CN102238547A - User session control method, session server, authentication, authorization and accounting (AAA) server and system - Google Patents

Abstract

The embodiment of the invention provides a method, a session server, an authentication, authorization and accounting (AAA) server and a system for controlling user sessions in a plurality of networks. The method for authenticating the user sessions in the plurality of networks comprises the following steps of: managing session information according to the types of session information notices transmitted by a plurality of AAA servers in different networks; and authenticating the user sessions according to the session information managed on the session server. The embodiment of the invention manages the session information from the plurality of networks in a centralized way on the session server, and authenticates the user sessions based on the session information to control the user sessions of the plurality of networks in a cross-network way, thereby realizing session number control among the plurality of AAA servers.

Description

Method, session server, AAA server and system for controlling user sessions

technical field

Embodiments of the present invention relate to the field of data communication, and more specifically, relate to a method for controlling user sessions in multiple networks, a session server, an AAA (Authentication, Authorization and Accounting, authentication, authorization and accounting) server and system .

Background technique

With the development of data communication business for many years, there are many kinds of data networks, such as fixed network broadband, CDMA (Code Division Multiple Access, code division multiple access), WCDMA (Wideband Code Division Multiple Access, wideband code division multiple access) and WiMAX ( Worldwide Interoperability for Microwave Access, Global Microwave Interoperability for Access), etc. According to the definition of the specification, each network requires a separate set of AAA servers.

Although the AAA server and NAS (Network Access System, network access device) devices under different networks communicate through the RADIUS (Remote Authentication Dial In User Service, remote user dial-in authentication system) protocol, the functions they implement are different. And there is no connection between AAA servers. Currently, a set of AAA servers can control the number of user sessions under this server, but many operators have more or less multiple network operation licenses and require multiple network unified account access during actual operation. In addition, in some operating scenarios, operators also require that one account can only be accessed by one user at a time on one network, that is, there is session number control and management between multiple sets of AAA servers. However, since the AAA servers currently built by operators are relatively independent, it is difficult to control the number of sessions among multiple sets of AAA servers.

Contents of the invention

Embodiments of the present invention provide a method, a session server, an AAA server and a system for controlling user sessions in multiple networks, which can centrally manage user information of multiple networks, so that the number of sessions between multiple sets of AAA servers is now control.

According to an aspect of an embodiment of the present invention, there is provided a method for authenticating a user session in multiple networks, the method comprising: according to the session managing session information based on the type of information notification; and authenticating user sessions based on the session information managed on the session server.

According to another aspect of the embodiments of the present invention, there is provided a method for supporting user session control in multiple networks, including: according to the session sent from multiple authentication, authorization and accounting AAA servers located in different networks managing session information according to the type of information notification; and controlling the user session according to the request message sent from the AAA server.

According to another aspect of the embodiments of the present invention, there is provided a method for supporting user session control in multiple networks, including: sending the session server to the session server according to the type of the charging message received from the network access device NAS information notification; when an access request is received from the NAS, send a request message to the session server and receive a corresponding response message; and send an access response to the NAS according to the response message sent by the session server, so that Authentication session.

According to another aspect of the embodiments of the present invention, there is provided a session server for supporting user session control in multiple networks, including: a session management unit configured to The session information is managed by charging the type of session information notification sent by the AAA server; and the session control unit is used to control the user session according to the request message sent from the AAA server.

According to another aspect of the embodiments of the present invention, there is provided an authentication, authorization and accounting AAA server for supporting user session control in multiple networks, including: a session information notification unit, configured to The type of the charging message received by the NAS sends a session information notification to the session server; and the first session control unit is configured to send a request message to the session server when receiving an access request from the NAS and receive a corresponding a response message; and a second session control unit, configured to send an access response to the NAS according to the response message sent by the session server so as to authenticate the session.

According to another aspect of the embodiments of the present invention, a communication system is provided, including the above-mentioned session server and an authentication, authorization and accounting AAA server.

The embodiment of the present invention centrally manages the session information from multiple networks on the session server, and authenticates the user session based on the session information, so that the user session of multiple networks can be controlled across the network, thereby realizing the connection between multiple sets of AAA servers. Control the number of sessions between sessions.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only some of the present invention. Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a schematic diagram showing an exemplary network system according to an embodiment of the present invention.

FIG. 2 is an exemplary flowchart illustrating a method for authenticating user sessions in multiple networks according to an embodiment of the present invention.

FIG. 3 is an exemplary flowchart illustrating a method for managing (ie, creating, updating and deleting) session information according to an embodiment of the present invention.

FIG. 4 is an exemplary flowchart illustrating a method for supporting user session control in multiple networks according to an embodiment of the present invention.

FIG. 5 is an exemplary flowchart illustrating another method for supporting user session control in multiple networks according to an embodiment of the present invention.

FIG. 6 is an exemplary signal flow diagram illustrating a process for controlling user sessions in multiple networks according to the first embodiment of the present invention.

FIG. 7 is an exemplary signal flow diagram illustrating a process for controlling user sessions in a plurality of networks according to a second embodiment of the present invention.

FIG. 8 is an exemplary signal flow diagram illustrating a process for an external system to query session information according to an embodiment of the present invention.

FIG. 9 is an exemplary signal flow diagram illustrating another process for an external system to query session information according to an embodiment of the present invention.

FIG. 10 is an exemplary block diagram showing the structure of a session server according to an embodiment of the present invention.

FIG. 11 is an exemplary block diagram showing a specific structure of a session management unit according to an embodiment of the present invention.

FIG. 12 is an exemplary block diagram showing a specific structure of a session control unit according to an embodiment of the present invention.

FIG. 13 is an exemplary block diagram showing the structure of an AAA server according to an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The technical solution of the present invention can be applied to various communication systems, such as fixed broadband, CDMA, WCDMA, WiMAX and the like. However, the present invention is not limited thereto, and those skilled in the art can apply the present invention to any suitable network as needed.

A set of AAA servers in the related art can only control the number of sessions within its scope. When multiple sets of AAAs exist at the same time and share user accounts, because there is no connection between the current AAA servers, it is impossible to implement multiple sets of AAA servers. To control the number of sessions between sessions, the embodiment of the present invention includes a session server in the network, which is used to centrally store, manage and control user session information of multiple AAA servers.

FIG. 1 is a schematic diagram showing an exemplary network system according to an embodiment of the present invention. The network system includes a session server 10, and the session server 10 centrally stores and manages session information of multiple networks such as fixed broadband, CDMA, WCDMA, and WiMAX. The first interface (Int1) in Fig. 1 is used for each AAA server to notify session server 10 to create/update/delete user session information, the embodiment of the present invention does not limit to the interface protocol of the first interface, can be flexible as required during application Definitions, such as RADIUS, SOAP (Simple Object Access Protocol, Simple Object Access Protocol), etc. The second interface (Int2) in Fig. 1 is used for session server 10 to each AAA server authentication session and each AAA server or external system inquires session information to session server 10, and the embodiment of the present invention does not do the interface protocol of the second interface either. Restrictions can be flexibly defined according to needs during application, such as HTTP (Hyper Text Transfer Protocol, Hypertext Transfer Protocol), SOAP, etc.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 2 is an exemplary flowchart illustrating a method 20 for authenticating user sessions in multiple networks according to an embodiment of the present invention.

As shown in FIG. 2, at 201 of method 20, session information is managed according to types of session information notifications sent from a plurality of AAA servers located in different networks. At 202, a user session is authenticated based on session information managed on a session server.

The embodiment of the present invention centrally manages the session information from multiple networks on the session server, and authenticates the user session based on the session information, so that the user session of multiple networks can be controlled across the network, thereby realizing the connection between multiple sets of AAA servers. Control the number of sessions between sessions.

According to an embodiment of the present invention, when a user accesses a network, such as one of fixed network broadband, CDMA, WCDMA, and WiMAX, the AAA server in the network sends a session information notification to the session server, and the session server Notifications to manage session information, specifically creating, updating, and deleting session information.

FIG. 3 is an exemplary flowchart illustrating a method 30 for managing (ie creating, updating and deleting) session information according to an embodiment of the present invention. Method 30 may be performed by a session server.

As shown in FIG. 3 , in 301 of the method 30, the type of the session information notification received from the AAA server is judged.

When the session information creation notification is received from the AAA server, in 302, the session information related to the user is created and stored.

When the session information update notification is received from the AAA server, in 303, the session information is updated.

When the session information deletion notification is received from the AAA server, in 304, the session information is deleted.

It should be noted that in some cases, such as when the session is maintained for a short time, the update session information notification may not be received from the AAA server, but after receiving the session creation notification and creating the session, If the session information deletion notification is directly received after a period of time, the update of the session information is not performed, and only the creation and deletion of the session information is performed. Therefore, 303 in method 30 can be omitted (as shown by the dotted line in FIG. 3 ).

In the following, different embodiments of the present invention will be described in more detail with reference to specific examples. In the description of the following embodiments, session information in multiple networks is centrally managed (created, updated, and deleted) by a session server, such as session server 10 shown in FIG. 1 , and session information is controlled by The AAA server sends a request message, and then the session server controls the session information according to the request message. In an exemplary embodiment of the present invention, the request message sent by the AAA server may include one of a session authentication request and a session query request, and accordingly, the session authentication function may be performed by the session server or the AAA server. However, the embodiments of the present invention are not limited thereto.

FIG. 4 is an exemplary flowchart illustrating a method 40 for supporting user session control in multiple networks according to an embodiment of the present invention. Method 40 may be performed by a session server, such as session server 10 in FIG. 1 .

As shown in FIG. 4, in 401 of method 40, session information is managed according to the types of session information notifications sent from multiple AAA servers located in different networks. Specifically, the method as shown in FIG. 3 may be used to manage session information. Create, update and delete session information.

In 402, the user session is controlled according to the request message sent from the AAA server.

In the embodiment of the present invention, by centrally managing the session information from multiple networks on the session server, user sessions in multiple networks can be controlled across networks, thereby realizing that when a user uses the same login name to access When networking, the number of sessions between multiple sets of AAA servers is controlled.

FIG. 5 is an exemplary flowchart illustrating another method 50 for supporting user session control in multiple networks according to an embodiment of the present invention. Method 50 may be implemented by an AAA server (such as any of the fixed network AAA server, CDMA AAA server, WCDMA AAA server, and WiMAX AAA server shown in FIG. 1).

As shown in FIG. 5, in 501 of the method 50, a session information notification is sent to the session server according to the type of the charging message received from the network access device NAS. For example, specifically, when the received accounting message is a start accounting request Accounting-Request (Start) message, a session creation notification is sent to the session server; when the accounting message is an intermediate accounting request Accounting-Request (Interim) message, send an update session information notification; and when the accounting message is an Accounting-Request (Stop) message, send a delete session information notification. However, the present invention is not limited thereto, and corresponding session information notifications may also be sent according to other charging messages.

In 502, when an access request is received from the NAS, a request message is sent to the session server and a corresponding response message is received. Those skilled in the art can understand that if a session authentication request is sent, a session authentication response is received, and if a session query request is sent, a session query response with session information is received, wherein the session information is the same as the session query Request session information for a session with the same login name as the login name of the corresponding session.

In 503, an access response is sent to the NAS according to the response message sent by the session server, so as to authenticate the session.

In the embodiment of the present invention, by centrally managing the session information from multiple networks on the session server, user sessions in multiple networks can be controlled across networks, thereby realizing that when a user uses the same login name to access When networking, the number of sessions between multiple sets of AAA servers is controlled.

Hereinafter, more detailed exemplary embodiments according to the present invention will be described with reference to the accompanying drawings.

FIG. 6 is an exemplary signal flow diagram illustrating a process 60 for controlling (in particular, authenticating) user sessions in multiple networks according to a first embodiment of the present invention. In a first embodiment of the invention, user sessions are authenticated by a session server, such as session server 10 in FIG. 1 . In FIG. 6, user A, AAA server (A) and NAS (A) belong to network A, and user B, AAA server (B) and NAS (B) belong to network B. The communication standard interface between each AAA server and its corresponding NAS may be RADIUS.

As shown in FIG. 6 , in 601 , user A in network A uses a login name such as zhangshandomain to initiate access to network A.

In 602, the NAS (A) sends an Access-Request message to the AAA server (A) after receiving the access request.

In 603, the AAA server (A) sends a request message, here a session authentication request, to the session server.

In 604, the session server authenticates the session. For example, the session server determines whether the current session number of the session with the login name zhangshandomain reaches a predetermined maximum number of sessions, wherein the current session refers to an existing session with the same login name (such as zhangshandomain) of the session corresponding to the session authentication request The login's session. The predetermined maximum number of sessions allowed for each session can be flexibly defined on the session server, for example, 1.

In 605, the session server sends a session authentication response to the AAA server (A). When the current session number is less than the predetermined maximum session number, the session server sends a session authentication success response to the AAA server (A), otherwise, when the current session number is equal to or greater than the predetermined maximum session number, the session server Send a session authentication failure response to the AAA server.

In the first embodiment of the present invention, it is assumed that the login name zhangshandomain is accessing the network for the first time and the predetermined maximum number of sessions is 1, so the current number of sessions is 0, which is less than the predetermined maximum number of sessions, so the session server sends to the AAA server (A) Session authentication success response. Therefore, at 606, the AAA server (A) sends an Access-Accept message to the NAS (A).

Afterwards, in 607, the NAS (A) sends an Accounting-Request (Start) message to the AAA server (A).

In 608, the AAA server (A) sends a create session information notification to the session server, and in 609, the session server creates session information related to the login name zhangshandomain.

In 610, the AAA server (A) returns an Accounting-Response (Start) message to the NAS (A).

Here, although it is described here that in 608, the AAA server (A) sends a session information notification to the session server and in 610, the AAA server (A) returns an Accounting-Response (Start) message to the NAS (A), However, those skilled in the art should understand that these two processes do not need to be executed sequentially according to the time sequence described, but can be executed in parallel or in any order.

After a predetermined time period (the predetermined time period can be configured on the NAS (A)), in 611 the NAS (A) sends an Accounting-Request (Interim) message to the AAA server (A).

In 612, the AAA server (A) sends an update session information notification to the session server, and in 613 the session server updates the session information according to the update session information notification.

In 614, the AAA server (A) returns an Accounting-Response (Interim) message to the NAS (A).

Similarly, although it is described here that the AAA server (A) sends an update session information notification to the session server in 612 and the AAA server (A) returns an intermediate accounting response Accounting-Response (Interim) message to the NAS (A) in 614, However, those skilled in the art should understand that these two processes do not need to be executed sequentially according to the time sequence described, but can be executed in parallel or in any order.

When user A requests to go offline, in 615, the NAS (A) sends an Accounting-Request (Stop) message to the AAA server (A).

In 616, the AAA server (A) sends a delete session information notification to the session server, and in 617, the session server deletes the session information related to the login name zhangshandomain.

In 618, the AAA server (A) returns an Accounting-Response (Stop) message to the NAS (A).

Similarly, although it is described here that in 616, the AAA server (A) sends a deletion session information notification to the session server and in 618, the AAA server (A) returns an Accounting-Response (Stop) message to the NAS (A) , but those skilled in the art should understand that these two processes do not need to be executed sequentially according to the time sequence described, but can be executed in parallel or in any order.

It should be noted by those skilled in the art that the steps in 611-614 can be repeated for many times. In addition, if the duration of the session is relatively short, the AAA server (A) may receive the Accounting-Request (Stop) message before the predetermined period of time has elapsed, so that the session server may not update the session information In this case, session information will be deleted. Therefore, the steps in 611-614 can also be omitted.

In 619, user B in network B uses the same login name (zhangshandomain) to initiate an access request from network B.

In 620, the NAS (B) sends an Access-Request message to the AAA server (B).

Likewise, in 621, the AAA server (B) initiates a session authentication request to the session server.

In 622, the session server authenticates the session. In the case that user A is not offline, the session server finds that the user whose login name is zhangshandomain is already online, and since the predetermined maximum session number is 1 and the current session number is 1, in 623, the session server sends a request to the AAA server (B) Returns a session authentication failure response.

In 624, the AAA server (B) sends an Access-Reject message to the NAS (B).

In the first embodiment of the present invention, in order to meet the operator's requirement that one login name can only be accessed by one user at the same time, the predetermined maximum number of sessions allowed is set to 1 on the session server, but , the present invention is not limited thereto. Those skilled in the art can understand that the predetermined maximum number of sessions can be flexibly defined on the session server, and can be set as any integer or without any limitation. For example, when the predetermined maximum number of sessions is set to 2, the access request of user B may also be accepted. However, if user C (not shown) also uses the same login name zhangshandomain to initiate network access, user C's access request will be rejected.

In addition, Accounting (Start/Interim/Stop) messages are standard messages supported by AAA servers in different networks. AAA servers in different networks use these three standard messages to trigger and notify the session server to create/update/delete session information. Therefore, there is no need to use an additional trigger notification message.

In the first embodiment of the present invention, the AAA server (AAA server (A) and AAA server (B)) sends a session information notification to the session server through a first interface (Int1 as shown in FIG. 6 ) on the session server , to create/update/delete session information. The interface protocol of the first interface is not limited, and can be flexibly defined according to needs during application, such as RADIUS, SOAP, and the like. In addition, the transmission of the authentication message between the AAA server and the session server is performed through a second interface on the session server (Int2 as shown in FIG. 6). The interface protocol of the second interface is not limited, and can be flexibly defined according to needs during application, such as HTTP, SOAP, and the like.

FIG. 7 is an exemplary signal flow diagram illustrating a process 70 for controlling (in particular, authenticating) user sessions in multiple networks according to a second embodiment of the present invention. In a second embodiment of the present invention, a user session is authenticated by an AAA server (such as any of the fixed line AAA server, CDMA AAA server, WCDMA AAA server and WiMAX AAA server shown in FIG. 1 ). Similar to FIG. 6 , in FIG. 7 , user A, AAA server (A) and NAS (A) belong to network A, and user B, AAA server (B) and NAS (B) belong to network B. The communication standard interface between each AAA server and its corresponding NAS may be RADIUS.

As shown in FIG. 7 , in 701 , user A in network A uses a login name such as zhangshandomain to initiate access to network A.

In 702, the NAS (A) sends an Access-Request message to the AAA server (A).

Different from the first embodiment of the present invention, in 703, the AAA server (A) sends a session query request instead of a session authentication request to the session server.

In 704, the session server queries the session information of the session with the same login name (zhangshandomain) as the session login name (zhangshandomain) corresponding to the session query request, that is, the session server queries the Session information for the session associated with the login name.

In 705, the session server sends a session query response to the AAA server (A), and the session query response includes the queried session information.

In 706, the AAA server (A) authenticates the session according to the session query response received from the session server, in particular the session information included in the session query response. For example, the AAA server (A) determines whether the current session number of the session with the login name zhangshandomain reaches a predetermined maximum number of sessions, where the current session refers to an existing login name (such as zhangshandomain ) with a session corresponding to the session authentication request ) session with the same login name. The predetermined maximum number of sessions allowed by each session can be flexibly defined on each AAA server, and can be set to any integer or without any limitation, for example, 1.

In 707, the AAA server (A) sends an access response message to the NAS (A). Wherein, when the current number of sessions is less than the predetermined maximum number of sessions, the AAA server (A) sends an access acceptance message to the NAS, and when the current number of sessions is equal to or greater than the predetermined maximum number of sessions, the AAA server (A) sends an access acceptance message to the NAS The NAS sends an Access Reject message.

Similar to the first embodiment, in the second embodiment of the present invention, it is assumed that the login name zhangshandomain is accessing the network for the first time and the predetermined maximum number of sessions is 1, so the current number of sessions is 0, which is less than the predetermined maximum number of sessions, so that in In 707, the AAA server (A) sends an Access-Accept message to the NAS (A).

Afterwards, in 708, the NAS (A) sends an Accounting-Request (Start) message to the AAA server (A).

In 709, the AAA server (A) sends a create session information notification to the session server, and in 710, the session server creates session information related to the login name zhangshandomain.

In 711, the AAA server (A) returns an Accounting-Response (Start) message to the NAS (A).

After a predetermined period of time (which can be configured on the NAS (A)), in 712 the NAS (A) sends an Accounting-Request (Interim) message to the AAA server (A).

In 713, the AAA server (A) sends an update session information notification to the session server, and in 714 the session server updates the session information according to the update session information notification.

In 715, the AAA server (A) returns an Accounting-Response (Interim) message to the NAS (A).

When user A requests to go offline, in 716, the NAS (A) sends an Accounting-Request (Stop) message to the AAA server (A).

In 717, the AAA server (A) sends a delete session information notification to the session server, and in 718, the session server deletes the session information related to the login name zhangshandomain.

In 719, the AAA server (A) returns an Accounting-Response (Stop) message to the NAS (A).

Likewise, the steps in 712-715 may be repeated multiple times, or may also be omitted in some cases. And, similar to the process in FIG. 6 , the steps in 709 and 711 , 713 and 715 , and 717 and 719 may be executed in parallel or other suitable word order instead of in the described chronological order.

In 720, user B in network B uses the same login name (zhangshandomain) to initiate an access request from network B.

In 721, the NAS (B) sends an Access-Request message to the AAA server (B).

In 722, the AAA server (B) initiates a session query request to the session server.

In 723 the session server queries the session and in 724 sends a session query response including the session information to the NAS(B).

Then, in 725, the AAA server (B) authenticates the session according to the session query response received from the session server. For example, when user A is not offline, the session server finds that the user whose login name is zhangshandomain is already online, and since the predetermined maximum session number is 1 and the current session number is 1, in 726, the AAA server (B) sends NAS(B) sends an Access-Reject message.

It can be seen that, except for the steps in 703-706 and 722-725, the signal flow in FIG. 7 is the same as the corresponding signal flow in FIG. 6 .

In the second embodiment of the present invention, the AAA servers (AAA server (A) and AAA server (B)) send session information notifications to the session server through the first interface (Int1 as shown in Figure 7) on the session server , to create/update/delete session information. The interface protocol of the first interface is not limited, and can be flexibly defined according to needs during application, such as RADIUS, SOAP, and the like. In addition, the transmission of query messages between the AAA server and the session server is performed through a second interface on the session server (Int2 as shown in FIG. 7 ). The interface protocol of the second interface is not limited, and can be flexibly defined according to needs during application, such as HTTP, SOAP, and the like.

The difference between the second embodiment of the present invention and the first embodiment is that the second embodiment forwards the session control (authentication) function to the AAA server for implementation, thereby making full use of the existing AAA servers in the existing network. The feature of the function of supporting the control of the number of sessions realizes the session control function of the multi-network without much modification, so the structure is easier to integrate and realize. However, if there is a special requirement to modify the authentication process, the operator needs to modify each set of AAA servers, and the workload is relatively large. At this time, the solution in the first embodiment of the present invention is easier to implement, because as long as the session One revision above is all it takes.

According to the embodiment of the present invention, by centrally saving the session information of multiple networks on the session server, the problem of controlling the number of sessions when a user uses the same login name to access the Internet in the multi-network AAA server scenario is solved, and the present invention In this embodiment, the existing accounting message (Accounting (Start/Interim/Stop)) can be used to trigger and notify the session server to create/update/delete session information without additional trigger signaling, which saves network resources.

In addition, according to the embodiment of the present invention, in addition to the session authentication function and session query function between the session server and the AAA server, the second interface can also be used for session query between the session server and an external system.

FIG. 8 is an exemplary signal flow diagram illustrating a process 80 for an external system to query session information according to an embodiment of the present invention.

As shown in FIG. 8 , at 801 , the user initiates a network access request using a login name (such as zhangshandomain), and is successfully authenticated. Here, specific steps related to the session authentication process are omitted, and those skilled in the art can use the method in the first embodiment or the second embodiment of the present invention as needed, or can also use other suitable methods to authenticate user sessions.

In 802, the NAS sends an Accounting-Request (Start) message to the AAA server.

In 803, the AAA server sends a create session information notification to the session server through the first interface Int1, and in 804, the session server creates session information related to the user's login name.

In 805, the AAA server returns an Accounting-Response (Start) message to the NAS.

In 806, the external system sends a session query request to the session server through the second interface Int2.

In 807, the session server queries session information of a session having the same login name as that of the session corresponding to the received session query request.

In 808, the session server sends a session query response to the external system through the second interface Int2, where the session query response includes the queried session information.

After a predetermined time period (the predetermined time period can be configured on the NAS), in 809, the NAS sends an Accounting-Request (Interim) message to the AAA server.

In 810, the AAA server sends an update session information notification to the session server through the first interface Int1, and in 811, the session server updates the session information.

In 812, the AAA server returns an Accounting-Response (Interim) message to the NAS.

In 813, the NAS sends an Accounting-Request (Stop) message to the AAA server.

In 814, the AAA server sends a delete session information notification to the session server through the first interface Int1, and in 815, the session server deletes the session information related to the login name zhangshandomain.

In 816, the AAA server returns an Accounting-Response (Stop) message to the NAS. Also, similar to the processes in FIG. 6 and FIG. 7 , the steps in 803 and 805 , 810 and 812 , and 814 and 816 may be performed in parallel or in other suitable word orders instead of in the described chronological order.

Likewise, the steps in 809-812 may be repeated multiple times, or may also be omitted in some cases.

In the process 80 shown in FIG. 8 , the external system sends a session query request after the session information is created and before it is updated, so the queried session information is the original information created. Those skilled in the art can understand that the external system can send the query request at any time, such as after the session information is updated.

9 is an exemplary signal flow diagram illustrating another process 90 for an external system to query session information according to an embodiment of the present invention, wherein the external system sends a query request after the session information is updated, so as to obtain the updated session information. Apart from this, the process 90 in FIG. 9 is basically similar to the process 80 in FIG. 8 , so other contents will not be repeated here.

In addition, the external system may also send a session query request after the session information is deleted or before the session information is created. At this time, the session server may send a session query response indicating that the session information does not exist to the external system.

According to the embodiment of the present invention, the session query function between the session server and the external system is additionally provided through the second interface, so that the external system can query the user's session information in some necessary cases, such as querying whether the user is online or querying the user's location information , Query the user's access method, check the user's login name or mobile phone number information according to the IP (Internet Protocol, Internet Protocol) address, and so on. Therefore, the external system can simply and conveniently obtain session information of users in multiple networks by only sending a session query request to the session server.

FIG. 10 is an exemplary block diagram showing the structure of the session server 10 according to the embodiment of the present invention.

As shown in FIG. 10 , the session server 10 may include a session management unit 1001 and a session control unit 1002 .

The session management unit 1001 is used to manage session information according to the types of session information notifications sent from a plurality of authentication, authorization and accounting AAA servers located in different networks. The session control unit 1002 is used for controlling the user session according to the request message sent from the AAA server.

In the embodiment of the present invention, by centrally managing the session information from multiple networks on the session server, user sessions in multiple networks can be controlled across networks, thereby realizing that when a user uses the same login name to access When networking, the number of sessions between multiple sets of AAA servers is controlled.

FIG. 11 is an exemplary block diagram showing a specific structure of a session management unit 1001 according to an embodiment of the present invention.

As shown in FIG. 11 , the session management unit 1001 may include a session creator 1101 , a session updater 1102 and a session deleter 1103 .

The session creator 1101 is configured to create and store session information when receiving a session information creation notification from the AAA server. The session updater 1102 is configured to update the session information when receiving the update session information notification from the AAA server. The session deleter 1103 is configured to delete the session information when receiving the session information delete notification from the AAA server.

Each part of the session management unit 1001 can execute the relevant steps as shown in FIG. 6-FIG.

FIG. 12 is an exemplary block diagram showing a specific structure of the session control unit 1002 according to an embodiment of the present invention.

As shown in FIG. 12 , the session control unit 1002 may include a session authentication module 1201 and a session query module 1202 .

The session authentication module 1201 is configured to: receive a session authentication request from the AAA server; authenticate a session; and send a session authentication response to the AAA server. The session query module 1202 is used to: receive a session query request from the AAA server; query the session information of a session with the same login name as the login name of the session corresponding to the session query request; and send the session information with the session information to the AAA server session query responses. In addition, the session query module 1202 can also be used to: receive a session query request from an external system; query session information of a session with the same login name as the session login name corresponding to the session query request; and send the session information with A session query response for session information.

The session authentication module 1201 can perform session authentication according to the authentication method described with reference to FIG. 6 , and the session query module 1202 can perform session query with the AAA server or an external system according to the query method described with reference to FIGS. 7-8 .

It should be noted that when the authentication function is performed by the AAA server, the session control unit 1002 may only include the session query module 1202, ie, in this case, the session authentication module 1201 may be omitted.

In addition, the session server 10 may also include a first interface and a second interface (not shown), wherein the first interface is used for communication between the session management unit of the session server and the multiple AAA servers, and the second interface Two interfaces are used for communication between the session control unit of the session server and the multiple AAA servers or external systems. The first interface and the second interface correspond to Int1 and Int2 in FIGS. 6-10 respectively.

FIG. 13 is an exemplary block diagram showing the structure of an AAA server 1300 according to an embodiment of the present invention. A non-limiting example of the AAA server 1300 may be any one of the fixed network AAA server, CDMA AAA server, WCDMA AAA server and WiMAX AAA server shown in FIG. 1 .

As shown in FIG. 13 , the AAA server 1300 may include a session information notification unit 1301 , a first session control unit 1302 and a second session control unit 1303 .

The session information notification unit 1301 is configured to send a session information notification to the session server according to the type of the charging message received from the network access device NAS. The first session control unit 1302 is configured to send a request message to the session server and receive a corresponding response message when receiving an access request from the NAS. The second session control unit 1303 is configured to send an access response to the NAS according to the response message sent by the session server so as to authenticate the session.

In the embodiment of the present invention, by centrally managing the session information from multiple networks on the session server, user sessions in multiple networks can be controlled across networks, thereby realizing that when a user uses the same login name to access When networking, the number of sessions between multiple sets of AAA servers is controlled.

Each part of the AAA server 1300 can execute the relevant process as described with reference to FIG. 5 , which will not be repeated here. For example, the session information notification unit 1301 sends a session information notification when the accounting message received from the NAS is an Accounting-Request (Start) message, and sends an update session information notification when the accounting message is an Accounting-Request (Interim) message, And when the accounting message is an Accounting-Request (Stop) message, a session information deletion notification is sent.

In addition, when the AAA server 1300 does not perform session authentication, when the AAA server 1300 receives an access request from the NAS, the first session control unit 1302 sends a session authentication request to the session server (such as the session server 10) and from The session server receives a session authentication response, and, when the session authentication response received from the session server is a session authentication success response, the second session control unit 1303 sends an access acceptance message to the NAS, and When the session authentication response received from the session server is a session authentication failure response, the second session control unit 1303 sends an access rejection message to the NAS.

On the other hand, when session authentication is performed by the AAA server 1300, when an access request is received from the NAS, the first session control unit 1302 sends a session query request to the session server and receives an access request from the NAS. The session server receives a session query response with session information, and the session is authenticated by the second session control unit 1303 according to the session information included in the session query response. The second session control unit 1303 may use the method as described with reference to FIG. 7 to perform the authentication process.

In addition, the communication system according to the embodiment of the present invention may include the above-mentioned session server and AAA server.

Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the relationship between hardware and software Interchangeability. In the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, and may be located in one place or distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-OnlyMemory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc and other media that can store program codes.

It should also be pointed out that in the device and method of the present invention, obviously, each component or each step can be decomposed and/or reassembled. These decompositions and/or recombinations should be considered equivalents of the present invention. Also, the steps for performing the above series of processes may naturally be performed in chronological order in the order described, but need not necessarily be performed in chronological order. Certain steps may be performed in parallel or independently of each other, for example, the session authentication process between the session server and the AAA server may be performed sequentially, in parallel, or independently in any order with the session query process between the session server and the external system.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (15)

1. A method for authenticating user sessions in multiple networks, characterized in that the method comprises: Manage session information according to the type of session information notifications sent from multiple Authentication, Authorization, and Accounting AAA servers located in different networks; and User sessions are authenticated based on session information managed on the session server. 2. The method according to claim 1, wherein managing the session information according to the type of the session information notification sent from the AAA server comprises at least one of the following operations: When receiving the creation session information notification from the AAA server, create and store the session information; updating the session information when receiving an update session information notification from the AAA server; and When the session information deletion notification is received from the AAA server, the session information is deleted. 3. The method according to claim 1 or 2, wherein said authenticating the user session according to the session information managed on the session server comprises: sending a session authentication request to the session server; authenticating the session by the session server; and Send a session authentication response to the AAA server. 4. The method according to claim 1 or 2, wherein said authenticating the user session according to the session information managed on the session server comprises: Send a session query request to the session server; Querying session information of a session having the same login name as the login name of the session corresponding to the session query request by the session server; sending a session query response with session information to the AAA server; and The session is authenticated based on the session information included in the session query response. 5. The method according to claim 3, wherein said authenticating a session by said session server comprises: determining whether the number of current sessions reaches a predetermined maximum number of sessions, wherein the current session is an existing session with authentication with the session requests a session with the same login as the corresponding session's login, and The sending a session authentication response to the AAA server includes: When the current number of sessions is less than the predetermined maximum number of sessions, sending a session authentication success response to the AAA server; and When the current number of sessions is equal to or greater than the predetermined maximum number of sessions, a session authentication failure response is sent to the AAA server. 6. The method according to any one of claims 1-5, further comprising: Receive a session query request from an external system; querying session information for a session having the same login name as the login name of the session corresponding to the session query request; and A session query response with session information is sent to the external system. 7. A method for supporting user session control in multiple networks, comprising: Manage session information according to the type of session information notifications sent from multiple Authentication, Authorization, and Accounting AAA servers located in different networks; and User sessions are controlled according to request messages sent from the AAA server. 8. A method for supporting user session control in multiple networks, comprising: Send a session information notification to the session server according to the type of the charging message received from the network access device NAS; When an access request is received from the NAS, sending a request message to the session server and receiving a corresponding response message; and Send an access response to the NAS according to the response message sent by the session server, so as to authenticate the session. 9. The method according to claim 8, wherein the sending a request message to the session server and receiving a corresponding response message comprises: sending a session authentication request to the session server; and receiving a session authentication response from the session server, And, the sending an access response to the NAS according to the response message sent by the session server so as to authenticate the session includes: sending an access accept message to the NAS when a session authentication success response is received from the session server, and When a session authentication failure response is received from the session server, an access rejection message is sent to the NAS. 10. The method according to claim 8, wherein the sending a request message to the session server and receiving a corresponding response message comprises: Send a session query request to the session server; Querying, by the session server, session information of a session having the same login name as that of the session corresponding to the session query request; and receiving a session query response with session information from the session server, And the sending an access response to the NAS according to the response message sent by the session server so as to authenticate the session includes: The session is authenticated based on the session information included in the session query response. 11. The method according to claim 10, wherein the authentication session comprises: determining whether the number of current sessions reaches a predetermined maximum number of sessions, wherein the current session is an existing session with a session corresponding to the session authentication request a session with the same login as the login, and When the current number of sessions is less than the predetermined maximum number of sessions, sending an access accept message to the NAS; and When the current number of sessions is equal to or greater than the predetermined maximum number of sessions, an access rejection message is sent to the NAS. 12. The method according to any one of claims 8 to 11, wherein the sending the session information notification to the session server according to the type of the charging message received from the network access device NAS comprises: When the charging message is an Accounting-Request (Start) message to start charging, send a session information notification; When the accounting message is an intermediate accounting request Accounting-Request (Interim) message, send an update session information notification; and When the accounting message is an Accounting-Request (Stop) message, a session information deletion notification is sent. 13. A session server for supporting user session control in multiple networks, comprising: a session management unit for managing session information according to the type of session information notification sent from a plurality of authentication, authorization and accounting AAA servers located in different networks; and A session control unit, configured to control the user session according to the request message sent from the AAA server. 14. An authentication, authorization and accounting AAA server for supporting user session control in multiple networks, comprising: A session information notification unit, configured to send a session information notification to the session server according to the type of the charging message received from the network access device NAS; and A first session control unit, configured to send a request message to the session server and receive a corresponding response message when an access request is received from the NAS; and The second session control unit is configured to send an access response to the NAS according to the response message sent by the session server so as to authenticate the session. 15. A communication system, comprising the session server according to claim 13 and the authentication, authorization and accounting AAA server according to claim 14.

Images