WO2009012729A1

WO2009012729A1 - A method, system and device for converting the network access authentication

Info

Publication number: WO2009012729A1
Application number: PCT/CN2008/071774
Authority: WO
Inventors: Ruobin Zheng
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-07-26
Filing date: 2008-07-28
Publication date: 2009-01-29
Also published as: CN101355485A; CN101355485B

Abstract

A method for converting the network access authentication, includes the following steps: receiving a first authentication protocol packet transmitted by a first side which supports the first authentication protocol; converting the first authentication protocol packet to a second authentication protocol packet, and transmitting the converted second authentication protocol packet to a second side which supports the second authentication protocol. A network node device and a system for converting the network access authentication are disclosed. Through implementing the embodiments of the invention, an authentication relay converts the layer-2 authentication protocol message to the layer-3 authentication protocol message, and authentication and authorization are performed in the network in which the authenticator lies, thus the problem of performing authentication in the next generation access network is resolved.

Description

Method, system and device for network access authentication conversion

The present invention relates to the field of network communications, and in particular, to a method, system and apparatus for network access authentication conversion. Background technique

The protocol for carrying authentication for network access (PANA) is a layer 3 authentication protocol. The layer 3 authentication protocol system generally includes a PANA client (PANA client, PaC) and a PANA authentication agent. PANA Authentication Agent (PAA), Authentication Server (AS), and Enforcement Point (EP). The PaC is located on the client of the PANA protocol, and is used to obtain access to the network where the PAA is located and participate in the authentication process of the PANA protocol. The PAA is located at one end of the access network and is responsible for communicating with the AS to verify the authenticity of the PaC certificate. Provide network access authorization for the device associated with the PaC. In addition, the access control status can be updated by establishing or deleting the access authorization. The AS is responsible for checking the PAC certificate forwarded by the PAA, and returns the result and authorization of the inspection to the PAA. The EP is located on a node on the access network and is responsible for monitoring the packets coming in and out of the PaC device and filtering the packets according to the monitoring policy obtained from the PAA.

FIG. 1 is a diagram showing an access network architecture of an existing layer 2 authentication protocol, where a plurality of customer premises equipment (TE), such as a customer premises equipment 1 to a customer premises equipment N, are included in a customer premises network, where Between the customer premises equipment 1 and the customer premises equipment N, a plurality of customer premises equipments are also included, and the customer premises equipments are connected to the access nodes (Access Nodes) in the IP convergence access network through a residential gateway (RG). The AN is authenticated by the AS in the Access Layer 2 authentication protocol of the Broadband Network Gateway (BNG) in the IP aggregation access network.

The existing user terminal basically uses the layer 2 authentication protocol, such as a layer 2 authentication method 802.1x and a point-to-point protocol (PPP), etc., the TE of the TE access layer 2 in FIG. When an Access Point (AP) authenticates through the Layer 2 protocol, the Layer 2 authentication protocol is an RG that cannot pass through Layer 3. Even the Layer 2 RG does not support transparent transmission of Layer 2 broadcast information. If layer 2 protocol authentication can pass through the RG of layer 3, but it cannot reach the AN or IP aggregation node of layer 3 The IP edge node where the PAA is located, and with the development of the access network, the layer 3 AN or IP aggregation node is the development trend of the next generation access network, which requires the client to meet the requirements of the layer 3 authentication protocol, but the layer 3 PANA of the authentication protocol is a new authentication protocol. If PANA is used for authentication, all clients supporting all Layer 2 authentication protocols need to be upgraded or replaced with a client supporting Layer 3 authentication protocol, but through This upgrade or replacement cost can be high. Summary of the invention

In view of the above problems in the prior art, embodiments of the present invention provide a method, system, and apparatus for network access authentication conversion. By setting an authentication relay in the network side, converting the received first authentication protocol message into a second authentication protocol message to the authentication device for authentication, and solving the authentication process of the layer 2 authentication client in the layer 3 protocol, thereby Allow users to smoothly transition to IP-based next-generation access networks.

An embodiment of the present invention provides a method for network access authentication and conversion, where the method includes: receiving a first authentication protocol packet sent by a first party that supports the first authentication protocol;

Converting the first authentication protocol packet into a second authentication protocol packet, and sending the converted second authentication protocol packet to a second party supporting the second authentication protocol.

An embodiment of the present invention further provides a network node device, including a receiving unit, an authentication relay unit, and a sending unit, where:

The receiving unit is configured to receive a first authentication protocol message sent by a first party that supports the first authentication protocol;

The authentication relay unit is configured to convert the first authentication protocol packet received by the receiving unit into a second authentication protocol packet;

The sending unit is configured to send the second authentication protocol packet converted by the authentication relay unit to a second party that supports the second authentication protocol.

The embodiment of the present invention further provides a network access authentication conversion system, including a client, an authentication relay, and an authentication device, where:

The client is configured to perform layer 2 authentication protocol packet interaction with the authentication relay, and provide an identity authentication material to perform authentication authentication on the authentication device.

The authentication relay is used to perform the conversion function of the layer 2 authentication protocol packet and the layer 3 authentication protocol packet, and the authentication relay agent interacts with the client to perform the layer 2 authentication protocol packet, and performs layer 3 with the authentication device. Authentication protocol packet interaction;

The authentication device is configured to perform Layer 3 authentication protocol packet interaction with the authentication relay to provide authentication and authorization for the user or device associated with the client.

After the embodiment of the present invention is configured, the authentication initiator is set in the network system, and after receiving the first authentication protocol message of the client, the first authentication protocol message is converted into the second authentication protocol message and sent to the authentication device for authentication, and the solution is solved. The Layer 2 authentication protocol client cannot be authenticated on the next generation access network. Through the authentication method, the client converts the first authentication protocol message into the second authentication protocol message by the authentication relay, and completes the access authentication in the authentication device by the interaction of the second authentication protocol message. Through the implementation of the method, the original layer 2 authentication protocol message is uniformly converted into the layer 3 authentication protocol message on the network side, thereby solving the problem that the layer 2 authentication protocol message cannot traverse the layer 3 network node, and the user does not need to Upgrade and replace the original Layer 2 client so that users can smoothly transition to the IP-based next-generation access network. DRAWINGS

1 is a schematic diagram of an access network architecture of an existing layer 2 authentication protocol;

2A is a system diagram of network access authentication conversion in an embodiment of the present invention;

2B is a schematic structural diagram of an authentication relay in the embodiment of the present invention;

3 is a schematic diagram of an IP session period in a process of client authentication relaying in the embodiment of the present invention; FIG. 4 is a diagram of an application scenario of an IP aggregation network authentication relay in the embodiment of the present invention;

FIG. 5 is a schematic diagram of another application scenario of the authentication relay in the embodiment of the present invention;

FIG. 6 is a schematic diagram of still another application scenario of the authentication relay in the embodiment of the present invention; FIG.

7 is a flowchart of successful 802. lx to PANA authentication authentication conversion in the embodiment of the present invention; FIG. 8 is a flowchart of 802. lx to PANA re-authentication authentication conversion in the embodiment of the present invention; FIG. 10 is a flowchart of PKM-to-PANA re-authentication authentication conversion in the embodiment of the present invention; FIG. 11 is an 802.1x-to-DHCP in the embodiment of the present invention. FIG. 12 is a flowchart of an 802.1 X to DHCP re-authentication authentication conversion in the embodiment of the present invention; FIG. 13 is a flowchart of a PKM-to-DHCP authentication successful authentication conversion according to an embodiment of the present invention; 14 is a flowchart of the authentication conversion of PKM to DHCP re-authentication in the embodiment of the present invention. detailed description

Embodiments of the present invention provide a method and device for network access authentication conversion. By setting the authentication relay in the network node device, the authentication relay agent uniformly converts the original layer 2 authentication protocol message into the layer 3 authentication protocol message, thereby solving the problem that the layer 2 authentication protocol client cannot traverse the layer 3 RG layer. The problem of the AN or IP aggregation node of 3 does not need to upgrade the client of the original layer 2 authentication protocol, so that the client smoothly transitions to the IP-based next generation access network, effectively protecting the interests of the user.

Preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

Referring to FIG. 2A, FIG. 2A is a system diagram of network access authentication conversion in the embodiment of the present invention, where the system includes a client 201, an authentication relay 202, an authenticator 203, an authentication server 204, and a layer 3 monitoring point. 205 and layer 2 access controller 206, wherein layer 2 access controller 206 and layer 3 monitoring point 205 are both located in the data plane, and other functional units are located in the control plane.

The client 201 is an authenticated applicant, and the client 201 seeks to obtain access to the network to which the authenticator 203 belongs, and provides identity authentication material to the authentication server 204 to participate in the authentication process of the authentication protocol, and the client 201 is associated with a group of authentication protocols. Within the scope of the client 201's own device or certificate, it can be a portable computer, personal digital assistant, mobile phone, PC or router connected to the terminal device on the network, using the layer 2 authentication protocol through the certification relay 202 The authentication server 204 of the support layer 3 authentication protocol where the authenticator 203 is located performs authentication, and the layer 2 authentication protocol used by the client 202 includes 802.1X, PPP, and Privacy Key Management (ΡΚΜ).

The Authentication Relay (AR) 202 provides a layer 2 authentication client 201 with a layer 2 authentication protocol message to a layer 3 authentication protocol message (such as PANA protocol or DHCP protocol), which is sent by the client 201. The message of the layer 2 authentication protocol is sent to the authenticator 203, and the message of the layer 3 authentication protocol sent by the authenticator 203 is converted into the layer 2 authentication protocol, and the message is sent to the client 201, thereby The interaction of the authentication information between the client 201 and the authenticator 203 is established. The client 201 authenticated by the AR202 and the authenticator 203 perform layer 3 protocol information interaction, and the client 201 is authenticated or authenticated by using the address identifier of the client 201. 2B is a schematic structural diagram of an AR in the embodiment of the present invention. The AR 202 is provided with a receiving unit 2021, an authentication relay unit 2022, a sending unit 2023, and a re-authentication unit 2024. The receiving unit 2021 is configured to receive and support the first authentication. The first authentication protocol sent by the first party of the agreement The authentication relay unit 2022 is configured to convert the first authentication protocol packet received by the receiving unit 2021 into the second authentication protocol packet, and the sending unit 2023 is configured to send the second authentication protocol packet converted by the authentication relay unit 2022 to the second authentication protocol packet. A third party that supports the second authentication agreement. It should be noted that the first party may be a client, the first authentication protocol is a layer 2 authentication protocol, the second party may be an authentication device, and the second authentication protocol is a layer 3 authentication protocol; or, the first party The authentication device, the first authentication protocol is a layer 3 authentication protocol, the second party may be a client, and the second authentication protocol is a layer 2 authentication protocol. The re-authentication unit 2024 herein is used to initiate a re-authentication process for the client 201 during the course of the session.

The authenticator 203 is an authentication proxy, that is, the PAA in the PANA protocol, and the proxy client 201 performs an AAA authentication protocol (such as RADIUS/Diameter)/API interaction with the authentication server 204 through the interaction of the layer 3 authentication protocol message with the AR 202. The device associated with the client 201 provides access authentication and authorization. In addition, the authenticator 203 can also update the access control state at the client 201 by establishing or releasing the access authorization. If the authenticator 203 and the authentication server 204 are located at the same network node, the authenticator 203 and the authentication server 204 can perform data transfer through an application program interface (API) if the authenticator 203 and the authentication server 204 are not located. When the same network node is used, the authenticator 203 and the authentication server 204 need to perform data transmission through a RADIUS or Diameter message carrying an authentication, authorization, and accounting protocol (AAA, AAA M message). The authenticator 203 sends a layer 3 access control policy and/or an authorization key to the layer 3 monitoring point 205. The authenticator 203 can be located in a network edge node of the network, such as a network gateway or network node such as BNG.

The Authentication Server (AS) 204 is responsible for verifying the authentication material provided by the client 201, and returns the result of the verification and the authorized parameters to the client 201, including the access control policy and the authorization key. The authentication server 204 may be located in the same network node as the authenticator 203, or may be located in a dedicated network node on the access network or a central server on the Internet.

A Layer 3 Enforcement Point (L3 EP) 205 is located at a node accessing the data plane of the network, and is responsible for monitoring the data packet from the layer 2 access controller 206, and according to the connection obtained from the authenticator 203. Incoming control policies to perform non-encrypted access filtering or encrypted access filtering on data packets. If the underlying network lacks security, the encrypted access filtering method must be used. The layer 3 access controller 206 and the L3 EP205 need to establish a layer 3 security association. The establishment of the security association can use the Internet key exchange protocol (Internet). Key Exchange, IKE), etc. After the completion of the layer 3 security alliance, The network layer encryption protocol can be used for data stream security protection. The encrypted data stream information can use the IP Security Protocol (IPSec) protocol. If the authenticator 203 and the L3 EP are located at the same node, only the API needs to perform data interaction between them; otherwise, the Layer 2 Control Protocol (L2CP) or the Simple Network Management Protocol (Simple Network Management Protocol) is required. , SNMP) for data interaction. The L3 EP 205 is typically located on the path between the AR 202 and the authenticator 203.

The Layer 2 Access Controller (L2 AC) 206 is located at a node accessing the data plane of the network, and is responsible for monitoring the data packet from the client 201 and forwarding it according to the L3 EP205 from the authenticator 203. The access control policy performs non-encrypted access filtering or encrypted access filtering on the data packet. Usually the L2 AC is located on the path between the client 201 and the AR 202. If the underlying network lacks security, you must use the encrypted access filtering method. A Layer 2 security association needs to be established between the client 201 and the L2 AC206. The Layer 2 security association establishes a four-way handshake protocol that can use 802.11i (4 WHS). ), or use the 802.16 three-way handshake protocol (3WHS); after completing the establishment of the security association, the link layer encryption protocol can be used for data stream security protection, and the encryption can use the 802.11i link layer encryption protocol, or 802.16 Link layer encryption protocol.

When the L2 AC206 and the L3 EP205 are located at the same node of the data plane, they can be set in the same device when the device is constructed. In this case, the layer 2 can be protected by the layer 2 or the client 201. Secure with layer 3.

The following is a schematic diagram of the IP session period in the client authentication transfer process of FIG. 3 in combination with the system diagram of the network access authentication relay shown in FIG. 3 and FIG. 2, as follows:

Step S301: Perform interaction of a layer 2 authentication protocol message between the client and the AR.

Step S302: The AR converts the layer 2 authentication protocol message of the client into a layer 3 authentication protocol message. Before the client fails to pass the authentication, the AR may apply for a temporary IP address instead of each client or use its own IP address to support layer 3. Certification

Step S303: Perform interaction of the layer 3 authentication protocol message between the authenticator and the AR.

Step S304: The Authenticator converts the Layer 3 authentication protocol message into an interaction between the Authentication, Authorization, and Accounting (AAA) protocol message and the AS.

Step S305: After the client passes the authentication, the client applies for a formal IP address for itself. The IP address can be provided by the AR or the DHCP server. If the IP address is provided by the AR, the IP address is The AR in step S302 replaces the IP address of each client application - corresponding;

Step S306: After the client passes the authentication, the authenticator sends the access control policy and the authorization key to the L3 EP.

Step S307: A layer 3 security association is established between the L2 AC and the L3 EP.

Step S308: The L3 EP converts the access control policy of layer 3 into the access control policy of layer 2; Step S309: Generate an authorization key of layer 2 in the L3 EP;

Step S310: The converted layer 2 access control policy and the layer 2 authorization key are sent to the L2 AC. Step S311: The L2 AC establishes a layer 2 security association with the client.

Step S312: The client establishes a data flow with the network where the authenticator is located, and the data flow is accessed through the security filtering of the L2 AC and the L3 EP.

Step S313: The L2 AC notifies the client that the user wants to go offline and listens to the message that the user goes offline, and the L2 AC senses that the client is offline when the layer 2 authentication protocol is 802. lx. Notifying the AR through EAP offline (EAPoL-Logoff) 4;

Step S314: The AR terminates the layer 3 authentication session, and the entire IP session ends. When the layer 3 authentication protocol is PANA, the AR and the authenticator terminate the response or PANAN terminate the reply (PANA- Termination-Request or PANA- Termination- Answer) The message is used to terminate the PANA session process. If the Layer 3 authentication protocol is the Dynamic Host Configuration Protocol (DHCP) authentication protocol, the AR sends a DHCP Release (DHCP Release) message to the authenticator to terminate the IP session.

4 to FIG. 6 show an application scenario of the authentication relay in the embodiment of the present invention, and FIG. 4 shows an authentication relay application in the IP aggregation network, and in the access IP aggregation network, the central office access node (Central Office AN, CO AN ) or IP edge devices, such as BNG or Broadband Network Gateway (BRAS) with PAA and L3 EP, ARs for Layer 2 with AR and AC, edge devices in IP aggregation networks Only PANA authentication is supported, but the client of layer 2 can perform authentication relay through the AR provided on the AN, and can support clients with different authentication modes after the AR transit, such as 802.1x/f terminal, 802.16 terminal, PPP terminal, etc. The PANA terminal directly performs the interaction between the Layer 3 authentication protocols through the PAA provided on the IP aggregation network.

FIG. 5 is a schematic diagram of another application scenario of the authentication relay in the embodiment of the present invention. The PAA and the L3 EP are set on the IP edge device, such as the BNG or the BRAS, and are set on the RG or the AP or the base station (Base, Station, BS). AR and L2 AC, the client can be authenticated by the AR transit authentication process during the authentication process. The AP is connected to the PAA for authentication.

FIG. 6 is a schematic diagram of still another application scenario of the authentication relay in the embodiment of the present invention. The home network and the visited network communicate with each other through the connection between the IP edge devices, and the PAA is set on the home network IP edge device such as BNG or BRAS. And L3EP, set the AR on the BNG or BRAS of the device at the edge of the IP address of the visited network, and set the AC on the AN of the visited network. When the client roams from the home network to the visited network, it performs authentication relay through the visited network BNG or the AR on the BRAS, and returns to the PAA on the IP edge device of the home network for authentication.

The entire authentication relay process is described in detail according to the session period shown in FIG. 3 and the authentication relay application scenario shown in FIG. 4 to FIG. 6. FIG. 7 shows the successful authentication conversion of 802.1X to PANA authentication in the embodiment of the present invention. The flow chart, the specific steps are as follows:

Step S701: The client initiates an EAPoL-Start (EAPoL-Start) message, and starts an Extensible Authentication Protocol (ΕΑΡ) authentication process;

Step S702: After receiving the EAPoL-Start 4 message, the AR triggers the PANA client to initiate the PANA-Client-Initiation to select the PAA that provides the authentication and authorization service;

Step S703: The PAA sends a PANA-Auth-Request message to the AR, indicating that the PAA can provide the authenticated authentication and authorization service, and configure the local local IP address for the AR, where the S position is

Step S704: The AR sends a PANA-Auth- Answer message to the PAA, indicating that the AR has received the PANA-Auth-Request message.

Step S705: The PAA sends an EAP-Request/Identity message to the AR, and the message is carried by the PANA-Auth-Request message.

Step S706: The AR converts the PANA-Auth-Request packet into an EAPoL packet, and sends the EAP-Request/Identity message to the client through the EAPoL packet.

Step S707: The client sends an EAPoL message carrying an EAP-Response/Identity message to the AR.

Step S708: The AR converts the EAPoL message into a PANA message, and carries the EAP-Response/Identity message to the PAA through the PANA-Auth- Answer message.

Steps S709 to S710: Perform EAP method negotiation and EAP method negotiation, and the identity certificate information associated with the client needs to be transmitted to the authentication server multiple times, through the client and the AR and the AR. The interaction between the PAA and the authentication protocol message The identity authentication of the entire client can be completed. In this process, the AR converts the EAPoL packet into a PANA packet for authentication and conversion to implement client-to-PAA authentication. This process is completed until the EAP authentication process ends.

Step S711: After the user authentication succeeds, the PAA returns an EAP success message (EAP success) message to the AR, and encapsulates the EAP success message and the corresponding EAP derivative key in the PANA-Auth-Request message, and passes the PANA-Auth-Request. The message is carried to the AR, where the C position is

Step S712: After receiving the PANA-Auth-Request packet, the AR sends a PANA-Auth-Answer message to the PAA to respond to the PAA, where the C bit is set;

Step S713: The AR sends the received EAP Success message to the client through the EAPoL message.

In the authentication conversion flowchart shown in FIG. 7, after the 802.1x authentication message is converted into a PANA message for authentication, the EAPoL message in the 802. lx first carries the corresponding EAP message to the AR, and between the AR and the PAA. The authentication process of the 802. lx terminal is performed by carrying the corresponding EAP message through the PANA-Request and the PANA-Diffuse message. After the authentication succeeds, the client needs to be re-authenticated to extend the session period in the entire IP session. , or for other reasons, the client needs to be re-authenticated. FIG. 8 is a flow chart showing the authentication conversion of 802.1 X to PANA re-authentication in the embodiment of the present invention, and the specific steps are as follows:

Step S801: The client initiates an EAPoL-Start packet, and restarts the EAP authentication.

Step S802: When the set handshake timer or the re-authentication timer exceeds the set time, the re-authentication may be initiated by the AR.

Step S801 and step S802 are two methods of re-authentication initiation, and the process of re-authentication may be initiated by the client, or the process of re-authentication may be initiated by the AR.

Step S803: After the re-authentication is triggered by the step S801 or the step S802, the process of re-authentication is requested between the AR and the PAA through the PANA-Notification-Request (PANA-Notification-Request) message, where the A bit is set;

Step S804: The PAA sends a PANA Announcement Answer (PANA-Notification-Answer) to the AR, indicating that the PAA has received the request for re-authentication, where the A bit is located;

Steps S805 to S813 are the same as steps S705 to S713 described in FIG. 7, and are not described here.

Figure 7 and Figure 8 above show that the client is authenticated to the PANA protocol through the 802. lx authentication protocol. The flow chart of the certifier's authentication. When the client is an 802.16 client and the PKM layer 2 protocol is used for authentication, the flow chart of the client authentication relay is shown in Figure 9. The specific steps are as follows:

Step S901: The client initiates a PKM request/EAP start (PKM-REQ/EAP-Start) message, and starts an EAP authentication process.

Step S902: After receiving the PKM-REQ/EAP-Start message, the AR triggers the PANA-Client-Initiation message to select the PAA that provides the authentication and authorization service.

Step S903: The PAA sends a PANA-Auth-Request message to the AR to indicate that it can provide the authenticated authentication and authorization service, and configures the local IP address used locally by the AR, where the S position is set. Step S904: The AR sends the PANA-Auth- Answer message to PAA;

Step S905: The PAA sends an EAP-Request/Identity message to the AR, and the message is carried by the PANA-Auth-Request message.

Step S906: The AR converts the PANA-Auth-Request message into a PKM-RSP/EAP-Transfer message, and sends the EAP-Request/Identity message to the PKM-RSP/EAP-Transfer message. Client

Step S907: The client sends a PKM-REQ/EAP-Transfer message carrying an EAP-Response/Identity message to the AR;

Step S908: The AR converts the PKM packet into a PANA packet, and carries the EAP-Response/Identity message to the PAA through the PANA-Auth- Answer message.

Steps S909 to S910: Perform EAP method negotiation and EAP method negotiation, and the identity certificate information associated with the client needs to be transmitted to the authentication server multiple times, through the client and the AR and the AR. The interaction between the PAA and the authentication protocol message can complete the identity authentication of the entire client. In this process, the AR converts the PKM packet into a PANA packet for authentication and conversion, and implements the client-to-PAA identity authentication. Step S911: After the user authentication succeeds, the PAA returns an EAP success message (EAP success) message to the AR, and encapsulates the EAP success message and the corresponding EAP derivative key in the PANA-Auth-Request message, and passes the PANA-Auth. - The Request message is carried to the AR, where the C position is set;

Step S912: After receiving the PANA-Auth-Request, the AR sends a PANA-Auth-Answer message to the PAA, where the C bit is set.

Step S913: The AR sends the received EAP Success message to the client through the PKM-RSP/EAP-Transfer message. In the authentication conversion flowchart shown in FIG. 9, the PKM authentication message is converted into a PANA message for authentication. After the authentication succeeds, the client needs to be re-authenticated to extend the session period or other during the entire IP session. The reason also requires re-authentication of the client. FIG. 10 is a flowchart of an authentication conversion performed by an 802.16 client to a PANA authentication server in the embodiment of the present invention, and the specific steps are as follows:

Step S1001: The client initiates a PKM-REQ/EAP-Start message, and restarts the EAP authentication. Step S1002: When the set handshake timer or the re-authentication timer exceeds the set time, the re-authentication may be initiated by the AR. ;

Step S1001 and step S1002 are two methods of re-authentication. The process of re-authentication may be initiated by the client, or the process of re-authentication may be initiated by the AR.

Step S1003: After the re-authentication is triggered by the step S1001 or the step S1002, the process of re-authentication is requested between the AR and the PAA through the PANA-Notification-Request (PANA-Notification-Request) message, where the A bit is set;

Step S1004: The PAA sends a PANA Announcement Answer (PANA-Notification- Answer) to the AR, indicating that the PAA has received the request for re-authentication, where the A bit is located;

Steps S1005 to S1013 are the same as steps S905 to S913 described in FIG. 9, and details are not described herein again.

The above is to authenticate the layer 2 client after the authentication protocol is converted through the PANA protocol in the layer 3 authentication protocol. The following FIG. 11 to FIG. 14 describe the layer 2 client after the authentication conversion by the DHCP protocol of the layer 3 authentication protocol. A flowchart for performing authentication.

Referring to FIG. 11 , FIG. 11 is a flowchart of a successful authentication conversion process from 802.1x to DHCP in the embodiment of the present invention. The specific steps are as follows:

Step S1101: The client initiates an EAPoL-Start message, and starts an EAP authentication process.

Step S1102: After receiving the EAPoL-Start text, the AR triggers the DHCP Discovery (DHCP Discover) to select the DHCP Authenticator PAA and the DHCP server that provide the authentication and authorization service, and indicates the AR by the authentication option (auth-proto Option). Supported authentication mode;

Step S1103: After the PAA receives the DHCP Discover message, the authentication option is added to indicate the authentication mode supported by the PAA, and the unclaimed IP address that the DHCP server can provide to the client is recorded, and the IP address is replaced by one. The local IP address used by the AR, and then forwards the DHCP Address Assignment Service (DHCP Offer) message to the AR; Step S1104: The AR sends a DHCP address request (DHCP Request) message in response to the DHCP Offer message of the PAA. The DHCP Request message includes the authentication mode supported by the PAA and the IP address provided by the PAA, indicating that the AR has selected the PAA that can support the corresponding authentication mode. And accepted the IP address provided by the PAA;

Step S1105: After receiving the DHCP Request message, the PAA sends an EEAP-Request/Identity message to the AR, and the message is carried by a DHCP Address Assignment (DHCP Ack) message;

Step S1106: The AR sends the DHCP Ack packet to the EAPoL packet, and sends the EAP-Request/Identity message to the client through the EAPoL packet.

Step S1107: The client sends an EAP-Response/Identity message to the AR by sending an EAP-Response/Identity message to the AR. Step S1108: The AR sends the EAPoL message to the DHCP message, and the EAP-Response/Identity message is sent to the PAA through the DHCP Request message.

Step S1109 to step S1110: performing an EAP method negotiation (EAP Method) negotiation and an authentication method interaction process, where the identity certificate information associated with the client needs to be transmitted to the authentication server multiple times, through the client and the AR and the AR and The interaction between the PAA and the authentication protocol message can complete the identity authentication of the entire client. In this process, the AR converts the EAPoL packet into a DHCP packet for authentication and conversion, and implements the client-to-PAA identity authentication. End;

Step S1111: After the client authentication succeeds, the PAA returns an EAP success message (EAP success) message to the AR, where the EAP success message is carried in the DHCP Ack message, and yiaddr is the assigned global IP address.

Step SI 112: After receiving the DHCP Ack packet, the AR sends the DHCP Ack packet to the EAPoL packet carrying the EAP success message, and sends the EAPoL packet carrying the EAP success message to the client.

In the authentication conversion flowchart shown in Figure 11, the 802. lx authentication message is converted into a DHCP message for authentication. After the authentication succeeds, the client needs to be re-authenticated to extend the session period during the entire IP session. Or for other reasons, the client needs to be re-authenticated. The flowchart of the 802. lx to DHCP re-authentication authentication conversion in the embodiment of the present invention is shown in FIG. 12, and the specific steps are as follows: Step S1201: The client initiates an EAPoL-Start message and restarts EAP authentication; Step S1202: When the set handshake timer or re-authentication timer exceeds the set time, Re-authentication initiated by the AR;

Step S1201 and step S1202 are two methods of re-authentication initiation, and the process of re-authentication may be initiated by the client, or the process of re-authentication may be initiated by the AR.

Step S1203: The AR sends a DHCP Request message (DHCP Request) message to the PAA. The DHCP Request message includes the authentication mode supported by the PAA and the IP address provided by the PAA, indicating that the AR has selected the PAA that can support the corresponding authentication mode, and accepts the PAA. IP address provided by the PAA;

Steps S1204 to S1211 are the same as steps S1105 to S1112 described in FIG. 11, and the details are not described here.

Figure 11 and Figure 12 are flowcharts for the client to authenticate through the 802.1 X authentication protocol. After the authentication is transferred, the client authenticates to the DHCP authenticator. When the client is an 802.16 client, the PKM layer 2 protocol is used for authentication. The flow chart of the client authentication relay is as shown in FIG. 13. The specific steps are as follows: Step S1301: The client initiates a PKM-REQ/EAP-Start message to start the EAP authentication process. Step 1302: The AR receives the PKM-REQ. After the /EAP-Start packet, the DHCP Discover message is triggered to select the DHCP Authenticator PAA and the DHCP server that provide the authentication and authorization service, and the authentication mode (auth-proto Option) is used to indicate the authentication mode supported by the AR.

Step S1303: After receiving the DHCP Discover message, the PAA adds an authentication option to indicate the authentication mode supported by the PAA, and records an un-lipped IP address that can be provided by the DHCP server for the client, and replaces the IP address with one for the IP address. The local IP address used by the AR, and then forwards the DHCP Offer message to the AR;

Step S1304: The AR sends a DHCP Request message in response to the DHCP Offer message of the PAA. The DHCP Request message includes the authentication mode supported by the PAA and the IP address provided by the PAA, indicating that the AR has selected the PAA that can support the corresponding authentication mode, and accepts the PAA. IP address;

Step S1305: After receiving the DHCP Request message, the PAA sends an EEAP-Request/Identity message to the AR, and the message is carried by the DHCP Ack packet.

Step S1306: The AR sends the DHCP Ack packet to the PKM-RSP/EAP-Transfer message, and sends the EAP-Request/Identity message to the client through the PKM-RSP/EAP-Transfer message. Step S1307: The client sends the PKM. The -REQ/EAP-Transfer message carries the EAP-Response/Identity message to the AR;

Step S1308: The AR converts the PKM message into a DHCP message, and carries the EAP-Response/Identity message to the PAA through the DHCP Request message. Step S1309 to step S1310: performing an EAP method negotiation (EAP Method) negotiation and an authentication method interaction process, where the identity certificate information associated with the client needs to be transmitted to the authentication server multiple times, through the client and the AR and the AR and The interaction between the PAA and the authentication protocol message can complete the identity authentication of the entire client. In this process, the AR converts the PKM packet into a DHCP packet for authentication and conversion to implement the client-to-PAA identity authentication. This process is up to the EAP authentication process. End;

Step S1311: After the client authentication succeeds, the PAA replies to the EAP success message (EAP success) message, wherein the EAP success message is carried in the DHCP Ack message, and yiaddr is the assigned global IP address.

Step S1312: After receiving the DHCP Ack packet, the AR sends the DHCP Ack packet to the EAPoL packet carrying the EAP success message, and sends the PKM-RSP/EAP-Transfer packet carrying the EAP success message to the client.

In the authentication conversion flowchart shown in FIG. 13, the PKM authentication message is converted into a DHCP message for authentication. After the authentication succeeds, the client needs to be re-authenticated to extend the session period or other during the entire IP session. The reason also requires re-authentication of the client. FIG. 14 is a flowchart showing the authentication conversion of the 802.16 client to the DHCP authentication server in the embodiment of the present invention, and the specific steps are as follows:

Step S1401: The client initiates a PKM-REQ/EAP-Start message, and restarts the EAP authentication. Step S1402: When the set handshake timer or the re-authentication timer exceeds the set time, the re-authentication may be initiated by the AR.

Step S1401 and step S1402 are two methods of re-authentication initiated, and the process of re-authentication may be initiated by the client, or the process of re-authentication may be initiated by the AR.

Step S1403: The AR sends a DHCP Request message (DHCP Request) message to the PAA. The DHCP Request message includes the authentication mode supported by the PAA and the IP address provided by the PAA, indicating that the AR has selected the PAA that can support the corresponding authentication mode, and accepts the PAA. IP address provided by the PAA;

The steps S1404 to S1411 are the same as the steps S1305 to S1312 described in Fig. 13, and the details are not described here.

The following figure 8 to FIG. 14 describe the process of PKM and 802. lx authentication conversion in the layer 2 authentication protocol, and so on, the authentication protocol message in layer 2 sent by the client implements the layer 2 authentication protocol message layer to layer through the AR. 3 The conversion of the authentication protocol message is performed in the authentication server of layer 3. Authorization Afterwards, the data plane of the authentication transit system needs to control the data flow of the data plane through the L2 AC and the L3 EP, and the layer 3 security association is established between the L2 AC and the L3 EP, and the layer 2 is established between the L2 AC and the client. After the access control policy generated by the PAA is sent to the L3 EP, the L3 EP sends the access control policy to the L2 AC. If the network layer where the data plane is located lacks security, you need to use the encrypted access filtering method to establish the security of the data stream.

In summary, the embodiment of the present invention provides an authentication relay agent in the network node device, and after receiving the layer 2 authentication protocol message of the client, the layer 2 authentication protocol message is uniformly converted into a layer 3 authentication protocol message and sent to the authenticator. The authentication is performed to solve the problem that the layer 2 authentication protocol client cannot be authenticated in the next generation access network. By setting an authentication relay in the access aggregation network and other network nodes of the network aggregation network, the problem that the layer 2 authentication protocol message cannot penetrate the RG or AN of the layer 3 is solved, and the client is authenticated by the authentication method. The end can authenticate to the authenticator of the next generation access network through the layer 2 authentication method, thereby realizing the authentication and authorization of the client in the authentication server, and the user can complete the upgrade without upgrading and replacing the client. In the authentication access system, the technology of separating the bearer and the control is adopted, and the layer 3 monitoring point and the layer 2 access controller monitor the data surface control data flow information, and after the authentication is passed, the layer 3 is monitored to the layer 2 through the layer 3 The access controller sends an access control policy to ensure the security of incoming and outgoing data flow information.

The above is only a preferred embodiment of the present invention, and the scope of the present invention is not limited thereto. Therefore, the equivalent changes according to the claims of the present invention are still covered by the present invention. range.

Claims

Rights request

A method for network access authentication conversion, the method comprising the steps of: receiving a first authentication protocol packet sent by a first party that supports the first authentication protocol;

The network access authentication conversion method according to claim 1, wherein the first party is a client, the first authentication protocol is a layer 2 authentication protocol, and the second party is an authentication device. The second authentication protocol is a layer 3 authentication protocol; or

The first party is an authentication device, and the first authentication protocol is a layer 3 authentication protocol; the second party is a client, and the second authentication protocol is a layer 2 authentication protocol, where:

The layer 2 authentication protocol is an 802. lx authentication protocol or a PKM authentication protocol, and the layer 3 authentication protocol is a network access authentication bearer protocol or a dynamic host configuration protocol.

The network access authentication and conversion method according to claim 2, wherein in the authentication process of the client on the network side, the authentication relayer applies for an IP address instead of the client, and after the network side successfully authenticates the client And assigning an IP address to the client, where: the IP address assigned by the authentication relay to the client corresponds to the IP address that the authentication relay replaces the client application.

The method for network access authentication conversion according to claim 3, further comprising:

After the authentication of the client is successful on the network side, the authenticator sends a first access control policy and/or a first authorization key to the layer 3 monitoring point;

The layer 3 monitoring point converts the first access control policy into a second access control policy, and/or generates a second authorization key according to the first authorization key;

And sending the second access control policy and/or the second authorization key to the layer 2 access controller.

5. The method for network access authentication conversion according to claim 4, further comprising After the Authenticator delivers the first access control policy and/or the first authorization key, the layer 3 monitoring point establishes a first security association with the layer 2 access controller;

After the layer 2 monitoring point sends the second access control policy and/or the second authorization key, the layer 2 access controller establishes a second security association with the client.

The method for network access authentication conversion according to claim 2, further comprising:

After the network side successfully authenticates the client, the authentication relay converts the first authentication protocol message into the second authentication protocol message during the session, and performs re-authentication in the authenticator.

A network node device, comprising: a receiving unit, an authentication relay unit, and a transmitting unit, wherein:

8. The network node device of claim 7, wherein

The first party is a client, the first authentication protocol is a layer 2 authentication protocol; the second party is an authentication device, and the second authentication protocol is a layer 3 authentication protocol; or

The first party is an authentication device, and the first authentication protocol is a layer 3 authentication protocol; the second party is a client, and the second authentication protocol is a layer 2 authentication protocol.

The network node device according to claim 8, wherein the network node device further comprises a re-authentication unit, configured to initiate a re-authentication process to the client during the session.

10. The network node device according to claim 9, wherein the network node device is a broadband network gateway, a broadband remote access server, an access node, a resident gateway, an access point, and a base station. Either a _t

A network access authentication conversion system, comprising: a client, an authentication relay, and an authentication device, wherein:

The client is configured to perform a layer 2 authentication protocol packet interaction with the authentication relay, and provide an identity authentication material to perform authentication authentication on the authentication device.

The authentication relay is configured to perform a layer 2 authentication protocol packet and a layer 3 authentication protocol packet conversion function, and the authentication relay device interacts with the client to perform a layer 2 authentication protocol packet, and the authentication device Perform layer 3 authentication protocol packet interaction;

12. The network access authentication conversion system according to claim 11, wherein the authentication device comprises an authenticator and an authentication server:

The authenticator is configured to interact with the authentication relay agent to perform a layer 3 authentication protocol, and provide access authentication and authorization for the user or device associated with the client;

The authentication server is configured to perform access authentication according to the identity authentication material provided by the client by using the authenticator, and return the authentication result and the first access control policy to the client by using the authenticator.

The network access authentication and conversion system according to claim 12, wherein the network access authentication conversion system further comprises a layer 3 monitoring point and a layer 2 access controller, wherein:

The layer 3 monitoring point, monitoring the data packet from the layer 2 access controller according to the first access control policy delivered by the authenticator, and converting the first access control policy into the second access control policy And/or generating a second authorization key according to the first authorization key;

The layer 2 accesses the controller, and monitors data packets from the client according to the second access control policy.

The network access authentication conversion system according to claim 13, wherein the layer 3 monitoring point and the layer 2 access controller are located in the same node device.