WO2009003409A1 - A method, system and equipment for network access - Google Patents

A method, system and equipment for network access Download PDF

Info

Publication number
WO2009003409A1
WO2009003409A1 PCT/CN2008/071506 CN2008071506W WO2009003409A1 WO 2009003409 A1 WO2009003409 A1 WO 2009003409A1 CN 2008071506 W CN2008071506 W CN 2008071506W WO 2009003409 A1 WO2009003409 A1 WO 2009003409A1
Authority
WO
WIPO (PCT)
Prior art keywords
dhcp
client
authentication
message
access
Prior art date
Application number
PCT/CN2008/071506
Other languages
English (en)
French (fr)
Inventor
Ruobin Zheng
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to EP08757898.5A priority Critical patent/EP2136508B1/en
Publication of WO2009003409A1 publication Critical patent/WO2009003409A1/zh
Priority to US12/649,873 priority patent/US20100107223A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies

Definitions

  • the present invention relates to the field of network communications, and in particular, to a network access method, system, and apparatus. Background technique
  • the Dynamic Host Configuration Protocol is a mechanism for dynamically specifying IP addresses and configuration parameters. It is mainly used in large network environments and where network configuration is difficult.
  • the DHCP system mainly includes a DHCP server (DHCP Server) and a DHCP client (DHCP Client). Some systems also include a DHCP authentication server.
  • the DHCP server automatically assigns an IP address to the client, making computer communication on the network more convenient and easy to implement through specified configuration parameters. All the configuration information is managed by the DHCP server.
  • the DHCP server allocates IP addresses and configures a large number of other parameter information, and leases the IP addresses to achieve time-division multiplexing of IP addresses. It has been widely used.
  • FIG. 1 shows an existing DHCP authentication flowchart, wherein the system diagram of the DHCP authentication flowchart includes a DHCP client, a DHCP server, and an Authentication Server (AS).
  • the DHCP client is a host in the network that uses the DHCP protocol to obtain configuration parameters such as an IP address, that is, a client's host or other device that can obtain an IP address.
  • the DHCP server is used to provide DHCP services. According to different DHCP clients, IP addresses or other network-related parameters are provided.
  • FIG. 1 shows a functional combination of a DHCPv4 message and a DHCP option (Option) in the prior art, wherein Option allows a vendor definition to provide more configuration consultation.
  • Option allows a vendor definition to provide more configuration consultation.
  • the DHCP authentication in FIG. 1 is described in detail below with reference to FIG. 1 and Table 1.
  • the process where the existing DHCP authentication uses two DHCPv4 messages (“DHCP Auth-request” message and “DHCP-response” message) or can use a DHCP message (“DHCP EAP” message), and through two The DHCP Option message authenticates the authentication protocol option (auth-proto) and the EAP message option (EAP-Message Option): ⁇ ) ⁇ ⁇ ( ⁇ ,,4 message I AP message function description
  • the source IP address is 0.0.0.0.
  • the DHCP EAP Request carries the corresponding EAP message.
  • the DHCP Auth-request EAP Request carries the corresponding EAP message.
  • EAP-Message /Response sending direction DHCP server DHCP Client Option
  • DHCP Offer EAP 1. Configurable network parameters, such as user IP address;
  • Step S101 When the user terminal where the DHCP client is located enters the network, it is widely distributed to the DHCP server.
  • the discovery of the dynamic host configuration protocol (DHCP Discover) message the auth-proto Option of the DHCP Discover message carries an authentication mode indicating that the DHCP client supports; the DHCP Discover message is used to request the IP address information of the DHCP server, the message source The IP address is 0.0.0.0;
  • Step S102 After receiving the DHCP Discover message, the DHCP server returns a DHCP Authentication Request (DHCP Auth-request) message or a DHCP EAP message to the DHCP client, where the EAP Request message is carried by the DHCP Auth-request message or the DHCP EAP message.
  • Authentication protocol message option EAP-Message Option );
  • Step S103 The DHCP client receives the DHCP Auth-request message or the DHCP EAP message, and sends a DHCP Authentication Reply (Auth-response) message to the DHCP server, where the EAP Response message carries the EAP in the Auth-response message or the DHCP EAP message.
  • Auth-response DHCP Authentication Reply
  • Step S104 The DHCP server encapsulates the EAP message of the DHCP client in an Authentication, Authorization and Accounting (AAA) message and sends it to the Authentication Server (AS).
  • AAA Authentication, Authorization and Accounting
  • Step SI 05 The AS sends an authentication result to the DHCP server. If the authentication succeeds, the AAA protocol is used to carry the EAP success message and sent to the DHCP server.
  • Step S106 The DHCP server constructs a DHCP Offer message carrying an EAP success message and sends it to the DHCP client, which includes an IP address item (your ip address, yiaddr) data message allocated to the DHCP client.
  • IP address item your ip address, yiaddr
  • Step S107 After receiving the DHCP Offer message, the DHCP client returns a configuration parameter request (DHCP request) message to the DHCP server.
  • DHCP request configuration parameter request
  • Step S108 The DHCP server returns an address allocation response (DHCP ACK) message to the DHCP client.
  • DHCP ACK address allocation response
  • the corresponding EAP message needs to be carried in the protocol of the DHCP server and the AS in the authentication process, so that the processing flow between the DHCP server and the AS changes, and the DHCP server and the AS need to be correspondingly
  • the transformation can support the corresponding certification function and increase the operating cost.
  • the authentication process in the solution can be performed only after a static IP address is allocated at the DHCP client. In the dynamic IP allocation process, the user does not have a user before the authentication process starts. For the IP address, the authentication process started in step S102 is impossible. Summary of the invention
  • embodiments of the present invention provide a network access method, system, and apparatus.
  • the DHCP client can configure the configuration parameters corresponding to each DHCP client through the DHCP access certifier to implement the authentication process. Therefore, the DHCP server cannot be modified accordingly to enable the authentication process.
  • the embodiment of the present invention provides a network access method, including: the access authenticator receives the discovery message of the client, and obtains the first configuration information used by the client authentication process in response to the discovery message.
  • the discovery message is used to discover an access authenticator; the access authenticator performs local authentication or interacts with the authentication server as a proxy of the client to implement remote authentication of the client;
  • the access authenticator After the authentication succeeds, the access authenticator sends a configuration request message to the configuration server, requesting to provide the second configuration information used by the session process by the client.
  • the embodiment of the present invention further provides a network access system, including an access authenticator and a configuration server:
  • the access certifier is configured to receive a discovery message of the client, and provide the first configuration information used by the authentication process by the client in response to the discovery message; performing local authentication on the client or serving as the client
  • the proxy performs remote authentication with the authentication server; if the client authentication succeeds, sending a configuration request to the configuration server, requesting to provide the client with second configuration information used by the session process;
  • the configuration server is configured to provide configuration information for the client, where the configuration information includes at least the second configuration information.
  • an embodiment of the present invention further discloses an access authentication apparatus, including:
  • a first processing module configured to receive a discovery message sent by the client, obtain first configuration information used by the client authentication process, and send the corresponding information to the client;
  • An authentication module configured to perform local authentication on the client or remotely authenticate the client and the authentication server;
  • the second processing module if the client authentication succeeds, initiates a configuration request to the configuration server, requesting to provide the client with second configuration information used by the session process.
  • the embodiment of the present invention further discloses a broadband access device, including an access authentication device, where the access authentication device includes:
  • a first processing module configured to receive a discovery message sent by the client, obtain first configuration information used by the client authentication process, and send the corresponding information to the client;
  • An authentication module configured to perform local authentication on the client or remotely authenticate the client and the authentication server;
  • the second processing module if the client authentication succeeds, initiates a configuration request to the configuration server, requesting to provide the client with second configuration information used by the session process.
  • the access authenticator is set in the network, and the access authenticator acts as the authentication proxy of the client for authentication, and the DHCP server is not required to be specially modified, and only the corresponding access authenticator needs to be configured.
  • the DHCP client is authenticated, and the first network address is provided to the client before authentication, thereby improving the stability of the authentication process and improving the authentication efficiency and success rate. . DRAWINGS
  • Figure 1 is a flow chart of an existing DHCP authentication
  • FIG. 2 is a diagram of a DHCP authentication system in an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of an IP session period in which DHCP access authentication is used in DHCP authentication according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of an IP session cycle using non-encrypted access filtering in DHCP authentication according to an embodiment of the present invention
  • FIG. 5 is a flowchart of the first DHCP authentication success of the DHCPv4 version in Table 2 in the embodiment of the present invention
  • FIG. 6 is a flowchart of the first DHCP authentication failure of the DHCPv4 version in Table 2 in the embodiment of the present invention
  • FIG. 9 is a simplified flowchart of the first DHCP authentication succeeded in the DHCPv4 version in Table 2 in the embodiment of the present invention
  • FIG. 10 is a flowchart of successful DHCP re-authentication of the DHCPv4 version in Table 2 in the embodiment of the present invention
  • FIG. 11 is a flowchart of successful DHCP authentication of the DHCPv4 version in Table 4 in the embodiment of the present invention
  • FIG. 13 is a flowchart of the embodiment of the present invention.
  • Table 4 shows the successful DHCP authentication for the first DHCPv4 version. Cheng Tu
  • 16 is a flow chart showing the success of the first DHCP authentication in the DHCPv4 version in Table 5 in the embodiment of the present invention.
  • 17 is another flowchart of successful DHCP authentication in the DHCPv4 version in Table 5 in the embodiment of the present invention.
  • FIG. 19 is another flowchart of the first DHCP authentication failure in the DHCPv4 version in Table 5 in the embodiment of the present invention.
  • FIG. 21 is a flowchart of DHCP authentication based on non-encrypted access filtering after successful DHCP authentication in the embodiment of the present invention. detailed description
  • Embodiments of the present invention provide a network access method, a network access system, and an access authentication apparatus.
  • a DHCP certifier is set up.
  • different DHCP clients can find the corresponding DHCP Authenticator, and the DHCP Authenticator performs the proxy authentication process, thereby eliminating the need for corresponding modification of DHCP and reducing operating costs. .
  • FIG. 2 is a system diagram of a DHCP authentication system according to an embodiment of the present invention, which introduces a technology for separating authentication and control.
  • the system includes multiple DHCP clients 301, DHCP certifiers 302, and authentication.
  • DHCP client 301 is the DHCP authentication applicant. After obtaining the DHCP authentication protocol on the network, the DHCP client 301 itself is associated with DHCP. Identity authentication information within the scope of the certification agreement.
  • the DHCP client 301 can be a terminal device connected to the network such as a portable computer, a personal digital assistant, a mobile phone, a personal desktop computer, and a routing enterprise. The DHCP client 301 needs to complete the client authentication process by using the DHCP authenticator 302 in the corresponding mode. .
  • the DHCP Authenticator 302 is an access certifier.
  • the number of DHCP Authenticators 302 can be set according to the requirements of the network.
  • the DHCP authenticator interacts with the DHCP client 301 supported by the DHCP client.
  • the DHCP client exchanges information with the DHCP server 303 and obtains DHCP client authentication from the DHCP server.
  • the first configuration information used by the process that is, a temporary IP address
  • the DHCP client exchanges information with the authentication server 304 using the temporary IP address
  • the authentication server 304 authenticates the DHCP client.
  • the DHCP authenticator 302 acts as an authentication proxy for the DHCP client 301, performs an AAA authentication protocol interaction with the authentication server 304, and provides access authentication and authorization for the DHCP client 301.
  • the DHCP authenticator can record the first configuration information returned by the DHCP server 303, replace the temporary IP address in the first configuration information with the local IP address used by the client on the local network, and send it to the DHCP client 301.
  • the DHCP authenticator 302 can also update the control state of the access access of the DHCP client 301 by establishing or releasing the access authorization.
  • the DHCP authenticator 302 also implements the relaying of the DHCP authentication process.
  • the DHCP authenticator 302 can be a Broadband Access Server (BRAS) located at the IP edge node of the network or a Gateway Device (BNG) in the network, and the DHCP authenticator 302 can be other access devices.
  • the DHCP authenticator 302 and the authentication server 304 can be constructed as the same physical entity. If the DHCP Authenticator 302 and
  • a first processing module is configured in the DHCP authenticator 302, and is configured to receive a discovery message sent by the DHCP client 301, and obtain the first configuration information used by the DHCP client 301 in the response process, that is, a temporary IP address. Addressing, and sending corresponding information to the DHCP client 301; an authentication module, configured to perform local authentication on the client or proxy remote authentication of the DHCP client 301 and the authentication server; and second processing module, if the DHCP The client 301 is successfully authenticated, and sends a configuration request to the configuration server, that is, the DHCP server 303, to request the client to provide the second configuration information used by the session process.
  • the re-authentication module is configured to perform the The DHCP client 301 performs re-authentication.
  • the DHCP server 303 provides a dynamic host and other related configuration services for the DHCP client 301 through the DHCP protocol according to the request sent by the DHCP client 301.
  • the DHCP client 301 is provided with second configuration information, where the second configuration information is an IP address used by the DHCP client 301 in the session process in the network.
  • the authentication server 304 checks the authentication material provided by the DHCP client 301 and returns the verification result and the authorized parameters to the DHCP client 301.
  • the authentication server 304 can be located at the same node as the DHCP authenticator 302, and the data is transmitted through an Application Programming Interface (API).
  • the authentication server 304 can also be an authentication server specially provided in the network.
  • the AAA protocol message needs to be carried by other protocols to implement data interaction in the authentication process, such as the remote user dialing authentication system RADIUS protocol or the RADIUS protocol upgrade. Version of the Diameter protocol.
  • An Access Controller (AC) 305 is configured to monitor data packets or data flow information sent from the DHCP client 301 or sent to the DHCP client 301, and according to the DHCP authenticator.
  • the access control policy obtained at 302 performs non-encrypted or encrypted access filtering on the data packet or data flow information.
  • the filtering of the data stream by the AC 305 can occur at the link layer or in the communication processing layer above the network layer or the network layer.
  • AC 305 is located on the link between DHCP client 301 and DHCP authenticator 302. If the network is not secure at the bottom of the network, the encryption access filtering mode is required.
  • the security association between the DHCP client 301 and the AC 305 needs to be established. The security association can use the Internet key exchange protocol.
  • IKE Internet Key Exchange
  • the data layer may be secured by using a link layer or a network layer encryption protocol, and the encryption protocol may be an IP Security Protocol IP (IPSec) or an 802.11i link layer encryption protocol, or 802.16 link layer encryption protocol.
  • IPSec IP Security Protocol IP
  • 802.11i link layer encryption protocol 802.16 link layer encryption protocol.
  • the AC 305 may be provided with a detecting unit and a data filtering unit, and the detecting unit is configured to monitor a data packet or a data stream sent by the client; the data filtering unit is configured to be connected according to the data. Entering a control policy provided by the authenticator to perform non-encrypted access filtering or encrypted access filtering on the data packet or data flow information.
  • the access authenticator 302 since the access authenticator 302 is connected to the DHCP server 303 and the authentication server 304, the access authenticator 302 provides the AC 305 with relevant information such as control policies. In this way, the information acquisition update is more convenient and flexible.
  • access filtering encrypted access filtering or non-encrypted access filtering
  • the DHCP client 301 uses the lease term to stipulate the IP session time, and the DHCP server 303 allows the DHCP client 301 to use an IP address within a specified time.
  • the DHCP server 303 and the DHCP client 301 can suspend the lease at any time.
  • the lease time of the DHCP client 301 reaches 50% or more, the lease period can be updated. In the process of updating the lease period, the DHCP client 301 needs to be reassigned the IP address.
  • IP session life cycle in the DHCP authentication process is shown in Figures 3 and 4.
  • Figure 3 shows the IP session period for encrypted access filtering in DHCP authentication.
  • Figure 4 shows the non-encrypted access filtering used in DHCP authentication.
  • IP session period, a DHCP session corresponding to an IP session consists of five different phases:
  • the DHCP client can broadcast a DHCP Authenticator by sending a request to a specific DHCP Authenticator.
  • the DHCP Authenticator initiates a new session by sending a reply.
  • (2) Authentication and authorization phase After the discovery and handshake phase, an authentication message is passed between the DHCP authenticator and the DHCP client.
  • the EAP payload carried in the DHCP message contains various methods of EAP authentication. It is mainly used to authenticate the DHCP client.
  • EAP authentication may be performed twice, once for the Network Access Provider (NAP) and once for the Internet Service Provider (ISP).
  • NAP Network Access Provider
  • ISP Internet Service Provider
  • the DHCP Authenticator passes the authentication and authorization results to the DHCP client at the end of this phase.
  • the DHCP client host can access the network after the authentication and authorization succeeds.
  • the IP data sent and received by the DHCP client can be checked by the AC.
  • both the DHCP client and the DHCP authenticator can send IP session test data to check the survival status of the peer IP session.
  • Re-authentication phase During the IP session, the re-authentication phase can be entered from the access phase by performing EAP authentication again. After the re-authentication is successful, return to the access phase and extend the current IP session period. Otherwise, the IP session will be deleted. Re-authentication can be initiated by a DHCP Authenticator or by a DHCP client or DHCP Authenticator.
  • Termination phase At any time, the DHCP client or DHCP Authenticator can send an explicit disconnect message (such as a DHCP release message) to the other party to abort the IP session, thus ending the access service. If the connection is aborted without sending a disconnect message, the IP session may expire or the IP session status detection may fail.
  • an explicit disconnect message such as a DHCP release message
  • the process of the entire authentication of DHCP will be described in detail below in conjunction with the IP session periods in Figs. 3 and 4.
  • the DHCP protocol versions of the IPv4 version and the IPv6 version are DHCPv4 and DHCPv6, respectively.
  • Table 2 shows the DHCPv4 elimination
  • DHCP Request EAP Request 1. Contains the IP address provided by the DHCP Authenticator. (EAP-Message /Response indicates that the provided IP address and corresponding Option have been accepted) DHCP Authenticator;
  • DHCPAck EAP Request 1. Configurable network parameters, such as user IP address
  • DHCP Nack EAP Failure carries the corresponding EAP message.
  • DHCP Release indicates that the user is offline and needs to release the corresponding session and IP address.
  • Step S501 When DHCP When the client accesses the network, it sends to the network accessed by the DHCP client.
  • a DHCP Discover message (DHCP Discover) message indicating that the DHCP Authenticator and the DHCP server providing the authentication and authorization service are selected, and the authentication mode supported by the DHCP client is indicated by an option in the protocol;
  • the AC needs to forward the received DHCP Discover message to the corresponding DHCP Authenticator.
  • Step S502 After receiving the DHCP Discover message, the DHCP authenticator forwards the message to the DHCP server.
  • Step S503 The DHCP server checks the parameters of the DHCP Discover, and responds to an address allocation service confirmation (DHCP Offer) message, providing the DHCP client with an untenanted IP address and other related DHCP configuration information, such as a related subnet mask. And the default gateway;
  • DHCP Offer address allocation service confirmation
  • Step S504 After receiving the DHCP Offer message, the DHCP Authenticator adds an authentication mode supported by the DHCP Authenticator to the option, records the un-lipped IP address provided by the DHCP server for the DHCP client, and replaces the un-lipped IP address. Is a local IP address used by the DHCP client on the local network, and then forwards the DHCP Offer message processed by the address replacement to the DHCP client;
  • Step S505 After receiving the DHCP Offer message, the DHCP client has a temporary local IP address, and the DHCP client sends a DHCP Request message to the DHCP authenticator to respond to the DHCP client having received the DHCP Offer.
  • the DHCP Request message indicates that the DHCP client has selected the DHCP Authenticator and accepted the local IP address provided by the DHCP Authenticator.
  • the DHCP Authenticator selected by the DHCP client can support the corresponding authentication mode.
  • Step S506 After receiving the DHCP Request message, the DHCP authenticator sends an EAP-Request/Identity message containing the identity query request to the DHCP client, where the EAP-Request/Identity message is carried in the address allocation response (DHCP Ack) message, and A "fake lease" is issued for the DHCP client only.
  • the "fake lease" is used to enable the DHCP client to respond quickly to the EAP message and reserve enough time for the DHCP authenticator to reply to the EAP authentication message.
  • the DHCP Authenticator will set a "fake lease" for the DHCP client to use only the EAP message carried in the DHCP Ack message after receiving the address allocation request message.
  • the DHCP client After receiving the DHCP Ack message, the DHCP client resets the timer T1 and the timer T2 according to the "fake lease".
  • the time set by the timer T1 or the timer T2 expires, the DHCP address is re-triggered.
  • the allocation request message updates the "fake lease" to carry the EAP message delivery time.
  • Step S507 The DHCP client receives the DHCP Ack containing the EAP-Request/Identity message. After the message, the DHCP client returns the EAP-Request/Identity message received by the DHCP client to the DHCP Authenticator when the timer T1 expires according to the timer T1 and the timer T2 set by the "fake lease". If the timeout is not completed within the time set by the timer T1, the return process needs to be completed within the timer T2, that is, the DHCP client has received the EAP-Request/Identity message and returns it to the DHCP authenticator, the EAP-Request/ The identity message is carried in the DHCP Request message.
  • Step S508 The DHCP Authenticator sends an EAP Response message to the AS, where the EAP Response message is carried by the AAA protocol.
  • Step S509 The DHCP client and the DHCP Authenticator exchange the EAP message carried in the message; the EAP message in the DHCP client and the DHCP Authenticator is carried in the DHCP Request/Ack message;
  • Step S510 The DHCP authenticator and the AS use the AAA message to carry the EAP message to perform the interaction.
  • Steps S509 and S510 may be the process of performing the EAP Method negotiation and the authentication method interaction, and the process of the DHCP client. The identity is checked and verified until the end of the EAP authentication process.
  • Step S511 The AS notifies the DHCP authenticator of the successful result of the authentication
  • Step S518, step S510, and step S511 it should be noted that if the DHCP authenticator and the AS are on the same network node, data interaction and delivery can be performed through the API; for example, the DHCP authentication proxy service and the AS are not in the same network node, Then, other protocols are required to carry the authentication data interaction by carrying the AAA protocol message, such as the remote user dial-up authentication system RADIUS protocol or the upgraded version of the RADIUS protocol Diameter protocol.
  • Step S512 The DHCP authenticator constructs a DHCP Request message according to the recorded un-rented IP address provided by the DHCP server for the DHCP client, and sends the DHCP Request message to the DHCP server.
  • Step S513 The DHCP server constructs a DHCP Request message according to the DHCP authenticator.
  • the parameter in the DHCP client is assigned a global IP address and a real lease, and a DHCP Ack message can be returned to the DHCP authenticator.
  • the DHCP Ack message carries the EAP message with successful authentication, where yiaddr is the IP address assigned to the user.
  • Step S514 After receiving the EAP message with the successful authentication, the DHCP Authenticator re-encapsulates the DHCP Ack message and sends it to the DHCP client.
  • the DHCP Ack message includes the global IP address assigned to the DHCP client and the real lease term.
  • FIG. 5 depicts the authentication flowchart for the first successful authentication in the DHCPv4 version, in DHCP.
  • the failure of the first authentication is also encountered.
  • the process of the first authentication failure in DHCPv4 is described below with reference to FIG. 6 and Table 2 and FIG. 5, because in the first authentication process, step S701 to step in FIG.
  • the S710 process is the same as the step S501 to the step S510 in FIG. 5, and details are not described herein again.
  • Step S611 After the AS fails to be authenticated, the AS sends an EAP failure message to the DHCP authenticator through the AAA message.
  • Step S612 After receiving the EAP failure message, the DHCP authenticator forwards the message to the DHCP client through the DHCP Nack message.
  • DHCPv4 The above is a detailed description of DHCPv4.
  • DHCPv6 Please refer to the combination of DHCPv6 message and DHCP Option in Table 3.
  • Table 3 The following table is based on the table in Table 3.
  • Option) Provide the DHCP client with an untenant IP address and other DHCP configuration information, such as the subnet mask and default gateway.
  • DHCP Request EAP Request 1 The IP address provided by the DHCP Authenticator indicates that (EAP-Message/Response has accepted the provided IP address and the corresponding Option) DHCP Authenticator;
  • DHCP Reply EAP Request 1.
  • Configurable network parameters such as user IP address;
  • Success/Failure Send Direction DHCP Authenticator DHCP Client
  • DHCP Release indicates that the user is offline and needs to release the corresponding session and IP address.
  • Step S701 When the DHCP client accesses the network, the DHCP client sends a DHCP Solicit message to the accessed network, where the message indicates that the DHCP client selects the DHCP authenticator and the DHCP server that provide the authentication and authorization service, and passes the The options in the protocol indicate the authentication mode supported by the DHCP client;
  • Step S702 After receiving the DHCP Solicit message, the DHCP authenticator forwards the message to the DHCP server.
  • Step S703 The DHCP server checks the parameters of the DHCP Solicit and responds to an address assignment service acknowledgement (DHCP Advertise) message, providing the DHCP client with an untenanted IP address and other related DHCP configuration information, such as a related subnet mask. And the default gateway;
  • DHCP Advertise address assignment service acknowledgement
  • Step S704 After receiving the DHCP Advertise message, the DHCP Authenticator adds an authentication mode indicating that the DHCP Authenticator supports the DHCP Authenticator, and records the un-lipped IP address provided by the DHCP server for the DHCP client, and replaces the un-lending IP address. Is a local IP address used by the DHCP client on the local network, and then forwards the DHCP Advertise message processed by the address replacement to the DHCP client;
  • Step S705 After receiving the DHCP Advertise message, the DHCP client obtains a temporary local IP address from the DHCP Advertise message. The DHCP client sends a DHCP Request message to the DHCP Authenticator in response to the DHCP Advertise message. The DHCP Request message indicates that the DHCP client has selected the DHCP Authenticator and accepted the local IP address provided by the DHCP Authenticator. The DHCP authenticator selected by the DHCP client can support the corresponding authentication mode.
  • Step S706 After receiving the DHCP Request message, the DHCP Authenticator sends an EAP-Request/Identity message indicating the identity query to the DHCP client, and the EAP-Request/Identity message is carried by the DHCP Reply message and sent.
  • Step S707 After the DHCP client receives the DHCP Reply message containing the EAP-Request/Identity message, the DHCP client returns an EAP-Response/Identity message to the DHCP authenticator indicating that the EAP-Request/Identity message has been received, and the EAP- The Response/Identity message is carried in the DHCP Request message.
  • Step S708 The DHCP Authenticator sends an EAP response message to the AS, where the EAP response message is carried by the AAA protocol.
  • Step S709 The DHCP client and the DHCP Authenticator exchange the EAP message; the EAP message in the DHCP client and the DHCP Authenticator is carried by the DHCP Request/Reply message;
  • Step S710 The DHCP authenticator exchanges an EAP message with the AS, and the EAP message adopts AAA cancellation.
  • step S709 and step S710 the EAP method negotiation and the authentication method interaction process are performed synchronously, and the identity of the DHCP client is checked and verified until the EAP authentication process ends.
  • Step S711 The AS notifies the DHCP authenticator of the successful result of the authentication
  • Step S712 The DHCP authenticator constructs a DHCP Request message according to the recorded un-rented IP address provided by the DHCP server for the DHCP client, and sends the DHCP Request message to the DHCP server.
  • Step S713 The DHCP server allocates a global IP address and a real lease to the DHCP client according to the parameters in the DHCP Request message constructed by the DHCP authenticator, and can return a DHCP Reply message to the DHCP authenticator.
  • the DHCP Reply message carries the authentication successfully.
  • the DHCP Authenticator re-encapsulates the EAP message and sends it to the DHCP client.
  • the DHCP Reply message includes the global IP address assigned to the DHCP client and the real IP address. Lease period.
  • FIG. 7 describes the authentication flowchart for the first authentication succeeded in the DHCPv6 version.
  • the first authentication failure is also encountered.
  • the first authentication in DHCPv6 is described below with reference to Figure 8 and Table 3 and Figure 7.
  • the process of the failure since the process of step S801 to step S810 in FIG. 8 is the same as the process in FIG. 7 in the first authentication process, the details are not described here.
  • the following steps describe the steps after the AS authentication fails:
  • Step S8011 After the AS fails to be authenticated, the AS DHCP authentication failure (EAP failure) message is sent to the DHCP authenticator by using the AAA message;
  • EAP failure AS DHCP authentication failure
  • Step S8012 After receiving the EAP failure message, the DHCP authenticator forwards the message to the DHCP client through the DHCP Reply message.
  • Steps S901 to S903 are the same as steps S501 to S503 in FIG. 5, and when proceeding to step S904, after receiving the DHCP Offer message, the DHCP authenticator directly carries the EAP-Request indicating the identity query request in the DHCP Offer message.
  • the DHCP Authenticator records the untenanted IP address provided by the DHCP server for the DHCP client, and replaces the un-lipped IP address in the DHCP Offer message with a local IP address for the DHCP client to use on the local network. And then forwards the DHCP Offer message to the DHCP client, and proceeds to step S905 to step S912.
  • the authentication process, the steps S905 to S912 are the same as the steps S507 to S514 described in FIG.
  • the EAP-Request/Identity message indicating the identity query request is added in the step S604 in the step of FIG. 6.
  • the EAP-equest/Identity message is carried by the DHCP Offer message and sent to the DHCP client, and the process proceeds directly to step S608.
  • the authentication process is performed by adding an EAP-Request/Identity message indicating the identity query request to the DHCP client in the DHCP Advertise message in step S704 of FIG. 7 or step S804 in FIG. 8 and directly transmitting to the DHCP client, and directly proceeding to step 708 or step S808 to perform the authentication process. , no more details here.
  • step S1001 after the DHCP client fails the authentication or the lease expires, the DHCP client is set.
  • the DHCP Request message is sent directly within the specified time.
  • the DHCP Request message contains the authentication mode supported by the DHCP Authenticator and the IP address provided by the DHCP Authenticator.
  • step S1002 the execution steps are the same as step S508 in the flowchart of FIG. 5 until the end of the entire successful authentication process, step S1002 to step S1010, and step S506 to step in the flowchart of FIG. S514 is the same.
  • the re-authentication process of the DHCP message in Table 3 of the DHCPv6 version is similar to the re-authentication process in the DHCPv4 version.
  • the DHCP message is different during the authentication process. .
  • the above method is to implement different functions in different combinations by using two new DHCP options (Option) added in the prior art, without adding the messages in the DHCPv4 and the DHCPv6 in the prior art.
  • the corresponding DHCP authentication function can be completed by the existing added DHCP message and the newly added DHCP Option, such as the DHCPv4 message and the DHCP Option shown in Table 4. Li, 1) (Pv4 > ⁇ .3 ⁇ 4 ⁇ ⁇ ' ⁇ '>' ⁇ & ⁇
  • the source IP address is 0.0.0.0.
  • Each DHCP Authenticator performs an authentication response, and (auth-proto Option) indicates the authentication mode supported by the DHCP Authenticator;
  • DHCP Client with an untenant IP address and other DHCP configuration information, such as the subnet mask and default gateway.
  • DHCP Request 1 Contains the authentication mode (auth-proto Option) supported by the DHCP Authenticator and the IP address provided by it, indicating that the provided IP address and the corresponding DHCP Authenticator have been accepted. Sending direction: DHCP Client DHCP Authenticator
  • Each DHCP Authenticator responds with an authentication.
  • auth-proto Option Request/Identity indicates the authentication mode supported by the DHCP Authenticator;
  • EAP-Message auth-proto Option is optional.
  • Option) Provide the DHCP Client with an untenant IP address and other DHCP configuration information, such as the subnet mask and default gateway.
  • the DHCP EAP Request carries the corresponding EAP message.
  • the DHCP Auth-request EAP Request carries the corresponding EAP message. Li, 1) 11 ( Pv4 , * ⁇ » ' ⁇ ' , * ⁇ ⁇ ⁇
  • DHCP Ack EAP Success 1.
  • Configurable network parameters such as user IP address;
  • DHCP Nack EAP Failure carries the corresponding EAP message.
  • DHCP Release indicates that the user is offline and needs to release the corresponding session.
  • Option) Provide the DHCP Client with an untenant IP address and other DHCP configuration information, such as the subnet mask and default gateway.
  • the DHCP EAP Request carries the corresponding EAP message.
  • the DHCP Auth-request EAP Request carries the corresponding EAP message.
  • DHCP Reply EAP 1. Configurable network parameters, such as user IP address;
  • DHCP Release indicates that the user is offline and needs to release the corresponding session.
  • the flowchart 11 for describing the authentication is performed according to the DHCP message added in the DHCPv4 version table 4 in the prior art and the added new DHCP Option, and the steps S1101 to S1105 and FIG. 5 are performed.
  • the steps S501 to S505 are the same, and are not described here.
  • the implementation method is as follows:
  • Step S1106 After receiving the DHCP Request message, the DHCP authenticator sends an EAP-Request/Identity message indicating the identity query request to the DHCP client, and the EAP-Request/Identity message responds by using an address assignment (DHCPAuth-request) message or DHCP EAP.
  • DHCPAuth-request an address assignment
  • Step S1107 After the DHCP client receives the DHCP Auth-request message or the DHCP EAP message containing the EAP-Request/Identity message, the DHCP client returns an EAP-Response/Identity message to the DHCP authenticator, and the EAP-Response/Identity message is passed.
  • the DHCP Auth-response message or the DHCP EAP message is carried;
  • Step S1108 The DHCP Authenticator receives the EAP-Response/Identity message indicating that the identity query request is received, and the EAP-Response may be re-encapsulated in the AAA message and sent to the AS.
  • Step S1109 The DHCP client and the DHCP Authenticator exchange the EAP message carried in the message; the EAP message exchanged between the DHCP client and the DHCP Authenticator is carried by the DHCP Auth-request/response message, or through the DHCP EAP message. Carrying;
  • Step S110 The EAP message of the DHCP Authenticator and the AS is carried by the AAA message.
  • Step S1109 and Step S1110 are the EAP Method negotiation and the authentication method interaction process, and the identity of the DHCP client is performed. Check and verify until the end of the EAP certification process.
  • Step S1111 The AS notifies the DHCP authenticator of the result of the successful authentication
  • Step S1112 The DHCP authenticator constructs a DHCP Request message by using the unclaimed IP address provided by the DHCP server for the DHCP client, and sends the DHCP Request message to the DHCP server.
  • Step SI 113 The DHCP server constructs a DHCP Request message according to the DHCP authenticator.
  • the parameter in the DHCP client is assigned a global IP address and a real lease, and the EAP message carrying the authentication is returned to the DHCP authenticator.
  • the EAP message is successfully carried by the DHCP Ack message, where yiaddr is assigned to the user. IP address;
  • Step S1114 After receiving the EAP message with successful authentication, the DHCP Authenticator re-encapsulates the message into a DHCP Ack message and forwards it to the DHCP client, where the DHCP Ack message carries the global IP address assigned to the DHCP client and the real lease term. .
  • the DHCP Auth-response message and the DHCP Auth-request message are used to carry the corresponding The EAP message and the DHCP Option message, or the corresponding EAP message and the DHCP Option message are carried by the DHCP EAP message, and so on.
  • the flowchart of the failure of the authentication process is as shown in FIG. 12, and the simplified flowchart process of the authentication is as shown in FIG. As mentioned, the steps are not repeated here.
  • the DHCP Auth-response message and the DHCP Auth-request message are used to carry the corresponding EAP message and the DHCP Option message, or the DHCP EAP message is used to carry the corresponding EAP message and the DHCP Option message.
  • the DHCP client can be triggered.
  • the re-authentication process can also be triggered by the DHCP authenticator.
  • the re-authentication process triggered by the DHCP client is shown in Figure 14.
  • the S1401 client directly sends a DHCP Request message, which includes the authentication mode supported by the DHCP authenticator and the IP address provided by the DHCP authenticator, indicating that the DHCP client has selected the DHCP authenticator.
  • step S1402 accept the local IP address provided by the DHCP authenticator, and the DHCP authenticator selected by the DHCP client can support the corresponding authentication mode.
  • step S1501 after the DHCP authentication succeeds, the authenticator initiates an authentication request to the DHCP client in the network, thereby completing the process of re-authentication.
  • DHCPv4 after adding DHCP messages and Option.
  • the DHCP messages and Option messages added in Table 5 of DHCPv6 can also be carried by different DHCP messages to complete the above DHCP authentication. Narration.
  • the DHCP message added by the existing DHCP message and the newly added DHCP Option, the DHCPv4 version and the DHCP version use different combinations of the DHCP message and the DHCP Option to complete the corresponding DHCP authentication function, as shown in Table 6.
  • DHCPv4 message and DHCP Option use different combinations of the DHCP message and the DHCP Option to complete the corresponding DHCP authentication function, as shown in Table 6.
  • DHCP Advertise EAP 1. Provide an untenant IP for the DHCP Client.
  • DHCP Reply EAP Failure 1.
  • Configurable network parameters such as user IP address;
  • DHCP Release indicates that the user is offline and needs to release the corresponding session and IP address.
  • Step S1601 When the DHCP client accesses the network, send a DHCP Discover message to the network accessed by the DHCP client to indicate that the DHCP client selects the DHCP authenticator and the DHCP server that provide the authentication and authorization service, and passes the protocol.
  • the options in the account indicate the authentication mode supported by the DHCP client;
  • the AC needs to forward the received DHCP Discover message to the corresponding DHCP Authenticator.
  • Step S1602 After receiving the DHCP Discover message, the DHCP authenticator forwards the message to the DHCP server.
  • Step S1603 The DHCP server checks the parameters in the DHCP Discover message, and responds to an address allocation service confirmation (DHCP Offer) message to provide an untenanted IP address for the DHCP client, wherein the DHCP server can also provide other DHCP client information.
  • DHCP Offer address allocation service confirmation
  • Relevant DHCP configuration information such as related subnet mask and default gateway;
  • Step S1604 The DHCP authenticator sends a request for an identity query to the DHCP client.
  • EAP-Request/Identity message the EAP-Request/Identity message is carried by a DHCP Auth-request message or a DHCP EAP message 7
  • Step S1605 After the DHCP client receives the DHCP Auth-request message or the DHCP EAP message, the DHCP client sends a response (EAP-esponse/Identity) message to the DHCP authenticator, and the EAP-Response/Identity message passes the DHCP Auth-response Message or DHCP EAP message bearer;
  • EAP-esponse/Identity EAP-esponse/Identity
  • Step S1606 The DHCP Authenticator sends the received message indicating the identity query request to the AS through the EAP Response over AAA protocol.
  • Step S1607 and step S2308 The EAP method negotiation and the authentication method exchange process are performed; in these processes, the EAP message exchanged between the DHCP client and the DHCP authenticator adopts DHCP Auth-request/ The response message or the DHCP EAP message is carried; the EAP message exchanged between the DHCP authenticator and the AS is carried by the AAA message; until the EAP authentication process ends;
  • Step S1609 The AS notifies the DHCP authenticator of the result of the successful authentication
  • Step S1610 After receiving the message that the authentication succeeds, the DHCP Authenticator encapsulates the EAP Success message in a DHCP Offer message and forwards the message to the DHCP client.
  • Steps S1611 to S1614 are the standard DHCP address application procedures in the prior art, and are not described here.
  • Another flow chart 17 describing the authentication according to the DHCP message added in the DHCPv4 version table 6 and the added new DHCP Option in the prior art is as follows:
  • Step S1701 When the DHCP client accesses the network, the DHCP client sends a DHCP Discover message to the accessed network, indicating that the DHCP client selects the DHCP authenticator that provides the authentication and authorization service, and passes the option in the protocol. Indicate the authentication mode it supports;
  • Step S1702 The DHCP Authenticator sends an EAP-Request/Identity message indicating the identity query request to the DHCP client, and provides an un-tenant IP address for the DHCP client, wherein the DHCP server can also provide other related DHCP for the DHCP client.
  • Configuration information such as a related subnet mask and a default gateway, the EAP-Request/Identity message is carried by a DHCP Auth-request message or a DHCP EAP message;
  • Step S1703 After receiving the DHCP Auth-request message or the DHCP EAP message, the DHCP client sends a response (EAP-Response/Identity) message to the DHCP authenticator, where The EAP-Response/Identity message is carried by a DHCP Auth-response message or a DHCP EAP message.
  • Step S1704 The DHCP Authenticator sends the received EAP-Response/Identity message to the AS through the AAA protocol.
  • Step S1705 and step S1706 The EAP method negotiation and the authentication method exchange process are performed; in these processes, the EAP message exchanged between the DHCP client and the DHCP authenticator adopts DHCP Auth-request/ The response message or the DHCP EAP message is carried; the EAP message exchanged between the DHCP authenticator and the AS is carried by the AAA message; until the EAP authentication process ends;
  • Step S1707 The AS notifies the DHCP authenticator of the result of the successful authentication
  • Step S1708 The DHCP Authenticator forwards the received DHCP Discover message to the DHCP service.
  • Step S1709 The DHCP server checks the parameters in the DHCP Discover, and responds to a DHCP Offer message indicating the address allocation service confirmation, providing the DHCP client with an untenanted IP address, wherein the DHCP server can also provide other related activities for the DHCP client.
  • DHCP configuration information such as the relevant subnet mask and default gateway;
  • Step S1710 After receiving the DHCP Offer message, the DHCP authenticator encapsulates the EAP Success message in the DHCP Offer message and forwards the message to the DHCP client.
  • Steps S1711 to S1714 are the standard DHCP address application procedures in the prior art, and are not described here.
  • the flow chart 18 describing the failure of the first authentication of DHCP is performed according to the DHCP message added in the DHCPv4 version table 6 in the prior art and the added new DHCP Option, because in the process of the first authentication, the steps S1801 to the step in FIG. 18 are performed.
  • S1808 is the same as step 1601 to step S1608 in FIG. 16, and details are not described herein again.
  • the following steps describe the steps after the AS authentication fails:
  • Step S1809 The DHCP authenticator receives the EAP failure message sent by the AS.
  • Step S1810 The DHCP authenticator re-encapsulates the received EAP failure message in a DHCP Nack message or a DHCP Offer message, and forwards the message to the DHCP client.
  • Step S1907 The DHCP authenticator receives the EAP failure message sent by the AS.
  • Step S1908 The DHCP authenticator re-encapsulates the received EAP failure message in a DHCP Nack message or a DHCP Offer message, and forwards the message to the DHCP client.
  • the above is a description of the DHCPv4 after the DHCP message and the DHCP Option message are added in different combinations.
  • the DHCPv6 and the DHCP Option message added in Table 7 can be carried in different DHCP messages. The process of completing the above DHCP authentication is not described here.
  • the DHCP client can access the network for data access.
  • the AC needs to detect the data flow of the DHCP client.
  • both the DHCP client and the DHCP authenticator can send IP session test data to detect the survival status of the IP session of the respective peer port.
  • Figure 20 below details the encrypted access.
  • the filtered DHCP authentication flowchart, the specific steps are as follows:
  • the DHCP authenticator After the authentication succeeds, the DHCP authenticator returns a message indicating that the authentication succeeds to the DHCP client, and the DHCP authenticator and the AC begin to perform step S2001;
  • Step S2001 The DHCP authenticator sends an access control policy and an authorization key to the DHCP client to the AC.
  • Step S2002 The AC receives an access control policy and an authorization key for the DHCP client, and establishes a security association with the DHCP client.
  • the process of establishing the security association may use the IKE protocol or the 802.lli 4WHS protocol, or the 802.16 3WHS. Agreement
  • Step S2003 After the establishment of the security association between the DHCP client and the AC, the data stream may be secured by using an encryption protocol in the link layer or the network layer;
  • Step S2004 The AC performs encrypted access filtering on the data stream to filter out insecure packets in the data stream.
  • Step S2005 When the entire IP session of the DHCP client ends, the DHCP client initiates a DHCP release message to the AS to terminate the IP address. Conversation
  • the AC detects that the data flow of the DHCP client's IP session is interrupted, and immediately sends a DHCP release message to the DHCP authenticator to inform the DHCP authenticator that the DHCP client has suspended the IP session.
  • Step S2006 After receiving the DHCP release message, the DHCP authenticator forwards the release message to DHCP server, the DHCP server will release the IP address of the DHCP client;
  • Step S2007 After the DHCP authenticator receives the DHCP release message, the DHCP authenticator notifies the AC to release the access control policy and the authorization key of the DHCP client.
  • Step S2101 The AC listens to the DHCP message, and when it returns a message with successful authentication, the IP address and the physical address (such as the MAC address) of the DHCP client are ) to bind;
  • Step S2102 The DHCP client initiates data flow information by using the allocated IP address.
  • Step S2103 The AC performs non-access encryption on the data flow information sent by the DHCP client, and filters out that the DHCP client IP address does not match the user MAC address. Data 4 ⁇ text;
  • Step S2104 When the entire IP session of the DHCP client ends, the DHCP client initiates a DHCP release message to the AS to terminate the IP session.
  • the AC detects that the data flow of the IP session of the DHCP client is interrupted, and immediately sends a DHCP release message to the DHCP authenticator to inform the DHCP authenticator that the DHCP client has suspended the IP session.
  • Step S2105 When the AC detects the DHCP client releasing the IP message or detecting the interruption of the IP session link, the AC unbinds the DHCP client IP address and the MAC address.
  • Step S2106 The DHCP authenticator forwards the DHCP release message to the DHCP server, and the DHCP client releases the IP address of the DHCP client according to the received message.
  • the authenticator performs proxy authentication by the corresponding DHCP client, and the corresponding authenticator can be configured to the DHCP client without modifying the DHCP server.
  • the corresponding authentication is performed.
  • the separation of the control plane and the data plane is realized by the introduction of the access controller, and the access controller is well implemented to implement the access filtering of the data plane, thereby ensuring the security of the data plane.
  • the re-authentication mechanism When the lease time of the DHCP client authentication is over, the authentication process is re-initiated, and the DHCP client is reassigned an IP address for IP call.
  • the process of re-authentication can be triggered by the DHCP client trigger mechanism and DHCP.
  • the authentication method provided in the embodiment of the present invention can be performed through different DHCP messages. It can be applied to IPv4 and can also be implemented in IPv6.

Description

一种网络接入方法、 系统和装置
技术领域
本发明涉及网络通信领域， 尤其涉及一种网^^入方法、 系统和装置。 背景技术
动态主机配置协议（Dynamic Host Configuration Protocol , DHCP )是一种 动态指定 IP地址和配置参数的机制， 主要用于大型网络环境和网络配置比较困 难的地方。 DHCP系统主要包括 DHCP服务器（ DHCP Server )和 DHCP客户端 ( DHCP Client ),有些系统也包括 DHCP认证服务器。 DHCP服务器自动为客户 端指定 IP地址， 通过指定的配置参数使得网络上的计算机通信变得更加方便和 易于实现。 所有的配置信息都通过 DHCP服务器来统一管理， 通过 DHCP服务 器分配 IP地址并配置其它大量的参数信息， 以及对 IP地址进行租期管理， 实现 IP地址的分时复用等诸多优点， 在网络环境中已经得到了广泛的应用。
在 DHCP系统中， 所有的 IP网絡设定的資料都由 DHCP服务器集中管理， 并负责处理 DHCP客户端的要求， 而 DHCP客户端则会使用从 DHCP分配下来 的 IP环境资料。 图 1示出了现有的 DHCP认证流程图， 其中该 DHCP认证流程 图的系统图包含了 DHCP客户端、 DHCP服务器以及认证服务器（ Authentication Server, AS )。 DHCP客户端为网絡中利用 DHCP协议来获取配置参数如 IP地址 的主机， 即客户的主机或者其他能够获取 IP地址的设备。 DHCP服务器用于提 供 DHCP服务， 根据不同 DHCP客户端提供 IP地址或其他网络相关参数， 一般 存在于路由器、三层交换机或者专门的 DHCP服务器中。 AS负责对 DHCP客户 端提供的认证材料进行检验， 并向 DHCP客户端返回认证的结果。 图 1示出了 现有技术中 DHCPv4消息与 DHCP选项 （Option ) 的功能组合， 其中 Option允 许厂商定义以提供更多的设定咨询， 下面结合图 1 和表 1 来详细说明图 1 中 DHCP认证的过程， 其中现有的 DHCP认证釆用两种 DHCPv4 消息 （"DHCP Auth-request" 消息和 "DHCP-response" 消息） 或可以采用一种 DHCP 消息 ( "DHCP EAP" 消息）， 并通过两种 DHCP Option 消息， 为认证协议选项 ( authentication protocol Option , auth-proto)和 EAP 消息选项 ( EAP-Message Option ) 进行认证： Ι)Ι Ι(Ί，、4消息 I AP消息 功能描述
DHCP Discover 1. 通过广播请求 DHCP服务器和 DHCP (auth-proto Option) 服务器的 IP地址信息， 该消息源 IP地址 是 0.0.0.0;
2. 表明 DHCP Client支持的认证模式。 发送方向： DHCP Client DHCP 服务器
DHCP EAP Request 携带相应的 EAP消息。
Auth-response /Response 发送方向：
(EAP-Message DHCP Client DHCP 服务器
Option) DHCP
EAP(EAP-Message
Option)
DHCP Auth-request EAP Request 携带相应的 EAP消息。 (EAP-Message /Response 发送方向： DHCP服务器 DHCP Client Option) /DHCP EAP(EAP-Message Option)
DHCP Offer EAP 1.可配置网络参数， 如用户 IP地址；
(EAP-Message Success/Failure 2.携带相应的 EAP消息。
Option) 发送方向： DHCP服务器 DHCP Client 表 1
步骤 S101 : DHCP客户端所在的用户终端进入网络时， 向 DHCP服务器广 播动态主机配置协议的发现（DHCP Discover ) 消息， DHCP Discover 消息的 auth-proto Option中携带了表明 DHCP客户端支持的认证模式；该 DHCP Discover 消息用于请求 DHCP服务器的 IP地址信息， 该消息源 IP地址是 0.0.0.0; 。
步骤 S102: DHCP服务器接收到 DHCP Discover消息之后， 向 DHCP客户 端返回 DHCP认证请求（ DHCP Auth-request )消息或 DHCP EAP消息，其中 EAP Request消息承载在 DHCP Auth-request消息或 DHCP EAP消息的可扩展认证协 议消息选项 （ EAP-Message Option ) 中；
步骤 S103： DHCP客户端接收 DHCP Auth-request消息或 DHCP EAP消息， 向 DHCP服务器发送 DHCP认证回复（ Auth-response )消息，其中， EAP Response 消息承载在 Auth -response消息或 DHCP EAP消息中携带了 EAP-Message Option 中；
步骤 S104: DHCP服务器将 DHCP客户端的 EAP消息封装在认证、授权和 计费 ( Authentication, Authorization and Accounting , AAA ) 消息中发送给认 证月 ϋ务器 ( Authentication Server, AS );
步骤 SI 05: AS向 DHCP服务器发送认证结果， 认证成功则利用 AAA协议 承载 EAP成功 （EAP success ) 消息并发送给 DHCP服务器；
步骤 S106: DHCP服务器构造携带 EAP success消息的 DHCP Offer消息并 发送给 DHCP客户端，其包括分配给 DHCP客户端的 IP地址项（ your ip address , yiaddr )数据报文；
步骤 S107: DHCP客户端收到 DHCP Offer消息后， 向 DHCP服务器返回 配置参数请求（DHCP request ) 消息；
步骤 S108: DHCP服务器向 DHCP客户端返回一个地址分配回应 （ DHCP ACK ) 消息。
在实施该方案的过程中， 因在认证过程中需要将相应的 EAP 消息携带在 DHCP服务器和 AS的协议中 ,致使 DHCP服务器和 AS之间的处理流程发生改 变， 需要对 DHCP服务器和 AS进行相应的改造才能支持相应的认证功能， 增 加了运营成本。 另外， 在实施该流程图 1的过程中， 只有在 DHCP客户端处分 配了一个静态的 IP地址之后， 本方案中的认证过程才能进行， 在动态 IP分配过 程中， 认证过程开始之前用户是没有 IP地址的， 则步骤 S102开始的认证过程 是没有办法进行的。 发明内容
鉴于上述现有技术所存在的问题， 本发明实施例提供了一种网络接入方法 及系统和装置。 通过在接入系统中设置接入认证者， 在认证的过程中， 不同的
DHCP客户端可以通过 DHCP接入认证者配置各个 DHCP客户端对应的配置参 数实现认证过程， 从而不需要对 DHCP服务器进行相应的改造从而能够进行认 证过程。
为了解决上述技术问题， 本发明实施例提出了一种网络接入方法， 包括： 接入认证者接收客户端的发现消息， 响应所述发现消息， 获得所述客户端 认证过程使用的第一配置信息， 其中， 所述发现消息用于发现接入认证者； 接入认证者所述客户端进行本地认证或作为所述客户端的代理与认证服务 器交互以实现对所述客户端的远程认证；
认证成功后， 所述接入认证者向配置服务器发送配置请求消息， 请求为所 述客户端提供会话过程使用的第二配置信息。
相应的， 本发明实施例还提出了一种网络接入系统， 包括接入认证者和配 置服务器：
所述接入认证者， 用于接收客户端的发现消息， 响应所述发现消息， 为所 述客户端提供认证过程使用的第一配置信息； 对所述客户端进行本地认证或作 为所述客户端的代理与认证服务器进行远程认证； 如果所述客户端认证成功， 向配置服务器发送配置请求， 请求为所述客户端提供会话过程使用的第二配置 信息；
所述配置服务器， 用于为客户端提供配置信息， 所述配置信息至少包括所 述第二配置信息。
相应的， 本发明实施例还公开了一种接入认证装置， 包括：
第一处理模块， 用于接收客户端发送的发现消息， 获得所述客户端认证过 程使用的第一配置信息， 并将相应信息发送给所述客户端；
认证模块， 用于对所述客户端进行本地认证或者代理所述客户端与认证服 务器进行远程认证；
第二处理模块， 如果所述客户端认证成功， 向配置服务器发起配置请求， 请求为所述客户端提供会话过程使用的第二配置信息。 相应的， 本发明实施例还公开了一种宽带接入设备， 包括接入认证装置； 其中， 所述接入认证装置包括：
第一处理模块， 用于接收客户端发送的发现消息， 获得所述客户端认证过 程使用的第一配置信息， 并将相应信息发送给所述客户端；
认证模块， 用于对所述客户端进行本地认证或者代理所述客户端与认证服 务器进行远程认证；
第二处理模块， 如果所述客户端认证成功， 向配置服务器发起配置请求， 请求为所述客户端提供会话过程使用的第二配置信息。
实施本发明实施例， 通过在网络中设置接入认证者， 通过所述接入认证者 充当客户端的认证代理进行认证， 不需要对 DHCP服务器进行特别的改造， 只 需要配置相应的接入认证者对 DHCP客户端进行认证， 在认证之前为客户端提 供第一网络地址，从而提高了认证过程的稳定性，也提高了认证效率和成功率。。 附图说明
图 1是现有的 DHCP认证流程图；
图 2是本发明实施例中 DHCP认证系统图；
图 3是本发明实施例中 DHCP认证中采用加密接入过滤的 IP会话周期示意 图；
图 4是本发明实施例中 DHCP认证中采用非加密接入过滤的 IP会话周期示 意图；
图 5是本发明实施例中表 2中 DHCPv4版本首次 DHCP认证成功的流程图； 图 6是本发明实施例中表 2中 DHCPv4版本首次 DHCP认证失败的流程图； 图 7是本发明实施例中表 3中 DHCPv6版本首次 DHCP认证成功的流程图； 图 9是本发明实施例中表 2中 DHCPv4版本首次 DHCP认证成功的简化流 程图；
图 10是本发明实施例中表 2中 DHCPv4版本 DHCP重认证成功的流程图； 图 11是本发明实施例中表 4中 DHCPv4版本首次 DHCP认证成功的流程图； 图 13是本发明实施例中表 4中 DHCPv4版本首次 DHCP认证成功的筒化流 程图；
图 14是本发明实施例中表 4中 DHCPv4版本中通过 DHCP客户端触发重认 证成功的流程图；
图 15是本发明实施例中表 4中 DHCPv4版本中通过 DHCP认证者触发重认 证成功的流程图；
图 16是本发明实施例中表 5中 DHCPv4版本中首次 DHCP认证成功的流程 图；
图 17是本发明实施例中表 5中 DHCPv4版本中首次 DHCP认证成功的另一 流程图；
图 18是本发明实施例中表 5中 DHCPv4版本中首次 DHCP认证失败的流程 图；
图 19是本发明实施例中表 5中 DHCPv4版本中首次 DHCP认证失败的另一 流程图；
图 20是本发明实施例中 DHCP认证成功后基于加密接入过滤的 DHCP认证 流程图；
图 21是本发明实施例中 DHCP认证成功后基于非加密接入过滤的 DHCP认 证流程图。 具体实施方式
本发明实施例提供了一种网络接入方法及网络接入系统和接入认证装置。 在认证系统中设置 DHCP认证者， 认证的过程中， 不同的 DHCP客户端可以找 到相应的 DHCP 认证者， 由 DHCP认证者执行代理认证过程， 从而不需要对 DHCP进行相应的改造， 减少了运营成本。
下面结合附图详细说明本发明的优选实施例。
首先请参阅图 2， 图 2示出了本发明实施例中的 DHCP认证系统的系统图， 引入认证和控制相分离的技术， 该系统包括了多个 DHCP客户端 301、 DHCP 认证者 302、 认证服务器 304、 DHCP服务器 303以及接入控制器 305等， 其中 接入控制器 305位于数据面， 其他都处于控制面。
DHCP客户端 （ DHCP Client ) 301为 DHCP认证的申请者， 需要获得网络 中的 DHCP认证协议之后才能访问网络， DHCP客户端 301本身关联了 DHCP 认证协议范围内的身份认证资料。 DHCP客户端 301可以是便携式电脑、个人数 字助理、 移动电话、 个人台式电脑以及路由企等连入网络的终端设备， DHCP 客户端 301需要借助相应模式下的 DHCP认证者 302来完成客户端的认证过程。
DHCP认证者 （ DHCP Authenticator ) 302是一种接入认证者， DHCP认证 者 302的个数可以根据网络的需求设置 , 即可设置多个。 在 DHCP认证过程中， DHCP认证者与自身支持的 DHCP客户端 301进行 DHCP认证协议交互， 在接 收 DHCP客户端 301的 DHCP发现消息后， 与 DHCP服务器 303交互信息， 从 DHCP服务器获得 DHCP客户端认证过程使用的第一配置信息， 即一个临时的 IP地址， DHCP客户端利用所述临时的 IP地址与认证服务器 304交互信息， 认 证服务器 304对所述 DHCP客户端进行认证。 DHCP认证者 302作为 DHCP客 户端 301的认证代理，与认证服务器 304进行 AAA认证协议等交互，并为 DHCP 客户端 301提供接入认证和授权。 另夕卜， DHCP认证者可以记录 DHCP服务器 303返回的第一配置信息， 将第一配置信息中的临时的 IP地址替换成客户端在 本地网络使用的局部 IP地址并发送给 DHCP客户端 301。 DHCP认证者 302还 可以通过建立或解除访问授权来对 DHCP客户端 301的接入访问的控制状态进 行更新， 另一方面， 通过 DHCP认证者 302也实现了在 DHCP认证过程的中继。 DHCP 认证者 302 可以是位于网络的 IP 边缘节点处的宽带接入服务器 ( Broadband Access Server , BRAS ) 或网络中的网关设备（ BNG ), DHCP认证 者 302可以是其它接入设备。 其中 DHCP认证者 302与认证服务器 304可以构 造为同一个物理实体。 如果 DHCP认证者 302和
在 DHCP认证者 302中设有第一处理模块， 用于接收 DHCP客户端 301发 送的发现消息， 响应所述发现消息， 获得 DHCP客户端 301认证过程使用的第 一配置信息， 即一个临时的 IP地址， 并将相应信息发送给 DHCP客户端 301 ; 认证模块， 用于对所述客户端进行本地认证或者代理所述 DHCP客户端 301与 认证服务器进行远程认证； 第二处理模块， 如果所述 DHCP客户端 301认证成 功， 向配置服务器， 即 DHCP服务器 303发起配置请求， 请求为所述客户端提 供会话过程使用的第二配置信息； 重认证模块， 用于在所述会话过程中， 对所 述 DHCP客户端 301进行重认证。
DHCP服务器 （ DHCP Server ) 303根据 DHCP客户端 301发送的请求， 通 过 DHCP协议为 DHCP客户端 301提供动态主机等相关的配置服务， 在 DHCP 客户端 301通过认证之后， 为 DHCP客户端 301提供第二配置信息， 所述第二 配置信息为 DHCP客户端 301在网络中会话过程使用的 IP地址。认证服务器 304 对 DHCP客户端 301提供的认证材料进行检验， 并向 DHCP客户端 301返回检 验结果以及授权的参数。 认证服务器 304可以和 DHCP认证者 302位于同一节 点， 通过应用程序接口 ( Application Programming Interface , API )进行数据的传 递， 认证服务器 304也可以是网絡中专门提供的认证服务器。 如果 DHCP认证 者 302和认证服务器 304不在同一个网络节点中，则需要依靠其它协议承载 AAA 协议消息以实现认证过程中数据交互， 所述其它协议如远程用户拨号认证系统 RADIUS协议或 RADIUS协议的升级版本的 Diameter协议。
接入控制器（Access Controller, AC ) 305用于对从 DHCP客户端 301发出或 发往 DHCP客户端 301的数据包或数据流信息进行监控， 并根据从 DHCP认证者
302处获得的接入控制策略对数据包或数据流信息进行非加密或加密接入过滤。
AC 305对数据流的过滤可以发生在链路层， 也可以发生在网络层或网络层以上 的通信处理层中。 通常 AC 305位于 DHCP客户端 301和 DHCP认证者 302之间的链 路上。若网络底层缺乏安全保障，则需要采用加密接入过滤方式， DHCP客户 301 与 AC 305之间需要建立安全联盟， 安全联盟建立可采用因特网密钥交换协议
( Internet Key Exchange , IKE )协议， 或采用 802.1 li的四次握手 （ 4-Way
Handshake, 4WHS )协议， 或采用 802.16的三次握手（ 3-Way Handshake, 3WHS ) 协议。 在安全联盟建立完成后， 可采用链路层或网络层加密协议实现数据流的 安全保护，加密协议可为网络安全协议（ IP Security Protocol IP, IPSec ),或 802.11i 链路层加密协议， 或 802.16链路层加密协议。 若 DHCP认证者 302和 AC 305位于 同一节点，则它们之间仅需 API相互通信即可，否则，需要第二层控制协议（Layer
2 Control Protocol , L2CP )或简单网络管理协议 ( Simple Network Management
Protocol, S MP )协议。 其中 AC 305中可设有检测单元和数据过滤单元， 检测 单元用于对客户端发送的数据包或数据流进行监控； 数据过滤单元用于根据接 入认证者提供的控制策略， 对所述数据包或数据流信息进行非加密接入过滤或 加密接入过滤。 这里， 由于接入认证者 302与 DHCP服务器 303和认证服务器 304相连，由接入认证者 302给 AC 305提供控制策略等相关信息，釆用这种方式， 信息获取更新更方便灵活。 当然， 对 DHCP客户端 301的数据或数据流的监控、 接入过滤 （加密接入过滤或非加密接入过滤） 的功能也可以在其它网络接入设 备中实现。
另外， 在 DHCP客户端 301进行 IP会话的过程中， DHCP客户端 301是利用 租期来约定 IP会话时间， DHCP服务器 303允许 DHCP客户端 301在某个指定的时 间内使用某个 IP地址。在 IP会话的过程中， DHCP服务器 303和 DHCP客户端 301 任何一方都可以随时中止租用。 当 DHCP客户端 301租用期达到 50%以上时， 可 以更新租用期， 在更新租期的过程中， 需要为 DHCP客户端 301重新分配 IP地址。
DHCP认证过程中 IP会话生命周期如图 3和 4所示， 图 3示出了 DHCP认证中釆 用加密接入过滤的 IP会话周期， 图 4示出了 DHCP认证中采用非加密接入过滤的 IP会话周期， 一个 DHCP认证对应的 IP会话包括五个不同的阶段：
( 1 )发现和握手阶段： 在这个阶段发起一个新的 IP会话。 DHCP客户端可 以通过向特定的 DHCP认证者发送请求， 以广播方式寻找 DHCP认证者。 DHCP 认证者通过发送应答来开始一个新的会话。
( 2 )认证和授权阶段： 在发现和握手阶段之后， 在 DHCP认证者和 DHCP 客户端之间传递认证消息。 DHCP消息携带的 EAP负载包含了 EAP认证的各种 方法， 它主要用来做 DHCP客户端的认证。在这个阶段， 可能要执行两次 EAP认 证， 一次是为网络访问提供商（NAP ) , 另一次是为互联网服务提供商（ISP ) 。
DHCP认证者在这个阶段的末尾把认证和授权结果传递给 DHCP客户端。
( 3 )访问阶段： DHCP客户端主机在认证和授权成功后就可以访问网络， 它发送和接收的 IP数据可以通过 AC检查。另夕卜，在这个阶段的任何时刻， DHCP 客户端和 DHCP认证者都可以发送 IP会话测试数据来检查各自对端的 IP 会话的 存活状态。
( 4 ) 重新认证阶段： 在 IP会话期， 可以通过再次执行 EAP认证来从访问阶 段进入重新认证阶段。 在重新认证成功后， 返回访问阶段并延长当前 IP会话期， 否则， IP会话将被删除。 重新认证可由 DHCP认证者发起， 或由 DHCP客户端或 是 DHCP认证者触发。
( 5 )终止阶段： 在任何时候， DHCP客户端或是 DHCP认证者都可以给对方 发送明确的连接断开消息（如 DHCP释放消息）来中止 IP会话， 从而结束访问服 务。 倘若是没有发送连接断开消息就中止了连接， 可能是 IP会话期期满， 或 IP 会话状态检测失败。
以下结合图 3和图 4中的 IP会话周期来详细描述 DHCP的整个认证的过程。 由于网络 IP地址选择应用不同， IPv4版本和 IPv6版本其所对应的 DHCP协议 版本分别为 DHCPv4版本和 DHCPv6版本。 表 2示出了 DHCPv4消
Figure imgf000012_0001
I)I ICPx4 ;':' EAP消息
地址和其它 DHCP配置信息， 比如子网掩码 和缺省网关；
3. 携带相应的 EAP消息。
发送方向： DHCP认证者 DHCP Client
DHCP Request EAP Request 1. 包含 DHCP认证者所提供的 IP地址， (EAP-Message /Response 表明已经接受了提供的 IP 地址及相应的 Option) DHCP认证者；
2. 携带相应的 EAP消息。
发送方向：
DHCP Client DHCP认证者
DHCP Inform EAP Request 1. 携带相应的 EAP 消息， 用于 DHCP
(EAP-Message /Response Client已静态配置了 IP地址。
Option) 2. 发送方向：
DHCP Client DHCP认证者
DHCPAck EAP Request 1.可配置网络参数， 如用户 IP 地址
(EAP-Message /Response/ ( yiaddr );
Option) Success 2.携带相应的 EAP消息。
发送方向： DHCP认证者 DHCP Client
DHCP Nack EAP Failure 携带相应的 EAP消息。
(EAP-Message 发送方向： DHCP认证者 DHCP Client
Option)
DHCP Release 表明用户下线， 需要释放相应的会话及 IP 地址
发送方向： DHCP Client DHCP认证者 表 2 息与 DHCP选项 （Option ) 的功能组合表， 下面结合图 5来详细说明其 DHCP 首次认证成功的第一流程图， 其包括以下步骤： 步骤 S501： 当 DHCP客户端接入网络时， 向 DHCP客户端接入的网络发送 一个 DHCP发现（DHCP Discover )消息来表明选择提供认证授权服务的 DHCP 认证者和 DHCP服务器， 并通过协议中的选项表明 DHCP客户端支持的认证模 式；
如果 AC和 DHCP认证者不在同一个物理层， 则需要通过 AC将接收到的 DHCP Discover消息转发给相应的 DHCP认证者。
步骤 S502: DHCP 认证者收到 DHCP Discover 消息后， 将此消息转发到 DHCP服务器；
步骤 S503: DHCP服务器检查 DHCP Discover的参数， 并回应一个地址分 配服务确认 ( DHCP Offer )消息， 为 DHCP客户端提供一个未租借的 IP地址和 其他相关的 DHCP配置信息， 比如相关的子网掩码和缺省网关；
步骤 S504: DHCP认证者收到 DHCP Offer消息后，在选项中添加表明 DHCP 认证者支持的认证模式， 记录 DHCP服务器为 DHCP客户端提供的未租借的 IP 地址， 并将该未租借的 IP地址替换为一个供 DHCP客户端在本地网使用的局部 IP地址， 然后向 DHCP客户端转发经地址替换处理的 DHCP Offer消息；
步骤 S505: DHCP客户端在收到 DHCP Offer消息后， 则具有了一个临时的 局部 IP地址， DHCP客户端向 DHCP认证者发送地址分配请求 ( DHCP Request ) 消息来响应 DHCP客户端已经收到 DHCP Offer消息， DHCP Request消息表明 了 DHCP客户端选择了 DHCP认证者并接受了 DHCP认证者所提供的局部 IP 地址， 其中 DHCP客户端选择的 DHCP认证者能够支持相应认证模式；
步骤 S506: DHCP认证者收到 DHCP Request消息后， 向 DHCP客户端发 送含有身份查询请求的 EAP-Request/Identity消息，该 EAP-Request/Identity消息 承载在地址分配回应（ DHCP Ack )消息中， 并下发一个仅供 DHCP客户端使用 的 "假租期"， 该 "假租期" 用于使 DHCP客户端能迅速响应 EAP消息， 并且 预留足够的时间以供 DHCP认证者回复 EAP认证消息给 DHCP客户端；
需要说明的是，在认证过程中 DHCP认证者在每收到地址分配请求消息后， 会通过 DHCP Ack消息携带的 EAP消息定下一个仅供 DHCP客户端认证使用的 "假租期"。 在 DHCP客户端每收到 DHCP Ack消息后， 会根据 "假租期" 重新 设置定时器 T1和定时器 T2, 当定时器 T1或定时器 T2设定的时间到期时， 会 重新触发 DHCP地址分配请求消息更新 "假租期"以携带 EAP消息传递的时间。
步骤 S507: DHCP客户端接收到含有 EAP-Request/Identity消息的 DHCP Ack 消息之后， DHCP客户端根据 "假租期"设定的定时器 T1和定时器 T2, 在定时 器 T1 到时间时将 DHCP客户端已经收到的 EAP-Request/Identity 消息返回给 DHCP认证者， 如果在定时器 T1设定的时间内完不成， 则需要在定时器 T2时 间内完成返回过程， 即将 DHCP客户端已收到 EAP-Request/Identity消息返回给 DHCP认证者， 所述 EAP-Request/Identity消息承载在 DHCP Request消息中； 步骤 S508: DHCP认证者向 AS发送身份查询响应 （EAP Response ) 消息， 该 EAP Response消息通过 AAA协议携带；
步骤 S509: DHCP客户端和 DHCP认证者通过消息中携带的 EAP消息进行 交互； DHCP客户端和 DHCP认证者中的 EAP消息承载在 DHCP Request/Ack 消息中；
步骤 S510: DHCP认证者和 AS釆用 AAA消息携带 EAP消息以进行交互； 步骤 S509和步骤 S510可以是同步进行 EAP的认证方法 ( EAP Method )协 商以及认证方法交互的过程， 对所述 DHCP客户端的身份进行检查和验证， 直 到 EAP认证过程结束。
步骤 S511： AS通知 DHCP认证者认证成功的结果；
步骤 S518、 步骤 S510和步骤 S511需要说明的是， DHCP认证者和 AS如 果在同一个网络节点上， 则可以通过 API进行数据交互和传递； 如 DHCP认证 代理服务和 AS不在同一个网络节点中， 则需要依靠其它协议承载 AAA协议消 息进行认证数据交互， 所述其它协议如远程用户拨号认证系统 RADIUS协议或 RADIUS协议的升级版本的 Diameter协议。
步骤 S512: DHCP认证者根据已记录的、 由 DHCP服务器为 DHCP客户端 提供的未租借的 IP地址构造 DHCP Request消息， 并发送给 DHCP服务器； 步骤 S513: DHCP服务器根据 DHCP认证者构造的 DHCP Request消息中 的参数为 DHCP客户端分配一个全局 IP地址和真正的租期，并可以向 DHCP认 证者返回 DHCPAck消息，该 DHCP Ack消息携带认证成功的 EAP消息， 其中， yiaddr为分配给用户的 IP地址；
步骤 S514: DHCP认证者收到携带认证成功的 EAP 消息后， 重新封装成 DHCP Ack消息并发送给 DHCP客户端， DHCP Ack消息中包括为 DHCP客户端 分配的全局 IP地址和真正的租期。
以上图 5描述了在 DHCPv4版本中首次认证成功的认证流程图， 在 DHCP 认证的过程中， 也会遇到首次认证的失败， 下面结合图 6和表 2以及图 5来描 述在 DHCPv4中首次认证失败的过程， 由于在首次认证过程中， 图 7中的步骤 S701至步骤 S710过程与图 5中的步骤 S501至步骤 S510相同， 这里不再过多 赘述， 以下详细描述在 AS认证失败后的步骤：
步骤 S611： AS在认证失败后， AS将 DHCP认证失败（ EAP failure ) 消息 通过 AAA消息携带发送给 DHCP认证者；
步骤 S612: DHCP认证者收到 EAP failure消息后通过 DHCP Nack消息携 带转发给 DHCP客户端。
以上是对 DHCPv4进行了详细的说明， 下面以 DHCPv6进行说明， 请参阅 表 3中的 DHCPv6消息与 DHCP Option的功能组合， 下面根据表 3中的表格结
Figure imgf000016_0001
DI IC IV6消息 Λ 消息 功能描述
(auth-proto Option, Request/Identity 明 DHCP认证者支持的认证模式；
EAP-Message auth-proto Option为可选；
Option) 2. 为 DHCP Client提供一个未租借的 IP 地址和其它 DHCP配置信息 , 比如子网 掩码和缺省网关；
3. 携带相应的 EAP消息。
发送方向： DHCP认证者 DHCP Client
DHCP Request EAP Request 1. DHCP认证者所提供的 IP地址， 表明 (EAP-Message /Response 已经接受了提供的 IP 地址及相应的 Option) DHCP认证者；
2.携带相应的 EAP消息。
发送方向： DHCP Client DHCP认证者
DHCP Reply EAP Request 1.可配置网络参数， 如用户 IP地址；
(EAP-Message /Response/ 2.携带相应的 EAP消息。
Option) Success/Failure 发送方向： DHCP认证者 DHCP Client
DHCP Release 表明用户下线，需要释放相应的会话及 IP 地址
发送方向： DHCP Client DHCP认证者 表 3
合图 7中的流程图对 DHCPv6认证过程进行说明：
步骤 S701 : 当 DHCP客户端接入网络时， DHCP客户端向接入的网络发送 一个发现（ DHCP Solicit )消息， 该消息表明 DHCP客户端选择提供认证授权服 务的 DHCP认证者和 DHCP服务器， 并通过协议中的选项表明 DHCP客户端支 持的认证模式；
如果 AC和 DHCP认证者不在同一个物理层， 则需要通过 AC将接收到的 DHCP Solicit消息转发给相应的 DHCP认证者。 步骤 S702: DHCP认证者收到 DHCP Solicit消息后，将此消息转发到 DHCP 服务器；
步骤 S703: DHCP服务器检查 DHCP Solicit的参数， 并回应一个地址分配 服务确认（ DHCP Advertise ) 消息， 为 DHCP客户端提供一个未租借的 IP地址 和其他相关的 DHCP配置信息， 如相关的子网掩码和缺省网关；
步骤 S704: DHCP认证者收到 DHCP Advertise消息后， 在选项中添加表明 DHCP认证者支持的认证模式， 记录 DHCP服务器为 DHCP客户端提供的未租 借的 IP地址， 并将该未租借的 IP地址替换为一个供 DHCP客户端在本地网使 用的局部 IP地址， 然后向 DHCP客户端转发经地址替换处理的 DHCP Advertise 消息；
步骤 S705: DHCP客户端在收到 DHCP Advertise消息后，从 DHCP Advertise 消息中获得一个临时的局部 IP地址。 DHCP客户端向 DHCP认证者发送地址分 配请求 （DHCP Request ) 消息以响应其已收到 DHCP Advertise 消息， DHCP Request消息表明 DHCP客户端选择了 DHCP认证者并接受了 DHCP认证者提 供的局部 IP地址， 其中， DHCP客户端选择的 DHCP认证者能够支持相应认证 模式；
步骤 S706: DHCP认证者收到 DHCP Request消息后， 向 DHCP客户端发 送表示身份查询的 EAP-Request/Identity消息，该 EAP-Request/Identity消息通过 地址分配回应 （DHCP Reply ) 消息携带， 并下发一个仅供 DHCP客户端使用的 "假租期"， 该 "假租期" 使 DHCP客户端能迅速响应 EAP消息， 并且预留足 够的时间以使 DHCP认证者给 DHCP客户端回复 EAP认证消息；
步骤 S707: DHCP客户端接收到含有 EAP-Request/Identity 消息的 DHCP Reply消息之后， DHCP客户端向 DHCP认证者返回 EAP-Response/Identity消息 表明已收到 EAP-Request/Identity消息， 所述 EAP-Response/Identity消息是承载 在 DHCP Request消息中；
步骤 S708: DHCP认证者向 AS发送身份查询响应 （ EAP response ) 消息， 该 EAP response消息通过 AAA协议携带；
步骤 S709: DHCP客户端和 DHCP认证者交互 EAP消息； DHCP客户端和 DHCP认证者中的 EAP消息是通过 DHCP Request/Reply消息进行携带的；
步骤 S710: DHCP认证者与 AS交互 EAP消息， 该 EAP消息采用 AAA消 息携带；
步骤 S709和步骤 S710是同步进行 EAP的认证方法（ EAP Method )协商以 及认证方法交互过程， 对所述 DHCP客户端的身份进行检查和验证， 直到 EAP 认证过程结束。
步骤 S711： AS通知 DHCP认证者认证成功的结果；
步骤 S712: DHCP认证者根据已记录的、 由 DHCP服务器为 DHCP客户端 提供的未租借的 IP地址构造 DHCP Request消息并发送给 DHCP服务器；
步骤 S713: DHCP服务器根据 DHCP认证者构造的 DHCP Request消息中 的参数为 DHCP客户端分配一个全局 IP地址和真正的租期，并可以向 DHCP认 证者返回 DHCP Reply消息， DHCP Reply消息中携带认证成功的 EAP消息； 步骤 S714: DHCP认证者收到携带认证成功的 EAP 消息后， 重新封装成 DHCP Reply消息并发送给 DHCP客户端， DHCP Reply消息中包括为 DHCP客 户端分配的全局 IP地址和真正的租期。
以上图 7描述了在 DHCPv6版本中首次认证成功的认证流程图， 在 DHCP 认证的过程中， 也会遇到首次认证的失败， 下面结合图 8和表 3以及图 7来描 述在 DHCPv6中首次认证失败的过程， 由于在首次认证过程中， 图 8中的步骤 S801至步骤 S810过程与图 7中的流程相同， 这里不再过多赘述， 以下详细描述 在 AS认证失败后的步骤：
步骤 S8011： AS在认证失败后， AS DHCP认证失败（ EAP failure ) 消息通 过 AAA消息携带发送给 DHCP认证者；
步骤 S8012: DHCP认证者收到 EAP failure消息后通过 DHCP Reply消息携 带转发给 DHCP客户端。
在实施本发明实施例的过程中， 首次认证的过程中根据实际的需要可以筒 化流程， 其结合图 5和表 2来说明首次 DHCP认证筒化发现阶段流程， 其流程 图如图 9所示， 其步骤 S901至 S903与图 5中的步骤 S501至 S503相同， 当在 进行至步骤 S904时， DHCP认证者收到 DHCP Offer消息后，直接在 DHCP Offer 消息中携带表示身份查询请求的 EAP-Request/Identity消息， 另外， DHCP认证 者记录 DHCP服务器为 DHCP客户端提供的未租借的 IP地址，并将 DHCP Offer 消息中未租借的 IP地址替换为一个供 DHCP客户端在本地网使用的局部 IP地 址， 然后向 DHCP客户端转发 DHCP Offer消息， 进入步骤 S905至步骤 S912 的认证过程， 其步骤 S905至步骤 S912与图 5中所述的步骤 S507至步骤 S514 相同。
以此类推， 可以在图 6 步骤中的 S604 步骤中添加表示身份查询请求的 EAP-Request/Identity消息， EAP- equest/Identity消息通过 DHCP Offer消息携带 并发送给 DHCP客户端，直接进入步骤 S608进行认证过程；在图 7的步骤 S704 或图 8 中的步骤 S804 中在 DHCP Advertise 消息添加表示身份查询请求的 EAP-Request/Identity消息并发送给 DHCP客户端，直接进入步骤 708或步骤 S808 进行认证过程， 这里不再过多赘述。
在 DHCP客户端 DHCP认证成功之后， 在相应的 IP会话租期到期时， 需要 执行重认证以重新为 DHCP客户端分配 IP地址， 从而延长 IP会话时间， 在重 认证的过程中省去了发现阶段， 直接执行握手阶段处理过程， 下面以 DHCPv4 版本表 2结合流程图 10来对重认证的过程进行描述， 在步骤 S1001 中， DHCP 客户端在遭受认证失败后或者租期到期时， 在设定的时间内直接发送 DHCP Request消息， DHCP Request消息中包含 DHCP认证者支持的认证模式及 DHCP 认证者提供的 IP地址，表明 DHCP客户端已经选择 DHCP认证者并接受了 DHCP 认证者提供的局部 IP地址，其中 DHCP客户端选择的 DHCP认证者能够支持相 应认证模式。 在步骤 S1002中认证者收到 DHCP Request消息后， 执行步骤与图 5流程图中的步骤 S508相同， 直到整个成功认证过程的结束， 步骤 S1002至步 骤 S1010与图 5流程图中的步骤 S506至步骤 S514相同。 以此类推， 在重认证 的过程中也会遇到重认证失败时， 这里我们不再赘述重认证失败的流程图， 在 重认证失败后， 也可以根据 DHCP客户端的配置参数再次进行重认证的过程直 到重认证成功， 其实现方法如图 10中的步骤， 这里不再赘述。
以此类推， DHCPv6版本中表 3的 DHCP消息在参与 DHCP认证成功之后 的重认证过程也与 DHCPv4版本中的重认证过程类似， 在认证过程中其执行的 DHCP消息不同， 这里不再过多赘述。
以上方法是通过在现有技术中不增加 DHCPv4和 DHCPv6中的消息， 通 过现有技术中增加的两个新的 DHCP选项 （Option ), 实现了不同组合中的不同 功能， 本发明实施例中还可以通过现有增加的 DHCP 消息和新增加的 DHCP Option来完成相应的 DHCP认证的功能， 如表 4所示的 DHCPv4消息与 DHCP Option 丽 1、)11( Pv4 >ή .¾· Ι' ΛΙ' >'ή恩 Π&揭迷
DHCP Discover 1.通过广播请求 DHCP认证者和 DHCP (auth-proto Option) 服务器的 IP地址信息， 该消息源 IP地 址是 0.0.0.0;
2. 表明 DHCP Client支持的认证模式。 发送方向： DHCP Client DHCP Authenticator
DHCP Offer 1. 每个 DHCP认证者进行认证应答， (auth-proto Option) 表明 DHCP认证者支持的认证模式；
2.为 DHCP Client提供一个未租借的 IP 地址和其它 DHCP配置信息， 比如子网 掩码和缺省网关。
发送方向： DHCP Authenticator
DHCP Client
DHCP Request 1. 包含 DHCP认证者支持的认证模式 (auth-proto Option) 及其所提供的 IP地址，表明已经接受了 提供的 IP 地址及相应的 DHCP认证者； 发送方向： DHCP Client DHCP Authenticator
DHCP Offer EAP 1. 每个 DHCP认证者进行认证应答， (auth-proto Option, Request/Identity 表明 DHCP认证者支持的认证模式； EAP-Message auth-proto Option为可选；
Option) 2.为 DHCP Client提供一个未租借的 IP 地址和其它 DHCP配置信息， 比如子网 掩码和缺省网关；
3. 携带相应的 EAP消息。
发送方向： DHCP Authenticator
DHCP Client
DHCP EAP Request 携带相应的 EAP消息。
Auth-response /Response 发送方向：
(EAP-Message DHCP Client -> DHCP Authenticator Option) DHCP EAP
( EAP-Message
Option )
DHCP Auth-request EAP Request 携带相应的 EAP消息。 丽 1、)11( Pv4 ,*ϊϊ» ' ΛΙ' ,*· ί έ| Ak>
>ή .¾· Ι >ή恩 Π&揭迷
(EAP-Message esponse 发送方向： DHCP Authenticator Option) /DHCP EAP DHCP Client
( EAP-Message
Option )
DHCP Ack EAP Success 1.可配置网络参数， 如用户 IP地址；
(EAP-Message 2.携带相应的 EAP消息。
Option) 发送方向： DHCP Authenticator
DHCP Client
DHCP Nack EAP Failure 携带相应的 EAP消息。
(EAP-Message 发送方向： DHCP Authenticator
Option) DHCP Client
DHCP Release 表明用户下线， 需要释放相应的会话及
IP地址
发送方向： DHCP Client DHCP Authenticator
表 4
功能表和图 5所示的 DHCPv6消息与 DHCP Option功能表。
Figure imgf000022_0001
1)1 κ Wb <¾· 功能揭迷
提供的 IP 地址及相应的 DHCP认证者； 发送方向： DHCP Client DHCP
Authenticator
DHCP Advertise EAP 1. 每个 DHCP认证者进行认证应答， (auth-proto Option, Request/Identity 表明 DHCP认证者支持的认证模式； EAP-Message auth-proto Option为可选；
Option) 2.为 DHCP Client提供一个未租借的 IP 地址和其它 DHCP配置信息， 比如子网 掩码和缺省网关；
3. 携带相应的 EAP消息。
发送方向： DHCP Authenticator
DHCP Client
DHCP EAP Request 携带相应的 EAP消息。
Auth-response /Response 发送方向：
(EAP-Message DHCP Client -> DHCP Authenticator Option) /DHCP EAP
( EAP-Message
Option )
DHCP Auth-request EAP Request 携带相应的 EAP消息。
(EAP-Message /Response 发送方向： DHCP Authenticator
Option) /DHCP EAP DHCP Client
( EAP-Message
Option )
DHCP Reply EAP 1.可配置网络参数， 如用户 IP地址；
(EAP-Message Success/Failure 2.携带相应的 EAP消息。
Option) 发送方向： DHCP Authenticator
DHCP Client
DHCP Release 表明用户下线， 需要释放相应的会话及
IP地址
发送方向： DHCP Client DHCP
Authenticator
表 5
下面根据现有技术中 DHCPv4版本表 4中增加的 DHCP消息和增加的新的 DHCP Option来进行描述认证的流程图 11， 其步骤 S1101至步骤 S 1105与图 5 所述的步骤 S501至步骤 S505相同， 这里不再赘述， 在进入步骤 S1105之后的 步骤中， 其实现方法如下：
步骤 S1106: DHCP认证者收到 DHCP Request消息后， 向 DHCP客户端发 送表示身份查询请求的 EAP-Request/Identity消息，该 EAP-Request/Identity消息 通过地址分配回应 （DHCPAuth-request ) 消息或 DHCP EAP消息携带；
步骤 S1107: DHCP客户端接收到含有 EAP-Request/Identity消息的 DHCP Auth-request消息或 DHCP EAP消息之后， DHCP客户端向 DHCP认证者返回 EAP-Response/Identity 消息， EAP-Response/Identity 消息是通过 DHCP Auth-response消息或 DHCP EAP消息携带的；
步骤 S1108： DHCP 认证者接收收到表明 身份查询请求的 EAP-Response/Identity消息，可以将 EAP-Response重新封装在 AAA消息中发送 给 AS;
步骤 S1109: DHCP客户端和 DHCP认证者通过消息中携带的 EAP消息进 行交互； DHCP 客户端和 DHCP 认证者之间交互的 EAP 消息是通过 DHCP Auth-request/response消息携带的， 或者通过 DHCP EAP消息进行携带；
步骤 SI 110： DHCP认证者和 AS交互的 EAP消息釆用 AAA消息携带； 步骤 S1109和步骤 S1110是同步进行 EAP的认证方法（ EAP Method )协商 以及认证方法交互过程，对所述 DHCP客户端的身份进行检查和验证，直到 EAP 认证过程结束。
步骤 S 1111： AS将认证成功的结果通知 DHCP认证者；
步骤 S1112: DHCP认证者利用已记录的、 由 DHCP服务器为 DHCP客户 端提供的未租借的 IP地址构造 DHCP Request消息并发送给 DHCP服务器； 步骤 SI 113： DHCP服务器根据 DHCP认证者构造的 DHCP Request消息中 的参数为 DHCP客户端分配一个全局 IP地址和真正的租期，并向 DHCP认证者 返回携带认证成功的 EAP消息，该认证成功的 EAP消息通过 DHCP Ack消息携 带， 其中， yiaddr为分配给用户的 IP地址；
步骤 S1114: DHCP认证者收到携带认证成功的 EAP消息后， 重新封装成 DHCP Ack消息并转发给 DHCP客户端， 其中，该 DHCP Ack消息携带为 DHCP 客户端分配的全局 IP地址和真正的租期。
这里通过 DHCP Auth-response消息和 DHCP Auth-request消息来携带相应的 EAP消息和 DHCP Option消息， 或者通过 DHCP EAP消息来携带相应的 EAP 消息和 DHCP Option消息， 以此类推， 其认证过程失败的流程图如图 12所述， 认证的简化流程图过程如图 13所述， 这里不再赘述其步骤。
用 DHCP Auth-response消息和 DHCP Auth-request消息来携带相应的 EAP 消息和 DHCP Option消息， 或者用 DHCP EAP消息来携带相应的 EAP消息和 DHCP Option消息， 在认证成功之后， 可以由 DHCP客户端触发重认证过程， 也可以由 DHCP认证者触发重认证过程。 由 DHCP客户端触发重认证过程如图 14所示， S1401客户端直接发送 DHCP Request消息， 其中包含 DHCP认证者支 持的认证模式及 DHCP认证者提供的 IP地址，表明 DHCP客户端已经选择 DHCP 认证者并接受 DHCP认证者提供的局部 IP地址， DHCP客户端选择的 DHCP认 证者能够支持相应认证模式。 在认证者收到 DHCP Request 消息后， 进入步骤 S1402, 执行身份认证。
由客户端触发认证如图 15所示， 在步骤 S1501中， DHCP认证成功之后， 认证者向网络中的 DHCP客户端发起认证请求， 从而完成重认证的过程。
以上是对 DHCPv4在增加了 DHCP消息和 Option后进行的说明， 以此类推 DHCPv6在表 5中增加的 DHCP消息和 Option消息也可采用不同的 DHCP消息 携带， 以完成上述的 DHCP认证， 这里不再赘述。
本发明实施例中还可以通过现有增加的 DHCP 消息和新增加的 DHCP Option, DHCPv4版本和 DHCP版本利用 DHCP消息和 DHCP Option的不同组 合来完成相应的 DHCP认证的功能，如表 6所示的 DHCPv4消息与 DHCP Option
Figure imgf000025_0001
Figure imgf000026_0001
功能表和图 6所示的 DHCPv6消息与 DHCP Option功能表。
Figure imgf000026_0002
Dl κ ι，νί) 恩 ΚΛΡ Ab, Jt
>ή恩
EAP(EAP-Message
Option)
DHCP Advertise EAP 1. 1. 为 DHCP Client提供一个未租借的 IP
(EAP-Message Success/ 地址和其它 DHCP配置信息， 比如子网掩
Option) EAP Failure 码和缺省网关；
2.承载相应的 EAP消息。
发送方向： DHCP Authenticator DHCP Client
DHCP Reply EAP Failure 1.可配置网络参数， 如用户 IP地址；
(EAP-Message 2.承载相应的 EAP消息。
Option) 发送方向： DHCP Authenticator -> DHCP
Client
DHCP Release 表明用户下线， 需要释放相应的会话及 IP 地址
发送方向： DHCP Client DHCP
Authenticator
下面根据现有技术中 DHCPv4版本表 6中增加的 DHCP消息和增加的新的 DHCP Option来进行描述认证的流程图 16, 其实现方法如下：
步骤 S1601： 当 DHCP客户端接入网络时， 向 DHCP客户端接入的网络发 送一个 DHCP发现（ DHCP Discover )消息来表明 DHCP客户端选择提供认证授 权服务的 DHCP认证者和 DHCP服务器， 并通过协议中的选项表明 DHCP客户 端支持的认证模式；
如果 AC和 DHCP认证者不在同一个物理实体中时， 则需要通过 AC将接 收到的 DHCP Discover消息转发给相应的 DHCP认证者。
步骤 S1602: DHCP认证者收到 DHCP Discover消息后， 将此消息转发到 DHCP服务器；
步骤 S1603： DHCP服务器检查 DHCP Discover消息中的参数， 并回应一个 地址分配服务确认（ DHCP Offer ) 消息， 为 DHCP客户端提供一个未租借的 IP 地址， 其中， DHCP服务器还可以为 DHCP客户端提供其他相关的 DHCP配置 信息， 比如相关的子网掩码和缺省网关；
步骤 S1604 : DHCP 认证者向 DHCP 客户端发出表示身份查询请求的 EAP-Request/Identity消息，该 EAP-Request/Identity消息通过 DHCP Auth-request 消息或 DHCP EAP消息 7|载；
步骤 S1605 : DHCP客户端接收到 DHCP Auth-request消息或 DHCP EAP消 息后， DHCP客户端向 DHCP认证者发送应答 ( EAP- esponse/Identity ) 消息， 所述 EAP-Response/Identity消息通过 DHCP Auth -response消息或 DHCP EAP消 息承载；
步骤 S1606 : DHCP 认证者将收到的表明身份查询请求的消息通过 EAP Response over AAA协议发送给 AS,；
步骤 S1607和步骤 S2308: 之后会进行 EAP的认证方法 (EAP Method)协商 以及认证方法交换的过程； 在这些过程中， DHCP客户端和 DHCP认证者之间 交互的 EAP消息均采用 DHCP Auth-request/response消息或 DHCP EAP消息 载； 在 DHCP认证者和 AS之间交互的 EAP消息均采用 AAA 消息承载； 直到 EAP认证过程结束；
步骤 S1609： AS将认证成功的结果通知 DHCP认证者；
步骤 S1610: DHCP认证者收到认证成功的消息后， 将 EAP Success消息 封装在 DHCP Offer消息 , 转发给 DHCP客户端；
步骤 S1611至步骤 S1614为现有技术中标准 DHCP地址申请过程， 这里不 再过多赘述。
下面根据现有技术中 DHCPv4版本表 6中增加的 DHCP消息和增加的新的 DHCP Option来进行描述认证的另一流程图 17 , 其实现方法如下：
步骤 S1701： 当 DHCP客户端接入网络时， DHCP客户端向接入的网络发送 一个 DHCP发现（ DHCP Discover )消息， 表明 DHCP客户端选择提供认证授权 服务的 DHCP认证者， 并通过协议中的选项表明其支持的认证模式；
步骤 S1702 : DHCP 认证者向 DHCP 客户端发送表示身份查询请求的 EAP-Request/Identity消息， 为 DHCP客户端提供一个未租借的 IP地址， 其中， DHCP服务器还可以为 DHCP客户端提供其他相关的 DHCP配置信息， 比如相 关的子网掩码和缺省网关， 该 EAP-Request/Identity消息通过 DHCP Auth-request 消息或 DHCP EAP消息 载；
步骤 S1703： DHCP客户端接收到 DHCP Auth-request消息或 DHCP EAP消 息后， 向 DHCP 认证者发送应答 ( EAP-Response/Identity ) 消息， 其中， EAP-Response/Identity 消息通过 DHCP Auth-response消息或 DHCP EAP消息携 带；
步骤 S1704: DHCP认证者将收到的 EAP-Response/Identity消息通过 AAA 协议携带发送给 AS;
步骤 S1705和步骤 S1706: 之后会进行 EAP的认证方法 (EAP Method)协商 以及认证方法交换的过程； 在这些过程中， DHCP客户端和 DHCP认证者之间 交互的 EAP消息均采用 DHCP Auth-request/response消息或 DHCP EAP消息 ? 载；在 DHCP认证者和 AS之间交互的 EAP消息采用 AAA 消息承载；直到 EAP 认证过程结束；
步骤 S1707： AS将认证成功的结果通知 DHCP认证者；
步骤 S1708: DHCP认证者将收到的 DHCP Discover消息转发给 DHCP服务 哭.
步骤 S1709: DHCP服务器检查 DHCP Discover中的参数， 并回应一个表示 地址分配服务确认的 DHCP Offer消息， 为 DHCP客户端提供一个未租借的 IP 地址， 其中， DHCP服务器还可为 DHCP客户端提供其他相关的 DHCP配置信 息， 比如相关的子网掩码和缺省网关；
步骤 S1710: DHCP认证者收到 DHCP Offer消息之后， DHCP认证者将 EAP Success消息封装在 DHCP Offer消息中， 转发给 DHCP客户端；
步骤 S1711至步骤 S1714为现有技术中标准 DHCP地址申请过程， 这里不 再过多赘述。
下面根据现有技术中 DHCPv4版本表 6中增加的 DHCP消息和增加的新的 DHCP Option来进行描述 DHCP首次认证失败的流程图 18, 由于在首次认证的 过程中， 图 18中的步骤 S1801至步骤 S1808与图 16中其中步骤 1601至步骤 S1608相同， 这里不再过多赘述， 以下详细描述在 AS认证失败后的步骤：
步骤 S1809: DHCP认证者收到 AS发送的 EAP failure消息；
步骤 S1810: DHCP认证者将收到的 EAP failure消息重新封装在 DHCP Nack 消息或 DHCP Offer消息中， 转发给 DHCP客户端。
下面根据现有技术中 DHCPv4版本表 6中增加的 DHCP消息和增加的新的 DHCP Option来进行描述 DHCP首次认证失败的另一流程图 19， 由于在首次认 证的过程中， 图 19中的步骤 S1901至步骤 S1906与图 17中其中步骤 1701至步 骤 S1706相同， 这里不再过多赘述， 以下详细描述在 AS认证失败后的步骤： 步骤 S1907: DHCP认证者收到 AS发送的 EAP failure消息；
步骤 S1908: DHCP认证者将收到的 EAP failure消息重新封装在 DHCP Nack 消息或 DHCP Offer消息中， 转发给 DHCP客户端。
以上是对 DHCPv4在增加了 DHCP消息和 DHCP Option消息进行不同组合 后进行的说明， 以此类推 DHCPv6在表 7中增加的 DHCP消息和 DHCP Option 消息进行不同组合后， 也能通过不同的 DHCP消息携带完成上述的 DHCP认证 的过程， 这里不再赘述。
通过上述不同版本的首次 DHCP认证成功及简化版本的 DHCP首次认证成 功和 DHCP重认证的成功， DHCP客户端能够接入网络中进行数据的访问， 这 里需要通过 AC来检测 DHCP客户端的数据流， 实现数据会话过程中的保密性， 在此过程中 DHCP客户端和 DHCP认证者都可以发送 IP会话测试数据，用于检 测各自对方端口的 IP会话的存活状态，以下图 20详细描述了基于加密接入过滤 的 DHCP认证流程图， 其具体步骤如下：
在认证成功之后 DHCP认证者向 DHCP客户端返回认证成功的消息，同时， DHCP认证者与 AC之间开始执行步骤 S2001 ;
步骤 S2001： DHCP认证者向 AC下发关于 DHCP客户端的接入控制策略和 授权密钥；
步骤 S2002: AC收到关于 DHCP客户端的接入控制策略和授权密钥， 与 DHCP客户端之间建立安全联盟，建立安全联盟过程可以采用 IKE协议或 802. lli 的 4WHS协议， 或采用 802.16的 3WHS协议；
步骤 S2003 : 在完成 DHCP客户端与 AC的安全联盟建立后， 可以采用链路 层或网络层中的加密协议对数据流进行安全保护；
步骤 S2004: AC对数据流进行加密接入过滤，滤出数据流中不安全的报文； 步骤 S2005: 当 DHCP客户端整个 IP会话结束时， DHCP客户端会向 AS 发起 DHCP释放消息来中止 IP会话；
当 DHCP客户端因为事故中断 IP会话时， AC检测到 DHCP客户端的 IP 会话的数据流中断后， 则会立即向 DHCP认证者发送 DHCP 释放消息来告知 DHCP认证者 DHCP客户端已中止 IP会话。
步骤 S2006: DHCP认证者收到 DHCP释放消息后， 会将释放消息转发给 DHCP服务器， DHCP服务器会释放 DHCP客户端的 IP地址；
步骤 S2007： DHCP认证者收到 DHCP释放消息后， DHCP认证者通知 AC 解除 DHCP客户端的接入控制策略和授权密钥。
以上是描述了 DHCP认证成功后对数据流进行加密接入过滤， 在本发明实 施例中， 也可以通过在认证成功之后通过 AC监听认证成功中的 success消息来 对数据流进行非接入加密的过程， 其具体流程图如图 21所示， 包括以下步骤： 步骤 S2101： AC对 DHCP消息进行监听， 当其返回有认证成功的消息后， 则对 DHCP客户端的 IP地址和物理地址（如 MAC地址）进行绑定；
步骤 S2102: DHCP客户端通过所分配的 IP地址发起数据流信息； 步骤 S2103： AC对 DHCP客户端发送的数据流信息进行非接入加密， 滤出 DHCP客户端 IP地址与用户 MAC地址不符合的数据 4艮文；
步骤 S2104: 当 DHCP客户端整个 IP会话结束时， DHCP客户端会向 AS 发起 DHCP释放消息来终止 IP会话；
当 DHCP客户端处因为事故中断 IP会话时， AC检测到 DHCP客户端的 IP会话的数据流中断后， 则会立即向 DHCP认证者发送 DHCP释放消息来告知 DHCP认证者 DHCP客户端已中止 IP会话。
步骤 S2105 : 当 AC在监听到 DHCP客户端释放 IP消息或检测到 IP会话链 路的中断时， 则会解除 DHCP客户端 IP地址和 MAC地址的绑定；
步骤 S2106: DHCP认证者向 DHCP服务器转发 DHCP释放消息， DHCP 客户端根据收到的消息释放 DHCP客户端的 IP地址。
综上所述， 通过在 IP 网絡中设置多个认证者， 由所述认证者代理相应的 DHCP客户端执行认证， 不需要对 DHCP服务器进行改造就能够配置相应的认 证者对所述 DHCP客户端进行相应的认证， 通过在认证过程中配置临时的 IP地 址， 解决了认证过程中不能进行认证会话的过程， 从而实现了认证过程的稳定 性， 并也提高了认证效率和成功率。 本发明实施例通过接入控制器的引入实现 了控制面和数据面的分离， 通过接入控制器很好的实现数据面的接入过滤， 保 证了数据面的安全性。 通过重认证机制， 能够在 DHCP客户端认证的租期时间 将完结时， 重新发起认证过程， 为 DHCP客户端重新分配一个 IP地址进行 IP 通话， 重认证的过程可以通过 DHCP客户端触发机制和 DHCP认证者触发机制 的两种重认证方式。 本发明实施例中提供的认证方法通过不同的 DHCP消息能 够应用于 IPv4中， 也能实现在 IPv6中。
以上所揭露的仅为本发明实施例中的一种较佳实施例而已， 当然不能以此 来限定本发明之权利范围， 因此依本发明权利要求所作的等同变化， 仍属本发 明所涵盖的范围。

Claims

权 利 要 求
1、 一种网 入方法， 其特征在于， 包括：
接入认证者接收客户端的发现消息， 响应所述发现消息， 获得所述客户端 认证过程使用的第一配置信息， 其中， 所述发现消息用于发现接入认证者； 接入认证者所述客户端进行本地认证或作为所述客户端的代理与认证服务 器交互以实现对所述客户端的远程认证；
认证成功后， 所述接入认证者向配置服务器发送配置请求消息， 请求为所 述客户端提供会话过程使用的第二配置信息。
2、 根据权利要求 1所述的网络接入方法， 其特征在于， 所述第一配置信息 包括： 所述客户端在本地网络使用的局部 IP地址和 /或从所述配置服务器获得的 未租借的 IP地址。
3、 根据权利要求 2所述的网络接入方法， 其特征在于， 所述响应所述动态 主机配置协议发现消息包括：
所述接入认证者向所述配置服务器转发所述发现消息；
所述接入认证者接收所述配置服务器的响应消息， 所述响应消息中携带所 述未租借 IP地址；
所述接入认证者将所述响应消息中未租借 IP地址替换为所述客户端在本地 网络使用的局部 IP地址后 , 发送给所述客户端。
4、 根据权利要求 1所述的网絡接入方法， 其特征在于， 所述方法还包括： 在所述会话过程中， 对所述客户端发送和 /或接收的数据包或数据流进行监 控， 利用控制策略对所述数据包或数据流信息进行非加密接入过滤或加密接入 过滤。
5、 根据权利要求 1 所述的网络接入方法， 其特征在于， 所述发现消息中 包括客户端支持的认证模式； 则所述响应所述发现消息包括： 所述接入认证者向所述客户端发送所述接入 认证者支持的认证模式。
6、 根据权利要求 1所述的网络接入方法， 其特征在于， 所述 所述接入认证者和所述认证服务器在同一物理实体， 则所述接入认证者和 所述认证服务器通过 API协议交互信息；
所述接入认证者和所述认证服务器不在同一物理实体， 则所述接入认证者 和所述认证服务器通过认证、 授权和计费 AAA 协议或远程用户拨号认证系统 RADIUS协议或 RADIUS协议的升级版本的 Diameter协议交互信息。
7、 一种网 ^入系统， 其特征在于， 包括接入认证者和配置服务器： 所述接入认证者， 用于接收客户端的发现消息， 响应所述发现消息， 为所 述客户端提供认证过程使用的第一配置信息； 对所述客户端进行本地认证或作 为所述客户端的代理与认证服务器进行远程认证； 如果所述客户端认证成功， 向配置服务器发送配置请求， 请求为所述客户端提供会话过程使用的第二配置 信息；
所述配置服务器， 用于为客户端提供配置信息， 所述配置信息至少包括所 述第二配置信息。
8、 根据权利要求 7所述的网^^入系统， 所述第一配置信息包括： 所 i¾ 户端在本地网络使用的局部 IP地址和 /或从所述配置服务器获得的未租借的 IP 地址。
9、 根据权利要求 8所述的网^ 入系统， 其特征在于， 所述网络接入系统 还包括：
接入控制器， 用于对客户端接收和 /或发送的数据包或数据流进行监控， 利 用所述接入认证者提供的控制策略对所述数据包或数据流信息进行非加密或加 密接入过滤， 其中， 所述接入控制器和所述接入认证者通过 API接口、 或 L2C 协议接口或 ANMP协议接口交互信息。
10、 根据权利要求 7所述的网络接入系统， 其特征在于，
所述发现消息中包括客户端支持的认证模式； 所述接入认证者进一步向所述客户端发送所述接入认证者支持的认证模式。
11、 一种接入认证装置， 其特征在于， 包括：
第一处理模块， 用于接收客户端发送的发现消息， 获得所述客户端认证过 程使用的第一配置信息， 并将相应信息发送给所述客户端；
认证模块， 用于对所述客户端进行本地认证或者代理所述客户端与认证服 务器进行远程认证；
第二处理模块， 如果所述客户端认证成功， 向配置服务器发起配置请求， 请求为所述客户端提供会话过程使用的第二配置信息。
12、 根据权利要求 11所述的装置， 其特征在于， 所述发现消息中包括所述 客户端支持的认证模式， 发送给所述客户端的相应信息中包括所述接入认证装 置支持的认证模式。
13、 根据权利要求 11所述的装置， 其特征在于， 所述装置还包括： 重认证模块， 用于在所述会话过程中， 对所述客户端进行重认证过程以重 新分配 IP地址。
14、 一种宽带接入设备， 其特征在于， 所述宽带接入设备包括权利要求 11 到 13任意一条所述的接入认证装置。
15、 根据权利要求 14所述的宽带接入设备， 所述宽带接入设备还包括与接 入控制器通信的接口， 所述与接入控制器通信的接口包括： API接口、 或 L2C 协议接口、 或 S MP协议接口， 其中：
所述接入认证装置通过所述与接入控制器通信的接口将控制策略发送控制策 略， 所述控制策略为： 对所述客户端接收和 /或发送的数据包或数据流信息进行 非加密或加密接入过滤的依据。
PCT/CN2008/071506 2007-07-02 2008-07-01 A method, system and equipment for network access WO2009003409A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP08757898.5A EP2136508B1 (en) 2007-07-02 2008-07-01 A method and system for network access
US12/649,873 US20100107223A1 (en) 2007-07-02 2009-12-30 Network Access Method, System, and Apparatus

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN200710028951.X 2007-07-02
CN200710028951 2007-07-02
CNA200710138938XA CN101340287A (zh) 2007-07-02 2007-07-18 一种网络接入认证方法及系统和装置
CN200710138938.X 2007-07-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/649,873 Continuation US20100107223A1 (en) 2007-07-02 2009-12-30 Network Access Method, System, and Apparatus

Publications (1)

Publication Number Publication Date
WO2009003409A1 true WO2009003409A1 (en) 2009-01-08

Family

ID=40214250

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/071506 WO2009003409A1 (en) 2007-07-02 2008-07-01 A method, system and equipment for network access

Country Status (4)

Country Link
US (1) US20100107223A1 (zh)
EP (1) EP2136508B1 (zh)
CN (2) CN101340287A (zh)
WO (1) WO2009003409A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105357485A (zh) * 2015-11-20 2016-02-24 武汉微创光电股份有限公司 一种网络视频监控中网络设备接入认证方法

Families Citing this family (35)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8539053B2 (en) * 2009-02-27 2013-09-17 Futurewei Technologies, Inc. Apparatus and method for dynamic host configuration protocol version 6 extensions for configuring hosts with multiple interfaces
CN102026160A (zh) * 2009-09-21 2011-04-20 中兴通讯股份有限公司 一种移动回程网安全接入的方法和系统
CN102195930B (zh) 2010-03-02 2014-12-10 华为技术有限公司 设备间安全接入方法和通信设备
US8918856B2 (en) * 2010-06-24 2014-12-23 Microsoft Corporation Trusted intermediary for network layer claims-enabled access control
CN101909058B (zh) * 2010-07-30 2013-01-16 天维讯达无线电设备检测（北京）有限责任公司 一种适合可信连接架构的平台鉴别策略管理方法及系统
CN101902507B (zh) * 2010-08-02 2013-01-23 华为技术有限公司 一种地址分配方法、装置和系统
CN101977187B (zh) * 2010-10-20 2015-10-28 中兴通讯股份有限公司 防火墙策略分发方法、客户端、接入服务器及系统
KR20120072032A (ko) * 2010-12-23 2012-07-03 한국전자통신연구원 모바일 단말의 상호인증 시스템 및 상호인증 방법
IL212344A (en) * 2011-04-14 2015-03-31 Verint Systems Ltd A system and method for selectively controlling encrypted traffic
CN103067333B (zh) * 2011-10-18 2016-03-30 华为终端有限公司 验证机顶盒接入身份的方法和认证服务器
CN102404346A (zh) * 2011-12-27 2012-04-04 神州数码网络(北京)有限公司 一种互联网用户访问权限的控制方法及系统
US9166949B2 (en) * 2012-06-07 2015-10-20 Qlicket Inc. Method and system of managing a captive portal with a router
CN103685147A (zh) * 2012-08-31 2014-03-26 中国联合网络通信集团有限公司 网络接入安全处理方法、设备及系统
EP2925034B1 (en) * 2012-11-22 2019-07-31 Huawei Technologies Co., Ltd. Network element access method and device
CN103441876B (zh) * 2013-08-23 2016-08-31 南京华讯方舟通信设备有限公司 一种基于dhcp协议和snmp协议的网络设备管理方法及系统
CN104519513A (zh) * 2013-09-30 2015-04-15 深圳市群云网络有限公司 一种基于无线局域网的通信方法及系统
CN104519546B (zh) * 2013-09-30 2018-12-14 深圳市群云网络有限公司 一种基于无线局域网的通信方法及系统
CN104519547B (zh) * 2013-09-30 2018-08-14 深圳市群云网络有限公司 一种基于无线局域网的通信方法及系统
CN103618717B (zh) * 2013-11-28 2017-12-05 北京奇虎科技有限公司 多账户客户信息的动态认证方法、装置和系统
EP2890052A1 (en) * 2013-12-27 2015-07-01 Telefonica S.A. Method and system for dynamic network configuration and access to services of devices
US20150237003A1 (en) * 2014-02-18 2015-08-20 Benu Networks, Inc. Computerized techniques for network address assignment
US10374819B2 (en) 2014-09-19 2019-08-06 Xiaomi Inc. Methods and devices of accessing wireless network
CN106067857B (zh) * 2016-08-10 2020-05-08 新华三技术有限公司 一种防止用户被强制下线的方法及装置
CN106254376B (zh) * 2016-09-05 2019-10-11 新华三技术有限公司 一种认证协商方法及装置
CN107872445B (zh) * 2016-09-28 2021-01-29 华为技术有限公司 接入认证方法、设备和认证系统
IL248306B (en) 2016-10-10 2019-12-31 Verint Systems Ltd System and method for creating data sets for learning to recognize user actions
US10389681B2 (en) * 2017-05-19 2019-08-20 Dell Products L.P. Auto discovery of network elements by defining new extension in DHCP options for management server IP addresses
CN107438113A (zh) * 2017-07-04 2017-12-05 上海斐讯数据通信技术有限公司 一种通过动态主机配置协议进行重定向的方法与系统
JP7070094B2 (ja) * 2018-05-28 2022-05-18 ブラザー工業株式会社 通信装置のためのコンピュータプログラムと通信装置
US10999295B2 (en) 2019-03-20 2021-05-04 Verint Systems Ltd. System and method for de-anonymizing actions and messages on networks
WO2021007166A1 (en) * 2019-07-08 2021-01-14 Arris Enterprises Llc Remote factory reset of an electronic device
WO2022037326A1 (zh) * 2020-08-20 2022-02-24 华为技术有限公司 一种接入管理方法、认证点和认证服务器
CN114554570A (zh) * 2020-11-19 2022-05-27 中国电信股份有限公司 用户接入的控制方法、装置和系统
CN114501445B (zh) * 2022-01-06 2024-02-09 新华三技术有限公司合肥分公司 一种接入控制方法及装置
CN115442256B (zh) * 2022-08-05 2023-08-29 武汉思普崚技术有限公司 用于监听用户上下线的稳定性测试的方法及相关设备

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1450766A (zh) * 2002-04-10 2003-10-22 深圳市中兴通讯股份有限公司 一种基于动态主机配置协议的用户管理方法
CN1889577A (zh) * 2006-07-18 2007-01-03 Ut斯达康通讯有限公司 一种基于dhcp扩展属性的ip地址分配方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6966004B1 (en) * 1998-08-03 2005-11-15 Cisco Technology, Inc. Method for providing single step log-on access to a differentiated computer network
US7143435B1 (en) * 2002-07-31 2006-11-28 Cisco Technology, Inc. Method and apparatus for registering auto-configured network addresses based on connection authentication

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1450766A (zh) * 2002-04-10 2003-10-22 深圳市中兴通讯股份有限公司 一种基于动态主机配置协议的用户管理方法
CN1889577A (zh) * 2006-07-18 2007-01-03 Ut斯达康通讯有限公司 一种基于dhcp扩展属性的ip地址分配方法

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
"application of PANA framework to DSL networks; draft-morand-pana-panaoverdsl-OO.txt", IETF STANDARD-WORKING-DRAFT, INTERNET ENGINEERING TASK FORCE, IETF, CH, 14 September 2006 (2006-09-14)
"Authentication Extensions for the Dynamic Host Configuration Protocol; draft-pruss-dhcp-auth-dsl-Ol. txt", IETF STANDARD-WORKING-DRAFT, INTERNET ENGINEERING TASK FORCE, IETF, CH, 19 May 2007 (2007-05-19)
"DHCP options for PANA Authentication Agents; draft-ietf-dhc-paa-option-04.txt", IETF STANDARD-WORKING-DRAFT, INTERNET ENGINEERING TASK FORCE, IETF, CH, vol. DHC, no. 4, 11 September 2006 (2006-09-11)
"Protocol for Carrying Authentication for Network Access (PANA) Framework; draft-ietf-pana-framework-07.txt", IETF STANDARD-WORKING-DRAFT, INTERNET ENGINEERING TASK FORCE, IETF, CH, vol. PANA, no. 7, 22 August 2006 (2006-08-22)
See also references of EP2136508A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105357485A (zh) * 2015-11-20 2016-02-24 武汉微创光电股份有限公司 一种网络视频监控中网络设备接入认证方法

Also Published As

Publication number Publication date
CN101340287A (zh) 2009-01-07
EP2136508A4 (en) 2010-05-05
CN101340334A (zh) 2009-01-07
EP2136508A1 (en) 2009-12-23
CN101340334B (zh) 2011-11-09
US20100107223A1 (en) 2010-04-29
EP2136508B1 (en) 2014-12-03

Similar Documents

Publication Publication Date Title
WO2009003409A1 (en) A method, system and equipment for network access
JP4666169B2 (ja) 信頼されないアクセス局を介した通信方法
KR101591609B1 (ko) 다이나믹 호스트 컨피규레이션 및 네트워크 액세스 인증
US7680878B2 (en) Apparatus, method and computer software products for controlling a home terminal
JP2002314549A (ja) ユーザ認証システム及びそれに用いるユーザ認証方法
EP1618697A2 (en) An identity mapping mechanism in wlan access control with public authentication servers
CN110958272B (zh) 身份认证方法、身份认证系统和相关设备
WO2010048874A1 (zh) 一种ip会话标识方法、装置和系统
WO2014101449A1 (zh) 一种无线局域网中接入节点的控制方法及通信系统
JP2014510480A (ja) ネットワーク通信システムおよび方法
WO2009082950A1 (fr) Procédé, dispositif et système de distribution de clés
JP2008160709A (ja) 計算機システム
WO2009012729A1 (fr) Procédé, système et dispositif de conversion d&#39;authentification d&#39;accès à un réseau
JP4495049B2 (ja) パケット通信サービスシステム、パケット通信サービス方法、エッジ側ゲートウェイ装置、およびセンタ側ゲートウェイ装置
JP4584776B2 (ja) ゲートウェイ装置およびプログラム
EP2939368A1 (en) Remote vpn provisioning of an endpoint
JP2006229265A (ja) ゲートウェイシステム
JP5830128B2 (ja) 通信システム、アクセスポイント装置、サーバ装置、ゲートウェイ装置及び通信方法
WO2013034056A1 (zh) 一种位置信息处理方法和系统
TWI255629B (en) Method for allocating certified network configuration parameters
JP2004023166A (ja) モバイル通信サービスシステム
WO2006080079A1 (ja) 無線ネットワークシステムおよびそのユーザ認証方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08757898

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2008757898

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE