JP6061304B2 - Line authentication method and system - Google Patents

Description

  The present invention relates to a line authentication method in a fixed network. More specifically, when the service control function that is deployed at the service edge that terminates the user accommodation line in the conventional fixed network is aggregated on the upper part of the network separated from the user accommodation line, the user accommodation line equivalent to the conventional one is used. The present invention relates to a technology for realizing information-based authentication.

  In a fixed network represented by NGN (Next Generation Network), when providing services such as IP (Internet Protocol) telephone and ISP (Internet Service Provider) connection, it is legal to prevent unauthorized use of services by unsigned users. Line authentication is performed to provide services only to secure lines. In conventional line authentication, packets that require authentication such as DHCP (Dynamic Host Configuration Protocol) requests and PPPoE (Point-to-Point Protocol over Ethernet) connection requests issued from user terminals at the start of service use This is implemented by notifying the ID (line authentication ID) of the user accommodation line between the user's home and the service edge from the service edge to the network control server (DHCP server, authentication server, etc.) when the control function is received. ing.

  Here, since a plurality of user accommodation lines are usually accommodated in one physical port of the service edge, the line authentication ID that needs to be unique for each user accommodation line is not limited to a physical port number. The ID (VLAN-ID or the like) for each user accommodation line assigned to the packet header is used. An outline of a network that performs the above-described conventional line authentication is shown in Non-Patent Document 1 and FIG.

  As shown in FIG. 5, in the conventional line authentication system, the service edge 900 includes a function for transferring a DHCP request from the user terminal 101 to the control server (DHCP relay agent function) and an authentication server for a PPPoE connection request. A service control function 500 such as a BAS function for inquiring the requesting user whether there is an ISP connection service contract and establishing a PPPoE session with the user terminal when the contract is present is provided.

  By the way, as shown in Non-Patent Document 2, there is an architecture proposal in which a service control function is separated from a service edge in a future carrier network and concentrated in a cloud above the network. This architecture proposal is shown in FIG. Here, in the present network architecture, since the service control function 500 needs to be able to receive broadcast packets (such as DHCP request packets) from the user terminal 101, the user terminal 101 and each service control function 500 have the same broadcast. In the domain. For this reason, it should be noted that rewriting of a source MAC (Media Access Control) address via a router or the like does not occur in the core network 400.

  More service users are connected to the service control function 500 aggregated in the upper part of the network than when the service control function 500 is deployed at the service edge 900 shown in FIG. Thus, in order to perform line authentication equivalent to the conventional one in the service control function 500, a larger amount of information is added to the packet as a line authentication ID in order to uniquely identify the line in which the user is accommodated. It will be necessary. That is, in a future carrier network architecture plan, more path IDs are given to the packet header than in the past for line authentication. For example, as shown in FIG. 6, a conventional user accommodation line 200 is encapsulated in a path 410 (MPLS (Multi Protocol Label Switching) path or the like) in the core network, and is represented by a VLAN (Virtual Local Area Network) -ID. The line authentication is performed based on the IDs of two paths, that is, the path of the user accommodation line 200 and the path 410 in the core network.

“What is line authentication”, [online], October 28, 2009, Itpro, [Search October 15, 2013], Internet <URL: http://itpro.nikkeibp.co.jp/article/Keyword / 20091027/339483> Takayuki Nakamura, Kaoru Suruga, Kenichi Koshizuka, “Evaluation of Applicability of Carrier Network Architecture to Changes in External Environment”, September 2013, 2013 IEICE Communication Society Conference, B-6-96

  As described above, in the future carrier network architecture plan, as described above, it is necessary to give more path IDs as line authentication IDs to the packet header than in the conventional carrier network. However, if the process of simply “adding” the line authentication ID to the header while maintaining the other header contents of the packet is performed, the payload of the packet decreases, and the quality of service (QoE (Quality of Quality of Service) of the user accompanying the decrease in throughput is reduced. Experience)) may be a factor of deterioration. In addition, since it is necessary to terminate many paths in the service control function 500, it is conceivable that processing for a plurality of path terminations may cause performance degradation of the service control function 500.

  The present invention has been made in view of the above circumstances, and the object of the present invention is to assign a lot of path IDs to a packet in order to identify a user accommodation line when collecting service control functions. It is an object of the present invention to provide a line authentication method and system capable of suppressing a decrease in QoE due to a decrease in packet payload and a performance deterioration in the service control function due to termination of many paths by the service control function.

  In order to achieve the above object, the present invention provides a core network, a user accommodation line for accommodating a user terminal in the core network, an edge device arranged at an edge of the core network and terminating the user accommodation line, and a user A line authentication method for authenticating a user accommodation line in a network system configured to have a service control function unit for controlling service provision to a terminal, and wherein the user terminal and the service control function unit are configured to belong to the same broadcast domain. When the edge device transfers the packet transmitted from the user terminal to the service control function unit to the path in the core network formed between the edge device and the service control function unit, the edge field of the packet There is no influence on the service control function in the service control function unit and at least the user terminal A step of embedding the line authentication ID in a header field having a sufficient number of bits to give a unique line authentication ID to each accommodated user accommodated line; And performing a line authentication process using a line authentication ID included in a header of a packet from the user terminal.

  According to the present invention, since the line authentication ID is embedded in the header field that is a packet header and originally prepared for other uses, the payload of the packet is obtained even when the amount of information of the line authentication ID increases. Does not reduce the area. Therefore, it is possible to suppress a decrease in QoE accompanying a decrease in payload. In the present invention, since the user accommodation line is terminated at the edge terminal, it is possible to suppress performance degradation of the service control function that accompanies termination of many paths by the service control function.

  As an example of a preferred aspect of the present invention, in the step of embedding the line authentication ID, the value of the header field of the embedding destination is stored in the storage device of the edge device, and the edge device further receives a service from the user terminal. A step of rewriting a header of the response packet using a value stored in the storage means when a response packet from the service control function unit to the packet transmitted to the control function unit is transferred to the user terminal. Things.

  As an example of a preferred aspect of the present invention, the line authentication ID is embedded in the header field storing the source address information in the step of embedding the line authentication ID.

  According to the present invention, when a service control function is aggregated, a large number of path IDs are assigned to a packet in order to identify a user accommodation line, thereby reducing QoE associated with a decrease in packet payload and a service control function. Therefore, it is possible to suppress the performance deterioration of the service control function due to terminating many paths.

Network configuration diagram assumed in the present invention A diagram for explaining a method of assigning a line authentication ID Sequence when acquiring an IP address by DHCP Sequence when starting PPPoE session between user terminal and BAS function Traditional carrier network architecture Future career network architecture proposal

  A line authentication method and system according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a network configuration diagram for realizing line authentication according to the present invention. One of the major differences between the network system according to the present embodiment and the future carrier network architecture proposal described with reference to FIG. 6 is that the user accommodation line is terminated by an edge device, and the edge The device is provided with a line authentication ID assigning function.

  As shown in FIG. 1, a user terminal 101 that terminates a user accommodation line 200 is provided in a user home 100. The user terminal 101 may be a computer or a network device that has a termination function for the user accommodating line 200 and is used alone, or a subscriber premises device called a home gateway (HGW). A local area network (LAN) may be formed underneath and a user terminal or various network devices may be connected to the LAN.

  The user accommodation line 200 is physically accommodated in a fixed line such as an optical fiber of FTTH (Fiber To The Home) or a cable of CATV (Cable Television), and a plurality of user accommodation lines 200 are included in one physical line. Are accommodated by being physically and logically (virtually) multiplexed to form an access network 250. Here, the user accommodation line 200 means a logical path formed between the user terminal 101 and the edge device 300. As a logical path formation method, for example, a method using VLAN technology may be used.

  The edge device 300 is arranged at the edge on the user terminal 101 side in the core network 400, terminates the user accommodation line 200, and accommodates the user terminal 101 in the core network 400. The edge device 300 has a function of transferring an uplink packet transmitted from the user terminal 101 to the logical path 410 in the core network 400 addressed to the service control function 500 according to packet header information or the like. In addition, a downlink packet transmitted from the service control function 500 is transferred to the user accommodation line 200 based on the transmission destination information in the packet header in the same manner as the uplink. That is, the edge device 300 has a packet distribution function. In addition, the edge device 300 has a line authentication ID giving function 350 that embeds a line authentication ID in the header of the packet when the packet is transferred. The line authentication ID giving function 350 will be described later.

  The core network 400 includes network devices such as an edge device 300, a core router (not shown), or a switch. In the present embodiment, packets related to communication between devices in the core network 400 are encapsulated and transferred by MPLS (Multi Protocol Label Switching) or the like. That is, a logical path 410 corresponding to the communication transmission source / transmission destination is formed in the core network 400.

  The core network 400 is provided with a service control function 500 that controls provision of services including line authentication processing to the user terminal 101. Examples of the service control function 500 include a DHCP relay agent that controls a DHCP request issued from the user terminal 101 and a BAS (Broadband Access Server) that controls a PPPoE connection request of the user terminal 101. The service control function 500 will be described later. In FIG. 1, communication related to DHCP between the user terminal 101 and the service control function 500 is indicated by a solid arrow, and communication related to the PPPoE is indicated by a dotted arrow.

  Here, it should be noted that in the network system according to the present invention, the user terminal 101 and the service control function 500 are in the same broadcast domain. In other words, the network system according to the present invention does not rewrite the source MAC address in the core network 400 via a router or the like in the core network 400, and the line authentication ID is added to the source MAC address of the upstream packet. It should be noted that it is assumed that the service control function 500 can acquire the line authentication ID even in the case of assigning.

  Next, the line authentication ID assigning function 350 of the edge device 300 will be described in detail. The line authentication ID assigning function 350 has no influence on the service control function 500 due to header rewriting out of the headers normally given to the packets in the upstream packet, and is unique for each user accommodation line 200 when aggregated in the upper part of the network. A line authentication ID is embedded in a header field having a sufficient number of bits to give a unique ID. Here, as the header field converted to the line authentication ID, the user terminal 101 can freely assign the header field that satisfies the above-described conditions. Therefore, the header field is normally used in the service control function 500 in the carrier network. The source MAC address having a relatively large bit width of 48 bits, or the lower 64 bits part (interface ID part) of the source IPv6 address automatically generated by the user terminal from the MAC address or the like is appropriate. . On the other hand, an IPv4 address that has an effect when the service control function 500 performs address translation or control for permitting communication only for a specific address is not appropriate as a header field for assigning a line authentication ID.

  Further, the line authentication ID assigning function 350 returns the field assigned the line authentication ID to the original bit string assigned by the user terminal 101 for the downstream packet. For example, when a bit string of the line authentication ID is embedded in the source MAC address of the upstream packet, the transmission destination MAC address of the downstream packet becomes a bit string embedded with the circuit authentication ID. At this time, in order to avoid the possibility that the user terminal does not receive the packet correctly when the packet destination MAC address is not addressed to the own terminal, transmission of the downstream packet transmission destination MAC address to the line authentication ID in the upstream packet is performed. Return to the original MAC address. In order to do this, the line authentication ID assigning function 350 stores a correspondence table of header information before and after conversion of the header to be converted of the upstream packet in a predetermined storage unit.

  Here, the line authentication ID assigned by the line authentication ID assigning function 350 may be connected to a plurality of terminals 101 within one user accommodating line 200, and the line authentication assigned to the downlink packet as described above. Since it is necessary to return the ID to a different bit string for each terminal 101 before conversion, the bit string is unique for each terminal 101 in the user accommodating line 200. For example, as shown in FIG. 2A, the information used in the conventional line authentication method such as the path ID of the user accommodation line 200 and the interface number of the edge device 300 is used in the header field that gives the line authentication ID. There is a method in which a different bit string is added to each terminal 101 to the bit string degenerated to a bit width. Alternatively, as shown in FIG. 2 (b), a bit string that is completely different from the information of the conventional line authentication method that is predetermined for each user-accepted line 200 that is completely different from the conventional line authentication method, A method in which is added.

  Next, the service control function 500 will be described in detail. Each service control function 500 has a DHCP relay agent function, a BAS function, a multicast distribution function, and the like which are necessary according to the service to be controlled.

  Further, the service control function 500 uses the line authentication ID extracted from the uplink packet when the line authentication in the linked server 501 (DHCP server or authentication server) is necessary in the uplink packet transmitted from the user terminal 101. It has a function to transmit to 501. Here, as a method for transmitting the line authentication ID to the cooperating server, a method corresponding to the protocol used in each service is taken. For example, in the service control function 500 having the DHCP relay agent function, a circuit authentication ID is assigned to an optional Agent Circuit ID in the DHCP message for the DHCP packet from the user terminal 101, and then the packet is sent to the DHCP server. Forward.

  As described above in detail, according to the present invention, when the service control function 500 deployed at the service edge in the conventional fixed network is concentrated on the upper part of the network, each user accommodation line 200 required for line authentication is provided. Of the headers normally assigned to the packet, the ID information is not affected by the service control function 500 by rewriting the header information, and is sufficient to give a unique ID to each aggregated user accommodating line 200. Embed in the part with the number of bits. As a result, in the conventional line authentication method, when the service control function 500 is aggregated, a QoE is reduced due to a decrease in the payload of the packet by assigning many path IDs to the packet in order to identify the user accommodation line 200. Therefore, it is possible to suppress the performance deterioration of the service control function 500 that accompanies termination of many paths in the service control function 500.

  In the network shown in FIG. 1, the operation of the embodiment will be described by taking as an example the case where the user terminal 101 acquires an IP address by DHCP and the case where a PPPoE session between the user terminal 101 and the BAS function is started.

[When obtaining an IP address by DHCP]
The sequence of this embodiment is shown in FIG. First, a DHCP request packet is distributed from the user terminal 101 to which an IP address is not assigned (step S101).

  The edge device 300 receives the DHCP request packet distributed from the user terminal 101, and based on the fact that the destination IP address is the broadcast address and the destination port number is the port number of the DHCP server 501, etc. Transfer to the service control function 500 having the relay agent function (step S103). At this time, the line authentication ID assigning function 350 in the edge device 300 embeds a line authentication ID in the source MAC address of the packet (step S102).

  Next, the DHCP relay agent function 500 describes the line authentication ID given to the source MAC address in the optional Agent Circuit ID in the DHCP message for the received DHCP packet (step S104). Is transferred to the DHCP server 501 (step S105).

  Similar to the conventional line authentication method, the DHCP server 501 uses the line authentication ID described in the option of the DHCP message and the correspondence table between the line authentication ID and the user accommodation line 200 held by the user, and the user accommodation line. 200 is specified, an IP address corresponding to the service contract of the line is described in the message of the DHCP response packet (step S106), and the packet is transmitted to the DHCP relay agent function 500 (step S107).

  The DHCP relay agent function 500 rewrites the transmission destination MAC address of the received packet to the transmission source MAC address (that is, the bit string to which the circuit authentication ID is assigned) in the above-described upstream packet, as in the general DHCP relay agent function. The DHCP response packet is transmitted to the edge device 300 that is the transmission source of the upstream packet (step S108).

  The edge device 300 returns the transmission destination MAC address of the received DHCP response packet to the MAC address of the user terminal 101 recorded at the time of rewriting the uplink packet (step S109), and the user in which the transmission source user terminal 101 is accommodated The packet is transmitted to the accommodation line 200 (step S110).

  The user terminal 101 sets the IP address of the own terminal 101 based on the received DHCP response packet (step S111).

[When starting a PPPoE session between the user terminal and the BAS function]
The sequence of the present embodiment is shown in FIG. First, it is assumed that a PPPoE session establishment request packet is distributed from the user terminal 101 (step S201).

  The edge device 300 receives the PPPoE session establishment request packet distributed from the user terminal 101, and transfers the received packet to the service control function 500 having the BAS function based on the fact that the Ethernet type number is a PPPoE number. (Step S203). At this time, the line authentication ID assigning function 350 in the edge device 300 assigns a line authentication ID to the transmission source MAC address of the packet (step S202).

  The BAS function 500 transmits an authentication request message (such as RADIUS Access-Request) to the authentication server 501 (such as a RADIUS server) upon reception of the PPPoE session establishment request packet (step S205). At this time, the line authentication ID assigned to the source MAC address is described in the authentication request message (step S204).

  As in the conventional line authentication, the authentication server 501 uses the line authentication ID described in the authentication request message and the correspondence table between the line authentication ID and the user accommodated line 200 held by the authentication server 501 based on the user accommodated line 200. If a PPPoE session establishment is permitted for the line, an authentication permission message (such as RADIUS Access-Accept) is transmitted to the BAS function 500 (step S206).

  Similar to the general BAS function, the BAS function 500 rewrites the transmission destination MAC address of the PPPoE session establishment response packet to the transmission source MAC address (that is, the bit string to which the circuit authentication ID is assigned) in the upstream packet ( In step S207, the packet is transmitted to the edge device 300 that is the transmission source of the uplink packet (step S208).

  The edge device 300 returns the destination MAC address of the received PPPoE session establishment response packet to the MAC address of the user terminal 101 (step S209), and sends the packet to the user accommodation line 200 in which the transmission source user terminal 101 is accommodated. Transmit (step S210).

  The user terminal 101 starts a PPPoE session when receiving the received PPPoE session establishment response packet (step S211).

  Although the embodiment of the present invention has been described in detail above, the present invention is not limited to this. For example, in the above embodiment, the line authentication ID is assigned to the lower 64 bit part (interface ID part) of the source IPv6 address automatically generated by the user terminal 101 from the source MAC address of the packet or the MAC address. However, other header fields may be used as long as they do not affect the service control function 500 and have a necessary and sufficient bit amount.

  In the above embodiment, DHCP and PPPoE are exemplified as an example of the service control function. However, the present invention can be applied to other protocols. In the above embodiment, a network employing VLAN and MPLS has been described. However, the present invention can also be applied to a network to which another technology is applied.

  DESCRIPTION OF SYMBOLS 101 ... User terminal, 200 ... User accommodation line, 300 ... Edge device, 350 ... Line authentication ID assignment function, 400 ... Core network, 410 ... Logical path, 500 ... Service control function

Claims (4)

A core network, a user accommodating line for accommodating a user terminal in the core network, an edge device disposed at an edge of the core network and terminating the user accommodating line, and a service control function unit for controlling service provision to the user terminal And the user terminal and the service control function unit authenticate the user accommodation line in a network system configured to belong to the same broadcast domain,
When the edge device transfers a packet transmitted from the user terminal to the service control function unit to a path in the core network formed between the edge device and the service control function unit, the edge device is a header field of the packet. In the header field having a sufficient number of bits to give a unique line authentication ID for each user accommodation line that has no influence on the service control function in the service control function unit and at least the user terminal is accommodated, Embedding the line authentication ID;
The service control function unit includes a step of performing line authentication processing using a line authentication ID included in a header of a packet from a user terminal transferred by an edge device. In the step of embedding the line authentication ID, the value of the header field of the embedding destination is stored in the storage means of the edge device, and
When the edge device transfers a response packet from the service control function unit to the user terminal in response to a packet transmitted from the user terminal to the service control function unit, the header of the response packet is used using the value stored in the storage means. The line authentication method according to claim 1, further comprising a step of rewriting. The line authentication method according to claim 1 or 2, wherein in the step of embedding the line authentication ID, a line authentication ID is embedded in a header field for storing source address information. A core network, a user accommodating line for accommodating a user terminal in the core network, an edge device disposed at an edge of the core network and terminating the user accommodating line, and a service control function unit for controlling service provision to the user terminal And the user terminal and the service control function unit authenticate the user accommodation line in a network system configured to belong to the same broadcast domain,
The edge device is a header field of the packet when the packet transmitted from the user terminal to the service control function unit is transferred to the path in the core network formed between the edge device and the service control function unit. In the header field having a sufficient number of bits to give a unique line authentication ID for each user accommodation line that has no influence on the service control function in the service control function unit and at least the user terminal is accommodated, Means for embedding the line authentication ID;
The service control function unit includes means for performing line authentication processing using a line authentication ID included in a header of a packet from a user terminal transferred by an edge device.

Images