CN101765057A

CN101765057A - Method, equipment and system for providing multicast service to WiFi access terminal

Info

Publication number: CN101765057A
Application number: CN200810207741A
Authority: CN
Inventors: 宾梵翔; 马松伟
Original assignee: Alcatel Lucent Shanghai Bell Co Ltd
Current assignee: Nokia Shanghai Bell Co Ltd
Priority date: 2008-12-25
Filing date: 2008-12-25
Publication date: 2010-06-30
Anticipated expiration: 2028-12-25
Also published as: CN101765057B

Abstract

The invention provides a method, equipment and a system for providing a multicast service to a WiFi access terminal. The system comprises an WiFi access terminal, a consumer premise gateway, network access equipment and an authentication server, wherein the consumer premise gateway, the network access equipment and the authentication server are connected with the WiFi access terminal, and the WiFi access terminal initiates a consumer authentication request and negotiates a key mechanism with the authentication server; and the network access equipment obtains the key mechanism, and multicast service data requested by the WiFi access terminal are provided to the WiFi access terminal in a unicast mode after encryption processing is carried out on the multicast service data requested by the WiFi access terminal accordingly. Thereby, the safe transmission guarantee of the multicast service contents of an IPTV and the like can be provided to a mobile WiFi terminal, and the mobile WiFi terminal can process the received multicast service data by utilizing an existing WiFi safety mechanism and does not need to modify or regulate the software and the hardware of the terminal.

Description

A kind of method, equipment and system that multicast service is provided to the WiFi access terminal

Technical field

The present invention relates to communication technical field, relate in particular to method and equipment thereof that multicast service is provided to WiFi (Wireless Fidelity) access terminal in a kind of network access system.

Background technology

The WiFi technology belongs to the short distance wireless technical that uses in office and family, what it used is near the frequency range of 2.4GHz, its available standards comprises institute of electrical and electronic engineers IEEE802.11a and IEEE802.11b and the follow-up standard of developing, it has following advantage: one, WiFi electric wave wide coverage, its covering radius then can reach 100 meters; Its two, transmission speed is very fast, can reach 11Mbps (MBPS), meets the individual and the demand of social informatization; Its three, the threshold that enters the WiFi field is lower, many people extend its broadband internet and insert by AP/WTP (WAP (wireless access point)/WLAN (wireless local area network) tip node) is installed in its family, the enterprise customer has also installed WiFi equipment in office mechanism and has substituted wire cable.

Current, the WiFi technology is popularized day by day among all kinds of portable terminals (as notebook computer, PDA, smart mobile phone etc.), and this type of moves the WiFi access terminal can be in the WiFi interface accessing the Internet by corresponding residence gateway such as particular place such as airport, hotel and coffee-house etc.And in current access network system, for comprising aforementioned particular place user network such as family, the access the Internet that links to each other by the particular type of user residence gateway and then with network access equipment usually of the LUT (for example PC, TV set-top box etc.) in the user network scope.

According to statistics, when only serving the local customer terminal, the average bandwidth utilance on the access link between user residence gateway and the network access equipment only is 1%.So, people associate and allow mobile WiFi access terminal also can share the access link resource by the WiFi interface of user residence gateway, thereby expand the zone that the WiFi access terminal can insert the Internet widely, FON (wireless network sharing model) technology promptly is a kind of typical realization means, and FON provides a kind of WiFi interface signal that is divided into public part and privately owned part.This just makes isolates the local customer system of oneself and those client access ends, and particularly, the owner of FON artificially limits the resource allocation on the access link by landing the configuration interface of router.If hypothesis access link total bandwidth is 2Mbps, can set 1.5Mbps and be used for the local customer terminal, and the WiFi access terminal that residue 512kbps is used to come to visit etc.

But, above-mentionedly for example provide IPTV etc. when interior multicast service is used to the WiFi access terminal to share the access link mode, aspect fail safe, there are many tangible deficiencies.Owing to adopt the mode of multicast analog broadcasting to realize the whole network broadcasting of TV in the IP network usually, although we can provide multicast services such as IPTV to the user by authentication by means such as access authentication of user, service access authentications, also be difficult under the existing access network system framework guarantee to of the fail safe of WiFi access terminal in the transmission of multicast service content.

In the typical access network system structural representation legend as schematically shown in Figure 1, the public WiFi interface of WiFi access terminal 11 by user residence gateway 12 (or be connected with user residence gateway 12, has the wireless aps of public WiFi interface/WTP) insert to share access link resource mode, it is after passing through the authenticating user identification of certificate server 31, can enjoy multicast service by network access equipment 21 and be applied in interior internet content service, when WiFi access terminal 11 transmits the multi-cast business datas such as IPTV of being asked, when the multi-cast business data that network access equipment 21 is provided is delivered to user residence gateway 12, LUT 13, thereby 14 may revise the multicast service content that user residence gateway 12 multicast forward table bypasses come out to steal a glance to send to the WiFi access terminal, or join request by the multicast service of counterfeit WiFi access terminal that (for example: IGMP Join) message is to watch the multicast service contents such as IPTV that should send to WiFi access terminal 11.

Summary of the invention

The present invention is intended to provide to the WiFi access terminal a kind of technical scheme of safe multicast service, the multi-cast business data that network access equipment is asked the WiFi access terminal with the security mechanism of agreement carries out encryption, thereby guarantee the fail safe that the multicast service content transmits, that is: guarantee that the multicast service of being asked sends the confidentiality of legal requestor and assurance business tine to.

According to an aspect of the present invention, the method that multicast services is provided to the WiFi access terminal in a kind of network access equipment is provided here, and it comprises the steps: a), receives from the access authentication request and the negotiation of WiFi access terminal and set up secret key safety mechanism; B), the multicast group multicast business data that the WiFi access terminal is asked carries out that the mode with clean culture offers described WiFi access terminal after the encryption.

According to another aspect of the present invention, a kind of network access equipment that is used for providing to the WiFi access terminal multicast services is provided here, it comprises: access control apparatus, reception is from the access authentication request of WiFi access terminal and consult to set up secret key safety mechanism, and the multi-cast business data of the WiFi access terminal being asked with described key mechanism carries out that the mode with clean culture offers described WiFi access terminal after the encryption; The multicast control device, the receiving multicast business request also provides corresponding multi-cast business data to described access control apparatus

According to another aspect of the present invention, a kind of access network system that multicast services is provided to the WiFi access terminal is provided here, comprise WiFi access terminal and the user residence gateway that is connected thereof, network access equipment, certificate server, wherein, user residence gateway provides network insertion to share the access link mode to the WiFi access terminal, wherein, the WiFi access terminal, initiate user authentication request and with certificate server arranging key mechanism; Network access equipment obtains described key mechanism, and the multi-cast business data of in view of the above the WiFi access terminal being asked carries out, and the mode with clean culture offers described WiFi access terminal after the encryption;

The present invention has following advantage:

1), technical solution of the present invention ensures by provide safe multicast service contents such as IPTV to transmit to all kinds of mobile WiFi terminals, thereby make Virtual network operator can further enlarge the service range of multicast services such as IPTV, mobile WiFi terminal can carried out the multicast application access by user residence gateway such as family, hotel etc.; 2), fail safe: network access equipment with the agreement security mechanism to the WiFi access terminal is asked multi-cast business data is encrypted, the multicast service of such security mechanism under original access network system framework is unexistent; 3) thereby, mobile WiFi terminal can utilize existing WiFi security mechanism that the data that receive are handled to obtain multicast service, do not need soft to terminal, hardware is made amendment or adjust.

Description of drawings

By the detailed description with the accompanying drawing that proposes below, it is more obvious that feature of the present invention, character and advantage will become, and components identical has identical sign in the accompanying drawing, wherein:

Fig. 1 is a kind of typical access network system structural representation legend;

The access network system structure embodiment that Fig. 2 is suitable for for a kind of the present invention;

Fig. 3 is the method example that multicast services is provided to the WiFi access terminal provided by the present invention.

Embodiment

Below in conjunction with accompanying drawing, preferred implementation of the present invention is described in detail.

Fig. 1 is a kind of typical access network system structural representation legend, and typical user residence gateway 12 can be DSL modulator-demodulator, optical network unit (ONU) or router etc.; Typical access link mode can be wired or wireless access means such as Digital Subscriber Line (DSL), EPON (PON) or Local Area Network; Typical network access equipment 21 can be digital subscriber line access multiplex (DSLAM), Optical Network Terminal (OLT) or network switch modes such as (SIWTCH).But user residence gateway 12 self possesses the WiFi interface capability or by providing access link to the wireless aps/WTP that is connected, have the WiFi interface to the WiFi access terminal with user residence gateway 12.

The access network system structure embodiment that Fig. 2 only is suitable for for a kind of the present invention, WiFi access terminal 11 links to each other with network access equipment DSLAM 21 to share DSL access link mode together by the privately owned wireless WiFi interface 122 that the

interior LUT

13,14 of public wireless WiFi interface 121, the local network of users 10 scopes of user residence gateway 12 passes through user residence gateway 12.Public, privately owned wireless WiFi interface can be distinguished so that bandwidth control, service parameter, data encryption etc. are controlled by different PVC/VLAN (permanent virtual connection/VLAN) with the data-transmission channel between the DSLAM 21.

WiFi access terminal 11 is after 802.11 wireless connections of finishing with user residence gateway 12 public wireless WiFi interfaces 121, and it can carry out access authentication.

Certificate server 31 can provide to comprise WiFi access terminal 11 in interior authentification of user, multicast service authority in interior rights management etc.It can be based on the specific access request message that includes user identity, to select concrete authentication mechanism and WiFi access terminal to authenticate mutually, its authentication result can return to WiFi access terminal 11 by DSLAM21, this authentication result can further comprise the corresponding multicast access of this user authority, for example: certificate server 31 is in the Radius Access-Accept that returns (visit is accepted) message, this message (for example: IP generally is used to return the required attribute of user, MASK, MTU etc.), here we can be by additional Vendor Specific (provider's appointment) attribute, this attribute generally is used for transmitting the self-defining information of manufacturer, we can utilize it to carry multicast access right limit information, concrete access authority expression way can be defined according to product performance by a producer or a plurality of producer, is not further stated here.

The interacting message of DSLAM 21 by authenticating mutually between WiFi access terminal 11 and the certificate server 31, final set up secret key safety mechanism, and carry out with the multi-cast business data that aforementioned secret key safety mechanism is asked WiFi access terminal 11 that the mode with clean culture offers described WiFi access terminal after the encryption with 11 negotiations of WiFi access terminal.

According to the enforcement legend that is provided, DSLAM 21 comprises access control apparatus 211, multicast control device 212, wherein:

Multicast control device 212, its receiving multicast business request is also handled and is provided corresponding multi-cast business data to the requesting party it.Multicast service request from

LUT

13,14 will be handled based on usual manner, not do elaboration here; Can anticipate by access control apparatus 211 from the multicast service request of WiFi access terminal 11 and to send to multicast control device 212 again, multicast control device 212 will be accordingly offers access control apparatus 211 with the multi-cast business data stream of Ethernet packing forms.

Access control apparatus 211; with the 802.11i/EAP authentication mode is example; it can bear the role of authenticator (Authenticator) in the verification process between WiFi access terminal 11 and the certificate server 31; after WiFi access terminal 11 is by authentication; receive the Access-Accept message; wherein comprised the mppe attribute that certificate server provided; the key that it extracts is wherein encrypted the PMK (master control key) of usefulness as WPA (WiFi protects access); and can send the EAP-Success message to WiFi access terminal 11; afterwards; WiFi access terminal 11 and DSLAM 21 use the PMK that gets access to carry out TKIP (Temporal Key Integrirty Protocol); CCMP (counter mode cypher block chaining message integrity code agreement) or WRAP singlecast keys such as (Wireless Robust Authenticated Protocol) are installed; negotiation is set up and is comprised cryptographic algorithm; key is in interior secret key safety mechanism, and detailed process can be with reference to IEEE 802.11i standard.After the key successful installation, data message between WiFi access terminal 11 and DSLAM21 can be encrypted transmission, with TKIP (Temporal Key Integrirty Protocol) encryption mechanism is example, it is the same as the RC4 cryptographic algorithm with WEP (Wired Equivalent Privacy agreement), and existing WEP is improved, in existing WEP crypto engine, appended 4 kinds of algorithms such as key segmentation, message integrity check, initial vector, key generation and regular update function, greatly improved encryption safe intensity with functional nucleotide sequence.

The multi-cast business data that access control apparatus 211 is asked WiFi access terminal 11 with aforementioned secret key safety mechanism again carries out that the mode with clean culture offers described WiFi access terminal after the encryption.Particularly, behind the multi-cast business data stream that DSLAM 21 receives with the Ethernet packing forms, find the Ethernet MAC Address of corresponding WiFi access terminal, with it as the destination address in the corresponding Ethernet bag, the IPTV multicast data flow becomes mode of unicast like this, carry out the conversion of WiFi layer again with this form, promptly with the cryptographic algorithm of consulting in the aforementioned singlecast key installation process to set up, key is encrypted the load in the Ethernet bag, and the target MAC (Media Access Control) address of conversion Ethernet layer is the MAC Address of WiFi terminal, transmit again and deliver to the user residence gateway 12 that the WiFi access terminal is inserted, will finally give WiFi terminal with wireless mode.

Preferably, access control apparatus 211 is behind the EAP-Logoff Frame of receiving from the WiFi access terminal, or it judges that according to alternate manner (for example: do not receive handshake information from WiFi access terminal 11 in the time at certain intervals) this WiFi access terminal 11 disconnects networks and connects, and it deletes the key mechanism of this user's correspondence.

Preferably, access control apparatus 211 can obtain the corresponding multicast of this user by aforementioned verification process and insert authority from the authentication result that certificate server 31 returns, can at first carry out asking multi-cast business datas to multicast control device 212 again after the multicast service authentication process from the multicast service request of user side; And judging that this WiFi access terminal disconnects its corresponding multicast of network connection back deletion and inserts authority.

Fig. 3 is for providing the method example of multicast services, wherein to the WiFi access terminal in the access network system:

Step S30, WiFi access terminal 11 by public part WiFi interface initiate authentication request and with DSLAM 21 arranging key security mechanisms.

Authenticate execution mode as what illustrate in the legend based on 802.11i/EAP, 802.11i be to work out for the safety issue that solves in 802.11 standards, this agreement has been used EAP (Extensible Authentication Protocol) and 802.1x, force the user to verify and validation-cross, and whether the byte of having used the information integrity code detection to transmit has situation about being modified, use three kinds of encryption mechanisms of TKIP, CCMP and WRAP in addition, encrypted process is become dynamically by original static state, allow the assailant more be difficult to crack.WiFi access terminal 11 exchanges its user rs credentials (Credential) with DSLAM21, this user rs credentials is one group and comprises identity and be used to obtain evidence of identity information local and network resource accession power that the form of expression of user rs credentials has: username and password, smart card or certificate etc.DSLAM 21 device interiors can be by providing the Radius/Diameter agreement upstream Interface of standard, and it will be encapsulated in from the user rs credentials of WiFi access terminal 11 in Radius/Diameter agreement AccessRequst (the inserting request) message of standard and send to certificate server 31;

Certificate server 31 will select concrete authentication mechanism and WiFi access terminal to authenticate mutually, it is after 11 successes of authentication WiFi access terminal, can send Radius Access-Accept (visit is accepted) message and give DSLAM 21, comprise the mppe attribute that it provided in the message; The key that DSLAM 21 can extract in the Radius Access-Accept message is encrypted the PMK (master control key) of usefulness as WPA (WiFi protects access), and can send the EAP-Success message to WiFi access terminal 11.

WiFi access terminal 11 and DSLAM 21 use the PMK that gets access to carry out the WPA singlecast key and install, and consult to set up the secret key safety mechanism that comprises cryptographic algorithm, key.Detailed process can be with reference to IEEE 802.11i standard, and after the key successful installation, the data message that WiFi access terminal 11 and DSLAM are 21 can be encrypted transmission.

As a kind of preferred implementation, among the step S30, certificate server 31 can be further inserts authority with the multicast service of this user's correspondence and offers DSLAM 21, for example: the required attribute of certificate server 31 portability user in the Radius Access-Accept message that returns (for example: IP, MASK, MTU etc.), here we can be by additional VendorSpecific (provider's appointment) attribute, this attribute generally is used for transmitting the self-defining information of manufacturer, we can utilize it to carry multicast access right limit information, concrete access authority expression way can be defined according to product performance by a producer or a plurality of producer, is not further stated here.

Step S31, after successfully carrying out authentication, WiFi access terminal 11 can be initiated multicast service request, and for example: it sends joining message of an IGMP (IGMP) and asks to add a specific multicast group.

Step S32, as a kind of preferred implementation, DSLAM 21 bases join request from the user's of WiFi access terminal multicast service, this user's that can be obtained further combined with abovementioned steps S30 multicast service inserts authority and carries out authentication operations (or port bandwidth efficiency test), if this user haves no right to insert (or network bandwidth resources restriction) to the multicast service of being asked, then DSLAM 21 can not respond this multicast service and joins request.

Step S33, DSLAM 21 responses join request from the multicast service of WiFi access terminal, and it carries out offering described WiFi access terminal 11 with mode of unicast after the encryption to the multi-cast business data of being asked with aforementioned secret key safety mechanism.

Particularly, after the multicast data flow that DSLAM21 receives with the Ethernet packing forms, find the Ethernet MAC Address of corresponding WiFi terminal, with it as the destination address in the corresponding Ethernet bag, the IPTV multicast data flow becomes mode of unicast like this, carry out the conversion of WiFi layer again with this form, promptly with the cryptographic algorithm of consulting in the aforementioned singlecast key installation process to set up, key is encrypted the load in the Ethernet bag, and the target MAC (Media Access Control) address of conversion Ethernet layer is the MAC Address of WiFi terminal, transmit again and deliver to the user residence gateway 12 that the WiFi access terminal is inserted, will finally give WiFi terminal with wireless mode.

Step S34 when WiFi access terminal 11 no longer needs to provide service from active user's residence network 10, wants to disconnect when connecting, and it sends the EAP-Logoff Frame;

Step S35, DSLAM 21 is after receiving the EAP-Logoff Frame, or DSLAM 21 can judge that this WiFi access terminal 11 disconnects networks and connects according to alternate manner (for example: do not receive Handshaking message from WiFi access terminal 11 in the time at certain intervals), and it deletes the key mechanism (inserting authority with multicast) of this user's correspondence.

Although above-mentioned being illustrated as the invention provides some embodiment; be not to be used for limiting protection scope of the present invention; the professional in present technique field can carry out various modifications to embodiment under the prerequisite that does not depart from the scope of the present invention with spirit, this modification all belongs in the scope of the present invention.

Claims

1. the method for multicast services is provided to the WiFi access terminal in the network access equipment, it is characterized in that comprising the steps:

A), reception is set up secret key safety mechanism from the access authentication request and the negotiation of WiFi access terminal;

B), the multi-cast business data of the WiFi access terminal being asked with described secret key safety mechanism carries out that the mode with clean culture offers described WiFi access terminal after the encryption.

2. the method for claim 1 is characterized in that described access authentication mode is the 802.11i/EAP mode.

3. the method for claim 1, it is characterized in that described step a) comprises that further the multicast that obtains the WiFi access terminal inserts authority, inserts authority according to described multicast in the step b) multicast service request from the WiFi access terminal is carried out authentication process earlier.

4. method as claimed in claim 3 is characterized in that further comprising step c), the connection status of WiFi access terminal is monitored, and disconnect at it and to connect its corresponding secret key safety mechanism of back deletion and multicast access authority.

5. network access equipment that is used for providing to the WiFi access terminal multicast services is characterized in that it comprises:

Access control apparatus: receive from the access authentication request of WiFi access terminal and consult to set up secret key safety mechanism, the multi-cast business data of the WiFi access terminal being asked with described secret key safety mechanism carries out that the mode with clean culture offers described WiFi access terminal after the encryption;

The multicast control device: the receiving multicast business request also provides corresponding multi-cast business data to described access control apparatus.

6. network access equipment as claimed in claim 5 is characterized in that described access control apparatus carries out encryption based on WiFi data encryption mechanism to multi-cast business data.

7. network access equipment as claimed in claim 5 is characterized in that described access control apparatus further obtains the multicast access authority of WiFi access terminal, carries out authentication process earlier to the multicast service request from the WiFi access terminal.

8. network access equipment as claimed in claim 7 is characterized in that described access control apparatus disconnects the connection back in the WiFi access terminal and further notifies access control apparatus to delete its corresponding secret key safety mechanism and multicast access authority.

9. access network system that multicast services is provided to the WiFi access terminal, comprise WiFi access terminal and the user residence gateway that is connected thereof, network access equipment, certificate server, wherein, user residence gateway provides network insertion to share the access link mode to the WiFi access terminal, it is characterized in that:

The WiFi access terminal: initiate user authentication request and further with network access equipment arranging key security mechanism;

Network access equipment: with described secret key safety mechanism the multi-cast business data that the WiFi access terminal is asked is carried out that the mode with clean culture offers described WiFi access terminal after the encryption.

10. access network system as claimed in claim 9 is characterized in that described network access equipment carries out encryption based on WiFi data encryption mechanism to multi-cast business data.

11. access network system as claimed in claim 9, it is characterized in that described certificate server further inserts authority with the corresponding multicast of this user and offers corresponding network access equipment, described network access equipment inserts authority according to described multicast the multicast service request from the WiFi access terminal is carried out authentication process earlier.

12. access network system as claimed in claim 11 is characterized in that described network access equipment connects back further its corresponding key mechanism of deletion and multicast access authority in the disconnection of WiFi access terminal.