, the shown or described steps may be executed in sequences different from those described here under some circumstances, or may form each integrated circuit module respectively, or multiple modules or steps therein may form a single integrated circuit module for implementation. As a consequence, the present disclosure is not limited to the combination of any specific hardware and software.
What is mentioned above is only the alternative embodiment of the present disclosure and not intended to limit the present disclosure, and for those skilled in the art, the present disclosure may have various modifications and variations. Any modifications, equivalent replacements, improvements and the like within the spirit and principle of the present disclosure shall fall within the scope of protection of the present disclosure.
As mentioned above, the communication system and access authentication method and system based on the communication system provided by the embodiment of the present disclosure have the following beneficial effects: an access authentication manner is simple and the processing delay is lower.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2014 1 0271224 | Jun 2014 | CN | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/CN2014/088868 | 10/17/2014 | WO | 00 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2015/192562 | 12/23/2015 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 20010053135 | Carpelan | Dec 2001 | A1 |
| 20020032869 | Lamberton | Mar 2002 | A1 |
| 20020035699 | Crosbie | Mar 2002 | A1 |
| 20030065952 | Otsuka | Apr 2003 | A1 |
| 20080016230 | Holtmanns | Jan 2008 | A1 |
| 20100161794 | Horn | Jun 2010 | A1 |
| 20170208063 | Tao | Jul 2017 | A1 |
| Number | Date | Country |
|---|---|---|
| 1881876 | Dec 2006 | CN |
| 102394818 | Mar 2012 | CN |
| 102005052263 | May 2007 | DE |
| 2013169161 | Nov 2013 | WO |
| Entry |
|---|
| Extend European Search Report for EP 14895450.6, completed by the European Patent Office on May 18, 2017 All together 9 Pages. |
| International Search Report for PCT/CN2014/088868, English Translation attached to original, Both completed by the Chinese Patent Office on Jan. 9, 2015, All together 5 Pages. |
| Number | Date | Country | |
|---|---|---|---|
| 20170208063 A1 | Jul 2017 | US |
