CN105681268B - Data transferring method and device - Google Patents

Abstract

The present invention discloses a data transmission method and device, wherein the method includes: the local area network gateway LGW assigns an IP address to the user equipment according to the authentication information of the user equipment, and saves the IP address and the area that the IP address can access network, and the way of establishing a secure connection with the access network gateway of the area network; the LGW performs data transmission between the user equipment and the area network corresponding to the IP address of the user equipment through a secure tunnel, wherein, The secure tunnel is established according to the method for establishing the secure connection. Through the present invention, the problem that different users access different area networks is not considered in the related art is solved, and different users access different area networks according to assigned IP addresses.

Description

Data transmission method and device

technical field

The present invention relates to the communication field, in particular, to a data transmission method and device.

Background technique

LTE proposes the concept of heterogeneous network (Heterogeneous Network, HN for short), thus evolving some new technologies, and 3GPP (3rd Generation Partnership Project: third-generation cooperation project) also conducts special research on this technology, such as local service switching local IP access (Local IP Access, referred to as LIPA), and data offload (SIPTO: Selected IP Traffic Offload, optional IP service offload), etc., directly exchange local or low-value data services and offload them to the Internet instead of sending them again Go back to the core network forwarding to avoid the impact of a large number of low-value services on the core network.

LIPA is proposed based on the Home eNodeB (HeNB for short) network. Its core idea is to offload the communication data of the local network directly from the HeNB, thereby reducing the load and transmission cost of the core network. LIPA technology can further evolve into the concept of local area network, that is, a local wireless network is deployed in a limited area. Wireless network users can access local area network resources after authentication, and can also access Internet resources. Access to the local network does not require billing or In addition to billing, the user can access the intranet without changing the terminal, and only needs to change the Access Point Name (APN for short).

User Equipment (UE for short) is based on standard IP data, and after a mobile user accesses a regional local network, it needs to strictly limit permissions. If multiple companies share one HeNB, the users of company A must not access the network of company B, and the employees of company B cannot access the network of company A in the same way. In addition, in a company, ordinary employees cannot access sensitive departments such as finance, and only senior authorized users can access them. For some temporary visiting customers, it is necessary to limit the customer's accessible resources as much as possible under the premise of meeting the basic needs of customers.

The inventors found that the intra-area wired network is complicated, and it is necessary to isolate internal users and divide different users into different area networks, for example, into different virtual local area networks (VLAN for short). However, the problem of different users accessing different regional networks has not been considered in related technologies.

Contents of the invention

The present invention provides a data transmission method and device to at least solve the problem that different users access different area networks which are not considered in the related art.

According to one aspect of the present invention, a data transmission method is provided, including: the local area network gateway LGW assigns an IP address to the user equipment according to the received configuration information, and saves the IP address and the IP address can be accessed The corresponding relationship between the local area network and the way of establishing a secure connection with the access network gateway of the local area network; the LGW is connected between the user equipment and the local area network corresponding to the IP address of the user equipment through a secure tunnel Data transmission between the secure tunnels, wherein the secure tunnel is established according to the manner in which the secure connection is established.

Further, before the LGW saves the corresponding relationship, the method further includes: the LGW forwards the authentication information used to authenticate the user equipment to an authentication server; the LGW receives the authentication information returned by the authentication server. The above configuration information, wherein the returned information includes: the access IP address allocated for the user equipment, the area network that the IP address can access, and the access network gateway established with the area network The way to connect securely.

Further, before the LGW forwards the authentication information used to authenticate the user equipment to an authentication server, the method further includes: the LGW receives the authentication information from the core network, where the authentication information is It is input after the user equipment selects the name of the access point of the local area network.

Further, the way of establishing the connection with the access network gateway of the regional network includes at least one of the following: IPSec way, SSL way, TLS way.

Further, the method further includes: the LGW receiving a notification that the user equipment is out of service range; and the LGW deleting the corresponding relationship.

According to another aspect of the present invention, a data transmission device is provided, which is applied to a local area network gateway LGW, including: an allocation module, configured to allocate an IP address to the user equipment according to the received configuration information, and store the The corresponding relationship between the IP address and the local area network that the IP address can access, and the way to establish a secure connection with the access network gateway of the local network; the data transmission module is used to communicate between the user equipment and the Data transmission is performed between the area networks corresponding to the IP address of the user equipment, wherein the secure tunnel is established according to the manner of establishing the secure connection.

Further, the apparatus further includes: a forwarding module, configured to forward the configuration used to authenticate the user equipment to an authentication server; a first receiving module, configured to receive information returned by the authentication server, wherein the The returned information includes: the access IP address allocated for the user equipment, the area network that the IP address can access, and the way to establish a secure connection with the access network gateway of the area network.

Further, the apparatus further includes: a second receiving module, configured to receive the authentication information from the core network, wherein the authentication information is input after the user equipment selects the name of the area network access point.

Further, the way of establishing the connection with the access network gateway of the regional network includes at least one of the following: IPSec way, SSL way, TLS way.

Further, the apparatus further includes: a third receiving module, configured to receive a notification that the user equipment is out of service range; a deleting module, configured to delete the corresponding relationship.

According to the present invention, the local area network gateway LGW is used to assign an IP address to the user equipment according to the received configuration information, and save the IP address, the area network that the IP address can access, and the connection with the area network The corresponding relationship between the ways in which the network access gateway establishes a secure connection; the LGW performs data transmission between the user equipment and the area network corresponding to the IP address of the user equipment through a secure tunnel, wherein the secure tunnel is It is established according to the way of establishing the secure connection, which solves the problem in the related art that different users access different area networks, and different users access different area networks according to the assigned IP addresses.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

Fig. 1 is a flowchart of a data transmission method according to an embodiment of the present invention;

2 is a block diagram of a data transmission device according to an embodiment of the present invention;

FIG. 3 is a first block diagram of a data transmission device according to a preferred embodiment of the present invention;

FIG. 4 is a second block diagram of a data transmission device according to a preferred embodiment of the present invention;

Fig. 5 is a third block diagram of a data transmission device according to a preferred embodiment of the present invention;

FIG. 6 is a schematic diagram of a regional network according to an embodiment of the present invention;

Fig. 7 is a schematic diagram of a UE accessing an area network according to an embodiment of the present invention.

Detailed ways

Hereinafter, the present invention will be described in detail with reference to the drawings and examples. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

A data transmission method is provided in this embodiment. FIG. 1 is a flowchart of a data transmission method according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:

Step S102, the local area network gateway LGW assigns an IP address to the user equipment according to the received configuration information, and saves the IP address and the local area network that the IP address can access, and establishes a secure connection with the access network gateway of the local area network The corresponding relationship of the way;

In step S104, the LGW transmits data between the user equipment and the area network corresponding to the IP address of the user equipment through a secure tunnel, wherein the secure tunnel is established according to the method of establishing the secure connection.

Through the above steps, data transmission is performed between the user equipment and the local area network corresponding to the IP address of the user equipment through a secure tunnel, so that the IP address and the local area network that can be accessed by the IP address, and the access to the local area network The corresponding relationship between the ways in which the network gateway establishes a secure connection controls the access authority of the user equipment, and solves the problem that different users access different area networks in the related art, and different users access different area networks according to the assigned IP addresses.

In order to be more secure, the configuration information can be sent after the authentication is completed. There are many ways to authenticate the user equipment. For example, in an optional implementation, before the LGW saves the correspondence, the LGW also The authentication information used to authenticate the user equipment may be forwarded to the authentication server; the LGW receives the configuration information returned by the authentication server, wherein the returned information includes: the access IP address allocated for the user equipment, and the The local area network that the IP address can access, and the way to establish a secure connection with the access network gateway of the local network.

Before the LGW forwards the authentication information used to authenticate the user equipment to the authentication server, the LGW may also receive the authentication information from the core network, where the authentication information is input after the user equipment selects the name of the local area network access point .

There can be many ways to establish a connection with the access network gateway of the local area network. In an optional embodiment, the manner to establish a connection with the access network gateway of the local area network can include at least one of the following: IPSec mode, SSL mode, TLS mode.

In an optional embodiment, when the user equipment is out of the service range, the LGW receives a notification that the user equipment is out of the service range, and deletes the corresponding relationship, releasing resources and saving storage space.

The embodiment of the present invention also provides a data transmission device, which is applied to a local area network gateway LGW. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and those that have already been described will not be repeated. As used below, the term "module" may be a combination of software and/or hardware that realizes a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

Fig. 2 is a block diagram of a data transmission device according to an embodiment of the present invention. As shown in Fig. 2 , it includes: an allocation module 22 and a data transmission module 24, each module will be briefly described below.

Assignment module 22, configured to assign an IP address to the user equipment according to the received configuration information, and store the IP address and the local area network that the IP address can access, and the way to establish a secure connection with the access network gateway of the local network corresponding relationship;

The data transmission module 24 is configured to transmit data between the user equipment and the local area network corresponding to the IP address of the user equipment through a secure tunnel, wherein the secure tunnel is established according to the method of establishing the secure connection.

Fig. 3 is a block diagram one of a data transmission device according to a preferred embodiment of the present invention. As shown in Fig. 3, the device also includes:

A forwarding module 32, configured to forward the authentication information used to authenticate the user equipment to an authentication server;

The first receiving module 34 is configured to receive the configuration information returned by the authentication server, wherein the returned information includes: the access IP address allocated for the user equipment, and the local area network that the IP address can access, and The way to establish a secure connection with the access network gateway of the local area network.

Fig. 4 is a block diagram two of a data transmission device according to a preferred embodiment of the present invention. As shown in Fig. 4, the device also includes:

The second receiving module 42 is configured to receive the authentication information from the core network, where the authentication information is input after the user equipment selects the name of the local area network access point.

In an optional embodiment, at least one of the following ways to establish a connection with the access network gateway of the area network can be determined: IPSec way, SSL way, TLS way.

Fig. 5 is a block diagram three of a data transmission device according to a preferred embodiment of the present invention. As shown in Fig. 5, the device also includes:

The third receiving module 52 is configured to receive a notification that the user equipment is not within the service range;

The deletion module 54 is configured to delete the corresponding relationship.

The embodiments of the present invention will be further described below in conjunction with optional embodiments.

LIPA introduces a network logical node of Local Gateway (LGW for short), and HeNB data is aggregated to LGW and then distributed. In practical applications, LGW and HeNB can be the same physical entity or separate physical entities.

When the user accesses the area network, the user selects the access area network APN on the UE, enters the user name and password, the core network sends the user authentication information of the area network to the LGW, and the LGW forwards it to the authentication server for authentication.

For user authentication, the LGW is deployed inside the LAN, and the authentication server that accesses the LGW is also inside the LAN. The LGW sends the UE request data to the authentication server. The authentication protocol is generally the standard Radius protocol (but not limited to the Radius protocol). The authentication information sent by the LGW to the authentication server includes the unique identity (Identity, referred to as UE ID), generally the global The International Mobile Subscriber Identification Number (IMSI) number of the Universal Subscriber Identity Module (USIM), or the mobile phone number, the user name and password for the UE to access the APN, etc.

Access authority allocation, after the authentication server receives the authentication request, it returns the pre-planned information to the UE and LGW, and returns the user IP, access gateway IP, access authority, authentication method, encryption algorithm, etc. for the user to access the local network.

Access gateway processing. The LAN access gateway needs to filter the incoming packets. For sensitive access areas, it is recommended to use strong authentication and encryption. For example, an IP Security (IP Security, IPSec for short) tunnel or Secure Sockets Layer/Transport Layer Security (Secure Sockets Layer/Transport Layer Security, SSL/TLS for short) is established between the LGW and the access gateway. In the IPSec tunnel, only Only messages in a specific range (IP, protocol, and port in a specified range) can access the LAN, and the rest of the messages are discarded directly.

The user UE accesses the local network, and the UE accesses the regional network. When the LGW forwards data, it first queries the gateway IP, access authority, authentication method, and encryption algorithm corresponding to the UE's access to the local network. If it is an IPSec method, an IPSec tunnel is established between the LGW and the access gateway assigned by the authentication server; if it is another secure access method (such as SSL/TLS), the LGW establishes a corresponding secure connection with the access gateway according to the protocol. For the message sent by the UE to the area network, the LGW encrypts it and sends it to the access gateway, and the access gateway decrypts it and then forwards it to the internal network. For the message from the area network to the UE, the access gateway encrypts it and forwards it to the LGW. After the LGW decrypts it, it forwards it to the corresponding UE according to the UE's IP.

To release resources, when the UE switches or leaves the base station, the LGW deletes the previously reserved UE and security tunnel mapping table synchronously.

For some large office buildings, there may be many smaller companies on each floor. Because of the small footprint, these companies will share a base station (most of them are Femto-level small stations), so the indoor network deployment may be Public parties such as property companies provide. For the shared network of multiple companies provided by the property management company, the access rights of different companies need to be isolated. For example, employees of company A cannot access the network of company B, and employees of company B cannot access the network of company A similarly.

When the property management company deploys the HeNB and LGW, it can consider establishing a secure tunnel between the LGW and the gateways of different companies, and users of different companies can access the company intranet through the secure tunnel.

For a large enterprise, there are many departments. Some public departments can access to every user in the publicity and advertising departments, but similar financial departments can only restrict access to certain advanced users. LGW can negotiate rules with access servers of different departments, such as access to public promotional materials, direct plain text access without encryption; access to other sensitive departments such as finance requires authentication and encryption between LGW and the access gateway.

Fig. 6 is a schematic diagram of an area network network according to an embodiment of the present invention. As shown in Fig. 6, an area network is a local wireless network deployed in a limited area, which may be a network of different companies or different floors. There is no need to replace the UE inside the regional network, nor does the base station need to change the frequency band, only the APN to be accessed needs to be modified.

The local area network needs the core network to support local switching and other functions. The local area network authentication server is placed in the local area network. The UE's access rights, IP, access gateway, authentication method, encryption algorithm, etc. are all allocated by the area network authentication server. Different recommendations Companies or different floors use different access gateways to isolate.

Fig. 7 is a schematic diagram of a UE accessing an area network according to an embodiment of the present invention. As shown in Fig. 7, the UE selects the APN of the area network, and after the user inputs the authentication information, the core network sends the user authentication information of the area network to the LGW, and the LGW forwards it to the Authentication server authentication.

User access authentication includes the following steps:

S702, the LGW sends the authentication data to the authentication server, and the authentication server authenticates the user information, and after the authentication is passed, allocates the UE's access IP, access authority and authentication method, mainly including the UE's user IP, access gateway, authentication method, and encryption algorithm and other information;

S704. After receiving the authentication information, the LGW assigns the user IP to the corresponding UE, saves the IP of the corresponding UE, and establishes a secure connection with the access gateway according to the authentication method and encryption algorithm assigned by the authentication server;

S706. The LGW receives the data sent by the UE to the area network, and queries the stored correspondence between the UE, the IP, and the security tunnel. If encryption is required, the LGW encrypts the data and sends it to the access gateway according to the negotiated secret key, and the access gateway sends the data to the access gateway. The text is decrypted and sent to the internal network; if there is a local area network internal message sent to the UE, the access gateway encrypts the message according to the negotiated secret key and sends it to the LGW. After the LGW decrypts it, it forwards it to different UEs according to the IP;

S708, if the UE data is transmitted between the same LGW, it is directly forwarded in the LGW without authentication and encryption processing. If the UE switches, leaves the base station, or loses power, etc., the base station will notify the LGW to delete the corresponding UE and IP correspondence before detecting that the UE is not in the service range, and also remove the pre-established tunnel connection;

S710, the UE accesses the local network.

The LGW in this optional embodiment needs to implement the following functions. It should be noted that the following functions can be implemented by different modules.

For the authentication function, the LGW needs to encapsulate the authentication information message to the authentication server to complete the authentication function for UE access.

For the secure connection function, the LGW needs to establish a secure connection with the access gateway to ensure reliable transmission of user data.

UE and IP, security tunnel mapping list, LGW needs to save the mapping relationship between each access area network UE's corresponding IP and security tunnel, send the UE's data in the negotiated security tunnel, and send it to the corresponding access gateway. When receiving the data packet from the area network to the UE, the data packet is decrypted and forwarded to the corresponding UE.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases, in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (8)

1. A data transmission method, characterized in that, comprising: The local area network gateway LGW assigns an IP address to the user equipment according to the received configuration information, and saves the IP address, the area network that the IP address can access, and the information for establishing a secure connection with the access network gateway of the area network. The corresponding relationship of the method; The LGW performs data transmission between the user equipment and the area network corresponding to the IP address of the user equipment through a security tunnel, wherein the security tunnel is established according to the method of establishing the security connection; Wherein, before the LGW saves the corresponding relationship, the method further includes: the LGW forwards the authentication information used to authenticate the user equipment to an authentication server; the LGW receives the authentication information returned by the authentication server. Configuration information, wherein the returned information includes: the access IP address allocated for the user equipment, the area network that the IP address can access, and the establishment of security with the access network gateway of the area network The way you connect. 2. The method according to claim 1, wherein before the LGW forwards the authentication information used to authenticate the user equipment to an authentication server, the method further comprises: The LGW receives the authentication information from the core network, where the authentication information is input after the user equipment selects the name of the access point of the area network. 3. The method according to any one of claims 1 to 2, wherein the manner of establishing a connection with the access network gateway of the area network includes at least one of the following: IPSec method, SSL method, TLS method. 4. The method according to any one of claims 1 to 2, characterized in that the method further comprises: The LGW receives a notification that the user equipment is out of service range; The LGW deletes the corresponding relationship. 5. A data transmission device, characterized in that it is applied to a local area network gateway LGW, comprising: An allocation module, configured to allocate an IP address to the user equipment according to the received configuration information, and store the IP address, the area network that the IP address can access, and the information for establishing a secure connection with the access network gateway of the area network The corresponding relationship of the method; A data transmission module, configured to transmit data between the user equipment and the local area network corresponding to the IP address of the user equipment through a security tunnel, wherein the security tunnel is established according to the method of establishing the security connection of; Wherein, the apparatus further includes: a forwarding module, configured to forward the authentication information used to authenticate the user equipment to an authentication server; a first receiving module, configured to receive the configuration information returned by the authentication server, wherein, The returned information includes: the access IP address assigned to the user equipment, the area network that the IP address can access, and the way to establish a secure connection with the access network gateway of the area network. 6. The device according to claim 5, further comprising: The second receiving module is configured to receive the authentication information from the core network, wherein the authentication information is input after the user equipment selects the name of the area network access point. 7. The device according to any one of claims 5 to 6, wherein the manner of establishing a connection with the access network gateway of the area network includes at least one of the following: IPSec method, SSL method, TLS method. 8. The device according to any one of claims 5 to 6, wherein the device further comprises: A third receiving module, configured to receive a notification that the user equipment is not within the service range; A deletion module, configured to delete the corresponding relationship.