WO2008106881A1

WO2008106881A1 - A ppp access method, corresponding system and access node device

Info

Publication number: WO2008106881A1
Application number: PCT/CN2008/070352
Authority: WO
Inventors: Zhenting Yang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-03-02
Filing date: 2008-02-25
Publication date: 2008-09-12
Also published as: CN101257420A

Abstract

A PPP access method, corresponding system and access node device are provided, with the method including steps of: an access node device receiving the PPP access message from the user, determining whether the PPP access message is a protocol message or a data message; when the PPP access message is a protocol message, sending the protocol message to an access controller, and performing access management for the user by the access controller; and when the PPP access message is a data message, forwarding the data message by the access node device.

Description

Point-to-point protocol access method, system and access node device

This application claims priority to Chinese Patent Application No. 200710085357.4, entitled "A Peer-to-Peer Access Method, System and Access Node Device", filed on March 2, 2007, the entire contents of which is hereby incorporated by reference. This is incorporated herein by reference.

Technical field

The present invention relates to the field of broadband access network technologies, and in particular, to a point-to-point protocol (PPP) access method, system, and access node device.

Background technique

The PPP protocol is a data link layer protocol in the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol stack, providing a standard way to transport multiple network layer protocols over a point-to-point link. Datagram. The PPP protocol has Network Control Protocol (NCP) supporting different network layers, such as Internet Protocol Control Protocol (IPCP) and Internet Work Packet Exchange Control Protocol (IPXCP). Link Control Protocol (LCP) and authentication protocol protocols such as Challenge Handshake Authentication Protocol (CHAP) and Password Authentication Protocol (PAP) _0, where NCP is mainly used to negotiate links. The format and type of the transmitted data packet. The LCP is mainly used to establish, tear down, and monitor the PPP data link. The authentication protocol is mainly used to authenticate the connected user, prevent the PPP connection of the illegal user, and ensure the security of the network. Figure 1 shows the frame format of the PPP protocol. The protocol field is used to identify the protocol type encapsulated in the information field. Currently, the protocol types used mainly include LCP, NCP, and common IP protocols, and their corresponding protocol domains. The fields are 0xC021, 0x80, and 0x0021, respectively. The following information contains different message contents according to different protocols.

With the development of network technology, broadband access has become a dominant user access method. Common broadband access methods include Asymmetric Digital Subscriber Loop (ADSL), Very High-Speed-bit Digital Subscriber Loop (VDSL), Ethernet, and Passive Optical Network. (PON, Passive Optical Network). These access methods require broadband dialing and authentication as required by the operator's operations. The main mode of current broadband dial-up and authentication is Asynchronous Transfer Mode (ATM), which carries PPP (PPPoA, PPP over). ATM, ) and Ethernet bear PPP (PPPoE, PPP over Ethernet). Among them, PPPoA ^ ^ is the ATM PPP layer 5 (ATMAAL5, ATM Adaptation Layer 5) PPP, PPPoA uses ATM to adapt the 5th layer assembled PPP package. The PPP protocol requires that both parties communicate in a peer-to-peer relationship and cannot be directly applied to broadcast Ethernet, and PPPoE solves this problem. Through the PPPoE protocol, multiple hosts in a shared Ethernet network can access multiple PPP sessions with a remote access server through one or more simple bridging access devices. PPPoE not only provides a broadband access method for users using bridged Ethernet access, but also provides convenient access control and billing.

The workflow of the PPPoE protocol includes two phases of discovery and session. When a host wants to start a PPP session, it first performs a discovery process to identify the other party's Media Access Control (MAC) address, and then establishes a unique PPP session identifier (ID, Identification). After the PPPoE session begins, the host and the access server transmit PPP data according to the PPP protocol, and perform PPP negotiation and data transmission. PPPoA and PPPoE provide a point-to-point connection. The difference is that PPPoA is carried on the ATM network, and PPPoE is carried on the Ethernet network, which is adapted to the ATM standard and Ethernet standard respectively.

Since the PPP protocol is a standard point-to-point connection, PPPoX (including PPPoA and PPPoE) provides a point-to-point connection. Protocol packets and user data packets are bundled between the two points of the protocol. . In the process of creating the present invention, the inventors found that at least the following problems exist in the prior art: Each technology update of the bearer network needs to support the PPP protocol, and the innovation of the PPP access technology also needs to adapt to the bearer network, which leads to the network. The increase of operating costs is not conducive to the expansion and upgrade of the network. With the evolution of the network, the separation of control and bearer becomes an inevitable requirement. Since PPPoX provides a point-to-point connection, the access server in the network serves as the end of the network side of the point-to-point connection. It needs to terminate a large number of PPP sessions and forward a large number of IP packets. When the service is busy, it is likely to become network performance. The bottleneck.

Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a PPP access authentication method, system, and access node device, so as to implement separation of control and bearer in PPP access authentication.

To solve the above technical problem, the object of the present invention is implemented by the following technical solutions: The embodiment of the present invention provides a point-to-point protocol access method, where the method includes:

The access node device receives the point-to-point protocol access message from the user, and determines the point-to-point protocol Whether the access packet is a protocol packet or a data packet;

When the point-to-point protocol access packet is a protocol packet, the protocol packet is sent to the access controller, and the access controller performs access management on the user;

When the point-to-point protocol access message is a data message, the access node device forwards the data message.

An embodiment of the present invention provides a point-to-point protocol access system, where the system includes an access node device and an access controller, where:

The access node device is configured to receive a point-to-point protocol access message from the user, and when the point-to-point protocol access message is a protocol message, send the packet to the access controller for processing; When the point-to-point protocol access packet is a data packet, the data packet is forwarded;

The access controller is configured to perform access management on the user according to the received protocol packet.

An embodiment of the present invention further provides an access node device, where the access node device includes a message receiving and identifying unit, a message sending unit, and a storage unit, where:

a message receiving and identifying unit, configured to receive a point-to-point protocol message, and identify the received point-to-point protocol message as a protocol message or a data message;

The message sending unit forwards the protocol message received by the message receiving and identifying unit to the first destination address, and forwards the data message received by the message receiving and identifying unit to the second purpose according to the data forwarding table stored in the storage unit. Address

A storage unit, configured to store a data forwarding table.

It can be seen from the above technical solution that the access node device judges the PPPoX access message from the user, separates the data packet and the protocol packet, and forwards the data packet, and the access controller Protocol packet access control and management, which completes the separation of control and bearer in PPP access, so that the innovation of PPP access control technology and the evolution of bearer network do not affect each other, which is conducive to network expansion and upgrade, and also saves Network operating costs.

At the same time, the access controller is responsible for access control and management of the user, and the access node device forwards the data packet, and the network load is shared by the two, thereby improving the utilization efficiency of the device and avoiding the burden of a certain device of the network. Excessive weight affects the operation of the entire network, reducing the performance requirements for network devices. DRAWINGS

1 is a schematic diagram of a PPP frame format in the prior art; 2 is a flowchart of accessing a preferred embodiment of a PPP access method according to the present invention;

3 is a schematic structural diagram of a PPP access system according to a preferred embodiment of the present invention;

4 is a schematic structural diagram of a preferred embodiment of an access node device according to the present invention.

detailed description

The present invention will be further described in detail below with reference to the drawings and embodiments.

First, an embodiment will be described to explain a PPP access method provided by the present invention. Referring to FIG.

Step 21: The access node device (AN, Access Node) receives the PPP access message from the user. First, the user equipment sends a PPP access message to request to establish a PPP connection. The PPP connection can be initiated by the user host or by the Residential Gateway (RG). The PPPoA access packet and the PPPoE access packet are used in the PPP access packet. Generally, the PPPoA is used in the routing mode. The access authentication process is performed by the RG, and the PPPoE works in the bridging mode. The host or RG initiates a PPPoE request. Therefore, the specific device on the user side can be the user host or the RG.

Step 22: The AN determines whether the PPPoX access message is a protocol message or a data message, if it is a protocol message, step 23 is performed; if it is a data message, step 27 is performed;

The AN can determine the type of the packet based on the protocol field of the PPP frame. For example, if the protocol field field is 0x8021, then the NCP protocol is used. If the protocol field is 0x0021, the IP data is 艮.

Step 23: The protocol packet is sent to an access controller (AC, Access Controller), and the AC performs access management on the user, including access link negotiation, user access address allocation, and access authentication authorization.

In the process of access management, the AC performs corresponding processing according to different protocol types. If the received LCP protocol packet is received, the user is negotiated to establish, maintain, or terminate the data link. If the authentication protocol, such as the Password Authentication Protocol (PAP) or the Challenge Handshake Authentication Protocol (CHP), is received, the protocol packet is forwarded to authorization, authentication, and accounting. _: Authentication, Authorization and Accounting) The server authenticates the user to prevent unauthorized users from PPP connections. If necessary, the message returned by the AAA server should also be converted to PPPoX format first. When receiving the protocol packet sent by the AC to the user, the AN directly forwards the protocol packet. To the user.

The AAA implementation can use RADIUS (Remote Authentication Dial In User Service), which is a type of network access server (NAS Access Network) such as BRAS (Broadband Remote Access Server) and shared authentication server. A protocol for transmitting authentication, authorization, and configuration information. RADIUS uses UDP (User Datagram Protocol) as its transport protocol. In addition, RADIUS is responsible for transmitting the accounting information between the network access server and the shared accounting server. In this embodiment, the AC can function as a NAS device such as a BRAS.

Step 24: The AN determines whether the user is allowed to access. If not, step 25 is performed; if yes, step 26 is performed;

The user identity can be verified to pass or not to determine whether to allow access to the user.

Step 25: Close the link and terminate the PPP session.

Step 26: The AN establishes and maintains a data forwarding table;

The AN can obtain the PPP signaling information of the user and the AC through monitoring or detection, and then obtain the required information or parameters. The AN can also be controlled by the AC through an additional control protocol such as SNMP (Simple Network Management Protocol), ANCP (Access Network Control Protocol), and the like. Thus, there is a management agent in the AN that is used to request information and actions from the AC.

In PPP peer-to-peer communication, each phase has a certain timing relationship. Therefore, if user access is not allowed, for example, if the user's identity authentication is not completed, the data message transmitted by the user cannot be transmitted to the destination network. Therefore, the interface can only transmit PPP packets on the user-side interface. By default, the device can transmit data packets, similar to 802.1X.

The AN establishes and maintains a data forwarding table based on the acquired PPP information.

For example, one of the data forwarding tables can be: (port [including logical port] identifier, user MAC, PPP session identifier) <-> (user MAC, user IP address, user gateway IP address), and the AN uses this table to PPP data. The packet is forwarded, including the format of the packet and the packet is sent to the destination address. The format of the packet is translated from IPoE to PPPoE or from PPPoE to PPPoA.

If the above is the case of PPPoE, and if the AN is a three-layer device, If the AN is a switch, the AN obtains the MAC address of the user through the ARP (Address Resolution Protocol).

Step 27: The AN determines whether the user access is allowed, if yes, step 28 is performed; if no, step 29 is performed;

For example, the AN can determine whether there is a corresponding session ID and destination address according to the data forwarding table established in step 26, and if so, the user is allowed to access. You can also set a port status indicating the user access in the table. By default, the port is disabled. When the user is allowed to access, the port is open and allows data packets to be transmitted.

Step 28: The AN forwards the data packet according to the established and maintained data forwarding table. In the PPP peer-to-peer communication, the negotiation is divided into five phases, namely: an offline phase, an association establishment phase, and authentication. (Authenticate) phase, network control negotiation (Network) phase and termination (Terminate) phase. Different stages of negotiation are carried out at different stages. After the previous agreement is negotiated, the result is transferred to the negotiation of the next stage agreement. Therefore, in general, when the user is allowed to access, for example, the authentication of the user identity is passed, the data message sent by the user can be forwarded by the AN to the destination address.

According to the destination address in the data forwarding table, it can be forwarded to the destination network, such as the aggregation network, or other users.

In the data forwarding table, the corresponding data packet can be converted from the PPPoX format to the IPoX format, that is, the PPPoX decapsulation is completed, and the data packet is sent to the corresponding destination IP address according to the table.

After the user is allowed to access, the other end of the PPP connection with the user can also send data packets to the user. After receiving the data packets, the AN sends the data packets to the user according to the established and maintained data forwarding table. . If required, for example, the data packet received by the AN is in the IPoX format, or the receiving side is different from the bearer mode of the network, the AN needs to first convert the received data packet format into the PPPoX format approved by the access side.

Step 29: Discard the data packet.

PPPoX provides a point-to-point connection. The above is the process of processing PPP access messages sent by users. It can be seen from the above workflow that the PPP access message sent by the user is performed in the AN. Separation, the AN forwards the data packet and sends the protocol packet to the AC for processing. Therefore, the control of the PPP access is separated from the bearer, so that the innovation of the access control technology and the evolution of the bearer network do not affect each other, which is beneficial to the expansion and upgrade of the network.

A PPP access method is described in the foregoing embodiment. A PPP access system is described in the following, and the system includes: an access node device and an access controller, where:

The access node device is configured to receive a PPP access packet from the user, and determine whether the PPP access packet is a protocol packet or a data packet, and when the PPP access packet is a protocol packet, The method is sent to the access controller for processing, and when the message sent by the access controller is allowed to be accessed by the user, the session data forwarding table is created and maintained; when the PPP access message is a data packet, according to the Forwarding the data forwarding table;

The access controller is configured to perform access management on the user according to the received protocol packet, and send the protocol packet to the user through the access node device.

The access node device can also be used to forward the data packet sent to the user to the user; receive the PPPoX protocol packet from the access controller and send the packet to the user;

As shown in FIG. 3, RG31, AN32, AC33, and aggregation network 35 form an access network.

The AN is logically connected to the AC.

RG31 is used to initiate a PPP call, request access to the network, and receive PPP packets and PPP data packets.

The AN32 is configured to receive and determine whether the packet sent by the user is a PPP data packet or a PPP protocol packet. When the packet is a PPP protocol packet, the packet is directly sent to the AC33 to authenticate the user. The packet is PPPoX data. The message is forwarded according to the data forwarding table, for example, sent to the Internet Service Provider (ISP) network 36 through the aggregation network 35. The data packet sent to the RG31 sent by the aggregation network 35 is forwarded to the user, and the protocol packet sent by the AC33 to the RG31 is directly sent.

The AC33 is used to control the PPP connection and perform access management for the user. For example, the authentication information is sent to the AAA server for identity authentication, and the state machine of the PPP is maintained, that is, the conversion is performed in different negotiation stages.

The AAA server 34 is configured to authenticate, authorize, and charge the user.

The ISP network 36 interacts with the user through the aggregation network 35 to provide access services and information services. And value-added services.

An access node device is described below by using an embodiment, where the device includes: a message receiving and identifying unit, a message sending unit, and a storage unit, where:

a packet receiving and identifying unit, configured to receive a PPP packet and identify whether the received PPP packet is a protocol packet or a data packet;

A storage unit, configured to store a data forwarding table.

In order to adapt to different network bearer modes, the access node device further includes a format conversion unit, configured to perform format conversion on the packet sent by the packet receiving and identifying unit according to the bearer mode of the destination network, and then send the packet to the packet sending unit. For example, PPPoX and IPoX can be converted, and PPPoA and PPPoE can be converted.

As shown in FIG. 4, the access node device includes: a message receiving and identifying unit 41, a text sending unit 42, and a storage unit 43, and further includes a format converting unit 44, where:

The packet receiving and identifying unit 41 is configured to receive the PPP packet and identify whether the received PPP packet is a protocol packet or a data packet.

The message sending unit 42 forwards the protocol message received by the message receiving and identifying unit 41 to the first destination address, for example, the address of the access controller in the access network; according to the data forwarding table stored in the storage unit 43 The data packet received by the text receiving and identifying unit 41 is forwarded to the second destination address;

The storage unit 43 is configured to store a data forwarding table;

The format conversion unit 44 is configured to format the message sent by the message receiving and identifying unit 41 according to the bearer mode of the destination network, and then send the message to the message sending unit 42.

The parameters in the data forwarding table according to the forwarding data packet may include: a PPP session identifier, an access user identifier, and a forwarding path identifier. The access node device can also obtain other required PPP signaling information as parameters in the data forwarding table.

In the foregoing embodiments, the access node device determines the PPPoX access packet from the user side, separates the data packet and the protocol packet, and forwards the data packet, and the access control The device performs access control and management according to the protocol packet, thereby completing the separation of PPP access control and bearer, so that the innovation of PPP access control technology and the evolution of the bearer network do not affect each other, which is beneficial to network expansion and upgrade. It also saves network operating costs.

At the same time, the access controller is responsible for access control and management of the user, and the access node device forwards the data packet, and the network load is shared by the two, thereby improving the utilization efficiency of the device and avoiding the burden of a certain device of the network. Excessive weight affects the operation of the entire network, reducing the performance requirements for network devices.

The PPP access method, system, and access node device provided by the present invention are described in detail by using the embodiments. The foregoing description of the embodiments is only used to help understand the method and the idea of the present invention. The present invention is not limited by the scope of the present invention, and the details of the present invention are not limited by the scope of the present invention.

Claims

Rights request

A point-to-point protocol access method, comprising:

The access node device receives the point-to-point protocol access message from the user, and determines whether the point-to-point protocol access message is a protocol message or a data message;

The point-to-point protocol access method according to claim 1, wherein the access controller performs access management on the user, including:

The access node device establishes and maintains a data forwarding table if the access controller allows the user to access.

The point-to-point protocol access method according to claim 2, wherein the access node device establishes the data forwarding table by monitoring a point-to-point protocol signaling message between the user and the access controller.

The point-to-point protocol access method according to claim 2, wherein the access node device establishes the data forwarding table by using user access information acquired by an additional control protocol.

The point-to-point protocol access method according to any one of claims 2 to 4, wherein the access node device forwards the data packet according to the data forwarding table.

The point-to-point protocol access method according to any one of claims 1 to 4, wherein before the accessing the data packet, the access node device further includes:

The access node device performs format conversion on the data packet according to different network bearer modes.

The point-to-point protocol access method according to claim 1, wherein the point-to-point protocol access comprises a point-to-point protocol access carried by an asynchronous transmission mode network, and/or a point-to-point protocol access of an Ethernet bearer.

A point-to-point protocol access system, comprising: an access node device, an access controller, wherein:

The access node device is configured to receive a point-to-point protocol access message from a user, where the point is When the point protocol access packet is a protocol packet, the packet is sent to the access controller for processing; when the peer-to-peer protocol access packet is a data packet, the data packet is forwarded;

The point-to-point protocol access system according to claim 8, wherein the access node device is further configured to create and maintain a forwarding device when the access controller allows the user to access the network. The data forwarding table required for the data message.

10. The point-to-point protocol access system according to claim 8 or 9, wherein the access controller is a broadband remote access server.

An access node device, comprising: a message receiving and identifying unit, a message sending unit, and a storage unit, wherein:

A storage unit, configured to store a data forwarding table.

The access node device according to claim 11, further comprising a format conversion unit, configured to perform format conversion on the packet sent by the packet receiving and identifying unit according to a bearer mode of the destination network, and then send the packet To the message sending unit.