WO2007131426A1

WO2007131426A1 - Aaa system and authentication method of multi-hosts network

Info

Publication number: WO2007131426A1
Application number: PCT/CN2007/001398
Authority: WO
Inventors: Ruobin Zheng
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-04-29
Filing date: 2007-04-26
Publication date: 2007-11-22
Also published as: CN101064605A; CN101064605B

Abstract

An AAA system and authentication method of multi-hosts network include: gateway device/bridge device, access server in access service network and AAA server process three parts authentication of device authentication and/or user authentication of gateway device/bridge device; after finishing the device authentication and/or user authentication of gateway device/bridge device, host device, network access server in gateway device/bridge device and AAA server process three parts authentication of device authentication and/or user authentication of host device. The invention enables to license and charge to the host device in WiMAX network of multi-hosts. It supports the authentication and authorization of the host device on the lay of a mechanism and protocol process. In AAA system, network access server can be neatly set in the gateway device/bridge device or the access server network.

Description

One

AAA system and authentication method for multi-host network

This application claims priority to Chinese Patent Application No. 200610078076. K, entitled "AAA Architecture and Authentication Method for Multi-Host Network", filed on April 29, 2006, the entire contents of which are hereby incorporated by reference. Combined in this application.

Technical field

The present invention relates to mobile communication technologies, and in particular to broadband wireless access technologies, and more particularly to an AAA system and an authentication method for a multi-host network.

Background technique

AAA refers to authentication, authorization, and accounting. After the AAA authentication is performed on the user, the accounting authority grants the corresponding permission according to the service type that the user applies when opening the account. When the user uses the network resource, The corresponding device in the AAA system counts the resources occupied by the user and charges the corresponding fee.

FIG. 1 is a network architecture of a WiMAX (World Interoperability for Microwave Access) system based on a mobile station (MS, Mobile Station). The MS11 passes through an R1 reference point and an access service network (ASN). A base station (BS, Base Station, not shown) is connected to connect to the ASN, and R1 uses 802.16e wireless transmission technology. The ASN 12 is connected to the Access Service Network (CSN) of the Visited-Network Service Provider 13 (CSN) through an R3 reference point, and the CSN 14 of the V-NSP and the home network service are provided. The CSNs 16 of the H-NSP (Home-Network Service Provider) 15 are connected by an R5 reference point.

The RFC2094 AAA Authorization Framework provides three configuration AAA framework models, including: Agent Order/Model, Pull Order/Model, Push Order/Model. The main differences between the three models are: 1 how the requester communicates with the authentication server; 2 how the control messages such as keys and policies are configured to the bearer device. The WiMAX Forum recommends using a pull sequence/model to define the AAA architecture of the WiMAX system shown in Figure 1 as shown in Figures 2 through 5:

Figure 2 shows a non-roaming AAA architecture that is not compatible with traditional CSN. The operator (NSP, Network Service Provider) is divided into an access service network (ASN) 21 and a connection service network (CSN) 22. The service equipment of the ASN becomes a network access server (NAS, Network Access Server). twenty three. The CSN 22 includes one or more AAA servers 24. AAA server supports three-party authentication Certification mechanism - "Supplicant", "Authenticator" and "Authentication Server". The three-party authentication mechanism supports multiple authentication methods based on the EAP (Extensible Authentication Protocol) protocol, such as: EAP-TLS, (EAP-Transport Layer Security, EAP Transport Layer Security) EAP-TTLS (EAP-Trivered TLS) , EAP Tunneling Layer Security), PEAP (Protected EAP, Protected Extensible Authentication Protocol), EAP-SIM (EAP-Service Identity Module, EAP Service Identification) module, EAP-AKA (EAP- Authentication and Key Agreement, EAP authentication and key agreement, etc., can support strong key derivation methods.

In the AAA architecture of FIG. 2, the MS is the applicant; the service device of the NAS is used to implement the authenticator; and the AAA server is the authentication server. The ASN includes one or more network access servers, that is, the ASN may include one or more authenticators/AAA clients. The AAA protocol is adopted between the NAS and the AAA server. The AAA protocol includes: Dimeter and RADIUS (Remote Authentication Dial In User Service).

The authentication process for users under this architecture is as follows:

The MS connects to the NAS to send an access network request, and the NAS collects the access authentication request sent by the MS, and transmits the access authentication request to the CSN's AAA server. After the AAA server is authenticated, it sends permission or rejection information to the NAS. If the authentication succeeds, the allowed information also includes 4 authorized information, and the related charging function is started. After receiving the response from the AAA server, the NAS notifies the MS to allow access or deny access.

Figure 3 shows a non-roaming AAA architecture compatible with the traditional CSN. Unlike the architecture shown in Figure 2, the connection service network 32 of the operator belongs to the traditional NSP, and the authentication and authorization backends are not compatible with the AAA protocol. Therefore, the authentication request transmitted by NAS23 to the CSN needs to be transmitted through the added Internet Gateway (IWG) 34 in the CSN, the AAA protocol and attributes are mapped to the specific protocols and attributes of the traditional carrier, and then the authentication and authorization process is performed. . The carrier's permission and rejection messages are then mapped to the AAA protocol by the IWG and transmitted to the NAS.

4 and FIG. 5 are respectively a roaming AAA architecture that is incompatible with CSN and CSN. In FIG. 4 and FIG. 5, the AAA server 43 in the V-NSP 41 acts as an AAA proxy (AAA Proxy), and passes the authentication request sent by the NAS 23 to the H. - NSP42 AAA server 44. In FIG. 5, the authentication request transmitted by NAS 23 to CSN 52 also needs to pass through IGW 54 in CSN 52, and the AAA protocol and attributes are mapped. Shoot the specific protocols and attributes of the traditional carrier and then perform the authentication and authorization process. When the AAA proxy of the V-NSP receives an allow or reject message from the CSN of the H-NSP, it transmits it to the NAS 23. In the case of roaming, there may be one or more AAA Brokers and AAA Agents between the NAS and the AAA server. However, an AAA session always exists between the NAS and the AAA server, and an AAA manager that provides a NAI (NAI, Network Access Identity) based routing pipeline is optional.

In the above four different AAA architectures, MS authentication includes: device authentication and user authentication. When the MS performs authentication, both device authentication and user authentication can be performed; or only device authentication, or only MS user authentication. When both device authentication and user authentication are performed, the device authentication of the MS is performed prior to the user authentication.

If the MS device authentication uses a digital certificate, such as X.509, an EAP method that supports digital certificates, such as EAP-TLS, is used. In order to avoid the intervention of the CSN, the MS shortens the round-trip delay of the device authentication. When the device authentication of the MS performs the three-party authentication, the authentication server in the AAA architecture is merged with the authenticator, and the MS uses the MAC (Mdium Access Control) address as Device flag, device authentication at the ASN's NAS, but not at the CSN.

If the device authentication of the MS adopts the pre-shared key (PSK), the PSK-based EAP method is used to perform device authentication, such as EAP PSK. The device authentication of the MS runs between the G-Host (Gateway-Host) and the V-CSN/H-CSN. When the MS device performs the three-party authentication, the MS uses the NAI as the device identifier. When the MS accesses the local network. According to the NAI, the MS requests authentication from the AAA server in the H-CSN through the AAA proxy in the V-CSN.

If the MS and the AAA server perform the three-party authentication of the MS, if the server or the different AAA servers of the same CSN are used, the dual EAP mode is used for authentication; if the device authentication and user authentication of the MS are terminated by the same authentication. For the server, the MS uses the dual EAP mode, or combines the device authentication and the user authentication in a single EAP mode. If only the device authentication or user authentication of the MS is performed, the single EAP mode is adopted.

The authentication process will be described below with reference to the user authentication protocol stack of the MS. As shown in Figure 6, the MS is the applicant, the NAS of the ASN is the authenticator, the AAA server of the CSN is the authentication server, the BS is the authentication relay, and the other AAA agents/managers are optional in the roaming state. MS user-certified EAP The packet authentication ends on the AAA server. The EAP packet between the MS and the BS is carried in the PKMv2 (referred to as EAPoP for short, and the EAP packet is carried in PKM (Privacy Key Management)), and is transmitted to the BS through the air interface of 802.16. PKMv2 also supports three-party authentication mechanisms and multiple EAP authentication methods. PKMv2 is specified by IEEE 802.16-2004 and 802.16e with EAP to support user authentication and device authorization. IEEE 802.16-2004 and 802.16e also specify PKMvl with EAP, which only provides support for device authentication and authorization, and supports fixed users in mobile networks. The EAP text 7 between the BS and the authenticator is contained in the authentication relay protocol and is transmitted to the ASN through the link between the BS and the ASN. The ASN NAS is the Authenticator. The EAP packet between the NAS and the AAA server is carried on the AAA protocol, and the AAA packet is carried in the UDP/IP (User Datagram Protocol/IP) protocol. User information is verified on the AAA server that is passed to the CSN on the transport layer protocol.

Figure 7 and Figure 8 show the flow chart of the device authentication using the EAP-TLS authentication method during the authentication process. In Figure 7, both the device authentication and the user authentication of the MS perform authentication, and the MS adopts the dual EAP mode. The MS performs device authentication first. Since the authentication server is merged with the authenticator, the MS device authentication ends with the ASN. After the MS device authentication ends, the MS performs user authentication, and the user authentication ends in the CSN. In Figure 8, the MS only performs device authentication, and the device authentication of the MS ends with the ASN. After the MS device is authenticated, the ASN carries the device identifier (MAC address) of the MS to the AAA protocol and passes it to the CSN to inform the AAA server that the MS device authentication has passed. In this case, the AAA server can further authorize the MS to access the corresponding ASN. Business.

Figure 9 and Figure 10 show the flow chart of the device authentication using the EAP-PSK authentication method during the authentication process. In Figure 9, the device authentication and user authentication of the MS are performed. The MS uses the dual EAP mode. The device authentication and user authentication of the MS terminates on the same authentication server. In Figure 10, the device authentication and user authentication of the MS are terminated on the same AAA server. The MS adopts the single EAP mode to jointly perform MS device authentication and user authentication, and terminates in the CSN.

The WiMAX Forum now defines a multi-host network based on gateway devices/bridge devices. In a network, a gateway device/bridge device can support multiple host devices. As shown in Figure 11, in a multi-host WiMAX network, a gateway relay station/gateway mobile station (G-RS/G-MS) 110 using a gateway device provides multiple hosts (Multiple Hosts) support, and if a bridge device is used to provide multiple hosts, For support, you can use the bridge relay station/bridge mobile station instead of the G-RS/G-MS in Figure 11. In Figure 11, the host device is a network. The host 101, 102, the G-RS/G-MS is connected to the plurality of gateway hosts through the first interface, and the G-RS/G-MS is connected to the BS (not shown) through the second interface to connect to the ASN 111; The first interface is a G interface, the G interface uses 802.3, 802.16, or 802.11 transmission technology; the second interface is an R1 interface, and the R1 uses an 802.16e wireless transmission technology. The ASN 111 and the CSN 112 are connected by an R3 reference point, and the CSN 113 of the NAP+V-NSP and the CSN 112 of the H-NSP are connected by an R5 reference point.

Since the gateway device/bridge device and the host device are added to the WiMAX network in Figure 11, the existing AAA architecture and authentication method are only for the MS authentication in the original network. Therefore, a new AAA architecture and corresponding authentication method are needed to support the authentication of gateway devices/bridge devices and host devices in a multi-host WiMAX network.

Summary of the invention

The embodiment of the invention provides an AAA system and an authentication method for supporting a multi-host network, and can flexibly select a location of the NAS in the AAA system, and authenticate the gateway device/bridge device and the host device.

An embodiment of the present invention provides an AAA system of a multi-host network, including: an access service network and a connection service network, where a network access server is set in the access service network, and at least one AAA server is set in the connection service network, where The AAA system of the multi-host network further includes: a gateway device/bridge device and a host device; the host device is connected with the gateway device/bridge device; the gateway device/bridge device is provided with the network access server; the host device authentication Performing separately from the gateway device/bridge device authentication; the gateway device/bridge device and the network access server in the access service network, and the AAA server, performing device authentication and/or user authentication of the gateway device/bridge device Three-party authentication; the network access server in the host device and the gateway device/bridge device, and the AAA server perform the three-party authentication of the device authentication and/or user authentication of the host device.

The embodiment of the present invention further provides an AAA system authentication method for a multi-host network, wherein when the host device is connected to the gateway device/bridge device, the AAA system authenticates the gateway device/bridge device and the host device respectively; The device/bridge device first transmits the authentication information of the gateway device/bridge device to the AAA server connected to the service network through the network access server in the access service network, where the gateway device/bridge device and the access service network The network access server, the AAA server, and the three-party authentication of the device authentication and/or user authentication of the gateway device/bridge device; after the device authentication and/or user authentication of the gateway device/bridge device is completed, the host device authenticates the device Information through the gateway device / The network access server in the bridge device transmits to the AAA server connected to the service network; the network access server in the host device, the gateway device/bridge device, the AAA server, performs device authentication and/or user authentication of the host device Three-party certification.

The embodiment of the present invention further provides an AAA system of a multi-host network, including an access service network and a connection service network, where the access service network is provided with a network access server, and the connection service network is set by at least one AAA server, wherein The AAA system also includes: a gateway device/bridge device and a host device; a host device connected to the gateway device/bridge device; a gateway device/bridge device connected to the access service network; a host device authentication and a gateway device/bridge Device authentication is performed separately and independently; the gateway device/bridge device and the network access server in the access service network, and the AAA server perform the three-party authentication of the device authentication and/or user authentication of the gateway device/bridge device; The network access server and the AAA server in the access service network perform the three-party authentication of the device authentication and/or the user authentication of the host device.

The embodiment of the present invention further provides an AAA system authentication method for a multi-host network, wherein when the host device is connected to the gateway device/bridge device, the AAA system authenticates the gateway device/bridge device and the host device respectively; The device/bridge device first authenticates the gateway device/bridge device to the gateway device/bridge device, the network access server in the access service network, and the AAA server, and performs device authentication of the gateway device/bridge device and/or Or user-authenticated three-party authentication; after the device authentication and/or user authentication of the gateway device/bridge device is completed, the host device transmits its authentication information to the AAA server connected to the service network through the network access server of the access service network. The host device, the network accessing the service network, the server, and the AAA server perform the three-party authentication of the device authentication and/or user authentication of the host device.

The embodiment of the present invention provides an AAA system for a multi-host WiMAX network, and solves the support for authentication and authorization of the gateway device/bridge device and the host device from the mechanism and protocol flow level. In the AAA system, the network access server can be flexibly set in the gateway device/bridge device or the ASN. When the host device accesses the network resource, the location of the network access server can be the gateway device/bridge device and the host. The provision of authentication of the device makes it possible to authorize and bill the host device in the multi-host WiMAX network.

DRAWINGS 1 is a schematic diagram of an existing WiMAX network;

Figure 2 shows a non-roaming AAA architecture that is not compatible with traditional connection service networks;

Figure 3 shows an existing non-roaming AAA architecture compatible with a traditional connection service network;

Figure 4 shows the existing roaming AAA architecture that is not compatible with the traditional connection service network;

Figure 5 shows an existing roaming AAA architecture compatible with a traditional connection service network;

6 is an existing PKMv2-based mobile station user authentication protocol stack;

7 is a flowchart of an embodiment of performing MS device authentication and user authentication in the prior art; FIG. 8 is a flowchart of an embodiment in which the MS performs device authentication only in the prior art;

9 is a flowchart of another embodiment of performing MS device authentication and user authentication in the prior art; FIG. 10 is a flowchart of joint authentication of MS device authentication and user authentication in the prior art; FIG. 11 is a prior art Schematic diagram of a multi-host network structure based on a gateway device;

12 is a non-roaming AAA system that is not compatible with a traditional connection service network based on a multi-host network according to an embodiment of the present invention;

13 is a non-roaming AAA system compatible with a traditional connection service network based on a multi-host network according to an embodiment of the present invention;

14 is a roaming AAA system that is not compatible with a traditional connection service network based on a multi-host network according to an embodiment of the present invention;

15 is a roaming AAA system compatible with a traditional connection service network based on a multi-host network according to an embodiment of the present invention;

16 is a user authentication protocol stack of an embodiment of a gateway host in a state in which the access network server is set in the gateway transit station/gateway mobile station in the system according to the embodiment of the present invention;

17 is a user authentication protocol stack of another embodiment of a gateway host in a state in which the access network server is set in the gateway transfer station/gateway mobile station in the system according to the embodiment of the present invention;

Figure 18 is a flow diagram of an embodiment of both gateway host device authentication and user authentication based on Figures 16 and 17;

Figure 19 is a flow diagram of an embodiment of performing only gateway host device authentication based on Figures 16 and 17; Figure 20 is a flow diagram of another embodiment of gateway host device authentication and user authentication based on Figures 16 and 17;

21 is another embodiment of an embodiment of performing gateway host device authentication based on FIGS. 16 and 17. Flow chart

22 is a user authentication protocol stack of an embodiment of a gateway server in an access service network and a gateway host in the system according to an embodiment of the present invention;

FIG. 23 is a user authentication protocol stack of another embodiment of a network access server in an access service network in a system according to an embodiment of the present invention;

Figure 24 is a flow chart of the conversion of EAPOL and ΕΑΡΟΡ in Figure 23;

Figure 25 is a flow diagram of an embodiment of both gateway host device authentication and user authentication based on Figures 23 and 24;

Figure 26 is a flow diagram of an embodiment of performing gateway host device authentication based on Figures 23 and 24; Figure 27 is a flow diagram of another embodiment of device authentication and user authentication based on the gateway hosts of Figures 23 and 24;

Figure 28 is a flow diagram of another embodiment of an embodiment of performing only gateway host device authentication based on Figures 23 and 24.

detailed description

As shown in FIG. 12, a schematic diagram of an AAA system embodiment of a network supporting a WiMAX multi-host network by a G-RS/G-MS (Gateway Transfer Station/Gateway Mobile Station) in a non-roaming state. The operator is divided into G-MS/G-RS+ASN and CSN. The gateway host 121 is connected to the G-RS/G-MS through the gateway interface as the first interface. The G-MS/G-RS is connected to the base station of the ASN by using the R1 interface as a second interface (not shown). The service device of the G-MS/G-RS + ASN is the network access server 122, that is, in addition to setting the service device of the ASN as the network access server NAS, the service device of the G-RS/G-MS can also be set as Network access server NAS.

G-MS/G-RS or ASN can be set to include one or more NASs, that is, set up multiple Authenticator/AAA clients (not shown), such as: Multiple RADIUS clients or DIAMETER Client, 0 or more AAA Proxy (proxy). The AAA server 124 is included in the connection service network 123.

Figure 13 is a diagram showing another embodiment of an AAA system supporting a WiMAX multi-master network with G-RS/G-MS in a non-roaming state. Different from the embodiment shown in FIG. 12, since the CSN belongs to the traditional carrier, the authentication and authorization backends are not compatible with the AAA protocol, so the AAA protocol and attributes need to be mapped to the specific protocols of the traditional NSP through the added IWG 134 function in the CSN. Attributes. Operation The authentication message of the feedback is then mapped to the AAA protocol through the IWG and transmitted to the AAA Client.

14 and FIG. 15 respectively show an incompatible CSN and a CSN-compliant roaming AAA system supporting a WiMAX multi-master network by G-RS/G-MS. Unlike the embodiment shown in FIG. 12, the AAA server 143 in the V-NSP 141 is shown. As an AAA proxy, the message sent by the NAS in the G-MS/G-RS + ASN is delivered to the AAA server 144 of the H-NSP 142. In Figure 15, since the CSN 151 belongs to the traditional carrier, the authentication and authorization backends are not compatible with the AAA protocol. Therefore, the AAA protocol and attributes need to be mapped to the specific protocols and attributes of the traditional NSP through the IWG 152 function added in the CSN 151. The authentication message fed back by the operator is then mapped to the AAA server 143 through the IWG mapping to the AAA protocol.

When the AAA proxy of the V-NSP receives the permission or rejection message from the HSN of the H-NSP, it forwards it to the G-MS/G-RS + ASN. In the roaming scenario shown in Figure 15, one or more AAA managers and AAA agents (not shown) may exist between the NAS and the AAA server. All AAA sessions are always present between the NAS and the AAA server, and AAA managers that provide routing pipes based on the NAI domain are optional.

When the gateway host and the connected G-MS/G-RS connect to access network resources, both the gateway host and the G-RS/G-MS need to be authenticated. The authentication and authorization methods based on the WiMAX network AAA system embodiments supporting multi-hosts in Figures 12 to 15 are as follows: Do not perform, the two are independent of each other.

2) Device authentication of G-RS/G-MS precedes user authentication. G-RS/G-MS and ASN's NAS, and AAA server, perform three-party authentication of G-RS/G-MS device authentication and/or user authentication. G-RS/G-MS device authentication and user authentication can be performed; or only G-RS/G-MS device authentication, or only G-RS/G-MS user authentication. If the device authentication and user authentication of the G-RS/G-MS are performed, but terminate in different authentication servers (including AAA servers ending in different CSNs or different AAA servers ending in the same CSN), then G-RS/G- The MS adopts the dual EAP mode for authentication. If the device authentication and user authentication of the G-RS/G-MS are performed and are terminated by the same authentication server (the same AAA server of the same CSN), the G-RS/G-MS adopts Dual EAP mode, or single EAP mode, combines device authentication and user authentication of G-RS/G-MS. If only G-RS/G-MS device authentication or G-RS/G-MS user authentication is performed, the G-RS/G-MS adopts the single EAP mode. 3) The device authentication of the gateway host precedes the user authentication. The gateway host can perform the three-party authentication of the device authentication and/or user authentication of the gateway host with the NAS of the G-RS/G-MS + ASN and the AAA server. Both the gateway host device authentication and user authentication are performed, or only the gateway host device authentication is performed, or only the gateway host user authentication is performed. If both the gateway host device authentication and the user authentication are performed but are terminated by different authentication servers (including AAA servers belonging to different CSNs and different AAA servers of the same CSN), the gateway host adopts dual EAP mode. If the gateway host device authentication and user authentication are both performed and terminated on the same authentication server (same AAA server), the gateway host adopts dual EAP mode, or adopts single EAP mode to authenticate the device and user of the G-RS/G-MS. Certification is carried out jointly. If the gateway host only performs device authentication or user authentication, the gateway host adopts the single EAP mode.

4) G-RS/G-MS authentication precedes gateway host authentication.

Based on the AAA system shown in FIG. 12 to FIG. 15, when the service device of the G-RS/G-MS is also set as the network access server, in the AAA system, when G-RS/G-MS authentication is performed, G- RS/G-MS is the "applicant", the NAS in the ASN is the "authenticator" of the G-RS/G-MS, and the AAA server in the CSN is the "authentication server"; when the gateway host t is authenticated, the gateway host is "Applicant", the NAS in the GR-RS/G-MS is the "authenticator" of the gateway host t; the AAA server in the CSN is still the "authentication server". The authentication of the G-RS/G-MS and the gateway host t is performed separately, and the authentication of the gateway host is performed after the authentication of the G-RS/G-MS is completed.

G-RS/G-MS and ASN's NAS, and AAA server, perform G-RS/G-MS device authentication and/or user authentication for three-party authentication. G-RS/G-MS uses digital certificates to perform device authentication. To avoid CSN intervention, the round-trip delay of G-RS/G-MS device authentication is shortened. The authentication server in the AAA system is merged with the authenticator, G-RS/ The G-MS uses the MAC address as the device identifier and performs device authentication on the ASN's NAS. If the G-RS/G-MS only performs device authentication, after the device authentication of the G-RS/G-MS is completed, the ASN transmits the device identification MAC address to the AAA server, and informs the AAA server of the G-RS/G-MS device authentication. If yes, the AAA server further authorizes the ASN to allow the G-RS/G-MS to access the corresponding service.

If the device authentication of the G-RS/G-MS adopts the pre-shared key (PSK), the G-RS/G-MS device authentication runs between the gateway host and the V-CSN/H-CSN, G-RS/G- The MS uses the Network Access Identity (NAI) as the device identifier. According to the NAI, the G-RS/G-MS requests authentication from the AAA server in the H-CSN through the AAA proxy in the V-CSN.

After the G-RS/G-MS device authentication is completed, G-RS/G-MS user authentication is performed, and G-RS/G-MS is used. User authentication only uses a pre-shared key. The device authentication and user authentication authentication process of the G-RS/G-MS is the same as the device authentication and user authentication of the existing MS.

After the G-RS/G-MS authentication is completed, the AAA system authenticates the gateway host t. In the authentication process of the gateway host t authentication, if the gateway host performs device authentication using a digital certificate, such as X.509, it supports digital authentication. EAP methods, such as EAP-TLS. The gateway host avoids the intervention of the CSN to shorten the round-trip delay. The Authenticator merges with the authentication server. The gateway host uses the MAC address of the device as the device identifier. The gateway host performs the device authentication of the gateway host on the NAS of the G-RS/G-MS. The device authentication of the gateway host is terminated by G-RS/G-MS. After the gateway host device is authenticated, the G-RS/G-MS sends the MAC address of the gateway host to the CSN through the AAA protocol. The CSN checks the gateway host device digital certificate according to the received MAC address of the gateway host device, such as X. 509 certificate, is it valid? When the device is authenticated by a digital certificate, NAI cannot be used as the device identifier to prevent the authentication of the gateway host from extending to other management domains.

If the gateway host uses the pre-shared key (PSK) for device authentication, the EAP method runs between the gateway host and the V-CSN/H-CSN. The gateway host device authentication ends in the CSN, and the gateway host confirms H-with the NAI as the device identifier. CSN. When the gateway host accesses the local network, the gateway host requests authentication from the AAA server in the H-CSN through the AAA proxy in the V-CSN according to the NAI.

The following describes the authentication process of the gateway host in conjunction with the following figures:

Figure 16 is a PKMv2-based gateway host user authentication protocol stack. The gateway host is the applicant, the G-RS/G-MS is the authenticator, the AAA server is the authentication server, and the BS is the authentication relay. In the roaming state, ASN and V-NSP The CSN can act as an AAA proxy and the AAA manager is an optional device.

PKMv2 delivers EAP packets through the gateway host and the G-RS/G-MS, and the 802.16 air interface between the NAS of the G-RS/G-MS and the BS in the ASN, and the EAP packet is carried in PKMv2, that is, EAP over PKMv2 ( Hereinafter referred to as EAPoP). G-RS/G-MS acts as the authenticator and uses the AAA protocol with the AAA server. Between the G-RS/G-MS and the BS, the embodiment of the present invention sets the message type of the PKM-REQ/RSP message of the PKMv2 protocol carrying the AAA message, so that the PKM-REQ/RSP message supports the transmitted AAA message. For example, the Access-Challenge message is accessed; the Access-Request message is spoofed; the Access-Accept message is spoofed; the Access-Reject message is 艮Text. The PKM message type can be set to: AAA-Transfer, or Radius-Transfer, or Diameter-Transfer. The AAA message is carried on PKMv2, referred to as AAAoP. The EAP packet is transmitted between the G-RS/G-MS and the BS through AAAoP. The AAA packet between the BS and the AAA server is carried in the transport layer protocol, such as UDP (User Datagram Protocol), TCP (Transmission Control Protocol), or SCTP (Stream Control Transmission Protocol). On the transport protocol), referred to as AAAoT. The BS converts AAAoP packets and AAAoT packets.

Figure 17 shows the gateway host user authentication protocol stack based on 802.3/802.11. For EAP authentication on Ethernet 802.3/802.11, the standard EAP defined by IEEE 802.1x is carried over Ethernet 802.3/802.11, ie EAP over LAN ( Hereinafter referred to as EAPoL). In Figure 17, the AAA packets between the NAS of the G-RS/G-MS and the ASN are carried in PKMv2, which is AAAOP. The AAA packets between the BS and the AAA server are carried in the transport layer protocol (eg UDP, TCP). Or SCTP protocol), referred to as AAAoT message. The BS still needs to convert the AAAoP message with the AAAoT message.

In the PKMv2 or 802.3/802.11-based gateway host device authentication protocol stack, when the gateway host terminates in G-RS/G-MS, the BS does not need to perform AAAoP and AAAoT conversion.

Figure 18 is a flow chart of the gateway host using the digital certificate for device authentication and the pre-shared key to perform user authentication. In Figure 18, both the device authentication and the user authentication of the gateway host perform authentication. The gateway host adopts dual EAP mode, and the gateway host performs device authentication first. Because the authentication server merges with the authenticator, the gateway host device authentication ends with G-RS/G- MS. After the gateway host device authentication is completed, user authentication is performed, and user authentication ends in the CSN. Figure 19 shows the flow chart of the gateway host using digital certificates and only performing device authentication. The device authentication of the gateway host is terminated by G-RS/G-MS. After the gateway host device is authenticated, the G-RS/G-MS carries the device identifier (MAC address) of the gateway host to the AAA protocol and passes it to the CSN.

Figure 20 and Figure 21 are flow diagrams of the gateway host performing device authentication and user authentication using a pre-shared key. In Figure 20, gateway host device authentication and user authentication are performed separately, and the gateway host adopts dual EAP mode. After the device authentication of the gateway host is completed, the gateway host performs user authentication, and the gateway host device authentication and user authentication are terminated by the same authentication server. . In Figure 21, the gateway host uses a single EAP mode to jointly perform device authentication and user authentication, and terminates in the CSN.

In the AAA system of FIG. 12 to FIG. 15, only the service device of the ASN is the NAS, the G-RS/G-MS and the gateway host are both "applicants", and the NAS in the ASN is the G-RS/G-MS and The "authenticator" of the gateway host, the AAA server in the CSN is still the "authentication server". AAA system to G-RS/G-MS and gateway The host is authenticated separately. The certification of G-RS/G-MS is performed first.

G-RS/G-MS and ASN NAS, and AAA server, perform G-RS/G-MS device authentication and/or user authentication, and G-RS/G-MS device authentication and user authentication. The process is consistent with the device authentication and user authentication authentication process of the G-RS/G-MS service device as the gateway host certifier.

After the authentication of the G-RS/G-MS is completed, the gateway host is authenticated. If the gateway host uses the digital certificate to perform device authentication, the authenticator merges with the authentication server. The gateway host uses the device's MAC address as the device identifier, and the gateway host is in the ASN. The NAS performs device authentication of the gateway host, and the device authentication of the gateway host ends with the ASN. After the gateway host device is authenticated, the ASN sends the MAC address of the gateway host to the CSN through the AAA protocol. The CSN checks whether the digital certificate of the gateway host device, such as the X.509 certificate, is valid according to the MAC address of the received gateway host device. When the gateway host uses the digital certificate to perform device authentication, it can prevent the G-Host authentication from extending to other management domains due to the use of NAI.

The following describes the authentication process of the gateway host in the AAA system where the ASN service device is NAS:

Figure 22 shows the gateway host user authentication protocol stack based on PKMv2. The gateway host is the applicant, the NAS of the ASN is the authenticator, the AAA server is the authentication server, and the BS is the authentication relay. In the roaming state, the ASN and V-NSP CSN can act as AAA agents.

The gateway host and the G-RS/G-MS (not shown), and the E-AP packets between the G-RS/G-MS and the ASN are carried on the PKMv2, referred to as EAPoP; the gateway host and the G-RS/G -MS, and G-RS/G-MS and BS pass EAP messages through the 802.16 air interface. After receiving the EAP packet, the BS forwards the EAP packet to the NAS. The AAA protocol is used between the NAS and the AAA server.

As shown in Figure 23, in the Ethernet, EAP packets between the gateway host and the G-RS/G-MS are used to deliver EAP packets to the G-RS/G-MS through EAPoL. The EAP packet between the G-RS/G-MS and the BS in the ASN is PKMv2, that is, EAPoP, and the E-AP is transmitted between the G-RS/G-MS and the BS through the 802.16 air interface. Message. The G-RS/G-MS needs to convert the EAP bearer EAPoL between the gateway host and the G-RS/G-MS, and the EAPoP between the G-RS/G-MS and the BS, by G-RS/G- The MS converts the EAPoL packet and the EAPoP packet.

As shown in Figure 24, the G-RS/G-MS converts the EAPoL packet and the EAPoP packet: 1 After the 802.11/802.3 basic link between the gateway host and the G-RS/G-MS is established, The gateway host starts the EAP-Start message of the EAPoL and applies for EAP authentication to the G-RS/G-MS.

2 After receiving the EAP-Start (EAS Start) message of the EAPoL, the G-RS/G-MS generates a PKM-Request (PKM Request) message, and sets the message type of the PKM-Request to EAP-Start, which means the PKM-Request message. Used to transmit EAP-Start messages. The G-RS/G-MS sends a PKM-Request message to the BS, and the BS delivers the EAP-Start message in the PKM-Request message to the NAS of the ASN, that is, the authenticator.

3 After receiving the EAP-Start message, the Authenticator sends an EAP-Request/Identity (EAP Request/Identity) identity query request to the gateway host; the EAP-Start message is between the BS and the G-RS/G-MS.

PKM-Response (PKM response) message message carrying, set the message type of the PKM-Response message to EAP-Transfer (EAP-transfer), that is, the PKM-Response message is used to transmit EAP packets.

4 After receiving the EAP-Request/Identity identity query request from the EAPoP, the G-RS/G-MS encapsulates the EAP-Request/Identity identity query request in the EAP-Packet (EAP packet) of the EAPoL and sends it to the gateway host.

The gateway host uses the EAP-Packet packet of the EAPoL to send EAP-Response/Identity response packets.

6 G-RS/G-MS encapsulates the EAP-Response/Identity in the PKM-Request message, and the message type is EAP-Transfer, which is forwarded to the BS. The EAP-Response/Identity is sent to the Authenticator by the BS.

7 The gateway host uses EAP-Packet packets to send EAP-REP/RSP Method-Negotiation (EAP-REP/RSP method negotiation) packets to perform EAP authentication method negotiation. The gateway relay station/gateway mobile station will EAP-REP/ The RSP Method-Negotiation message is encapsulated in the PKM-REP/RSP message, and the message type is EAP-Transfer, which is forwarded to the BS. The EAP-REP/RSP Method-Negotiatioi message is sent to the NAS by the BS to perform EAP authentication method negotiation.

8 The gateway host uses EAP-Packet packets to send EAP-REP/RSP Method. (EAP-REP/RSP method) message, EAP authentication method exchange, the gateway relay station/gateway mobile station encapsulates the EAP-REP/RSP Method message in the PKM-REP RSP message, and the message type is EAP- Transfer, forwarded to the base station, and the EAP-REP/RSP Method message is sent by the base station to the NAS certifier for EAP authentication method exchange.

9 After the EAP authentication is completed, the NAS sends an EAP-Success message to the gateway host. After receiving the EAP-Success message, the gateway transit station/gateway mobile station encapsulates the EAP-Success in the EAP-Packet and sends it to the EAP-Packet. Gateway host.

In the process of authentication method negotiation and authentication method exchange, the BS and G-RS/G-MS use PKM-Request/Response message interaction, the message type is EAP-Transfer; in the gateway host and G-RS/G - The EAPoL EAP-Packet packets are exchanged between the MSs; until the EAP authentication process ends.

In the EAP authentication process, for 802.11, the AAA server sends the relevant key to the G-RS/G-MS, such as the session key between the gateway host and the G-RS/G-MS. The embodiment of the present invention uses a PKM message packet to carry an 8Q2.11 key to be transmitted.

After the gateway host is authenticated, the G-RS/G-MS detects that the gateway host is offline or abnormal. (There may be multiple reasons and detection methods, such as: gateway host deregistration, gateway host shutdown, and air interface signal quality are unavailable. However, the G-RS/G-MS will initiate an EAP-Logoff (EAP offline) message and encapsulate the EAP-Logoff in a PKM-Request message. The message type is EAP. -Transfer, instructs the NAS Authenticator to modify the corresponding authorization status.

Figure 25 is a flow chart of the gateway host using the digital certificate for device authentication and the pre-shared key to perform user authentication. Both the device authentication and the user authentication of the gateway host are performed. The gateway host adopts the dual EAP mode. The gateway host performs the device authentication. The authentication server is merged with the authenticator. The gateway host device authentication is terminated in the ASN. After the gateway host device authentication is completed, the gateway host device performs the authentication. User authentication, and user authentication ends in CSN.

As shown in Figure 26, the gateway host uses a digital certificate to perform only device authentication. The device authentication of the gateway host is terminated in the ASN. After the gateway host device is authenticated, the ASN carries the device ID (MAC address) of the gateway host to the AAA. On the agreement, pass to the CSN.

FIG. 27 and FIG. 28 are flowcharts of the gateway host performing device authentication and user authentication by using a pre-shared key. In Figure 27, gateway host device authentication and user authentication are performed separately, and the gateway host adopts the Han EAP mode. After the device authentication of the gateway host is completed, the gateway host performs user authentication, and the gateway host device authenticates and User authentication ends on the same authentication server. In Figure 28, the gateway host adopts a single EAP mode, which will

MS device authentication and user authentication are combined and terminated at CSN.

If the bridge device supports multiple host devices in the WiMAX network of Figure 11, the operator is separated into bridge relay station/bridge mobile stations + ASN and CSN. The host device is connected to the bridge relay station/bridge mobile station via the interface. The bridge relay station/bridge mobile station is connected to a plurality of host devices through a first interface (such as a gateway interface), and the bridge relay station/bridge mobile station passes through a second interface (such as an R1 interface) and

Base station connection of ASN. The service device of the bridge transfer station/bridge mobile station + ASN is a network access server, that is, in addition to setting the ASN service device as a network access server, the service device setting of the bridge transfer station/bridge mobile station can also be set. For the network access server.

The difference between the AAA system using the bridge relay station/bridge mobile station and the AAA system using the gateway relay station/gateway mobile station is: The second-layer bridge relay station/bridge mobile station is used instead of the three-layer gateway relay station/ Gateway mobile station, when the NAS is set in the bridge relay station/bridge mobile station, the bridge relay station/bridge mobile station can become the authenticator of the host device authentication.

The setting of other network elements in the AAA system does not change. The bridge relay station/bridge mobile station supports the authentication and authorization method of the multi-host WiMAX network AAA system and the gateway relay station/gateway mobile station supports the multi-host WiMAX network. The process of authentication and authorization methods of the AAA system is identical. The steps may be completed by a program instructing related hardware, and the program may be stored in a computer readable storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, or the like.

It can be seen that the embodiment of the present invention provides an AAA system for a multi-host WiMAX network, and solves the support for authentication and authorization of the gateway device/bridge device and the host device from the mechanism and protocol flow level. In the AAA system, the network access server can be flexibly set in the gateway device/bridge device or the ASN. When the host device accesses the network resource, the location of the network access server can be the gateway device/bridge device and the host. Certification of the equipment provided. Authorization and billing of host devices in a multi-host WiMAX network is made possible.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

An AAA system of a multi-host network, comprising an access service network and a connection service network, wherein the access service network is provided with a network access server, and the connection service network is provided with at least one AAA server, and features thereof The AAA system further includes: a gateway device/bridge device and a host device;

The host device is connected to the gateway device/bridge device; the gateway device/bridge device is provided with the network access server; the authentication of the host device and the authentication of the gateway device/bridge device Separately performing separately; the AAA server in the connection service network, performing the device authentication and/or user authentication of the gateway device/bridge device; receiving the AAA server in the service network, executing the host device Three-party certification for device certification and/or user authentication.

The AAA system of the multi-master network according to claim 1, wherein the gateway device/bridge device and a network access server in the access service network, and the connection service network When the AAA server performs the three-party authentication of the device authentication and/or user authentication of the gateway device/bridge device,

The gateway device/bridge device is an applicant, the network access server in the access service network is an authenticator, and the AAA server in the connection service network is an authentication server;

If the device authentication and the user authentication of the gateway device/bridge device are performed but terminated in different authentication servers, the gateway device/bridge device adopts dual EAP mode authentication; or

If the device authentication and the user authentication of the gateway device/bridge device are performed and terminated in the same authentication server, the gateway device/bridge device adopts dual EAP mode authentication; or adopts a single EAP mode to perform device authentication and Joint authentication for user authentication; or

If the gateway device/bridge device only performs device authentication or only performs user authentication, the gateway device/bridge device adopts a single EAP mode.

The AAA system of the multi-host network according to claim 1, wherein the host device and the network access server in the gateway device/bridge device, and the connection service network When the AAA server performs the device authentication of the host device and/or the three-party authentication of the user authentication, the host device is an applicant, and the network access server in the gateway device/bridge device is an authenticator. The AAA server in the connection service network is an authentication server;

If both the device authentication and the user authentication of the host device are performed but terminated in different authentication servers, the host device adopts dual EAP mode authentication; or

If the device authentication and the user authentication are performed on the host device, and the terminal device is terminated in the same authentication server, the host device adopts dual EAP mode authentication; or the host device adopts a single EAP mode, and performs device authentication and user authentication combined authentication; Or

If the host device performs only device authentication or only user authentication, the host device adopts a single EAP mode.

The AAA system of the multi-host network according to claim 3, wherein the access service network is further provided with a base station; the base station is between the gateway device/bridge device and the base station The bearer of the AAA packet is converted, and the bearer of the AAA packet between the base station and the authentication server is converted.

The AAA system of the multi-master network according to claim 4, wherein the gateway device/bridge device is connected to each host device through a first interface, and the gateway device/bridge device passes the second The interface is connected to the access service network; the first interface adopts: 802.3 or 802.11 or 802.16 transmission technology; and the second interface uses 802.16 wireless transmission technology;

The EAP packet is transmitted between the host device and the gateway device/bridge device through the air interface PKMv2, and the EAP packet between the host device and the gateway device/bridge device is EAPoP; Or

Transmitting EAP between the host device and the gateway device/bridge device through 802.3 or 802.11

The AAA system of the multi-master network according to claim 5, wherein the AAA message between the gateway device/bridge device and the base station is carried on the PKMv2 protocol, and the packet bearer message is carried as AAAoT;

The base station converts the bearer of the AAA message between the gateway device/bridge device and the base station, and the bearer of the AAA message between the base station and the authentication server, that the base station will AAAoP's ^=艮文 is converted to AAAoT's ^艮文.

The AAA system of the multi-master network according to claim 6, wherein the gateway device/bridge device and the base station carry an AAA message by using a PKM-REQ/RSP message type of the PKMv2.

8. The AAA system authentication method of the multi-host network, wherein the AAA system authenticates the gateway device/bridge device and the host device respectively when the host device is connected to the gateway device/bridge device;

The gateway device/bridge device first transmits the authentication information of the gateway device/bridge device to the AAA server connected to the service network through the network access server in the access service network, and the gateway device/bridge device The network access server and the AAA server in the access service network perform three-party authentication of device authentication and/or user authentication of the gateway device/bridge device;

After the device authentication and/or user authentication of the gateway device/bridge device is completed, the host device transmits its authentication information to the connection service network through the network access server in the gateway device/bridge device. The AAA server performs the three-party authentication of the device authentication and/or the user authentication of the host device by the host device, the network access server in the gateway device/bridge device, and the AAA server.

9. The method according to claim 8, characterized by: user authentication;

The method according to claim 9, wherein the gateway device/bridge device and the network access server and the AAA server in the access service network perform the gateway device/bridge device When three-party authentication for device certification and/or user authentication,

The gateway device/bridge device is an applicant, the network access server in the access service network is an authenticator, and the AAA server is an authentication server; when the authentication server is used, the gateway device/bridge device adopts dual EAP. Mode authentication; or

If the device authentication and the user authentication of the gateway device/bridge device are both performed and terminated in the same authentication server, the gateway device/bridge device adopts dual EAP mode authentication; or the gateway The device/bridge device adopts a single EAP mode to jointly authenticate the device authentication and the user authentication. Alternatively, if the gateway device/bridge device performs only device authentication or only performs user authentication, the gateway device/bridge device adopts a single EAP mode.

The method according to claim 9, wherein the device authentication of the host device is performed by the host device, the network access server in the gateway device/bridge device, and the AAA server, and/or In the three-party authentication of the user authentication, the host device is an applicant, the network access server in the gateway device/bridge device is an authenticator, and the AAA server is an authentication server;

If both the authentication and the user authentication of the host device are performed, but the authentication is terminated by different authentication servers, the host device adopts dual EAP mode authentication; or

If both the device authentication and the user authentication of the host device are performed, and the authentication is terminated in the same authentication server, the host device adopts dual EAP mode authentication, or the main device device adopts a single EAP mode, and the device authentication and User authentication joint authentication; or

If the host device performs only device authentication authentication or only user authentication, the host device adopts a single EAP mode.

The method according to claim 11, wherein the access service network is further provided with a base station, and the base station carries an AAA packet between the gateway device/bridge device and the base station, And converting the AAA packet bearer between the base station and the authentication server.

The method according to claim 12, wherein the gateway device/bridge device is connected to each host device through a first interface, and the gateway device/bridge device connects to the device through a second interface. The first interface uses 802.3 or 802.11 or 802.16 transmission technology; the second interface uses 802.16 wireless transmission technology;

The method according to claim 13, wherein the AAA message between the gateway device/bridge device and the base station is carried on the PKMv2 protocol, which is AAAoP; between the base station and the authentication server The AAA packet is carried on the transport layer and is AAAoT. Converting, by the base station, the bearer of the AAA packet between the gateway device/bridge device and the base station, and the AAA packet bearer between the base station and the authentication server, the base station will be AAAoP ^艮文 converted to ΑΑΑοΤ ό message.

The method according to claim 14, wherein the PKM-REQ/RSP message type of the PKMv2 carrying the AAA 4 message between the gateway device/bridge device and the base station is set,

The PKM-REQ/RSP message is used to support AAA message transmission between the gateway device/bridge device and the base station.

16. An AAA system of a multi-host network, comprising an access service network and a connection service network, wherein the access service network is provided with a network access server, and the connection service network is provided with at least one AAA server, and its characteristics The AAA system further includes: a gateway device/bridge device and a host device;

The host device is connected to the gateway device/bridge device; the gateway device/bridge device is connected to the access service network; and the authentication of the host device is separated from the authentication of the gateway device/bridge device Performing independently; performing an AAA server in the connection service network, performing three-party authentication of device authentication and/or user authentication of the gateway device/bridge device;

The host device and the network access server in the access service network and the AAA server in the connection service network perform three-party authentication of device authentication and/or user authentication of the host device.

The AAA system of the multi-master network according to claim 16, wherein the gateway device/bridge device and the host device are applicants; and the network access server in the access service network is Authenticator; The AAA server in the connection service network is an authentication server.

The AAA system of the multi-master network according to claim 17, wherein the access service network is further provided with a base station; the base station is between the gateway device/bridge device and the base station The bearer of the AAA packet is converted, and the bearer of the AAA packet between the base station and the authentication server is converted.

The AAA system of the multi-master network according to claim 18, wherein the gateway device/bridge device is connected to each host device through a first interface, and the first interface adopts 802.3 or 802.11 or 802.16. Transmission technology The gateway device/bridge device is connected to the access service network through a second interface, and the second interface adopts an 802.16 wireless transmission technology;

The EAP packet is transmitted between the host device and the gateway device/bridge device through the air interface PKMv2, and the EAP packet between the host device and the gateway device/bridge device is EAPoP; or the host The EAP packet is transmitted between the device and the gateway device/bridge device through 8Q2.3 or 802.11, and the EAP payload between the primary device and the gateway device/bridge device is EAPoL; The EAP packet is transmitted between the device/bridge device and the base station through the air interface PKMv2, and the EAP packet bearer between the gateway device/bridge device and the base station is EAPoP.

The AAA system of the multi-master network according to claim 19, wherein when the EAP bearer of the host device and the gateway device/bridge device is EAPoL, the gateway device/bridge device will The EAPoL between the host device and the gateway device/bridge device and the EAPoP between the gateway device/bridge device and the base station are converted.

An AAA system authentication method for a multi-host network, wherein, when the host device is connected to the gateway device/bridge device, the AAA system authenticates the gateway device/bridge device and the host device respectively; The network access server in the service network is transmitted to the AAA server connected to the service network, and the gateway device/network is executed by the gateway device/bridge device, the network access server in the access service network, and the AAA server. Tripartite certification of equipment certification and/or user authentication of bridge equipment;

After the device authentication and/or user authentication of the gateway device/bridge device is completed, the host device transmits its authentication information to the AAA server of the connection service network through the network access server of the access service network. The three-party authentication of the device authentication and/or the user authentication of the host device is performed by the host device, the network access server of the access service network, and the AAA server.

The method according to claim 21, wherein the device authentication of the gateway device/bridge device performs user authentication prior to the gateway device/bridge device;

23. The method of claim 22, wherein

If the device authentication and the user authentication of the gateway device/bridge device are performed, but are terminated by different authentication servers, the gateway device/bridge device adopts dual EAP mode authentication; or If the device authentication and the user authentication of the gateway device/bridge device are both performed and terminated in the same authentication server, the gateway device/bridge device adopts dual EAP mode authentication; or the gateway device/bridge device adopts Single EAP mode, joint authentication of device authentication and user authentication; or

24. The method of claim 22, wherein

If both the device authentication and the user authentication of the host device are performed but are terminated by different authentication server authentication, the host device adopts dual EAP mode authentication; or

If both the device authentication and the user authentication of the host device are performed, and the terminal device is authenticated by the same authentication server, the host device adopts dual EAP mode authentication; or the host device adopts a single EAP mode, and performs device authentication and user authentication. Joint certification; or

If the host device performs only device authentication or user authentication, the host device adopts a single EAP mode.

25. A method according to claim 23 or 24, characterized in that

The gateway device/bridge device is connected to each host device through a first interface, and the first interface adopts: 802.3 or 802.11 or 802.16 transmission technology;

The gateway device/bridge device is connected to the access service network through a second interface, the access service network is further provided with a base station, and the second interface adopts an 802.16 wireless transmission technology;

The EAP packet is transmitted between the host device and the gateway device/bridge device through the air interface PKMv2, and the EAP packet between the host device and the gateway device/bridge device is EAPoP; or the host Transmitting EAP packets between the device and the gateway device/bridge device through the air interface PKMv2 between the gateway device/bridge device and the base station by using 802.3 or 802.11, the gateway device/bridge device and the The EAP packet carrying between the base stations is EAPoP.

The method according to claim 25, wherein when the EAP bearer of the host device and the gateway device/bridge device is EAPoL, the gateway device/bridge device compares the host device with the EAPoL between the gateway device/bridge device and the EAPoP between the gateway device/bridge device and the base station, the gateway device/bridge device converts the EAPoL message into an EAPoP message.