RU2556468C2 - Terminal access authentication method and customer premise equipment - Google Patents

Abstract

FIELD: radio engineering, communication.

SUBSTANCE: invention relates to means of accessing customer premise equipment (CPE). The method comprises CPE sending, according to an IP address of each access controller (AC) in a server of a WLAN, a discovery request to each AC; if the CPE receives a discovery response which is returned by any one of the ACs and corresponds to the discovery request, the CPE establishing a tunnel with any one of the ACs; enabling access the WLAN through the tunnel and enabling the server of the WLAN to authenticate the terminal accessing the WLAN through the tunnel.

EFFECT: providing independent terminal authentication.

18 cl, 11 dwg

Description

FIELD OF THE INVENTION

Embodiments of the present invention relate to communications technology and, in particular, to a terminal access authentication method and equipment located in a subscriber's territory.

BACKGROUND

In the communication system, equipment located on the territory of the subscriber (equipment located on the territory of the subscriber is referred to as CPE) includes a home gateway, access point (access point referred to as AP), modem (modem), router, data transfer card, etc. .P. With the development of home broadband services, CPE is increasingly being applied to the home network.

Currently, a wireless LAN (a wireless LAN is referred to as a WLAN) should be deployed based on a long-term development network resource with an improved packet core (long-term development with an improved packet core, referred to as an LTE-EPC network). Therefore, an existing terminal can directly access the LTE-EPC network. However, when accessing the WLAN, the terminal must go through the LTE-EPC network, i.e. The LTE-EPC network transparently transfers interactive information between the terminal and the WLAN.

In the prior art, however, CPE LTE has a built-in WiFi AP and an Ethernet port and supports a smartphone and a personal computer (a personal computer referred to as a PC) when accessing the aforementioned LTE-EPC network via WiFi or PC when accessing the aforementioned LTE-EPC network Ethernet port. According to the standards of the 3rd Generation Systems Partnership Project (3GPP), the LTE-EPC network only has information about CPE LTE and only records in a CPE LTE unit, but does not have information about a WiFi terminal accessing CPE LTE, and therefore, cannot perform independent authentication of the WiFi terminal. In addition, a WLAN that accesses the LTE-EPC network cannot independently authenticate, meter, or manage quality of service (quality of service is referred to as QoS) on the WiFi terminal.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a terminal access authentication method and equipment located in a subscriber's territory to solve the problem of the prior art in that an LTE-EPC based WLAN cannot independently authenticate a terminal connected to the CPE.

An embodiment of the present invention provides a terminal access authentication method, including:

sending equipment located in the subscriber’s territory, CPE, a discovery request to each access controller, AC, in accordance with the Internet Protocol address (Internet Protocol referred to as IP) of each AC in the server of the wireless LAN network, WLAN;

if the CPE accepts a discovery request that returns through any one AC out of many ACs and matches the discovery request, establishing a control and initialization tunnel for the wireless access points via the CPE (the management and initialization of wireless access points is referred to as CAPWAP) with any one AC; and

enabling the CPE over the CAPWAP tunnel, a terminal connected to the CPE, to access the WLAN network and enabling the WLAN server to authenticate, over the CAPWAP tunnel, the terminal accessing the WLAN network.

An embodiment of the present invention provides equipment located in a subscriber’s territory, including:

a sending unit configured to send a discovery request to each access controller, AC, in accordance with the IP address of each AC in the server of the wireless LAN network, WLAN;

a receiving unit configured to receive a discovery response that is returned by any one AC of many ACs and corresponds to a discovery request;

an establishment unit configured for: after the reception unit receives a discovery response that is returned by any one AC of many ACs and corresponds to a discovery request, establishment of a control tunnel and initialization of wireless access points, CAPWAP, with any one AC; and

an access execution unit configured to enable, through the CAPWAP tunnel, a terminal connected to equipment located on the subscriber’s territory, to access the WLAN network and enable the WLAN server to authenticate, through the CAPWAP tunnel, the terminal performing access to the WLAN network.

According to the above technical solutions, by a method of authenticating access of a terminal and equipment located in a subscriber’s territory, in embodiments of the present invention, a CPE establishes a CAPWAP tunnel with AC in a WLAN network server using CAPWAP protocol, wherein the CAPWAP tunnel allows the terminal connected to the CPE to access to the WLAN, so that the WLAN server authenticates through the CAPWAP tunnel, the terminal accessing the WLAN, which solves the problem of the prior art and lies in the fact that the WLAN network is accessing the LTE-EPC network can not independently authenticate the terminal connected to the CPE.

BRIEF DESCRIPTION OF THE DRAWINGS

To more clearly illustrate the technical solutions of the present invention, the accompanying drawings are briefly presented below to illustrate embodiments. Obviously, the accompanying drawings below are simply attached drawings of some embodiments of the present invention, and those skilled in the art can obtain other attached drawings, which can also implement the technical solutions of the present invention, from these attached drawings without the application of creative efforts.

FIG. 1 is a diagram of a scenario where a terminal is connected to a WLAN according to the present invention;

FIG. 2 is a diagram of a scenario where a terminal is connected to a WLAN according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a terminal access authentication method according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a terminal access authentication method according to another embodiment of the present invention;

FIG. 5 is a schematic flowchart of a terminal access authentication method according to another embodiment of the present invention;

FIG. 6 is a schematic flowchart of a terminal access authentication method according to another embodiment of the present invention;

FIG. 7A and FIG. 7B is a schematic flowchart of a terminal access authentication method according to another embodiment of the present invention;

FIG. 8 is a schematic flowchart of a terminal access authentication method according to another embodiment of the present invention;

FIG. 9 is a schematic structural diagram of equipment located in a subscriber territory, according to another embodiment of the present invention; and

FIG. 10 is a schematic structural diagram of equipment located in a subscriber territory according to another embodiment of the present invention.

DETAILED DESCRIPTION OF EMBODIMENTS

To clarify the objectives, technical solutions and advantages of the present invention, the technical solutions of the present invention are clearly and fully described below with reference to the accompanying drawings. Of course, the embodiments below are merely part of the embodiments of the present invention. Based on the following embodiments of the present invention, those skilled in the art can obtain other embodiments that can solve the technical problem of the present invention and achieve the technical result of the present invention by making equivalent changes to part or all of the technical features without creative effort, where the equivalent changes obviously do not go beyond the scope described by the present invention.

To enable those skilled in the art to better understand the technical solutions provided in the embodiments of the present invention, a solution in the prior art is briefly presented. As shown in FIG. 1, in a prior art solution, the CPE 11 LTE has an integrated AP, and the CPE 11 LTE, which has an integrated AP, is configured with an Ethernet port. Therefore, various terminals can be directly connected to the LTE CPE 11, for example, a personal computer 10 (a personal computer is referred to as a PC) accesses the network using the WiFi method, or PC 10 accesses the network via an Ethernet port.

In this case, the LTE-EPC network 12 only has information about the LTE CPE, can only account for the LTE CPE unit, and does not have information about the terminal that subsequently accesses the LTE CPE. Therefore, a WLAN based on an LTE-EPC network cannot independently authenticate, record, and manage the QoS of a terminal connected to the LTE CPE 11. With this in mind, embodiments of the present invention provide a terminal access authentication method so that it is realized that a WLAN accessing an LTE-EPC network independently authenticates a terminal connected to the CPE.

FIG. 2 is a diagram of a scenario where a terminal is connected to a WLAN according to an embodiment of the present invention. As shown in FIG. 2, CPE 21 in an embodiment of the present invention can integrate a small AP internally or can directly connect to a large AP. The terminal 20 can access the LTE-EPC network 22 or can connect to the WLAN 23 using the WiFi method; or terminal 20 can access LTE-EPC network 22 or can connect to WLAN 23 through an Ethernet port.

Specifically, a CAPWAP tunnel is established between the CPE 21 in the embodiment of the present invention and the WLAN network server accessing the LTE-EPC network, and the CPE 21 forwards, through the CAPWAP tunnel, the information that the terminal connected to the CPE sends to the WLAN network server, so that the terminal 20 connected to the CPE can access the WLAN network, and the WLAN server can perform, through the CAPWAP tunnel, authentication, accounting and QoS of the terminal connected to the CPE.

It should be noted that the CPE 21 shown in FIG. 2, may have a built-in small AP, or the CPE connects externally to the large AP.

In other application scenarios, the terminal can also connect to the CPE directly through the Ethernet port.

It may be understood that the small AP in the embodiment performs only the bridge forwarding function, while functions such as terminal access, online translation of the AP, authentication, routing, AP control, secure data transfer protocol and QoS are available for AC and are committed by him and / or the broadband remote access server (the broadband remote access server is referred to as BRAS).

The large AP fully performs the function of the 802.11 protocol, i.e. An 802.11-based packet can directly terminate on a large AP. It can be understood that each large AP can be used as a separate network entity in the network and independently manage, including functions such as terminal access, authentication, data forwarding, AP management, security protocol, routing, and QoS.

In an embodiment of the present invention, a terminal access authentication method in an embodiment is described as follows.

The CPE allows, through the CAPWAP tunnel, a terminal connected to the CPE, to access the WLAN, which is based on the LTE-EPC network, and allows the WLAN server to authenticate, through the CAPWAP tunnel, the terminal that accesses the WLAN.

For example, the aforementioned CAPWAP tunnel may be a CAPWAP tunnel established by CPE with a WLAN server after completing the LTE-EPC network connection procedure.

It can be known from the terminal access authentication method mentioned in the embodiment that the CAPWAP tunnel that the CPE establishes via the CAPWAP protocol allows the terminal connected to the CPE to access the WLAN network, so that the WLAN network server performs by using the CAPWAP tunnel authentication of the terminal accessing the WLAN, which solves the problem of the prior art, that the WLAN cannot independently authenticate the terminal connected to the CPE.

FIG. 3 is a schematic flowchart of a terminal access authentication method according to an embodiment of the present invention. As shown in FIG. 3, a terminal access authentication method in an embodiment is described as follows.

301. The CPE sends a discovery request to each access controller (the access controller is referred to as an AC) according to the IP address of each AC in the WLAN server.

It should be noted that there are many ways to obtain an AC IP address, for example, resolving a domain name system (the domain name system is referred to as DNS), a variant of the dynamic host configuration protocol (the dynamic host configuration protocol is referred to as DHCP), static configuration of the IP address, broadcasting etc.

For example, a method of obtaining IP address list information includes:

obtaining by CPE the IP address of each AC in the WLAN server from the packet data network gateway (packet data network referred to as PDN) of the LTE-EPC network, where the LTE-EPC network is a network connected to a WLAN network (the WLAN network accesses to the LTE-EPC network, or the WLAN network is based on the LTE-EPC network); or

receiving by CPE information about the domain name of each AC in the WLAN server from the PDN gateway of the LTE-EPC network, sending a request for resolving the domain name, which includes information about the domain name of each AC, to the LTE-EPC DNS network in accordance with the name information the domain of each AC and receiving a list of IP addresses, which DNS returns in accordance with a domain name resolution request, where the list of IP addresses includes the IP address of each AC.

In an embodiment, there are many ACs. Therefore, the IP address list also includes multiple IP addresses, where each IP address corresponds to one AC.

302. If the CPE receives a discovery response that is returned by any one AC of many ACs and matches the discovery request, the CPE establishes a CAPWAP tunnel with any one AC.

In an embodiment, the CAPWAP tunnel established with the AC in step 302 may include a CAPWAP control plane channel and a CAPWAP data plane channel. When the CPE is connected to the terminal, the CPE communicates with the AC over the CAPWAP control plane channel, so that the CPE establishes an association with the AC for the terminal. The CAPWAP data plane channel is used to enable the terminal to communicate with the WLAN.

303. A CPE allows, through a CAPWAP tunnel, a terminal connected to a CPE, to access a WLAN network, and allows a WLAN server to authenticate, through a CAPWAP tunnel, a terminal accessing a WLAN.

In particular, in accordance with the aforementioned step 302, if the CPE does not receive a discovery response that is returned by one or many ACs of many ACs and matches a discovery request, the CPE resends after a predetermined time (e.g., 10 s, 5 s and 15 s) discovery request on an AC that does not return a discovery response.

For example, a predetermined time in an embodiment may be an interval of 2 s, 3 s, 11 s, 20 s, 30 s, and the like. A terminal connected to the CPE may be a PC connected to the CPE via an external large AP, a terminal connected to the CPE via an Ethernet port on the CPE, or a WiFi terminal performing WiFi access.

In the practical application procedure after step 302 and before step 303, the terminal access authentication method further includes step 304, which is not shown in FIG. 3.

304. The CPE receives, based on the CAPWAP tunnel, AP version information sent by the ACs establishing the tunnel. If the AP version information received by the CPE is incompatible with the AP version information configured in the CPE, the CPE initiates a request to update the AP version information on the AC, so that the AC establishing the tunnel updates the AP version.

In an embodiment, the CPE stores version information of the AP, for example, whether there is an embedded small AP or an external large AP.

For example, the tunnel establishing AC sends information about the version of the AP expected by the tunnel establishing AC to the CPE via the aforementioned established CAPWAP control plane channel, and the built-in AP or the external CPE AP determines whether an update is required.

Of course, in other embodiments, when receiving the above AP version information, in step 304, the CPE is also configured to receive configuration information corresponding to the AP version information sent by the tunnel establishing AC, so that the CPE checks whether the internally installed version information and AP configuration information is the same with the received version information and AP configuration information.

It should be noted that the configuration information contains the configuration information of the service set identifier (the service set identifier is referred to as the SSID) so that the WLAN can better authenticate the terminal accessing the WLAN.

It must be understood that reference may be made to the relevant CAPWAP protocol specification for interactive information, such as version information and AP configuration information, after the CPE establishes a CAPWAP tunnel with AC, which is not described again here.

It may be known from the aforementioned embodiment that in the terminal access authentication method, the CPE obtains the AC IP address in the LTE-EPC network connection procedure, and then the CPE actively initiates a discovery request on the AC, so that the CPE establishes a CAPWAP tunnel with AC, and When accessing the WLAN network, the terminal can communicate via the CAPWAP tunnel with the AC that establishes the tunnel, thereby realizing the independent authentication function of the terminal accessing via WiFi or via the Ethernet port in the WLAN, which solves the problem and is known in the art, it consists in the fact that the WLAN network can not perform an independent authentication independent accounting and QoS control terminal connected to the CPE.

The following illustrates, through the use of examples, methods for obtaining IP address list information in a terminal access authentication method.

In an application scenario, the CPE is pre-configured with a list of AC IP addresses in a WLAN server, where the list of IP addresses includes the IP address of each AC.

In another application scenario, the CPE is pre-configured with AC domain name information in the WLAN server, and the method for obtaining the IP address list via CPE in accordance with the domain name information is as follows:

S01. The CPE sends a domain name resolution request, which includes domain name information, to the LTE-EPC DNS network in accordance with the predefined AC domain name information.

S02. DNS resolves domain name information in accordance with a domain name resolution request and returns a list of IP addresses that is formed from IP addresses corresponding to AC domain name information.

In one case, the DNS in the above step S01 can be used as a network element in an LTE-EPC network. In another case, when the LTE-EPC network and the WLAN network are deployed, DNS can also be used as a separate resolution server in accordance with the requirement of operator deployment. In this case, in step S101, the CPE sends a domain name resolution request, which includes the domain name information, to the DNS in accordance with the predetermined AC domain name information to obtain a list of IP addresses formed from IP addresses corresponding to AC domain name information.

In the third application scenario in the LTE-EPC network connection procedure, the CPE obtains a list of AC IP addresses from the PDN gateway by expanding the protocol configuration option (the protocol configuration option is referred to as PCO).

Specifically, the CPE sends a request for obtaining IP addresses of all ACs to a PDN gateway and receives a list of IP addresses including IP addresses of all ACs, where the list of IP addresses is returned by the PDN gateway in accordance with a request for obtaining IP addresses of all ACs .

That is, the CPE obtains a list of IP addresses formed from AC IP addresses from the PDN gateway of the LTE-EPC network.

In a fourth application scenario, the CPE sends a request for AC domain name information to a PDN gateway and receives AC domain name information that the PDN gateway returns in accordance with a request for AC domain name information.

In this case, in the LTE-EPC network connection procedure, the CPE obtains AC domain name information from the PDN gateway by extending the protocol configuration option (the protocol configuration option is referred to as PCO).

The CPE sends a domain name resolution request, which includes domain name information, to the LTE-EPC DNS network in accordance with the AC domain name information, and receives a list of IP addresses that DNS returns in accordance with the domain name resolution request, where the IP addresses in the IP address list are IP addresses corresponding to AC domain name information.

In the fifth application scenario, the first method for obtaining the list of AC IP addresses is as follows: in the procedure for connecting to the LTE-EPC network via CPE, the PDN gateway of the LTE-EPC network does not allocate an IP address; after setting the default CPE radio channel, parameters such as the CPE IP address, default gateway and DNS are obtained from the PDN gateway of the LTE-EPC network through the dynamic host configuration protocol process (the dynamic host configuration protocol is referred to as DHCP), and the IP list AC addresses are additionally obtained through option 43.

The second method of obtaining AC IP address list information is as follows: if the DHCP process in the aforementioned first method supports option 15 and option 15 is carried in the CPE IP address allocation response packet, the CPE receives according to the list of AC host names, where the list of names hosts are transferred in option 15, the IP address of the AC in the list from DNS and then receives a list of IP addresses of all ACs.

It should be noted that the above IP-address and default gateway allocation for CPE in the LTE-EPC network is an existing standard DHCP allocation process, and option 43 and option 15 can be information carried in the response message that the DHCP server sends to the CPE .

FIG. 4 is a schematic flowchart of a terminal access authentication method according to another embodiment of the present invention. As shown in FIG. 4, a terminal access authentication method in an embodiment is described as follows.

401. The CPE sends a discovery request to each AC in accordance with the IP address of each AC in the WLAN server.

402. If the CPE receives a discovery response that is returned by any one AC of many ACs and matches a discovery request, the CPE establishes a CAPWAP tunnel with any one AC.

403. The CPE receives the DHCP Discovery message (Dynamic Host Configuration Protocol discovery message) and sends, through the CAPWAP tunnel, the DHCP Discovery message to the AC that has already established the tunnel with the CPE, where the DHCP Discovery message is sent by the terminal connected to CPE, and is used to request access to a WLAN, and the DHCP “Discovery” message includes medium access control information (medium access control is referred to as MAC) of the terminal.

For example, the CPE encapsulates the DHCP Discovery message using the CAPWAP protocol and sends the encapsulated message to the AC over the CAPWAP tunnel.

404. The CPE receives a DHCP “offer” message (Dynamic Host Configuration Protocol proposal message), which is sent over the CAPWAP tunnel through the AC that establishes the tunnel, and corresponds to the DHCP discovery message, where the DHCP “offer” message contains the IP address that is allocated through the AC establishing the tunnel, and corresponds to the MAC information.

405. The CPE forwards the DHCP “offer” message to the terminal, so that the terminal accesses the WLAN based on the IP address allocated by the tunneling AC and the WLAN network server authenticates, through the CAPWAP tunnel, the terminal accessing WLAN networks.

In practical application, before step 403, i.e. before the CPE sends a DHCP Discovery message over the CAPWAP tunnel to the AC establishing the tunnel, the terminal access authentication method further includes step 406 and step 407, which are not shown in FIG. four.

406. The CPE obtains the MAC information of the terminal from the DHCP “Discovery” message sent by the terminal connected to the CPE and sends an “Association” message (association message) over the CAPWAP tunnel to the AC establishing the tunnel, wherein the “Association” message includes MAC information terminal.

Specifically, the aforementioned step is used to illustrate the step of receiving a new terminal by the CPE and initiating association with the AC for the new terminal, so that the AC adds information related to the new terminal.

407. After receiving an “Association” response message that is returned over the CAPWAP tunnel by the AC establishing the tunnel and corresponds to the “Association” message, the CPE establishes, according to the MAC information of the terminal, an association for the terminal with the AC establishing the tunnel.

Specifically, in a practical application, after receiving the “Association” response message sent by the AC, the CPE also receives configuration information for adding a terminal message element where the configuration information is sent by the AC, so that the CPE performs configuration in accordance with the configuration information located there. For example, the CPE receives a “Station Configuration Request” message (terminal configuration request message) from the AC and sends a “Station Configuration Response” message (terminal configuration response message) to the AC in accordance with the “Station Configuration Request” message.

The message "Request for station configuration", the message "response to configure the station", the message "Association" and the response message to "Association" are the content specified in the CAPWAP protocol, and are used only as examples in the embodiment. Reference may be made to the CAPWAP protocol specification with respect to the content of the information interacting to establish an association between the CPE and the AC.

In other embodiments, if the CPE receives multiple DHCP Discovery messages that include the same MAC information and is sent by a terminal connected to the CPE, the CPE sends CAPWAP through the tunnel to the AC that establishes the tunnel, any one Discovery message »DHCP from multiple DHCP“ Discovery ”messages, which includes the same MAC information, and discards other messages from multiple DHCP“ Discovery ”messages.

Preferably, the CPE selects the medium access control address (medium access control referred to as MAC) of the first DHCP “Discovery” message from the multiple DHCP “Discovery” messages, which include the same MAC information, to initiate the aforementioned association process, at the same time discarding other DHCP Discovery messages without starting the association process.

In addition, if any one CPE port receives multiple DHCP “Discovery” messages with a pre-configured discovery time (for example, 5 s, 10 s, 15 s, 20 s, and 30 s), and each DHCP “Discovery” message from the multiple “ "Discovery" includes various MAC information, the CPE discards the numerous DHCP "Discovery" messages received from the port.

For example, when a particular CPE port receives 50 DHCP discovery messages in a row for 10 seconds, or a particular CPE port receives 30 DHCP discovery messages in a row for 5 seconds, all of these DHCP discovery messages include different MAC information The CPE may consider that a network attacker is attacking the network and therefore discards DHCP “Discovery” messages that a particular port receives during the discovery time without initiating the aforementioned association process. The CPE prohibits this unusual case to prevent the phenomenon that the terminal attacks the network by changing various MAC information. A specific port here is any one port that is defined in the CPE and used to connect to a WLAN, for example, an Ethernet port or a port connected to a large AP.

In a practical operation scenario, the CPE can identify, in accordance with the predetermined operating mode of the port, the network to which the terminal accessing the CPE is to be connected.

Of course, there may be one case that may occur: The same terminal is connected to a WLAN through different CPEs. In this case, the method of processing the terminal by the WLAN is described as follows.

When the tunnel-setting AC receives the Association message, which sends another CPE, over the CAPWAP tunnel and determines according to the MAC information in the Association message that the terminal connected to the other CPE is the same as the terminal connected to CPE, CPE receives a terminal configuration update message (status configuration update message) that the tunnel-setting AC sends over the CAPWAP tunnel, where the terminal configuration update message contains the station information element deleted ia (information element of the deletion state), and deletes information related to the terminal in accordance with the information element of the deletion station.

The above terminal access authentication method can solve the problem that the LTE-EPC based WLAN network independently authenticates the terminal connected to the CPE and can further solve the problem that the WLAN network independently performs accounting and management QoS of the terminal connected to the CPE.

FIG. 5 is a schematic flowchart of a terminal disconnecting a WLAN network in a terminal access authentication method according to another embodiment of the present invention. As shown in FIG. 5, a process for disconnecting a WLAN network by a terminal in an embodiment is described as follows.

501. After the terminal is disconnected from the WLAN, the CPE sends a “Reset Association” message (unassign message) through the CAPWAP tunnel to the AC establishing the tunnel, where the “Reset Association” message is used to enable the AC establishing the tunnel, remove the association between AC and CPE for the terminal.

Typically, the “Association Removal” message includes the MAC information of the terminal.

502. The CPE receives a response message that is sent over the CAPWAP tunnel through the AC and corresponds to the “Association Removal” message, and configuration information for deleting a terminal message element where the configuration is sent by AC, and deletes terminal related information in accordance with the configuration information for deletion terminal message item.

For example, configuration information for deleting a terminal message item may be configuration information that is contained in a Station Configuration Request message that the CPE receives from the AC.

Specifically, before step 501, the terminal access authentication method further includes:

if a message that includes service data is not received and sent by the terminal connected to the CPE within a predetermined time (for example, 1 min, 5 min, 10 min and 50 min), the CPE determines that the connection between the terminal and the network is disconnected WLAN or

when checking that the terminal connected to the specific CPE port is in the disconnected state, the CPE determines that the connection between the terminal and the WLAN is disconnected, and then the CPE performs the above process of disconnecting the WLAN through the terminal.

Typically, a CPE may set a time (e.g., 8 minutes, 15 minutes, etc.) for evaluating a service data message or service data traffic. If the service data message is not received from the terminal or it is found that the service data traffic is zero for a predetermined time, the CPE considers that the terminal has already switched to offline mode or is in a disconnected state, and the CPE needs to initiate the process of removing association with the AC for the terminal.

In other embodiments, if the terminal actively disconnects from the WLAN and initiates the process of releasing the DHCP process of the WLAN, the CPE also needs to initiate the process of removing association to the AC for the terminal.

In addition, after the PC is turned off, the Ethernet port through which the PC is directly connected to the CPE is in the disabled state, and the CPE may have information about the status of the port. If there is evidence that the state of the port on the port is disconnected and cannot be restored within one minute, the CPE initiates the association removal process for the PC.

It should be noted that the aforementioned CAPWAP tunnel includes a CAPWAP control plane channel and a CAPWAP data plane channel. The CPE sends a DHCP Discovery message to the AC over the CAPWAP data plane channel; and the CPE receives the DHCP “offer” message, which the AC sends over the CAPWAP data plane channel.

The above-mentioned “Association” message, “Association” response message, Station configuration request message, Station configuration response message, and the like. sent over the CAPWAP control plane channel. It may be understood that information interacting to establish an association between the CPE and the AC is transmitted over a CAPWAP control plane channel; the information interacting between the terminal and the WLAN, after the CPE establishes association with the AC, is transmitted over the CAPWAP data plane channel.

It may be known from the aforementioned embodiment that when a terminal connected to the CPE accesses the WLAN, the AC can perform fine-grained control and operation on the terminal, for example, independent authentication, accounting and QoS management can be performed on the terminal. In addition, the aforementioned CPE can reduce operator investment costs. In addition, the LTE-EPC network is used to perform backhaul, i.e. return transmission, which helps the operator in an area where the fixed network is not sufficiently developed to provide service and reduce investment costs, and the dependence on the terminal is weak.

FIG. 6 is a schematic flowchart of a terminal access authentication method according to an embodiment of the present invention. As shown in FIG. 6, a terminal access authentication method in an embodiment is described as follows.

The CPE in this embodiment integrates the CAPWAP protocol stack, where the CPE is connected to a regular home AP. Typically, a typical home AP is a large AP, and an 802.11 radio interface packet on a large AP is an 802.11 standard packet.

For example, the RJ45 port in the CPE is a port connected to a regular home AP. In this case, the WiFi terminal is connected to the CPE via a regular home AP.

601. After the CAPWAP tunnel has been established with the AC, the CPE receives the DHCP Discovery message, which the WiFi terminal sends via the AP, where the DHCP Discovery message includes the MAC information of the WiFi terminal and is used to indicate that the new WiFi terminal is pre-accessing the network. WLAN

602. The CPE obtains the MAC information of the WiFi terminal from the DHCP “Discovery” message, encapsulates the MAC information of the WiFi terminal, and sends the Association message over the CAPWAP tunnel control plane channel to the AC establishing the tunnel, where the Association message includes encapsulated MAC terminal information WiFi and is used to inform the AC that the new WiFi terminal is accessing the WLAN and allows the CPE to associate with the AC establishing the tunnel for the new WiFi terminal.

603. After receiving the Association response message, which is returned on the CAPWAP tunnel control plane channel by the AC establishing the tunnel and corresponds to the Association message, the CPE establishes an association for the new WiFi terminal with the AC establishing in accordance with the MAC information of the WiFi terminal tunnel.

604. After establishing association with the AC, the CPE sends the aforementioned DHCP Discovery message, which includes the MAC information of the WiFi terminal, to the AC over the CAPWAP tunnel data plane channel.

605. The CPE receives a DHCP “offer” message that is sent over the CAPWAP tunnel data plane channel through the AC and corresponds to a DHCP “Discovery” message, where the DHCP “offer” message contains an IP address that is allocated by the tunnel establishing AC, and corresponds to MAC information.

606. The CPE forwards the DHCP “offer” message to the terminal, so that the terminal accesses the WLAN based on the IP address allocated by the tunneling AC, and then the WiFi terminal authenticates the WLAN server.

It may be known from the aforementioned embodiment that in the terminal access authentication method, a CAPWAP tunnel is established between the CPE and the AC; The CPE enables the terminal accessing the CPE to access the WLAN via the CAPWAP tunnel, and it enables the WLAN server to authenticate the terminal through the CAPWAP tunnel, which solves the prior art problem that the WLAN cannot independently authenticate terminal connected to CPE.

According to another aspect of the present invention, the present invention further provides a terminal access authentication method, the method including: over a CAPWAP tunnel established between the CPE and the AC, authenticating the terminal connected to the CPE in a WLAN based on an LTE-EPC network.

For example, FIG. 7 is a schematic flowchart of a terminal access authentication method according to an embodiment of the present invention. As shown in FIG. 7, a terminal access authentication method in an embodiment is described as follows.

The authentication listed in the embodiment refers to WEB authentication. WEB authentication is the most common authentication method for a WiFi terminal, and authentication, authorization and accounting are performed using a username / password.

After the WiFi terminal accesses the WLAN of FIG. 6, FIG. 7 illustrates a WEB authentication procedure performed on a WiFi terminal by way of example.

The following ACs, Broadband Remote Access Server (Broadband Remote Access Server referred to as BRAS), Portal Server and Authentication, Authorization and Accounting Server (Authentication, Authorization and Accounting Server referred to as AAA Server) are WLAN servers.

701. After accessing the WLAN, the WiFi terminal sends the Hypertext Transfer Protocol (HTTP) packet used for access authentication to the CPE.

702. After receiving the HTTP packet sent by the WiFi terminal, the CPE re-encapsulates the HTTP packet in accordance with the CAPWAP protocol and sends the re-encapsulated HTTP packet to the AC over the CAPWAP data plane channel.

703. After receiving the HTTP packet sent by the CPE, the AC decapsulates the encapsulated HTTP packet and forwards the decapsulated HTTP packet to BRAS; BRAS redirects the HTTP packet to the portal server (portal server).

704. After receiving the HTTP packet, the portal server places the WEB authentication interface on the CPE via the CAPWAP data plane channel.

705. After receiving the WEB authentication interface sent by the portal server, the CPE forwards the WEB authentication interface to the WiFi terminal, so that the WEB authentication interface is displayed on the side of the WiFi terminal and, in addition, the user name and password that are entered by the user are received.

706. The CPE receives information about the username, password, etc., sent by the WiFi terminal, and sends it to the portal server via the CAPWAP data plane channel.

Specifically, the CPE sends information on the username, password, etc. to the CAPWAP data plane channel. to the portal server.

707. After receiving information about the username, password, etc. the portal server decapsulates it and submits an authentication request to BRAS.

708. After receiving the authentication request sent by the portal server, BRAS initiates the authentication request “Access request” to the AAA server in accordance with the authentication request.

709. After receiving the authentication request “Access request”, the AAA server authenticates the user name, password, and the like. WiFi terminal; if the authentication performed by the AAA server is successful, the “Accept Access” message is sent to BRAS;

otherwise, returns error hint information.

710. BRAS receives the “Accept Access” message sent by the AAA server and returns a response message corresponding to the “Accept Access” message to the AAA server and, in accordance with the “Accept Access” message, returns a response message indicating that authentication is passing to the portal server successfully.

711. After receiving a response message indicating that authentication is successful, the portal server sends a successful authentication interface to the CPE on the CAPWAP data plane channel; The CPE forwards the successful authentication interface to the WiFi terminal, so that the WiFi terminal starts a handshake acknowledgment status message, and then the WiFi terminal performs normal maintenance on the WLAN, and meanwhile, the WLAN starts accounting for the WiFi terminal.

FIG. 8 is a schematic flowchart of a terminal access authentication method according to an embodiment of the present invention. As shown in FIG. 8, a terminal access authentication method in an embodiment is described as follows.

After the WiFi terminal completes the WEB authentication of FIG. 7, FIG. 8 illustrates an accounting process performed for a WiFi terminal as an example.

801. After the WiFi terminal completes the WEB authentication of the WLAN, BRAS initiates the “Start Accounting Request” message (start accounting request message) for the WiFi terminal to the AAA server, informing the AAA server that accounting has been started for the WiFi terminal.

802. The AAA server returns a “start accounting” response message to BRAS.

803. The uplink traffic of a WiFi terminal accessing a WLAN service is sent via CPE to BRAS over a CAPWAP data plane channel.

Downlink traffic sent by BRAS is sent to the CPE via the CAPWAP data plane channel, so that the CPE forwards downlink traffic to the WiFi terminal.

804. BRAS monitors the usage status of the user's network and sends an interim accounting request message (interim accounting request message) to the AAA server in real time.

805. The AAA server updates the call data record (CDR) in accordance with the accounting policy and returns an intermediate Accounting Response message to verify that the accounting is normal; if the condition for generating part of the CDR is satisfied, the AAA generates an intermediate CDR, and the AAA provides the CDR to the CBS system, and the CBS system completes the accounting of user payments.

The aforementioned CDR is generated through the interaction of BRAS + AAA + CBS, and the WiFi terminal account is output by the operator billing system.

806. After the WiFi terminal actively goes offline, or the access side (ie, the side of the WLAN network) detects that the WiFi terminal goes offline due to a timeout, the message “Stop accounting request” (stop message accounting request) initiated by AAA.

807. AAA closes the CDR file and returns the message “Stop accounting response” (message stop accounting response).

In conclusion, the CPE performs WLAN access authentication and accounting services (such as Internet services) in accordance with each terminal that has accessed at the IP level, where the services are encapsulated by the CPE over the CAPWAP tunnel and routed via EPC to AC / BRAS for WEB authentication ; each terminal accesses the Internet and the service domain, and the AAA server authenticates and accounts at the IP level and manages QoS.

According to another aspect of the present invention, the present invention also provides equipment located in a subscriber territory. As shown in FIG. 9, equipment located in the subscriber’s territory includes a sending unit 91, a receiving unit 92, an establishment unit 93, and an access execution unit 94. The sending unit 91 is configured to send a discovery request to each AC in accordance with the IP address of each AC in the WLAN server; a receiving unit 92 is configured to receive a detection response that is returned by any one AC of many ACs and corresponds to a discovery request; establishment unit 93 is configured to establish a CAPWAP tunnel with any one AC, after the reception unit receives a discovery response that is returned by any one AC of many ACs and corresponds to a discovery request; the access execution unit 94 is configured to allow a terminal connected to equipment located in the subscriber's territory to access the WLAN network through the CAPWAP tunnel and to enable the WLAN network server to authenticate, through the CAPWAP tunnel, the terminal performing access to the WLAN network.

According to the above, the equipment located in the subscriber’s territory, in the embodiment, can solve the problem that the LTE-EPC based WLAN network independently authenticates the terminal connected to the CPE.

In practical use, the aforementioned sending unit 91 is further configured for: when the receiving unit 92 does not receive a detection response that is returned by one or multiple ACs of many ACs and corresponds to a discovery request, resends after a predetermined time a discovery request to ACs that do not return a response.

In the scenario, the above equipment located on the territory of the subscriber should also include an address acquisition unit. The address obtaining unit is configured to obtain the IP address of each AC in the WLAN server from the packet data network gateway (packet data network referred to as PDN) of the LTE-EPC network, where the LTE-EPC network is connected to the WLAN network (the WLAN network accesses LTE-EPC networks, or a WLAN based on an LTE-EPC network); or

the address obtaining unit is configured to: obtain information about the domain name of each AC in the WLAN server from the PDN gateway of the LTE-EPC network, send, in accordance with the information about the domain name of each AC, a request for resolving the domain name, which includes information about the name the domain of each AC, on the LTE-EPC DNS network, and receiving the list of IP addresses that DNS returns in accordance with the domain name resolution request, where the list of IP addresses includes the IP address of each AC.

Of course, in other embodiments, the aforementioned list of IP addresses can also be pre-configured in the CPE.

Typically, a CPE has an embedded small AP or an external large AP, and the CPE stores version information of the AP. In this case, after the CPE establishes a tunnel with the AC, the receiving unit 92 is further configured to receive AP version information that the tunnel establishing AC sends through the CAPWAP tunnel.

Accordingly, the sending unit 91 is further configured for: if the version information of the AP received by the receiving unit 92 is not consistent with the version information of the AP set in the equipment located in the subscriber’s territory, initiating a request to update the version information of the AP on the AC, so that The tunneling AC updates the version of the AP.

In the practical application procedure, as shown in FIG. 10, the aforementioned access execution unit 94 specifically includes a message sending unit 941, a message receiving unit 942, and a message sending unit 943. A message routing unit 941 is configured to receive a DHCP “Discovery” message and send a DHCP “Discovery” message through a CAPWAP tunnel to an AC establishing a tunnel where a DHCP “Discovery” message is sent by a terminal connected to equipment located in the subscriber’s territory and used to request WLAN access, and the DHCP “Discovery” message includes the MAC information of the terminal.

The message receiving unit 942 is configured to receive a DHCP “offer” message that is sent through the CAPWAP tunnel through the tunnel establishing AC and corresponds to the DHCP discovery message, where the DHCP offer message carries the IP address that is allocated through the tunnel establishing AC , and corresponds to the MAC information.

A message sending unit 943 is configured to route a DHCP “offer” message to the terminal, so that the terminal accesses, based on the IP address allocated by the tunneling AC, to the WLAN.

In addition, the access execution unit 94 includes an association message sending unit 944 and an association unit 945. The association message sending unit 944 is configured to receive the MAC information of the terminal from the DHCP discovery message sent by the terminal connected to the equipment located in the subscriber’s territory and send the Association message via the CAPWAP tunnel to the AC establishing the tunnel where the Association message is sent "Includes the information of the MAC terminal.

The association unit 945 is configured to: after receiving an “Association” response message that is returned through the CAPWAP tunnel by the AC establishing the tunnel and corresponds to the “Association” message, establishing in accordance with the MAC information of the association terminal for the terminal with the AC establishing the tunnel.

Specifically, the aforementioned message routing unit 941 is further configured to: when receiving multiple DHCP “Discovery” messages, including the same MAC information from a terminal connected to equipment located in the subscriber’s territory, send any one DHCP “Discovery” message (e.g., the first DHCP Discovery messages) from multiple DHCP Discovery messages over the CAPWAP channel on the AC that establishes the tunnel, and discarding other messages from multiple DHCP Discovery messages.

In addition, the message routing unit 941 is further configured to: determine that any one port of the equipment located on the subscriber territory receives multiple DHCP “Discovery” messages during the pre-configured discovery time, and each DHCP “Discovery” message from the multiple “Discovery” messages "Includes various MAC information, and discarding numerous DHCP" Discovery "messages.

Of course, the aforementioned message directing unit 941 is further configured for: when the tunnel-setting AC receives the “Association” message sent by other equipment located in the subscriber’s territory via the CAPWAP channel and determines, in accordance with the MAC information in the “Association” message, that the terminal connected to other equipment located on the territory of the subscriber is the same as the terminal connected to equipment located on the territory of the subscriber receiving an update message eniya station configuration sent through AC, establishing the tunnel through the tunnel CAPWAP, wherein the station configuration update message carries information element removal station and relating to the removal of the terminal information according to the information element removal station.

In practical operation, equipment located on the territory of the subscriber additionally includes an association elimination unit (not shown in the figure), where the association elimination unit is configured to: after disconnecting the connection between the terminal and the WLAN network, send the message “Association Removal” via the CAPWAP tunnel to AC establishing a tunnel, where the message “Association Elimination” is used to enable the AC establishing the tunnel to remove the association for the terminal with the CPE.

In addition, the association elimination unit is configured to: receive a response message that is sent via the CAPWAP tunnel through the AC and corresponds to the “Association Removal” message, and configuration information for deleting the terminal message element where the configuration information is sent via AC, and deleting the terminal related information in accordance with the configuration information for deleting a terminal message item.

Of course, the aforementioned association elimination unit is further configured for: when a message including service data is not received from the terminal connected to the equipment located in the subscriber’s territory for a predetermined time to determine that the connection between the terminal and the WLAN is disconnected; or, if it is detected that the status of the terminal connected to a specific port of equipment located in the subscriber’s territory is in the disconnected state, determining that the connection between the terminal and the WLAN is disconnected.

It may be known from the aforementioned embodiment that the equipment located in the subscriber’s territory in an embodiment provides the possibility, by using the sending unit, the receiving unit and the establishing unit, of the CPE to establish, based on the CAPWAP protocol, a CAPWAP tunnel with an AC in a WLAN network server; then it enables, by using the access execution unit, the terminal connected to the CPE to access the WLAN network via the CAPWAP tunnel, and further provides the possibility of the WLAN network based on the LTE-EPC network to authenticate, through the CAPWAP tunnel, the terminal performing access to WLAN network, which solves the problem of the prior art, namely, that the WLAN network cannot independently authenticate the terminal connected to the CPE.

In several embodiments provided herein, it is understood that the described system, device and method may be implemented by other methods. For example, the above described embodiment of the device is merely exemplary.

Blocks described as separate parts may or may not be physically separate, and parts shown as blocks may or may not be physical blocks, may be in the same position, or may be distributed across multiple network elements. Part or all of the blocks may be selected according to actual need to achieve the objectives of the solutions of the embodiments.

In addition, the functional blocks in the embodiments of the present invention may be integrated into a processing unit, or each block may exist separately physically, or two or more two blocks are integrated into one block. An integrated unit may be implemented as hardware or may be implemented as a software function block.

An integrated unit, if implemented as a software function unit and sold or used as a separate product, may be stored on a computer-readable storage medium. Based on this understanding, the technical solutions of the present invention, essentially, either a part contributing to the prior art, or all or part of the technical solutions can be implemented as a software product. The computer program product is stored on a storage medium and includes several instructions for instructing a computing device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in embodiments of the present invention. The storage medium may be various media that can store program codes, such as a U-disk, removable hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or compact -disk.

Finally, it should be noted that the above embodiments are provided merely to describe the technical solutions of the present invention, but are not intended to limit the present invention. One skilled in the art will appreciate that, although the present invention has been described in detail with reference to the aforementioned embodiments, modifications to the technical solutions embodied in the embodiments can still be made, or equivalent replacements of part of the technical features in the technical solutions can be made, provided that such modifications or replacements do not cause a deviation of the nature of the relevant technical solutions from the essence and scope of the embodiments of this gaining.

Claims (18)

1. A method for authenticating terminal access, comprising the steps of:
send a discovery request to each access controller (AC) according to the IP address of each AC in the server of the wireless local area network (WLAN) equipment by the equipment located in the subscriber’s territory (CPE);
if the CPE receives a discovery response that is returned by any one AC of many ACs and corresponds to a discovery request, establish, by means of the CPE, a wireless access point management and initialization tunnel (CAPWAP) tunnel with said any one AC; and
enable a terminal connected to a CPE to access a WLAN through a CAPWAP tunnel through a CPE, and enable a WLAN server to authenticate a terminal that accesses a WLAN through a CAPWAP tunnel. 2. The method of claim 1, further comprising the step of: if the CPE does not receive a discovery response that is returned by one or multiple ACs from many ACs and matches a discovery request, retrieve a discovery request for ACs that do not return a response after a predetermined time. . 3. The method according to claim 1, wherein before sending a discovery request via CPE to each AC in accordance with the IP address of each AC in the WLAN server, the method further comprises the steps of:
Obtaining by means of the CPE the IP address of each AC in the WLAN server from the Gateway of the Packet Data Network (PDN) of the Advanced Packet Core (LTE-EPC) network, wherein the LTE-EPC network is a network connected to a WLAN network; or
receive, via CPE, information about the domain name of each AC in the WLAN server from the PDN gateway of the LTE-EPC network, send, in accordance with the information about the domain name of each AC, a request for the resolution of the domain name, which contains information about the domain name of each AC, to the system domain names (DNS) of the LTE-EPC network, and receive a list of IP addresses, which DNS returns in accordance with a request for resolving a domain name, and the list of IP addresses contains the IP address of each AC. 4. The method according to claim 1, wherein after establishing a CAPWAP tunnel with said any one AC via a CPE and before allowing a terminal connected to the CPE to access a WLAN through a CAPWAP tunnel through a CPE, the method further comprises the steps of:
receiving, via the CPE, version information of the wireless access point (AP) sent by the tunnel setting AC through the CAPWAP tunnel; and
if the version information of the AP received by the CPE is incompatible with the version information of the AP specified in the CPE, initiate by the CPE a request to update the version information of the AP on the AC, so that the AC establishing the tunnel updates the version of the AP. 5. The method of claim 1, wherein enabling the terminal connected to the CPE to access a WLAN through a CAPWAP tunnel through a CPE, comprises the steps of:
receive the Dynamic Host Configuration Protocol (DHCP) “Discovery” message through the CPE and send the DHCP “Discovery” message over the CAPWAP tunnel to the AC establishing the tunnel, the DHCP “Discovery” message being sent by the terminal connected to the CPE and used to request network access A WLAN, wherein the DHCP “Discovery” message contains terminal media access control (MAC) information; receive, through the CPE, a DHCP “offer” message that is sent over the CAPWAP tunnel by the AC establishing the tunnel and corresponds to the DHCP discovery message, wherein the DHCP “offer” message carries the IP address that is allocated by the tunnel establishing AC and matches the information MAC and
forward the DHCP “offer” message via the CPE to the terminal so that the terminal accesses, based on the IP address allocated by the tunneling AC, to the WLAN. 6. The method according to claim 5, wherein before sending the DHCP “Discovery” message via the CAPWAP tunnel through the CAPWAP tunnel to the AC establishing the tunnel, the method further comprises the steps of:
receive, through the CPE, the MAC information of the terminal from the DHCP “Discovery” message sent by the terminal connected to the CPE, and send the “Association” message over the CAPWAP tunnel to the AC establishing the tunnel, wherein the “Association” message contains the MAC information of the terminal; and
after receiving the “Association” response message, which is returned via the CAPWAP tunnel through the tunnel establishment AC and corresponds to the Association message, the association for the terminal with the tunnel establishment AC is established by the CPE in accordance with the terminal MAC information. 7. The method of claim 5, further comprising the step of:
if the CPE receives multiple DHCP “Discovery” messages containing the same MAC information from a terminal connected to the CPE, send any single DHCP “Discovery” message from the multiple DHCP “Discovery” messages through the CAPWAP tunnel to the AC establishing the tunnel through the CPE, and discard the other Messages from multiple DHCP Discovery messages. 8. The method of claim 5, further comprising the step of:
if any one CPE port receives multiple DHCP discovery messages during a pre-configured discovery time, and each DHCP discovery message from multiple discovery messages contains different MAC information, multiple DHCP DHCP discovery messages are discarded. 9. The method of claim 6, further comprising the steps of: upon termination of the connection between the terminal and the WLAN, sending an Association Elimination message via the CAPWAP tunnel to the AC establishing the tunnel via the CPE, wherein the Association Elimination message is used to enable the AC establishing a tunnel, remove the association for the terminal with the CPE; and
receive, by the CPE, a response message that is sent over the CAPWAP tunnel by the AC and corresponds to the “Association Removal” message, and configuration information for deleting the terminal message element, the configuration information being sent by AC, and the terminal related information is deleted in accordance with the configuration information for deletion terminal message item. 10. Equipment for authentication of terminal access to the network, located on the territory of the subscriber, containing:
a sending unit configured to send a discovery request to each access controller (AC) in accordance with the IP address of each AC in the server of the wireless local area network (WLAN) network;
a receiving unit configured to receive a discovery response that is returned by any one AC of many ACs and corresponds to a discovery request;
an establishment unit configured to: upon receipt by the reception unit of a discovery response that is returned by any one of the many ACs and matches the discovery, establishment of a control tunnel and initialization of wireless access points (CAPWAP) request with any one AC; and
an access execution unit configured to enable a terminal connected to equipment located in the subscriber's territory to access a WLAN network through a CAPWAP tunnel and to enable a WLAN server to authenticate a terminal that accesses a WLAN network through a CAPWAP tunnel. 11. Equipment located on the territory of the subscriber, according to p. 10, in which:
the sending unit is further configured for: when the receiving unit does not receive a discovery response that is returned by one or multiple ACs of many ACs and corresponds to a discovery request, retransmit after a predetermined time a discovery request to an AC that does not return a response. 12. Equipment located on the territory of the subscriber, according to p. 10, additionally containing:
an address obtaining unit configured to obtain an IP address of each AC in a WLAN server from a packet data network (PDN) gateway of a long-term advanced packet core network (LTE-EPC), the LTE-EPC network being a network that is connected to WLAN or
configured to receive the domain name information of each AC in the WLAN server from the PDN gateway of the LTE-EPC network, send a request to resolve the domain name, which contains the domain name information of each AC, to the LTE-EPC domain name system (DNS) in accordance with information about the domain name of each AC, and receiving a list of IP addresses that DNS returns in accordance with a request for resolving a domain name, the list of IP addresses containing the IP addresses of each AC. 13. Equipment located on the territory of the subscriber, according to claim 10, in which:
the receiving unit is further configured to receive version information of the wireless access point (AP) that the tunnel-setting AC sends through the CAPWAP tunnel; and
the sending unit is further configured for: if the version information of the AP received by the receiving unit is incompatible with the version information of the AP set in the equipment located on the subscriber’s territory, initiating a request to update the version information of the AP on the AC, so that the AC setting the tunnel updates the version of AP. 14. Equipment located on the territory of the subscriber according to claim 10, in which the access execution unit, in particular, comprises:
a message forwarding unit configured to receive the “Discovery” message of the Dynamic Host Configuration Protocol (DHCP) and send the “Discovery” DHCP message through the CAPWAP tunnel to the AC establishing the tunnel, the DHCP “Discovery” message being sent by the terminal connected to the equipment located in the territory the subscriber, and is used to request access to the WLAN network, and the DHCP “Discovery” message contains terminal access control (MAC) information;
a message receiving unit configured to receive a DHCP “offer” message that is sent over the CAPWAP tunnel by the AC establishing the tunnel and corresponds to the DHCP discovery message, wherein the DHCP “offer” message carries the IP address that is allocated by the tunnel establishing AC , and corresponds to the MAC information; and
a message sending unit configured to forward the DHCP “offer” message to the terminal so that the terminal accesses, based on the IP address allocated by the tunnel setting AC, to the WLAN. 15. Equipment located on the territory of the subscriber according to claim 14, in which the access execution unit further comprises:
an association message sending unit configured to receive the MAC information of the terminal from the DHCP “Discovery” message sent by the terminal connected to the equipment located on the subscriber’s territory and send the “Association” message through the CAPWAP tunnel to the AC establishing the tunnel, wherein the “Association” message contains the information of the MAC terminal; and
an association unit configured to: after receiving an “Association” response message that is returned over the CAPWAP tunnel by the AC establishing the tunnel and corresponding to the “Association” message, establishing in accordance with the MAC information of the association terminal for the terminal with the tunnel establishing AC. 16. Equipment located on the territory of the subscriber, according to p. 14, in which:
the message forwarding unit is additionally configured for: when receiving multiple DHCP “Discovery” messages containing the same MAC information from a terminal connected to equipment located on the territory of the subscriber, sending any one DHCP “Discovery” message from the multiple DHCP “Discovery” messages through the tunnel CAPWAP on the AC establishing the tunnel, and discarding other messages from the numerous DHCP Discovery messages. 17. Equipment located on the territory of the subscriber, according to p. 14, in which:
the message forwarding unit is additionally configured for: if any one port of the equipment located on the subscriber's territory receives multiple DHCP “Discovery” messages during a pre-configured discovery time, and each DHCP “Discovery” message from the many “Discovery” messages contains different MAC information, discarding multiple DHCP “Discovery” messages. 18. Equipment located on the territory of the subscriber, according to p. 15, additionally containing:
association elimination unit configured to: after disconnecting the connection between the terminal and the WLAN, send a “Resolve Association” message through the CAPWAP tunnel to the AC that establishes the tunnel, and the “Resolve Association” message is used to allow the AC that establishes the tunnel to remove the association for the terminal with CPE; and
configured to receive a response message that is sent through the CAPWAP tunnel through the AC and corresponds to the “Association Removal” message, and configuration information for deleting the terminal message element, the configuration information being sent via AC, and deleting terminal related information in accordance with the configuration information for deletion terminal message item.

Images