Method, apparatus, and network system for terminal to traverse private network to communicate with server in ims core network

A method performed by a security tunnel gateway for a terminal in a private network to communicate with a network server in an Internet Protocol Multimedia Subsystem (IMS) network, comprising:

• receiving a first tunnel packet over a tunnel between the security tunnel gateway and the terminal, wherein a source IP address of the first tunnel packet is an IP address of the terminal, and a destination IP address of the first tunnel packet is an IP address of the security tunnel gateway;
• decapsulating the first tunnel packet to obtain a first service packet, wherein a source address of the first service packet is a virtual IP address, and a destination address of the first service packet is an address of the network server;
• and
• forwarding the first service packet to the network server.

A terminal, comprising a communication capability component, wherein the communication capability component comprises:

• a first data converging module, configured to:
• set a source address of service data to be sent as a virtual Internet Protocol (IP) address, set a destination address of the service data to be sent as an address of a network server in an internet protocol multimedia subsystem (IMS) network, and obtain a first service packet, wherein the virtual IP address is an address allocated by an Internet Protocol Multimedia Subsystem (IMS) network to the terminal;
• a first tunnel transmission module, configured to encapsulate the first service packet into a first tunnel packet, where a source IP address of the first tunnel packet is an IP address of the terminal, and a destination IP address of the first tunnel packet is an IP address of a security tunnel gateway;
• and send the first tunnel packet to the security tunnel gateway over a Virtual Private Network (VPN) tunnel between the terminal and the security tunnel gateway, so that the security tunnel gateway sends the first service packet in the first tunnel packet to the network server.

A security tunnel gateway, comprising:

• a first receiving module, configured to receive a first tunnel packet over a tunnel between the security tunnel gateway and a terminal, wherein a source IP address of the first tunnel packet is an IP address of the terminal, and a destination IP address of the first tunnel packet is an IP address of the security tunnel gateway;
• a decapsulating module, configured to decapsulate the first tunnel packet;
• and
• a first sending module, configured to send the first service packet obtained as a result of decapsulation by the decapsulating module to an network server in an Internet Protocol Multimedia Subsystem (IMS) network, wherein a source address of the first service packet is a virtual IP address, and a destination address of the first service packet is an address of the network server.

An Internet Protocol Multimedia Subsystem (IMS) network system, comprises a security tunnel gateway and a network server, wherein

• the security tunnel gateway is configured to:
• receive a first tunnel packet over a tunnel between the security tunnel gateway and a terminal, wherein a source IP address of the first tunnel packet is an IP address of the terminal, and a destination IP address of the first tunnel packet is an IP address of the security tunnel gateway;
• decapsulate the first tunnel packet to obtain a first service packet, where a source address of the first service packet is a virtual IP address, and a destination address of the first service packet is an address of the network server;
• send the first service packet to the network server;
• receive a second service packet sent by the network server, wherein a source address of the second service packet is the address of the network server, and a destination address of the second service packet is the virtual IP address;
• encapsulate the second service packet into a second tunnel packet, wherein a source IP address of the second tunnel packet is the IP address of the security tunnel gateway, and a destination IP address of the second tunnel packet is the IP address of the terminal;
• and
• send the second tunnel packet to the terminal over the tunnel between the security tunnel gateway and the terminal;
• and
• the network server is configured to receive the first service packet sent by the security tunnel gateway, and send the second service packet to the security tunnel gateway.