WO2009043220A1 - Procédé et dispositif permettant de commander l'accès d'un dispositif utilisateur à un service multidiffusion dans un réseau d'accès - Google Patents

Procédé et dispositif permettant de commander l'accès d'un dispositif utilisateur à un service multidiffusion dans un réseau d'accès Download PDF

Info

Publication number
WO2009043220A1
WO2009043220A1 PCT/CN2008/000304 CN2008000304W WO2009043220A1 WO 2009043220 A1 WO2009043220 A1 WO 2009043220A1 CN 2008000304 W CN2008000304 W CN 2008000304W WO 2009043220 A1 WO2009043220 A1 WO 2009043220A1
Authority
WO
WIPO (PCT)
Prior art keywords
user equipment
multicast service
network
authentication
access
Prior art date
Application number
PCT/CN2008/000304
Other languages
English (en)
French (fr)
Inventor
Fanxiang Bin
Songwei Ma
Haibo Wen
Jun Zheng
Renxiang Yan
Qingshan Zhang
Chunyan Yao
Original Assignee
Alcatel Lucent
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alcatel Lucent filed Critical Alcatel Lucent
Publication of WO2009043220A1 publication Critical patent/WO2009043220A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources

Definitions

  • the present invention relates to an access network, and more particularly to a network access device and a network authentication device in an access network. Background technique
  • the computer network business is developing rapidly, and corresponding network applications are emerging one after another, such as broadband access, V0D services, video conferencing, interactive multicast, etc.
  • network operators and service providers provide network value-added services, they are generally at user terminals.
  • DSL digital subscriber line
  • the user equipment needs to be authenticated at the network access level and the service level, that is, the identity of the user equipment is authenticated. And determining the right of the user equipment to access the network service, and configuring the port for the user equipment based on the successful authentication to provide a corresponding service.
  • icat ion handles multicast access control, which requires the access node to participate in the service authentication process. But at the moment, there is no suitable certification solution to achieve this goal.
  • the first implementation an access control method based on PPPoE (Point-to-Point Protocol over Ethernet) authentication.
  • PPPoE Point-to-Point Protocol over Ethernet
  • the user equipment initiates a PPPoE authentication request, and the BRAS (Broadband Remote Access Service Device) extracts user related information from the user and sends it to the corresponding network authentication device to authenticate the user equipment. If the authentication succeeds, the user is authenticated.
  • the device sets a private IP address and pushes an electronic program menu (EPG) to the user equipment.
  • EPG electronic program menu
  • the user equipment sends an IGMP (Internet Multicast Management Protocol) request message in the PPPoE packet to the BRAS, BRAS from IGMP. Extracting user request information from the request message and transmitting authentication information such as an IP address, a DSLAM line ID, a request multicast group address, etc.
  • IGMP Internet Multicast Management Protocol
  • the network authentication device returns the authentication result, and then the BRAS pushes the private control message to the network access device, so that the network access device transmits the multicast data stream requested by the user equipment to the user equipment.
  • the shortcomings of this implementation scheme are as follows: 1) Because the BRAS is used to determine the user's access to the network service, and then the access authority is pushed to the network access device, the speed is relatively slow when the channel is changed; 1) the standard Radius server needs to be extended. The function of the remote user dial-up network authentication device to authenticate the user based on the user-related information extracted from the IGMP federation message; 3) transmitting the access right to the network access device using the private control message.
  • the second implementation scheme is as follows: First, the user equipment is authenticated by the network backup authentication device by using 802. lx, PPPoE, or web interface entry, and the related electronic program menu (EPG) is acquired; second, the user equipment accesses the network access device. Sending an IGMP request message (that is, a network service request message); then, the network access device intercepts the IGMP request message, and extracts user equipment related information (DSL port number, IP address, MAC address, request multicast group address), etc., and Forwarding the user equipment related information to the network authentication device; subsequently, the network authentication device authenticates the request of the user equipment, and pushes the related access authority to the network access device, and the access authority is stored in the network access device. Finally, the network access device allows or denies the provision of the multicast service requested by the user based on the received access rights.
  • IGMP request message that is, a network service request message
  • the network access device intercepts the IGMP request message, and extracts user equipment related information (DS
  • the disadvantages of this implementation are: 1) There are two separate authentication steps, and the network authentication device must have multicast access rights from 802. lx, PPPoE or Web interface entry authentication and user related information contained in the IGMP request message. (network port information) associated; 2) need to extend the functionality of the standard Radius server to authenticate the user based on the user-related information extracted from the IGMP request message; 3) push the multicast access to the network using private messages
  • the access device has an authentication processing delay after the user terminal sends an IGMP request message.
  • the present invention proposes a method and apparatus for controlling user equipment to access a multicast service in an access network.
  • the user equipment identity authentication can be performed only once.
  • the network authentication device sends the multicast service access rights corresponding to the user equipment to the The network access device is stored in the network access device.
  • the user equipment when the user equipment applies for a certain multicast service in the multicast service, the user equipment only needs to determine whether the user equipment has access to the multicast according to the multicast service authorization information saved in the network access device.
  • the authority of the business can be.
  • a method for controlling a user equipment to access a multicast service in a network access device of an access network includes the following steps: determining the received a message type of the user equipment; b. if the received message from the user equipment is a service authentication request message, acquiring, by the network authentication device, multicast service authorization information corresponding to the user equipment, where The service authentication request message is used by the user equipment to apply for a certain type of multicast service; c.
  • the multicast service authorization information corresponding to the device determines whether the user equipment has the right to access the multicast service, and provides the user equipment when the user equipment has the right to access the multicast service.
  • the multicast service request message is used by the user equipment to apply for a certain multicast service.
  • a method for controlling a user equipment to access a multicast service in a network authentication device of an access network includes the following steps: i. receiving access via a network a service authentication request message from the user equipment forwarded by the device; ii. generating multicast service authorization information corresponding to the user equipment according to the service authentication request message; iii. transmitting the multicast service authorization information To the network access device.
  • a network access device in an access network comprising: a first determining means, configured to determine a received message type from the user equipment; and acquiring means, if the received The message from the user equipment is a service authentication request message, and the network authentication device obtains the multicast service authorization information corresponding to the user equipment, where the service authentication request message is used by the user equipment to apply for a certain class.
  • a second determining device configured to: if the received message from the user equipment is a multicast service request message, according to the saved multicast service authorization information corresponding to the user equipment Determining whether the user equipment has the right to access the multicast service, where the first sending device is configured to provide the multicast to the user equipment when the user equipment has the right to access the multicast service The service, where the multicast service request message is used by the user equipment to apply for a certain multicast service.
  • an auxiliary control device for controlling a user equipment to access a multicast service in a network authentication device that accesses a network, includes: a third receiving device, configured to: Receiving a service authentication request message from the user equipment that is forwarded by the network access device; the first generating means is configured to generate, according to the service authentication request message, multicast service authorization information corresponding to the user equipment; The third sending device is configured to send the multicast service authorization information to the network access device.
  • a multicast access system for controlling a user equipment to access a multicast service in an access network, including a network access device and a network authentication device, where the network is provided
  • the access device includes the control device for controlling user equipment access to the multicast service according to any one of claims 8 to 12, the network authentication device comprising the method of any one of claims 13 and 14.
  • An auxiliary control device for controlling user equipment to access multicast services.
  • the network authentication device will perform the multicast corresponding to the user equipment.
  • the service access right is sent to the network access device and stored in the network access device. Specifically, when the user equipment applies for a certain multicast service in the multicast service, the network access device only needs to save according to the network access device.
  • the multicast service authorization information is used to determine whether the user equipment has the right to access the multicast service, and does not need to apply for the user equipment.
  • the user equipment is authenticated for each multicast service in the service in the class, so that the number of authentications can be reduced, and a certain network service only needs to copy a few copies to the corresponding network access device and is used by the network.
  • the access device forwards to different user devices, thereby saving network bandwidth.
  • the present invention is based on the existing network communication technology, the identity authentication and service authentication of the present invention can be conveniently implemented, so the present invention can be used for providing multicast services by a network service provider (NSP) and an associated service provider (ASP). And occasions; and mobile multicast services can be applied across the scope of the NSP domain.
  • NSP network service provider
  • ASP associated service provider
  • FIG. 1 is a schematic diagram of a system for controlling user equipment to access a multicast service in an access network according to the present invention
  • FIG. 2 is a flowchart of a method for controlling a user equipment to access a multicast service in a network access device of an access network according to an embodiment of the present invention
  • FIG. 3 is a flow chart showing a method for obtaining the multicast service authorization information corresponding to the user equipment to the network authentication device according to a specific implementation of the step S12 in FIG. 2;
  • FIG. 4 is a flowchart of a method for controlling a user equipment to quit a multicast service in a network access device of an access network according to an embodiment of the present invention
  • FIG. 5 is a flowchart of a method for controlling a user equipment to access a multicast service in a network authentication device that accesses a network according to an embodiment of the present invention
  • FIG. 6 is a schematic structural diagram of a control apparatus for controlling a user equipment to access a multicast service in a network access device of an access network according to an embodiment of the present invention
  • FIG. 7 is a schematic diagram of a first embodiment of the first obtaining device 12, which is used to obtain the multicast service authorization information corresponding to the user equipment from the network authentication device.
  • FIG. 8 is a schematic structural diagram of a control apparatus for controlling a user equipment to exit a multicast service in a network access device of an access network according to an embodiment of the present invention.
  • Figure 9 illustrates an auxiliary control device for controlling user equipment access to multicast services in a network authentication device accessing a network, in accordance with an embodiment of the present invention.
  • FIG. 1 shows a schematic diagram of a system for controlling user equipment access to a multicast service in an access network in accordance with the present invention. Although only one user equipment 1 is shown in the figure, in a specific application, multiple user equipments may apply for the same or different multicast services in the same type of multicast service.
  • a certain type of multicast service may include network services such as IPTV, Internet access, video, and voice.
  • the user equipment 1 also issues multiple requests. For example, after being allowed to access the IPTV service, the user equipment 1 sends a request to switch channels, that is, stops receiving the program of channel 1, but sends an access. The request of channel 2, after being allowed to access channel 2, is again requested to access channel N, and so on. Therefore, network access device 2 will again and again from user equipment 1. A request to access a network service is processed.
  • the user equipment 1 sends a request message to the network access device 2, and after receiving the request message from the user equipment 1, the network access device 2 determines the request message.
  • the network authentication device 3 can be sent to the network authentication device 3 (the network authentication device can be an authentication server, specifically, After the service authentication request message (which includes the user identification information and the user identity authentication information) of an AAA authentication server, the network access device 2 adds the service authentication request message
  • the network identification information of the user equipment 1 (the network identification information includes an IP address, a MAC address, a DSL port number), and the updated service authentication request message is sent to the network authentication device 3.
  • the network authentication device 3 After receiving the updated service authentication request message from the network access device 2, the network authentication device 3 extracts user identification information (for example, the xyz@IPTV service is used to identify the user xyz to apply for the IPTV service to the IPTV service provider) and the user.
  • the identity authentication information is used to authenticate the user equipment 1 to generate an authentication result according to the user identification information and the user identity authentication information, to determine whether the user equipment 1 is a legitimate user of the multicast service.
  • the user identity authentication information may include a password set by the user equipment 1 and the network authentication device 3, or a digital certificate, and may also include other types of identity authentication information, as long as the network authentication device 3 can determine the user device by using the identity authentication information.
  • the identity of 1 is sufficient, which should be understood by those skilled in the art, and will not be described herein.
  • the network authentication device 3 After the user equipment 1 passes the identity authentication, the network authentication device 3 searches for the access rights of the certain types of multicast services requested by the user equipment 1 in the multicast service access rights table according to the user identification information, when the network authentication device 3 After the access right of the certain type of multicast service requested by the user equipment 1 is found, the network of the user equipment 1 is formed according to the network identifier information of the user equipment 1 (the network identifier information includes an IP address, a MAC address, and a DSL port number). The mapping relationship between the port information (the DSL port number) and the access rights of the multicast service requested by the user equipment 1 to generate the multicast service authorization information corresponding to the user equipment 1.
  • the DSL port number is used to indicate that the network access device 2 provides the user equipment 1 with a certain multicast service in a certain type of multicast service that it applies for through the DSL port.
  • the network authentication device 3 sends the multicast service authorization information corresponding to the user equipment 1 and the authentication result to the network access device 2.
  • the network access device 2 After receiving the multicast service authorization information and the authentication result sent by the network authentication device 3, the network access device 2 stores the group corresponding to the user equipment 1 by using the network port information (DSL port number) and the authentication session identification information as indexes. Broadcast service access rights and forward the authentication result to user equipment 1.
  • the authentication session identification information may include an EAP ID or a Session ID, and may also include other types of session identification information, depending on the authentication.
  • the protocol used in the session should be understood by those skilled in the art and will not be described herein. Further, the EAP protocol is a commonly used authentication method in the field of communications. EAP is a protocol defined by the IETF. It provides RFC3748 with a message format for mutual interaction.
  • Each EAP session has an identifier that allows both parties to understand which session the authentication process belongs to, that is, the result of the authorization. Sub-certification related.
  • the authentication session identification information may be used to deactivate the authentication according to the authentication session identification information.
  • the network access device 2 determines that the message from the user equipment 1 is a multicast service request message sent by the user equipment 1 for requesting a certain multicast service in a certain type of multicast service (the multicast service request message)
  • the network access device 2 extracts the network identification information of the user equipment 1 from the multicast service request message, and Determining the multicast service authorization information corresponding to the user equipment 1 according to the network identification information, and determining, according to the multicast service authorization information corresponding to the user equipment 1 stored in the network access device 2, whether the user equipment 1 has Accessing the multicast service that is requested by the user equipment 1 and providing the multicast service to the user equipment 1 when the user equipment 1 has the right to access the multicast service, when the user equipment 1 does not access the group.
  • the multicast service is refused to be provided to the user equipment 1 when the service is granted.
  • the network access device 2 can provide the multicast service to the user equipment 1 in two ways.
  • the network access device 2 copies the group of the multicast service requested by the user equipment 1" Stream and send it to user device 1 through the corresponding network port (DSL port).
  • the network access device 2 forwards the multicast service request message of the user equipment 1 to the upper-level network. That is, the IGMP request message, and the upper-level network does not check the authority of the multicast service request until the multicast stream of the multicast service is transmitted to the network access device 2, and the group is forwarded via the network access device 2. Broadcast to user device 1.
  • the user equipment 1 Sending a multicast service cancellation request message to the network access device 2 (the multicast service cancellation request message includes the authentication session identification information generated when the user equipment 1 applies for the multicast service and requests the network authentication device 3 for identity authentication, and After the network access device 2 receives the multicast service cancellation request message sent from the user equipment, the network access device 2 extracts the user equipment 1 to apply for the multicast service and requests the network authentication device 3 for the identity.
  • the authentication session identification information generated during the authentication, and the access authority of the network service requested by the user equipment 1 is searched according to the authentication session identification information, and the network access device 2 searches for the deletion requested by the user equipment 1 After the network network service access rights, delete it.
  • FIG. 2 is a flow chart showing a method for controlling user equipment access to a multicast service in a network access device of an access network according to an embodiment of the present invention.
  • step S11 is performed to determine the received message type from the user equipment.
  • step S12 is performed, and the multicast service authorization information corresponding to the user equipment is obtained from the network authentication device;
  • step S13 is performed to determine whether the user equipment has an access station according to the saved multicast service authorization information corresponding to the user equipment.
  • the rights to the multicast service is performed to determine whether the user equipment has an access station according to the saved multicast service authorization information corresponding to the user equipment.
  • step S14 is performed to provide the multicast service to the user equipment.
  • step S11 after the network access device 2 receives the request message from the user equipment 1, the type of the request message is determined. If the network access device 2 determines that the request message is used by the user equipment 1 to request a certain type of multicast service, the network authentication device 3 can be sent to the network authentication device 3 (the network authentication device can be an authentication server, specifically, an AAA authentication server). After the service authentication request message (the authentication request message includes the user identification information and the user identity authentication information), in step S12, the The network access device 2 adds the network identification information of the user equipment 1 (the network identification information includes an IP address, a MAC address, a DSL port number) in the service authentication request message, and sends the updated service authentication request message to the network authentication.
  • the network identification information includes an IP address, a MAC address, a DSL port number
  • the device 3 is configured to acquire the multicast service authorization information corresponding to the user equipment 1 to the network authentication device 3. Further, after receiving the service authentication request message from the user equipment 1, the network access device 2 first detects the user identification information therein to determine the type of service authentication requested by the user equipment 1, and then, the network access device 2 Find the appropriate network authentication device and send the service authentication request message to the correct service provider.
  • the network authentication device 3 After receiving the updated service authentication request message from the network access device 2, the network authentication device 3 extracts user identification information (for example, the xyz@IPTV service is used to identify the user xyz to apply for the IPTV service to the IPTV service provider) and the user.
  • the identity authentication information is used to authenticate the user equipment 1 to generate an authentication result according to the user identification information and the user identity authentication information, to determine whether the user equipment 1 is a legitimate user of the multicast service.
  • the user identity authentication information may include a password set by the user equipment 1 and the network authentication device 3, or a digital certificate, and may also include other types of identity authentication information, as long as the network authentication device 3 can determine the user device by using the identity authentication information.
  • the identity of 1 can be, which should be understood by those skilled in the art, and will not be described herein.
  • the network authentication device 3 After the user equipment 1 passes the identity authentication, the network authentication device 3 searches for the access rights of the certain types of multicast services requested by the user equipment 1 in the multicast service access rights table according to the user identification information, when the network authentication device 3 After the access right of the certain type of multicast service requested by the user equipment 1 is found, the network of the user equipment 1 is formed according to the network identifier information of the user equipment 1 (the network identifier information includes an IP address, a MAC address, and a DSL port number). The mapping relationship between the port information (the DSL port number) and the access rights of the multicast service requested by the user equipment 1 to generate the multicast service authorization information corresponding to the user equipment 1.
  • the DSL port number is used to indicate that the network access device 2 provides the user equipment 1 with a certain multicast service of a certain type of multicast service that it applies for through the DSL port.
  • the network authentication device 3 sends the multicast service authorization information corresponding to the user equipment 1 and the authentication result to the network access device 2.
  • the network access device 2 stores the network port information (DSL port number) and the authentication session identification information as an index, and stores the corresponding information corresponding to the user equipment 1.
  • the multicast service access rights are forwarded to the user equipment 1.
  • the authentication session identification information may include an EAP ID or a session ID, and may also include other types of session identification information, which is determined by the protocol used by the authentication session, which should be understood by those skilled in the art and will not be described herein.
  • EAP protocol is a commonly used authentication method in the field of communications.
  • EAP is a protocol defined by the IETF. It provides RFC3748 with a message format for mutual interaction.
  • Each EAP session has an identifier that allows both parties to understand which session the authentication process belongs to, that is, the result of the authorization. Sub-certification related.
  • the authentication session identification information may be used to deactivate the authentication service according to the authentication session identification information when the user equipment 1 requests to cancel a certain type of multicast service.
  • the network authentication device 3 can also find the access rights of a certain type of multicast service requested by the user equipment 1 in the multicast service access authority table according to the user identification information.
  • the multicast service access permission table searches for access rights of a certain type of network service associated with the multicast service, and associates one or more types of networks associated with a certain type of multicast service requested by the user equipment 1.
  • the access rights of the service are sent to the network access device 2 together with the access rights of a certain type of multicast service requested by the user equipment 1 and stored in the network access device 2.
  • the network authentication device 3 may also not send the authentication result to the network access device 2, but only send the multicast service authorization information to the network access device 2, because the network access device 2 only receives by means of receiving
  • the multicast service authorization information can be known that the user equipment 1 has passed the identity authentication, and the user equipment 1 judges that it has passed the identity authentication only because it has not received the authentication result within a predetermined period of time.
  • the network authentication device 3 transmits the authentication result that has not passed the identity authentication to the network access device 2, and the identity is not passed through the network access device 2.
  • the authenticated authentication result is sent to the user equipment 1, and therefore, in this case, the user equipment 1 judges whether or not it passes the identity authentication only by whether it receives the authentication result within a predetermined period of time.
  • the network access device 2 determines that the message from the user equipment 1 is a multicast service request message sent by the user equipment 1 for requesting a certain multicast service in a certain type of multicast service ( After the multicast service request message includes the network identifier information of the user equipment 1 and a certain multicast service identifier information requested by the user equipment 1, the network access device 2 extracts the user equipment 1 from the multicast service request message.
  • Network identification information and searching for multicast service authorization information corresponding to the user equipment 1 according to the network identification information, and according to the multicast service authorization information corresponding to the user equipment 1 stored in the network access device 2 Determining whether the user equipment 1 has the right to access the multicast service requested by the user equipment 1 and providing the multicast service to the user equipment 1 when the user equipment 1 has the right to access the multicast service, when the user equipment 1 When the permission of the multicast service is not accessed, the multicast service is denied to the user equipment 1.
  • the network access device 2 can provide the multicast service to the user equipment 1 in two ways.
  • the network access device 2 replicates the multicast of the multicast service requested by the user equipment 1. Stream and send it to user device 1 through the corresponding network port (DSL port).
  • the network access device 2 forwards the multicast service request message of the user equipment 1 to the upper-level network. That is, the IGMP request message, and the upper-level network does not check the authority of the multicast service request until the multicast stream of the multicast service is transmitted to the network access device 2, and the group is forwarded via the network access device 2. Broadcast to user device 1.
  • FIG. 3 is a flow chart showing a specific implementation of the step S12 in FIG. 2, that is, a method for obtaining, by the network authentication device, multicast service authorization information corresponding to the user equipment.
  • step S121 is performed to send the service authentication request message to the network authentication device.
  • step S122 the multicast service authorization information corresponding to the user equipment from the network authentication device is received; Finally, step S123 is executed to store the multicast service authorization information corresponding to the used device.
  • the network access device 2 determines that the request message is a service authentication request message sent by the user equipment 1 to the network authentication device 3 for requesting a certain type of multicast service (the authentication request message includes user identification information and user identity authentication information) Specifically, in step S121, the network access device 2 adds the network identifier information of the user equipment 1 (the network identifier information includes an IP address, a MAC address, a DSL port number) in the service authentication request message, and The updated service authentication request message is sent to the network authentication device 3.
  • the network identifier information includes an IP address, a MAC address, a DSL port number
  • the network access device 2 After receiving the service authentication request message from the user equipment 1, the network access device 2 first detects the user identification information therein to determine the type of service authentication requested by the user equipment 1, and then, the network access device 2 Find the appropriate network authentication device and send the service authentication request message to the correct service provider.
  • the network authentication device 3 After receiving the updated service authentication request message from the network access device 2, the network authentication device 3 generates multicast service authorization information corresponding to the user equipment according to the service authentication request message, and authorizes the multicast service. Information is sent to the network access device 2.
  • the network access device 2 uses the network port information (DSL port number) and the authentication session identification information as The index stores the multicast service access rights corresponding to the user equipment 1 and forwards the authentication result to the user equipment 1.
  • the authentication session identification information may include an EAP ID or a session ID, and may also include other types of session identification information, which is determined by the protocol used by the authentication session, which should be understood by those skilled in the art and will not be described herein.
  • EAP protocol is a commonly used authentication method in the field of communications.
  • EAP is a protocol defined by the IETF. It provides RFC3748 with a message format for mutual interaction.
  • Each EAP session has an identifier that allows both parties to understand which session the authentication process belongs to, that is, the result of the authorization. Sub-certification related.
  • the authentication session identification information may be used to deactivate the authentication according to the authentication session identification information.
  • FIG. 4 is a flow chart showing a method for controlling a user equipment to quit a multicast service in a network access device accessing a network according to another embodiment of the present invention.
  • step S21 is performed to receive a multicast service cancellation request message from the user equipment.
  • step S22 is performed to extract the authentication session identification information from the multicast service cancellation request message.
  • step S23 is performed to delete the access authority of the multicast service corresponding to the authentication session identifier information according to the authentication session identifier information.
  • the user equipment 1 Sending a multicast service cancellation request message to the network access device 2 (the multicast service cancellation request message includes the authentication session identification information generated when the user equipment 1 applies for the multicast service and requests the network authentication device 3 for identity authentication, and After the network access device 2 receives the multicast service cancellation request message sent from the user equipment, the network access device 2 extracts the user equipment 1 to apply for the multicast service and requests the network authentication device 3 for the identity.
  • the authentication session identification information generated during the authentication, and the access authority of the network service requested by the user equipment 1 is searched according to the authentication session identification information, and the network access device 2 searches for the deletion requested by the user equipment 1 After the network network service access rights, delete it.
  • the user management system may also delete the multicast service access rights corresponding to the user equipment 1 stored in the network access device 2 according to the user identification information.
  • FIG. 5 is a flow chart showing a method for controlling a user equipment to access a multicast service in a network authentication device accessing a network according to still another embodiment of the present invention.
  • step S31 is performed to receive a service authentication request message from the user equipment that is forwarded by the network access device;
  • step S32 is performed to extract user identity authentication information, user identity information, and network identity information of the user equipment from the service authentication request message.
  • Step S33 performing identity authentication on the user equipment according to the user identity authentication information and the user identity information; Then, in step S34, when the user equipment passes the identity authentication, the access authority of the user equipment is searched according to the user identifier information;
  • step S35 the multicast service authorization information corresponding to the user equipment is generated according to the network identifier information of the user equipment and the access authority of the user equipment;
  • step S36 the multicast service authorization information is sent to the network access device.
  • the network access device 2 determines that the request message from the user equipment 1 is a service authentication request message sent by the user equipment 1 to the network authentication device 3 for requesting a certain type of multicast service, the authentication request message includes the user identifier. After the information and the user identity authentication information, the network access device 2 adds the network identifier information of the user equipment 1 (the network identifier information includes an IP address, a MAC address, a DSL port number) in the service authentication request message, and is updated. The subsequent service authentication request message is sent to the network authentication device 3 for acquiring the multicast service authorization information corresponding to the user equipment 1 to the network authentication device 3.
  • the network authentication device 3 After receiving the updated service authentication request message from the network access device 2, the network authentication device 3 extracts the user identification information and the user identity authentication information, and performs the user device 1 according to the user identification information and the user identity authentication information.
  • the identity authentication is used to generate an authentication result, which is used to determine whether the user equipment 1 is a legitimate user of the multicast service.
  • step S34 and step S35 after the user equipment 1 passes the identity authentication, the network authentication device 3 searches for a certain type of multicast service requested by the user equipment 1 in the multicast service access authority table according to the user identifier information.
  • Access authority after the network authentication device 3 finds the access right of a certain type of multicast service requested by the user equipment 1, according to the network identification information of the user equipment 1 (the network identification information includes an IP address, a MAC address,
  • the DSL port number forms a mapping relationship between the network port information (DSL port number) of the user equipment 1 and the access rights of a certain type of multicast service requested by the user equipment 1 to generate a multicast corresponding to the user equipment 1 Business authorization information.
  • the DSL port number is used to indicate that the network access device 2 provides the user equipment 1 with a certain multicast service of a certain type of multicast service that it applies for through the DSL port.
  • the network authentication device 3 sends the multicast service authorization information corresponding to the user equipment 1 and the authentication result to the network access device 2.
  • the network access device 2 After receiving the multicast service authorization information and the authentication result sent by the network authentication device 3, the network access device 2 stores the group corresponding to the user equipment 1 by using the network port information (DSL port number) and the authentication session identification information as indexes. Broadcast service access rights and forward the authentication result to user equipment 1.
  • the network authentication device 3 can also find the access rights of a certain type of multicast service requested by the user equipment 1 in the multicast service access authority table according to the user identification information.
  • the multicast service access permission table searches for access rights of a certain type of network service associated with the multicast service, and associates one or more types of networks associated with a certain type of multicast service requested by the user equipment 1.
  • the access rights of the service are sent to the network access device 2 together with the access rights of a certain type of multicast service requested by the user equipment 1 and stored in the network access device 2.
  • the network authentication device 3 may also not send the authentication result to the network access device 2, but only send the multicast service authorization information to the network access device 2, because the network access device 2 only receives by means of receiving
  • the multicast service authorization information can be known that the user equipment 1 has passed the identity authentication, and the user equipment 1 judges that it has passed the identity authentication only because it has not received the authentication result within a predetermined period of time.
  • the network authentication device 3 transmits the authentication result that has not passed the identity authentication to the network access device 2, and the unreached identity via the network access device 2
  • the authenticated authentication result is sent to the user equipment 1, and therefore, in this case, the user equipment 1 judges whether or not it passes the identity authentication only by whether it receives the authentication result within a predetermined period of time.
  • FIG. 6 is a schematic structural diagram of a control apparatus for controlling a user equipment to access a multicast service in a network access device of an access network according to an embodiment of the present invention.
  • the control device 1 includes a first judging device 11, an obtaining device 12, a second judging device 13, and a first transmitting device 14.
  • the first determining device 11 determines the received message type from the user equipment; If the received message from the user equipment is a service authentication request message, the acquiring device 12 acquires multicast service authorization information corresponding to the user equipment from the network authentication device;
  • the second determining device 13 determines, according to the saved multicast service authorization information corresponding to the user equipment, whether the user equipment has access.
  • the rights of the multicast service is a multicast service request message
  • the first sending device 14 When the user equipment has the right to access the multicast service, the first sending device 14 provides the multicast service to the user equipment.
  • the receiving device in the network access device 2 (not shown in FIG. 6 for simplicity) receives the request message from the user device 1, the first determining device 11 in the control device 1 requests the request. The type of message is judged. If the first determining device 11 determines that the request message is used by the user equipment 1 to request a certain type of multicast service, the first authentication device 11 can be sent to the network authentication device 3 (the network authentication device can be an authentication server, specifically, an AAA authentication server).
  • the network access device 2 After the service authentication request message (the authentication request message includes the user identification information and the user identity authentication information), the network access device 2 adds the network identification information of the user equipment 1 to the service authentication request message (the network identification information includes The IP address, the MAC address, the DSL port number, and the updated service authentication request message are sent to the network authentication device 3 by the second sending device 121 in the obtaining device 12 for acquiring the user device 1 with the network authentication device 3. Corresponding multicast service authorization information.
  • the determining device first detects the user identification information therein to determine the type of service authentication requested by the user device 1, The lookup device in the network access device 2 then looks up the appropriate network authentication device and sends the service authentication request message to the correct service provider.
  • the second extracting device 32 extracts the user identification information therefrom (for example: xyz@IPTV service for identification)
  • the user xyz requests the IPTV service provider for the IPTV service) and the user identity authentication information, and the authentication device 33 according to the
  • the user identification information and the user identity authentication information are used to authenticate the user equipment 1 to generate an authentication result, which is used to determine whether the user equipment 1 is a legitimate user of the multicast service.
  • the user identity authentication information may include a password set by the user equipment 1 and the network authentication device 3, or a digital certificate, and may also include other types of identity authentication information, as long as the network authentication device 3 can determine the user device by using the identity authentication information.
  • the identity of 1 is sufficient, which should be understood by those skilled in the art, and will not be described herein.
  • the searching device 34 in the network authentication device 3 searches for the access authority of the certain type of multicast service requested by the user equipment 1 in the multicast service access authority table according to the user identification information.
  • the second generating device 35 is configured according to the network identification information of the user equipment 1 (the network identification information includes an IP address, a MAC address, and a DSL).
  • the port number forms a mapping relationship between the network port information (DSL port number) of the user equipment 1 and the access rights of the multicast service requested by the user equipment 1 to generate a multicast service corresponding to the user equipment 1 Authorization information.
  • the DSL port number is used to indicate that the network access device 2 provides the user equipment 1 with a certain multicast service in a certain type of multicast service that it applies for through the DSL port.
  • the third sending device 36 in the network authentication device 3 sends the multicast service authorization information corresponding to the user equipment 1 and the authentication result to the network access device 2.
  • the storage device 123 indexes the network port information (DSL port number) and the authentication session identification information. And storing the multicast service access authority corresponding to the user equipment 1 and forwarding the authentication result to the user equipment 1.
  • the authentication session identification information may include an EAP ID or a session ID, and may also include other types of session identification information, which is determined by the protocol used by the authentication session, which should be understood by those skilled in the art and will not be described herein.
  • EAP protocol is a commonly used authentication method in the field of communications.
  • EAP is a protocol defined by the IETF. It provides RFC3748 with a message format for mutual interaction.
  • Each EAP session has an identifier that allows both parties to understand which session the authentication process belongs to, that is, the result of the authorization. Sub-certification related.
  • Authentication session identifier The information may be specifically deautured according to the authentication session identification information when the user equipment 1 requests to cancel a certain type of multicast service.
  • the searching device 34 in the network authentication device 3 searches for the access rights of certain types of multicast services requested by the user equipment 1 in the multicast service access rights table according to the user identification information.
  • the access authority of a certain type of network service associated with the multicast service may be searched in the multicast service access permission table, and the certain type of group requested by the user equipment 1 is requested by the third sending device 36.
  • the access rights of one or more types of network services associated with the broadcast service are sent to the network access device 2 and stored in the network access device 2 together with the access rights of a certain type of multicast service requested by the user equipment 1.
  • the third transmitting device 36 in the network authentication device 3 may also not send the authentication result to the network access device 2, but only send the multicast service authorization information to the network access device 2, because the network The access device 2 can know that the user equipment 1 has passed the identity authentication only by receiving the multicast service authorization information, and the user equipment 1 judges that the user equipment 1 passes the identity authentication only because it has not received the authentication result within a predetermined period of time. .
  • the third sending device 36 in the network authentication device 3 sends the authentication result that has not passed the identity authentication to the network access device 2, and is connected via the network.
  • the incoming device 2 transmits the authentication result that has not passed the identity authentication to the user device 1, and therefore, in this case, the user device 1 determines whether it passes the identity authentication only based on whether it receives the authentication result within a predetermined period of time. Just fine.
  • the first determining device 11 in the control device 1 determines that the request message from the user equipment 1 is a multicast service request message sent by the user equipment 1 for requesting a certain multicast service in a certain type of multicast service (the group)
  • the broadcast service request message includes the network identification information of the user equipment 1 and a certain multicast service identification information requested by the user equipment 1
  • the extraction device in the network access device 2 extracting the network identification information of the user equipment 1 from the multicast service request message, and the searching device (not shown in FIG. 6 for simplicity) searches for the multicast corresponding to the user equipment 1 according to the network identification information.
  • the service authorization information, the second determining device 13 determines the user equipment 1 according to the multicast service authorization information corresponding to the user equipment 1 stored in the network access device 2 If the user equipment 1 has the right to access the multicast service, the first sending device 14 provides the multicast service to the user equipment 1 when the user equipment 1 has the right to access the multicast service. 1 If the permission of the multicast service is not accessed, the multicast service is denied to the user equipment 1.
  • the network access device 2 can provide the multicast service to the user equipment 1 in two ways.
  • the network access device 2 replicates the multicast of the multicast service requested by the user equipment 1. Stream and send it to user device 1 through the corresponding network port (DSL port).
  • the network access device 2 forwards the multicast service request message of the user equipment 1 to the upper-level network. That is, the IGMP request message, and the upper-level network does not check the authority of the multicast service request until the multicast stream of the multicast service is transmitted to the network access device 2, and the group is forwarded via the network access device 2. Broadcast to user device 1.
  • FIG. 7 is a schematic diagram of a first embodiment of the first obtaining device 12, which is used to obtain the multicast service authorization information corresponding to the user equipment from the network authentication device.
  • the first acquisition device 12 includes a second delivery device 121, a first receiving device 122, and a storage device 123.
  • the second sending device 121 is configured to send the service authentication request message to the network authentication device.
  • the first receiving device 122 is configured to receive the multicast service authorization information corresponding to the user equipment from the network authentication device.
  • the storage device 123 is configured to store the multicast service authorization information corresponding to the user equipment.
  • the first determining device 11 in the network access device 2 determines that the request message from the user equipment 1 is a service authentication request message sent by the user equipment 1 for requesting a certain type of multicast service to the network authentication device 3 ( After the authentication request message includes user identification information and user identity authentication information, the network access device 2 is in the service authentication request.
  • the network identifier information of the user equipment 1 is added to the message (the network identifier information includes an IP address, a MAC address, a DSL port number), and the second sending device 121 in the obtaining device 12 sends the updated service authentication request message to the network authentication device.
  • 3 is configured to acquire, by the network authentication device 3, multicast service authorization information corresponding to the user equipment 1.
  • the determining device first detects the user identification information therein to determine the type of service authentication requested by the user device 1, The lookup device in the network access device 2 then looks up the appropriate network authentication device and sends the service authentication request message to the correct service provider.
  • the third receiving device 31 in the network authentication device 3 receives the updated service authentication request message from the network access device 2, the first generating device generates a group corresponding to the user equipment according to the service authentication request message.
  • the third transmission means 36 sends the multicast service authorization information to the network access device 2.
  • the storage device 123 indexes the network port information (DSL port number) and the authentication session identification information.
  • the storage and user authentication session identification information may include an EAP ID or a session ID, and may also include other types of session identification information, depending on the protocol used in the authentication session, which should be understood by those skilled in the art. Narration.
  • EAP protocol is a commonly used authentication method in the field of communications.
  • EAP is a protocol defined by the IETF. It provides RFC3748 with a message format for mutual interaction.
  • Each EAP session has an identifier that allows both parties to understand which session the authentication process belongs to, that is, the result of the authorization. Sub-certification related.
  • the authentication session identification information may be used to de-authenticate the authentication according to the authentication session identification information.
  • FIG. 8 is a schematic structural diagram of a control apparatus for controlling a user equipment to exit a multicast service in a network access device of an access network according to another embodiment of the present invention.
  • the control device 2 includes a second receiving device 21, a first extracting device 22, and a Second delete device 23.
  • the second receiving device 21 receives a multicast service cancellation request message from the user equipment
  • the first extracting device 22 extracts authentication session identification information from the multicast service cancellation request message.
  • the second deleting means 23 deletes the access authority of the multicast service corresponding to the authentication session identification information according to the authentication session identification information.
  • the user equipment 1 In order to avoid excessive storage load of the network access device 2, when the user equipment 1 needs to delete access rights stored in the network access device 2 corresponding to some type of network service previously applied, the user equipment 1 The sending device sends a multicast service cancel request message to the network access device 2 (the multicast service cancel request message includes the authentication generated when the user equipment 1 applies for the multicast service and requests the network authentication device 3 for identity authentication).
  • the session identifier information and the network identifier information of the user equipment 1) after the second receiving device 21 in the control device 2 receives the multicast service cancellation request message sent by the user equipment, the first extracting device 22 extracts the user equipment 1 therefrom.
  • the second deleting device 23 deletes the access right of the network service requested by the user equipment 1 stored in the network access device 2 to delete the network service.
  • the user management system may also delete the multicast service access rights corresponding to the user equipment 1 stored in the network access device 2 according to the user identification information.
  • FIG. 9 shows an auxiliary control device for controlling user equipment to access a multicast service in a network authentication device accessing a network according to still another embodiment of the present invention.
  • the control device 3 includes a third receiving device 31, a second extracting device 32, an authenticating device 33, a searching device 34, a second generating device 35, and a third transmitting device 36.
  • the third receiving device 31 receives a service authentication request message from the user equipment that is forwarded via the network access device;
  • the second extracting device 32 extracts user identity authentication information, user identifier information, and network identity information of the user equipment from the service authentication request message;
  • the authentication device 33 performs identity authentication on the user according to the user identity authentication information and the user identification information.
  • the searching device 34 when the user equipment passes the identity authentication, searches for the access authority of the user equipment according to the user identifier information;
  • the second generating device 35 is configured to generate, according to the network identity information of the user equipment and the access authority of the user equipment, the multicast service authorization information corresponding to the user equipment.
  • the third transmitting device 36 sends the multicast service authorization information to the network access device.
  • the network access device 2 when the first determining device 11 in the network access device 2 determines that the request message from the user equipment 1 is a service authentication request message sent by the user equipment 1 for requesting a certain type of multicast service to the network authentication device 3 ( After the authentication request message includes the user identification information and the user identity authentication information, the network access device 2 adds the network identifier information of the user equipment 1 to the service authentication request message (the network identifier information includes an IP address, a MAC address, and a DSL). The port number), the second sending device 121 in the first obtaining device 12 sends the updated service authentication request message to the network authentication device 3 for acquiring the multicast service authorization information corresponding to the user device 1 to the network authentication device 3. .
  • the second extracting device 32 extracts user identification information and user identity authentication information therefrom, and the authentication device 33 is based on the user.
  • the identification information and the user identity authentication information are used to authenticate the user equipment 1 to generate an authentication result, which is used to determine whether the user equipment 1 is a legitimate user of the multicast service.
  • the locating device 34 searches for the access rights of the certain type of multicast service requested by the user equipment 1 in the multicast service access rights table according to the user identification information, and the network authentication device 3 searches for
  • the second generating device 35 forms the network identity information according to the user equipment 1 (the network identifier information includes an IP address, a MAC address, a DSL port number).
  • the network identifier information includes an IP address, a MAC address, a DSL port number.
  • the DSL port number is used to indicate that the network access device 2 provides the user equipment 1 with a certain multicast service of a certain type of multicast service that it applies for through the DSL port.
  • the third sending device 36 sends the multicast service authorization information corresponding to the user equipment 1 and the authentication result to the network access device 2.
  • the storage device 123 indexes the network port information (DSL port number) and the authentication session identification information. And storing the multicast service access authority corresponding to the user equipment 1 and forwarding the authentication result to the user equipment 1.
  • the searching device 34 in the network authentication device 3 searches for the access rights of certain types of multicast services requested by the user equipment 1 in the multicast service access rights table according to the user identification information.
  • the access authority of a certain type of network service associated with the multicast service may be searched in the multicast service access permission table, and the certain type of group requested by the user equipment 1 is requested by the third sending device 36.
  • the third transmitting device 36 in the control device may also Sending the authentication result to the network access device 2, and transmitting only the multicast service authorization information to the network access device 2, because the network access device 2 can know that the user equipment 1 has been received only by receiving the multicast service authorization information.
  • identity authentication the user equipment 1 judges that it has passed the identity authentication only because it has not received the authentication result within a predetermined period of time.
  • the third sending device 36 sends the authentication result that has not passed the identity authentication to the network access device 2, and fails through the network access device 2
  • the authentication result of the identity authentication is sent to the user equipment 1, and therefore, in this case, the user equipment 1 judges whether or not it passes the identity authentication only by whether it receives the authentication result within a predetermined period of time.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

接入网络中控制用户设备接入组播业务的方法和装置 技术领域
本发明涉及接入网络， 尤其涉及接入网络中的网络接入设备和网 络认证设备。 背景技术
当前， 计算机网絡事业迅速发展， 相应的网络应用层出不穷， 例 如宽带接入、 V0D服务、 视频会议、 交互式多点广播等， 网絡运营商 和服务提供商在提供网络增值服务时， 一般在用户终端通过数字用户线 路（DSL )或其它接入网络配置宽带增值服务的时候， 需要在网络接入 级（network access )和服务级别 （service level )上对用户设备进 行认证， 即对用户设备身份进行认证和确定用户设备接入网络业务的权 限， 并在认证成功的基础上为用户设备配置端口， 以提供相应的服务。
例如, 对移动组播接收者 ( nomadic mul t icas t receivers ) 以及一 些诸如非主流组播服务（如视频会议、朋友间视频共享等）的网络业务， 网络接入设备需要根据服务认证 ( service authent icat ion ) 的结果来 处理组播接入控制， 这需要接入节点参与服务认证过程。 但目前， 还没 有合适的认证解决方案来实现这个目标。
根据现有技术的两种实现方案具体如下：
第一种实现方案： 基于 PPPoE (以太网上的点对点协议）认证的接 入控制方法。
首先， 用户设备发起 PPPoE认证请求， BRAS (宽带远程接入服务设 备）从中提取出用户相关信息并将其发送到相应的网络认证设备以对该 用户设备进行认证， 如果认证成功， 就为该用户设备设置一个私有 IP 地址， 并将电子节目菜单（EPG )推送到该用户设备； 其次， 该用户设 备将载于 PPPoE包中的 IGMP (互联网组播管理协议）请求消息发送到 BRAS, BRAS从 IGMP请求消息中提取出用户请求信息并将诸如 IP地址、 DSLAM线 ID、 请求组播组地址等的认证信息传送给网络认证设备以进行 认证； 最后， 网络认证设备返回认证结果， 然后 BRAS将私有控制消息 推送至网络接入设备， 使网络接入设备将用户设备所请求的组播数据流 传输到用户设备。
该实现方案的缺陷在于： 1 ) 由于使用 BRAS判定用户接入网络业务 的权限， 然后再将接入权限推送给网络接入设备， 使得在频道变更时速 度比较慢； 1 ) 需要扩展标准 Radius服务器（远程用户拨号网络认证设 备） 的功能， 以基于从 IGMP联合消息中提取出的用户相关信息来对用 户进行认证； 3 )使用私有控制消息将接入权限传送给网络接入设备。
第二种实现方案： 首先， 通过 802. lx、 PPPoE或 Web界面入口等方 法， 用户设备被网备认证设备认证， 并获取相关的电子节目菜单（ EPG ); 其次， 用户设备向网絡接入设备发送 IGMP请求消息 （即网络业务请求 消息）； 然后， 网络接入设备截取 IGMP请求消息， 提取其中的用户设备 相关信息 （DSL端口号、 IP地址、 MAC地址、 请求组播组地址）等， 并 将这些用户设备相关信息转发至网络认证设备； 随后， 网络认证设备对 用户设备的请求进行认证， 并将相关的接入权限推送至网络接入设备， 该接入权限将存储在网络接入设备上； 最后， 网络接入设备基于所接收 到的接入权限， 允许或拒绝提供用户所申请的组播业务。
该实现方案的缺陷在于： 1 )存在两个分离的认证步骤， 网络认证设 备必须将来自 802. lx、 PPPoE或 Web界面入口认证的组播接入权限与 IGMP请求消息中所包含的用户相关信息 （网络端口信息）相关联； 2 ) 需要扩展标准 Radius服务器的功能， 以基于从 IGMP请求消息中提取出 的用户相关信息来认证用户身份； 3 )采用私有消息将組播接入权限推 送至网络接入设备， 在用户终端发出 IGMP请求消息之后存在一个认证 处理延时。
由上述可见， 在现有技术中， 都存在这样或那样的缺陷， 例如， 上 述第一种实现方案中对于每次网絡服务请求， 用户设备均需要通过网络 认证设备进行认证， 导致认证的速度比较慢； 而对于第二种实现方案， 网絡接入设备可以存储经过认证的用户设备接入权限， 但其获取该用户 设备接入权限的过程比较复杂， 例如存在两个分离的认证步骤， 这也不 是一个合适的方案。 发明内容
为解决现有技术中的上述缺点， 本发明提出了一种在接入网络中用 于控制用户设备接入组播业务的方法和装置。 当用户设备申请某类組播 业务时， 只需进行一次用户设备身份认证即可， 当该用户设备通过身份 认证后， 网络认证设备将与该用户设备相对应的组播业务接入权限发送 至网络接入设备并存储于该网络接入设备。 具体地， 当该用户设备申请 该类组播业务中的某项组播业务时， 只需根据网络接入设备中保存的组 播业务授权信息来判断该用户设备是否具有接入所述组播业务的权限 即可。
根据本发明的第一个方面， 提供了一种在接入网络的网络接入设备 中用于控制用户设备接入组播业务的方法， 其特征在于， 包括以下步骤 a. 判断接收到的来自所述用户设备的消息类型； b. 如果所述接收到的 来自所述用户设备的消息为服务认证请求消息， 则向网络认证设备获取 与所述用户设备相对应的组播业务授权信息，其中， 所述服务认证请求 消息用于所述用户设备申请某类组播业务； c. 如果所述接收到的来自 所述用户设备的消息为组播业务请求消息， 则根据保存的与所述用户设 备相对应的组播业务授权信息判断所述用户设备是否有接入所述组播 业务的权限， 当所述用户设备有接入所述组播业务的权限时向所述用户 设备提供所述组播业务， 其中， 所述组播业务请求消息用于所述用户 设备申请某项组播业务。
根据本发明的第二个方面， 提供了一种在接入网络的网络认证设备 中用于控制用户设备接入組播业务的方法，其特征在于， 包括以下步骤： i .接收经由网络接入设备转发的来自所述用户设备的服务认证请求消 息； i i .根据所述服务认证请求消息， 生成与所述用户设备相对应的组 播业务授权信息； i i i .将所述组播业务授权信息发送至所述网絡接入设 备。
根据本发明的第三个方面， 提供了一种在接入网络的网络接入设备 中用于控制用户设备接入组播业务的控制装置， 其特征在于， 包括： 第 一判断装置， 用于判断接收到的来自用户设备的消息类型； 获取装置， 用于如果所述接收到的来自所述用户设备的消息为服务认证请求消息， 则向网络认证设备获取与所述用户设备相对应的组播业务授权信息， 其 中， 所述服务认证请求消息用于所述用户设备申请某类組播业务； 第 二判断装置， 用于如果所述接收到的来自所述用户设备的消息为组播业 务请求消息， 则根据保存的与所述用户设备相对应的所述组播业务授权 信息判断所述用户设备是否有接入所述组播业务的权限， 第一发送装 置， 用于当所述用户设备有接入所述组播业务的权限时向所述用户设备 提供所述组播业务， 其中， 所述组播业务请求消息用于所述用户设备 申请某项組播业务。
根据本发明的第四个方面， 提供了一种在接入网络的网络认证设备 中用于控制用户设备接入组播业务的辅助控制装置，其特征在于， 包括： 第三接收装置， 用于接收经由网络接入设备转发的来自所述用户设备的 服务认证请求消息； 第一生成装置， 用于根据所述服务认证请求消息， 生成与所述用户设备相对应的组播业务授权信息；第三发送装置， 用于 将所述组播业务授权信息发送至所述网络接入设备。
根据本发明的第五个方面，提供了一种在接入网络中用于控制用户 设备接入组播业务的组播接入系统， 包括网络接入设备以及网络认证 设备， 其中， 所述网络接入设备包括如权利要求 8至 12中任一项所 述的用于控制用户设备接入组播业务的控制装置， 所述网络认证设备 包括如权利要求 13和 14中任一项所述的用于控制用户设备接入組播 业务的辅助控制装置。
本发明中，对申请某类组播业务的用户设备来说，只需对该用户设备 的身份进行一次认证， 当该用户设备通过认证后， 网络认证设备将与该 用户设备相对应的組播业务接入权限发送至网络接入设备并存储于该 网络接入设备， 具体地， 当该用户设备申请该类组播业务中的某项組播 业务时， 网络接入设备只需根据其中保存的组播业务授权信息来判断该 用户设备是否具有接入所述组播业务的权限即可， 而无需在用户设备申 请该类中业务中的每项组播业务时都对该用户设备进行身份认证， 从而 可以减少认证次数， 并且某项网络业务只需复制少数几份到相应的网络 接入设备并由该网络接入设备转发给不同的用户设备， 从而可以节约网 络带宽。
由于本发明是基于现有的网络通信技术， 可以方便地实现本发明的 身份认证及业务认证， 所以本发明可用于由网络业务提供商 （NSP )和 相关服务提供商 （ASP )提供组播服务的场合； 并且可以在跨 NSP域的 范围内应用移动组播服务。 附图说明
通过阅读参照以下附图对非限制性实施例所作的详细描述， 本发明 的其它特征、 目的和优点将会变得更明显：
图 1示出根据本发明的在接入网络中用于控制用户设备接入组播 业务的系统示意图；
图 2示出根据本发明的一个具体实施方式的， 在接入网络的网络 接入设备中用于控制用户设备接入组播业务的方法的流程图；
图 3示出图 2中所述步骤 S12的一个具体实施方式， 即向网络认 证设备获取与所述用户设备相对应的组播业务授权信息的方法的流 程图；
图 4示出根据本发明的一个具体实施方式的， 在接入网络的网络 接入设备中用于控制用户设备退出组播业务的方法的流程图；
图 5示出根据本发明的一个具体实施方式的， 在接入网络的网络 认证设备中用于控制用户设备接入组播业务的方法的流程图；
图 6示出根据本发明的一个具体实施方式的， 在接入网络的网络 接入设备中用于控制用户设备接入组播业务的控制装置的结构示意 图；
图 7示出图 6中所述第一获取装置 12的一个具体实施方式， 即 用于向网络认证设备获取与所述用户设备相对应的组播业务授权信 息的第一获取装置 12的结构示意图； 图 8示出根据本发明的一个具体实施方式的， 在接入网络的网络 接入设备中用于控制用户设备退出组播业务的控制装置的结构示意 图； 以及
图 9示出根据本发明的一个具体实施方式的， 在接入网络的网络 认证设备中用于控制用户设备接入组播业务的辅助控制装置。 具体实施方式
下面结合附图对本发明作进一步详细描述。
图 1示出根据本发明的在接入网络中用于控制用户设备接入组播业 务的系统示意图。 尽管图中只示出了一个用户设备 1 , 但在具体应用 中可以有多个用户设备申请相同的某类组播业务中的相同或不同的 某项组播业务。
具体地， 某类组播业务可以包括 IPTV、 上网、 视频、 语音等网络 业务。 在同一类业务中， 用户设备 1也会发出多次请求， 例如在被允 许接入 IPTV业务后， 用户设备 1会发出转换频道的请求， 即停止继 续接收频道 1的节目， 而是发出接入频道 2的请求， 待被允许接入频 道 2后的某一个时刻后， 又再次发出接入频道 N的请求， 以此类推， 因此， 网络接入设备 2会一次次地对来自用户设备 1的接入一项网络 业务的请求进行处理。
以下将针对一个用户设备 1向网络接入设备 2申请某类组播业务 中的某项组播业务的情况对本发明做进一步的详细描述。
具体地， 首先， 用户设备 1发送一请求消息至网络接入设备 2, 网络接入设备 2接收到来自该用户设备 1的请求消息后， 对该请求消 息进行判断。
其次， 当网络接入设备 2判断出来自用户设备 1的请求消息为用 户设备 1用于请求某类组播业务而发送至网络认证设备 3 (该网络认 证设备可以为一个认证服务器， 具体的， 可以为一个 AAA认证服务 器）的服务认证请求消息（该认证请求消息包括用户标识信息以及用 户身份认证信息）后， 该网络接入设备 2在该服务认证请求消息中加 入用户设备 1的网络标识信息 （该网絡标识信息包括 IP地址， MAC 地址， DSL端口号）， 并将更新后的服务认证请求消息发送至网絡认 证设备 3。
网絡认证设备 3接收到来自网络接入设备 2的更新后的服务认证 请求消息后， 从中提取用户标识信息 （例如： xyz@IPTV service用于 标识用户 xyz向 IPTV服务提供商申请 IPTV服务） 以及用户身份认 证信息， 并根据该用户标识信息以及用户身份认证信息， 对用户设备 1进行身份认证以生成认证结果， 用以判断该用户设备 1是否为该类 组播业务的合法用户。 该用户身份认证信息可以包括用户设备 1与网 络认证设备 3预先设置好的口令， 或数字证书， 也可以包括其他类型 的身份认证信息， 只要网络认证设备 3能够凭借该身份认证信息确定 该用户设备 1的身份即可， 这是本领域技术人员应能理解的， 在此不 作贅述。
当用户设备 1通过身份认证后， 网络认证设备 3根据用户标识信 息在其组播业务接入权限表中查找用户设备 1所请求的某类组播业务 的接入权限， 当该网络认证设备 3查找到用户设备 1所请求的某类组 播业务的接入权限后， 根据用户设备 1的网络标识信息（该网络标识 信息包括 IP地址， MAC地址， DSL端口号）形成该用户设备 1的网 络端口信息（DSL端口号）与该用户设备 1所请求的某类组播业务接 入权限的映射关系， 以生成与该用户设备 1相对应的组播业务授权信 息。 进一步地， DSL端口号用于指示网絡接入设备 2通过该 DSL端 口向用户设备 1提供其所申请的某类组播业务中的某项組播业务。 当 生成组播业务授权信息后， 网络认证设备 3将与用户设备 1相对应的 组播业务授权信息以及认证结果一同发送至网络接入设备 2。
网络接入设备 2接收到来自网絡认证设备 3发送的组播业务授权 信息和认证结果后， 以网络端口信息（ DSL端口号）以及认证会话标 识信息为索引，存储与用户设备 1相对应的组播业务接入权限并将认 证结果转发至用户设备 1。 该认证会话标识信息可以包括 EAP ID或 Session ID, 也可以包括其他类型的会话标识信息， 关键取决于认证 会话所采用的协议， 这是本领域技术人员应能理解， 在此不作赘述。 进一步地， EAP协议在通信领域是一种常用的认证方式。 EAP 是 IETF定义的一个协议， 为 RFC3748, 提供认证时双方交互的消息 格式， 每个 EAP会话有个标识， 让会话双方理解所认证的处理是属 于哪次会话， 也即授权的结果是与哪次认证有关。 采用认证会话标识 信息可以在用户设备 1要求取消某类组播业务时， 根据该认证会话标 识信息有针对性地取消认证的服务。
再次， 当网络接入设备 2判断出来自用户设备 1的消息为用户设 备 1用于请求某类组播业务中的某项组播业务而发送的组播业务请求 消息（该组播业务请求消息包括用户设备 1的网络标识信息以及用户 设备 1所请求的某项组播业务标识信息）后， 网络接入设备 2从该组 播业务请求消息中提取出该用户设备 1的网络标识信息， 并根据该网 络标识信息查找与该用户设备 1相对应的组播业务授权信息， 并根据 保存于该网络接入设备 2的与该用户设备 1相对应的组播业务授权信 息判断用户设备 1是否有接入其所请求的该项组播业务的权限， 当用 户设备 1有接入该项组播业务的权限时向用户设备 1提供该项组播业 务， 当用户设备 1没有接入该项组播业务的权限时拒绝向用户设备 1 提供该项组播业务。
进一步地， 该网络接入设备 2可以通过两种方式向用户设备 1提 供该项组播业务。
第一种方式， 如果用户设备 1所申请的组播业务的组播流已到达 网路接入设备 1 , 则该网络接入设备 2复制用户设备 1所申请的该类 组播业务的组 "流， 并将其通过相应的网络端口 （DSL端口）发送至 用户设备 1。
第二种方式， 如果用户设备 1所申请的组播业务的组播流没有到 达网络接入设备 2, 则该网络接入设备 2将向上一级网络转发用户设 备 1的组播业务请求消息， 即 IGMP请求消息， 同时上一级网络不再 检查这个组播业务请求的权限， 直到该组播业务的组播流传送到该网 络接入设备 2, 并经由该网络接入设备 2转发该組播流给用户设备 1。 进一步地， 为了避免网絡接入设备 2的存储负担过重， 当用户设 备 1需要删除存储于网络接入设备 2中的对应于先前所申请的某类网 络业务的接入权限时， 用户设备 1向网络接入设备 2发送一组播业务 取消请求消息（该组播业务取消请求消息包括用户设备 1申请该类组 播业务而向网络认证设备 3请求身份认证时所产生的认证会话标识信 息以及用户设备 1的网络标识信息） ， 网络接入设备 2接收到来自用 户设备发送的组播业务取消请求消息后， 从中提取出该用户设备 1 申 请该类组播业务而向网络认证设备 3请求身份认证时所产生的认证会 话标识信息， 并根据该认证会话标识信息查找用户设备 1所请求删除 的该类网络业务的接入权限， 当网络接入设备 2查找到用户设备 1所 请求删除的该类网络业务的接入权限后将其删除。
图 2示出根据本发明的一个具体实施方式的， 在接入网络的网络 接入设备中用于控制用户设备接入组播业务的方法的流程图。
在本具体实施方式中， 首先， 执行步骤 S11 , 判断接收到的来自 所述用户设备的消息类型；
如果接收到的来自所述用户设备的消息为服务认证请求消息， 则 执行步骤 S12, 向网络认证设备获取与所述用户设备相对应的组播业 务授权信息；
如果接收到的来自所述用户设备的消息为组播业务请求消息， 则 执行步骤 S 13 , 根据保存的与所述用户设备相对应的组播业务授权信 息判断所述用户设备是否有接入所述组播业务的权限，
当所述用户设备有接入所述组播业务的权限时，则执行步驟 S 14 , 向所述用户设备提供所述组播业务。
具体地， 在步骤 S 11中， 当网络接入设备 2接收到来自该用户设 备 1的请求消息后， 对该请求消息的类型进行判断。 如果网络接入设 备 2判断出该请求消息为用户设备 1用于请求某类组播业务而发送至 网络认证设备 3 (该网络认证设备可以为一个认证服务器， 具体的， 可以为一个 AAA认证服务器） 的服务认证请求消息 （该认证请求消 息包括用户标识信息以及用户身份认证信息）后， 在步驟 S12中， 该 网络接入设备 2在该服务认证请求消息中加入用户设备 1的网络标识 信息 （该网络标识信息包括 IP地址， MAC地址， DSL端口号）， 并 将更新后的服务认证请求消息发送至网络认证设备 3用于向网络认证 设备 3获取与用户设备 1相对应的組播业务授权信息。 进一步地， 网 络接入设备 2接收到来自用户设备 1的服务认证请求消息后， 首先对 其中的用户标识信息进行检测， 以判断用户设备 1所请求的服务认证 的类型， 然后， 网络接入设备 2查找合适的网络认证设备并将该服务 认证请求消息发送至正确的服务提供商。
网络认证设备 3接收到来自网络接入设备 2的更新后的服务认证 请求消息后， 从中提取用户标识信息 （例如： xyz@IPTV service用于 标识用户 xyz向 IPTV服务提供商申请 IPTV服务） 以及用户身份认 证信息， 并根据该用户标识信息以及用户身份认证信息， 对用户设备 1进行身份认证以生成认证结果， 用以判断该用户设备 1是否为该类 组播业务的合法用户。 该用户身份认证信息可以包括用户设备 1与网 络认证设备 3预先设置好的口令， 或数字证书， 也可以包括其他类型 的身份认证信息， 只要网络认证设备 3能够凭借该身份认证信息确定 该用户设备 1的身份即可， 这是本领域技术人 应能理解的， 在此不 作赘述。
当用户设备 1通过身份认证后， 网络认证设备 3根据用户标识信 息在其组播业务接入权限表中查找用户设备 1所请求的某类组播业务 的接入权限， 当该网络认证设备 3查找到用户设备 1所请求的某类组 播业务的接入权限后， 根据用户设备 1的网絡标识信息（该网络标识 信息包括 IP地址， MAC地址， DSL端口号）形成该用户设备 1的网 络端口信息（DSL端口号）与该用户设备 1所请求的某类组播业务接 入权限的映射关系， 以生成与该用户设备 1相对应的组播业务授权信 息。 进一步地， DSL端口号用于指示网络接入设备 2通过该 DSL端 口向用户设备 1提供其所申请的某类组播业务中的某项组播业务。 当 生成组播业务授权信息后， 网络认证设备 3将与用户设备 1相对应的 组播业务授权信息以及认证结果一同发送至网络接入设备 2。 当网络接入设备 2接收到来自网络认证设备 3发送的组播业务授 权信息和认证结果后， 以网络端口信息（ DSL端口号）以及认证会话 标识信息为索引， 存储与用户设备 1相对应的组播业务接入权限并将 认证结果转发至用户设备 1。 该认证会话标识信息可以包括 EAP ID 或 Session ID, 也可以包括其他类型的会话标识信息， 关键取决于认 证会话所采用的协议，这是本领域技术人员应能理解，在此不作赘述。
进一步地， EAP协议在通信领域是一种常用的认证方式。 EAP是 IETF定义的一个协议， 为 RFC3748, 提供认证时双方交互的消息格 式， 每个 EAP会话有个标识， 让会话双方理解所认证的处理是属于 哪次会话， 也即授权的结果是与哪次认证有关。 釆用认证会话标识信 息可以在用户设备 1要求取消某类组播业务时， 根据该认证会话标识 信息有针对性地取消认证的服务。
在一个优选的实施例中， 网络认证设备 3在根据用户标识信息在 其组播业务接入权限表中查找用户设备 1所请求的某类组播业务的接 入权限的同时， 也可以在其组播业务接入权限表中查找与该类組播业 务相关联的某类网络业务的接入权限， 并将与用户设备 1所请求的某 类组播业务相关联的一类或多类网络业务的接入权限与用户设备 1所 请求的某类组播业务的接入权限一同发送至网絡接入设备 2并存储于 网络接入设备 2中。
在一种变化例中， 网络认证设备 3也可以不将认证结果发送至网 络接入设备 2， 而仅仅将组播业务授权信息发送至网络接入设备 2, 因为网络接入设备 2仅仅凭借接收到组播业务授权信息就可以知晓该 用户设备 1 已通过身份认证， 而用户设备 1仅凭其在预定的某一段时 间内未收到认证结果来判断其通过身份认证。 当然， 在这种情况下， 当用户设备 1没有通过身份认证时， 网络认证设备 3会发送其未通过 身份认证的认证结果至网络接入设备 2 , 并经由网络接入设备 2将未 通过身份认证的认证结果发送至用户设备 1 , 因此， 在这种情况下， 用户设备 1仅凭其在预定的某一段时间内是否收到认证结果来判断其 是否通过身份认证即可。 具体地， 在步骤 S13中， 如果网絡接入设备 2判断出来自用户设 备 1的消息为用户设备 1用于请求某类组播业务中的某项组播业务而 发送的组播业务请求消息（该组播业务请求消息包括用户设备 1的网 络标识信息以及用户设备 1所请求的某项组播业务标识信息）后， 网 络接入设备 2从该组播业务请求消息中提取出该用户设备 1的网络标 识信息， 并根据该网絡标识信息查找与该用户设备 1相对应的組播业 务授权信息， 并根据保存于该网络接入设备 2的与该用户设备 1相对 应的组播业务授权信息判断用户设备 1是否有接入其所请求的该项组 播业务的权限， 当用户设备 1有接入该项组播业务的权限时向用户设 备 1提供该项组播业务， 当用户设备 1没有接入该项组播业务的权限 时拒绝向用户设备 1提供该项组播业务。
进一步地， 该网络接入设备 2可以通过两种方式向用户设备 1提 供该项组播业务。
第一种方式， 如果用户设备 1所申请的组播业务的组播流已到达 网路接入设备 1， 则该网络接入设备 2复制用户设备 1所申请的该类 组播业务的组播流， 并将其通过相应的网络端口 （DSL端口）发送至 用户设备 1。
第二种方式， 如果用户设备 1所申请的组播业务的组播流没有到 达网络接入设备 2, 则该网络接入设备 2将向上一级网络转发用户设 备 1的组播业务请求消息， 即 IGMP请求消息， 同时上一级网络不再 检查这个组播业务请求的权限， 直到该组播业务的组播流传送到该网 络接入设备 2, 并经由该网络接入设备 2转发该组播流给用户设备 1。
图 3示出图 2中所述步骤 S12的一个具体实施方式， 即向网络认 证设备获取与所述用户设备相对应的组播业务授权信息的方法的流 程图。
在本具体实施方式中， 首先， 执行步骤 S121 , 发送所述服务认 证请求消息至所述网络认证设备；
其次， 执行步骤 S122, 接收来自所迷网络认证设备的与所述用 户设备相对应的所述组播业务授权信息； 最后， 执行步骤 S123， 存储与所述用 设备相对应的所述组播 业务授权信息。
当网络接入设备 2判断出该请求消息为用户设备 1用于请求某类 組播业务而发送至网络认证设备 3的服务认证请求消息（该认证请求 消息包括用户标识信息以及用户身份认证信息）后， 具体地， 在步骤 S121中，该网络接入设备 2在该服务认证请求消息中加入用户设备 1 的网络标识信息（该网络标识信息包括 IP地址 , MAC地址， DSL端 口号）， 并将更新后的服务认证请求消息发送至网络认证设备 3。 进一 步地，网络接入设备 2接收到来自用户设备 1的服务认证请求消息后， 首先对其中的用户标识信息进行检测， 以判断用户设备 1所请求的服 务认证的类型， 然后， 网络接入设备 2查找合适的网络认证设备并将 该服务认证请求消息发送至正确的服务提供商。
网络认证设备 3接收到来自网络接入设备 2的更新后的服务认证 请求消息后， 根据该服务认证请求消息， 生成与所述用户设备相对应 的组播业务授权信息并将该组播业务授权信息发送至所述网络接入 设备 2。
具体地， 在步骤 S122和步骤 S123中， 网络接入设备 2接收到来 自网络认证设备 3发送的组播业务授权信息和认证结果后， 以网络端 口信息（DSL端口号）以及认证会话标识信息为索引， 存储与用户设 备 1相对应的组播业务接入权限并将认证结果转发至用户设备 1。 该 认证会话标识信息可以包括 EAP ID或 Session ID,也可以包括其他类 型的会话标识信息， 关键取决于认证会话所采用的协议， 这是本领域 技术人员应能理解， 在此不作赘述。
进一步地， EAP协议在通信领域是一种常用的认证方式。 EAP 是 IETF定义的一个协议， 为 RFC3748, 提供认证时双方交互的消息 格式， 每个 EAP会话有个标识， 让会话双方理解所认证的处理是属 于哪次会话， 也即授权的结果是与哪次认证有关。 采用认证会话标识 信息可以在用户设备 1要求取消某类组播业务时， 根据该认证会话标 识信息有针对性地取消认证的服务。 图 4示出根据本发明的另一个具体实施方式的， 在接入网络的网 络接入设备中用于控制用户设备退出组播业务的方法的流程图。
在本具体实施方式中， 首先， 执行步骤 S21 , 接收来自所述用户 设备的组播业务取消请求消息；
其次， 执行步骤 S22, 从所述组播业务取消请求消息中提取所述 认证会话标识信息；
最后， 执行步骤 S23, 根据所述认证会话标识信息， 删除与该认 证会话标识信息相对应的所述组播业务的接入权限。
具体地， 为了避免网络接入设备 2的存储负担过重， 当用户设备 1需要删除存储于网络接入设备 2中的对应于先前所申请的某类网络 业务的接入权限时， 用户设备 1向网络接入设备 2发送一组播业务取 消请求消息（该组播业务取消请求消息包括用户设备 1申请该类組播 业务而向网络认证设备 3请求身份认证时所产生的认证会话标识信息 以及用户设备 1的网络标识信息） ， 网络接入设备 2接收到来自用户 设备发送的组播业务取消请求消息后， 从中提取出该用户设备 1 申请 该类组播业务而向网络认证设备 3请求身份认证时所产生的认证会话 标识信息， 并根据该认证会话标识信息查找用户设备 1所请求删除的 该类网络业务的接入权限， 当网络接入设备 2查找到用户设备 1所请 求删除的该类网络业务的接入权限后将其删除。
进一步地， 用户管理系统也可以根据用户标识信息删除存储于网 络接入设备 2的对应于用户设备 1的组播业务接入权限。
图 5示出根据本发明的又一个具体实施方式的， 在接入网络的网 络认证设备中用于控制用户设备接入组播业务的方法的流程图。
在本具体实施方式中， 首先， 执行步骤 S31 , 接收经由网络接入 设备转发的来自所述用户设备的服务认证请求消息；
其次， 执行步骤 S32, 从所述服务认证请求消息中提取用户身份 认证信息， 用户标识信息以及所述用户设备的网络标识信息；
再次， 执行步骤 S33， 根据所述用户身份认证信息以及所述用户 标识信息， 对所述用户设备进行身份认证； 然后， 执行步骤 S34, 当所述用户设备通过身份认证， 则根据所 述用户标识信息， 查找所述用户设备的接入权限；
随后， 执行步骤 S35 , 根据所述用户设备的网絡标识信息以及所 述用户设备的接入权限， 生成与所述用户设备相对应的所述组播业务 授权信息；
最后， 执行步骤 S36, 将所述组播业务授权信息发送至所述网络 接入设备。
具体地， 当网络接入设备 2判断出来自用户设备 1的请求消息为 用户设备 1用于请求某类组播业务而发送至网络认证设备 3的服务认 证请求消息（该认证请求消息包括用户标识信息以及用户身份认证信 息）后， 该网络接入设备 2在该服务认证请求消息中加入用户设备 1 的网络标识信息（该网络标识信息包括 IP地址， MAC地址， DSL端 口号）， 并将更新后的服务认证请求消息发送至网絡认证设备 3用于 向网络认证设备 3获取与用户设备 1相对应的组播业务授权信息。
网络认证设备 3接收到来自网络接入设备 2的更新后的服务认证 请求消息后， 从中提取用户标识信息以及用户身份认证信息， 并根据 该用户标识信息以及用户身份认证信息， 对用户设备 1进行身份认证 以生成认证结果， 用以判断该用户设备 1是否为该类组播业务的合法 用户。
具体地， 在步骤 S34和步骤 S35中， 当用户设备 1通过身份认证 后， 网络认证设备 3根据用户标识信息在其组播业务接入权限表中查 找用户设备 1所请求的某类组播业务的接入权限， 当该网络认证设备 3查找到用户设备 1所请求的某类组播业务的接入权限后， 根据用户 设备 1的网络标识信息 （该网络标识信息包括 IP地址， MAC地址， DSL端口号）形成该用户设备 1的网络端口信息（DSL端口号）与该 用户设备 1所请求的某类组播业务接入权限的映射关系， 以生成与该 用户设备 1相对应的组播业务授权信息。 进一步地， DSL端口号用于 指示网络接入设备 2通过该 DSL端口向用户设备 1提供其所申请的 某类组播业务中的某项组播业务。 当生成组播业务授权信息后， 网络认证设备 3将与用户设备 1相 对应的组播业务授权信息以及认证结果一同发送至网络接入设备 2。
网络接入设备 2接收到来自网络认证设备 3发送的组播业务授权 信息和认证结果后， 以网络端口信息（DSL端口号）以及认证会话标 识信息为索引， 存储与用户设备 1相对应的组播业务接入权限并将认 证结果转发至用户设备 1。
在一个优选的实施例中， 网络认证设备 3在根据用户标识信息在 其组播业务接入权限表中查找用户设备 1所请求的某类组播业务的接 入权限的同时， 也可以在其组播业务接入权限表中查找与该类组播业 务相关联的某类网络业务的接入权限， 并将与用户设备 1所请求的某 类組播业务相关联的一类或多类网絡业务的接入权限与用户设备 1所 请求的某类组播业务的接入权限一同发送至网络接入设备 2并存储于 网络接入设备 2中。
在一种变化例中， 网络认证设备 3也可以不将认证结果发送至网 络接入设备 2, 而仅仅将组播业务授权信息发送至网络接入设备 2, 因为网络接入设备 2仅仅凭借接收到组播业务授权信息就可以知晓该 用户设备 1 已通过身份认证， 而用户设备 1仅凭其在预定的某一段时 间内未收到认证结果来判断其通过身份认证。 当然， 在这种情况下， 当用户设备 1没有通过身份认证时， 网络认证设备 3会发送其未通过 身份认证的认证结果至网络接入设备 2, 并经由网络接入设备 2将未 通过身份认证的认证结果发送至用户设备 1 , 因此， 在这种情况下， 用户设备 1仅凭其在预定的某一段时间内是否收到认证结果来判断其 是否通过身份认证即可。
图 6示出根据本发明的一个具体实施方式的， 在接入网絡的网络 接入设备中用于控制用户设备接入组播业务的控制装置的结构示意 图。 该控制装置 1包括第一判断装置 11 , 获取装置 12， 第二判断装 置 13以及第一发送装置 14。
在本具体实施方式中， 首先， 第一判断装置 11， 判断接收到的来 自所述用户设备的消息类型； 如果接收到的来自所述用户设备的消息为服务认证请求消息， 则 获取装置 12,向网络认证设备获取与所述用户设备相对应的组播业务 授权信息；
如果接收到的来自所述用户设备的消息为组播业务请求消息， 则 第二判断装置 13 ,根据保存的与所述用户设备相对应的组播业务授权 信息判断所述用户设备是否有接入所述组播业务的权限，
当所述用户设备有接入所述组播业务的权限时， 则第一发送装置 14, 向所述用户设备提供所述组播业务。
以下结合图 7至图 9对图 6做进一步的详细描述：
具体地， 当网络接入设备 2中的接收装置（为简明起见， 图 6中 未示出）接收到来自该用户设备 1的请求消息后， 控制装置 1中的第 一判断装置 11对该请求消息的类型进行判断。 如果第一判断装置 11 判断出该请求消息为用户设备 1用于请求某类组播业务而发送至网络 认证设备 3 (该网络认证设备可以为一个认证服务器， 具体的， 可以 为一个 AAA认证服务器） 的服务认证请求消息 （该认证请求消息包 括用户标识信息以及用户身份认证信息）后， 该网络接入设备 2在该 服务认证请求消息中加入用户设备 1的网络标识信息（该网络标识信 息包括 IP地址， MAC地址， DSL端口号）， 并通过获取装置 12中的 第二发送装置 121将更新后的服务认证请求消息发送至网络认证设备 3用于向网络认证设备 3获取与用户设备 1相对应的组播业务授权信 息。 进一步地， 网絡接入设备 2中的接收装置接收到来自用户设备 1 的服务认证请求消息后， 首先判断装置对其中的用户标识信息进行检 测， 以判断用户设备 1所请求的服务认证的类型， 然后， 网絡接入设 备 2中的查找装置查找合适的网络认证设备并将该服务认证请求消息 发送至正确的服务提供商。
网络认证设备 3中的第三接收装置 31接收到来自网络接入设备 2 的更新后的服务认证请求消息后， 第二提取装置 32从中提取出用户 标识信息 （例如： xyz@IPTV service用于标识用户 xyz向 IPTV服务 提供商申请 IPTV服务）以及用户身份认证信息， 认证装置 33根据该 用户标识信息以及用户身份认证信息， 对用户设备 1进行身份认证以 生成认证结果， 用以判断该用户设备 1是否为该类组播业务的合法用 户。 该用户身份认证信息可以包括用户设备 1与网络认证设备 3预先 设置好的口令， 或数字证书， 也可以包括其他类型的身份认证信息， 只要网络认证设备 3能够凭借该身份认证信息确定该用户设备 1的身 份即可， 这是本领域技术人员应能理解的， 在此不作赘述。
当用户设备 1通过身份认证后，网络认证设备 3中的查找装置 34 根据用户标识信息在其组播业务接入权限表中查找用户设备 1所请求 的某类组播业务的接入权限， 当该网络认证设备 3查找到用户设备 1 所请求的某类组播业务的接入权限后， 第二生成装置 35根据用户设 备 1的网络标识信息（该网络标识信息包括 IP地址， MAC地址， DSL 端口号）形成该用户设备 1的网络端口信息（DSL端口号）与该用户 设备 1所请求的某类组播业务接入权限的映射关系， 以生成与该用户 设备 1相对应的组播业务授权信息。 进一步地， DSL端口号用于指示 网络接入设备 2通过该 DSL端口向用户设备 1提供其所申请的某类 组播业务中的某项组播业务。 当生成组播业务授权信息后， 网络认证 设备 3中的第三发送装置 36将与用户设备 1相对应的组播业务授权 信息以及认证结果一同发送至网络接入设备 2。
网络接入设备 2中的第一接收装置 122接收到来自网络认证设备 3发送的组播业务授权信息和认证结果后， 存储装置 123以网络端口 信息（DSL端口号）以及认证会话标识信息为索引， 存储与用户设备 1相对应的组播业务接入权限并将认证结果转发至用户设备 1。 该认 证会话标识信息可以包括 EAP ID或 Session ID,也可以包括其他类型 的会话标识信息， 关键取决于认证会话所采用的协议， 这是本领域技 术人员应能理解， 在此不作赘述。
进一步地， EAP协议在通信领域是一种常用的认证方式。 EAP 是 IETF定义的一个协议， 为 RFC3748, 提供认证时双方交互的消息 格式， 每个 EAP会话有个标识， 让会话双方理解所认证的处理是属 于哪次会话， 也即授权的结果是与哪次认证有关。 采用认证会话标识 信息可以在用户设备 1要求取消某类組播业务时，根据该认证会话标 识信息有针对性地取消认证的服务。
在一个优选的实施例中， 网络认证设备 3中的查找装置 34在根 据用户标识信息在其组播业务接入权限表中查找用户设备 1所请求的 某类组播业务的接入权限的同时， 也可以在其组播业务接入权限表中 查找与该类組播业务相关联的某类网络业务的接入权限， 并通过第三 发送装置 36将与用户设备 1所请求的某类组播业务相关联的一类或 多类网络业务的接入权限与用户设备 1所请求的某类组播业务的接入 权限一同发送至网络接入设备 2并存储于网络接入设备 2中。
在一种变化例中， 网络认证设备 3中的第三发送装置 36也可以 不将认证结果发送至网络接入设备 2, 而仅仅将組播业务授权信息发 送至网络接入设备 2, 因为网络接入设备 2仅仅凭借接收到组播业务 授权信息就可以知晓该用户设备 1 已通过身份认证， 而用户设备 1仅 凭其在预定的某一段时间内未收到认证结果来判断其通过身份认证。 当然， 在这种情况下， 当用户设备 1没有通过身份认证时， 网络认证 设备 3中的第三发送装置 36会发送其未通过身份认证的认证结果至 网络接入设备 2, 并经由网络接入设备 2将未通过身份认证的认证结 果发送至用户设备 1， 因此， 在这种情况下， 用户设备 1仅凭其在预 定的某一段时间内是否收到认证结果来判断其是否通过身份认证即 可。
如果控制装置 1中的第一判断装置 11判断出来自用户设备 1的 请求消息为用户设备 1用于请求某类组播业务中的某项组播业务而发 送的组播业务请求消息（该组播业务请求消息包括用户设备 1的网络 标识信息以及用户设备 1所请求的某项组播业务标识信息）后， 网络 接入设备 2中的提取装置（为筒明起见， 图 6中未示出）从该組播业 务请求消息中提取出该用户设备 1的网络标识信息， 查找装置（为简 明起见， 图 6中未示出）根据该网络标识信息查找与该用户设备 1相 对应的组播业务授权信息， 第二判断装置 13根据保存于该网络接入 设备 2的与该用户设备 1相对应的组播业务授权信息判断用户设备 1 是否有接入其所请求的该项组播业务的权限， 当用户设备 1有接入该 项组播业务的权限时第一发送装置 14向用户设备 1提供该项组播业 务， 当用户设备 1没有接入该项组播业务的权限时拒绝向用户设备 1 提供该项组播业务。
进一步地， 该网络接入设备 2可以通过两种方式向用户设备 1提 供该项组播业务。
第一种方式， 如果用户设备 1所申请的组播业务的组播流已到达 网路接入设备 1 , 则该网络接入设备 2复制用户设备 1所申请的该类 组播业务的组播流， 并将其通过相应的网络端口 （DSL端口）发送至 用户设备 1。
第二种方式， 如果用户设备 1所申请的组播业务的组播流没有到 达网络接入设备 2, 则该网絡接入设备 2将向上一级网络转发用户设 备 1的组播业务请求消息， 即 IGMP请求消息， 同时上一级网络不再 检查这个组播业务请求的权限， 直到该组播业务的组播流传送到该网 络接入设备 2, 并经由该网络接入设备 2转发该组播流给用户设备 1。
图 7示出图 6中所述第一获取装置 12的一个具体实施方式， 即 用于向网络认证设备获取与所述用户设备相对应的组播业务授权信 息的第一获取装置 12的结构示意图。 该第一获取装置 12包括第二发 送装置 121 , 第一接收装置 122以及存储装置 123。
首先， 第二发送装置 121， 用于发送所述服务认证请求消息至所 述网络认证设备；
其次， 第一接收装置 122, 用于接收来自所述网络认证设备的与 所述用户设备相对应的所述组播业务授权信息；
最后， 存储装置 123 , 用于存储与所述用户设备相对应的所述组 播业务授权信息。
具体地， 当网络接入设备 2中的第一判断装置 11判断出来自用 户设备 1的请求消息为用户设备 1用于请求某类组播业务而发送至网 络认证设备 3的服务认证请求消息（该认证请求消息包括用户标识信 息以及用户身份认证信息）后， 该网络接入设备 2在该服务认证请求 消息中加入用户设备 1的网络标识信息 （该网络标识信息包括 IP地 址， MAC地址， DSL端口号）， 获取装置 12中的第二发送装置 121 将更新后的服务认证请求消息发送至网络认证设备 3用于向网络认证 设备 3获取与用户设备 1相对应的组播业务授权信息。 进一步地， 网 络接入设备 2中的接收装置接收到来自用户设备 1的服务认证请求消 息后， 首先判断装置对其中的用户标识信息进行检测， 以判断用户设 备 1所请求的服务认证的类型， 然后， 网络接入设备 2中的查找装置 查找合适的网络认证设备并将该服务认证请求消息发送至正确的服 务提供商。
网络认证设备 3中的第三接收装置 31接收到来自网络接入设备 2 的更新后的服务认证请求消息后， 第一生成装置根据该服务认证请求 消息， 生成与所述用户设备相对应的组播业务授权信息， 第三发送装 置 36将该组播业务授权信息发送至所述网络接入设备 2。
第一获取装置 12中的第一接收装置 122接收到来自网络认证设 备 3发送的组播业务授权信息和认证结果后， 存储装置 123以网络端 口信息（ DSL端口号）以及认证会话标识信息为索引， 存储与用户设 认证会话标识信息可以包括 EAP ID或 Session ID,也可以包括其他类 型的会话标识信息， 关键取决于认证会话所采用的协议， 这是本领域 技术人员应能理解， 在此不作赘述。
进一步地， EAP协议在通信领域是一种常用的认证方式。 EAP 是 IETF定义的一个协议， 为 RFC3748, 提供认证时双方交互的消息 格式， 每个 EAP会话有个标识， 让会话双方理解所认证的处理是属 于哪次会话， 也即授权的结果是与哪次认证有关。 采用认证会话标识 信息可以在用户设备 1要求取消某类组播业务时， 根据该认证会话标 识信息有针对性地取消认证的服务。
图 8示出根据本发明的另一个具体实施方式的，在接入网络的网 络接入设备中用于控制用户设备退出组播业务的控制装置的结构示 意图。 该控制装置 2包括第二接收装置 21 , 第一提取装置 22以及第 二删除装置 23。
在本具体实施方式中， 首先， 第二接收装置 21 , 接收来自用户设 备的组播业务取消请求消息；
第一提取装置 22,从所述组播业务取消请求消息中提取认证会话 标识信息；
第二删除装置 23 ,根据所述认证会话标识信息，删除与该认证会 话标识信息相对应的所述组播业务的接入权限。
具体地， 为了避免网络接入设备 2的存储负担过重， 当用户设备 1需要删除存储于网络接入设备 2中的对应于先前所申请的某类网络 业务的接入权限时， 用户设备 1 中的发送装置向网络接入设备 2发送 一组播业务取消请求消息 （该组播业务取消请求消息包括用户设备 1 申请该类组播业务而向网络认证设备 3请求身份认证时所产生的认证 会话标识信息以及用户设备 1的网络标识信息）， 控制装置 2中的第 二接收装置 21接收到来自用户设备发送的組播业务取消请求消息后， 第一提取装置 22从中提取出该用户设备 1申请该类組播业务而向网 络认证设备 3请求身份认证时所产生的认证会话标识信息， 查找装置 (为简明起见， 图 8中未示出）根据该认证会话标识信息查找用户设 备 1所请求删除的该类网络业务的接入权限， 当网络接入设备 2查找 到用户设备 1所请求删除的该类网络业务的接入权限后， 第二删除装 置 23将存储于网络接入设备 2中的用户设备 1所请求删除的该类网 络业务的接入权限删除。
进一步地， 用户管理系统也可以根据用户标识信息删除存储于网 络接入设备 2的对应于用户设备 1的组播业务接入权限。
图 9示出 居本发明的又一个具体实施方式的， 在接入网络的网 络认证设备中用于控制用户设备接入组播业务的辅助控制装置。 该控 制装置 3包括第三接收装置 31 , 第二提取装置 32， 认证装置 33 , 查 找装置 34, 第二生成装置 35以及第三发送装置 36。
在本具体实施方式中， 首先， 第三接收装置 31 , 接收经由网络接 入设备转发的来自所述用户设备的服务认证请求消息； 其次， 第二提取装置 32, 从所述服务认证请求消息中提取用户身 份认证信息， 用户标识信息以及所述用户设备的网络标识信息；
再次， 认证装置 33 , 根据所述用户身份认证信息以及所述用户标 识信息， 对所述用户进行身份认证；
然后， 查找装置 34, 当所述用户设备通过身份认证， 则根据所述 用户标识信息， 查找所述用户设备的接入权限；
随后， 第二生成装置 35， 用于根据所述用户设备的网络标识信息 以及所述用户设备的接入权限， 生成与所述用户设备相对应的所述组 播业务授权信息。
最后， 第三发送装置 36, 将所述组播业务授权信息发送至所述网 络接入设备。
具体地，当网络接入设备 2中的第一判断装置 11判断出来自用户 设备 1的请求消息为用户设备 1用于请求某类组播业务而发送至网络 认证设备 3的服务认证请求消息（该认证请求消息包括用户标识信息 以及用户身份认证信息）后， 该网络接入设备 2在该服务认证请求消 息中加入用户设备 1的网络标识信息（该网络标识信息包括 IP地址， MAC地址， DSL端口号）， 第一获取装置 12中的第二发送装置 121 将更新后的服务认证请求消息发送至网络认证设备 3用于向网络认证 设备 3获取与用户设备 1相对应的组播业务授权信息。
控制装置 3中的第三接收装置 31接收到来自网络接入设备 2的 更新后的服务认证请求消息后， 第二提取装置 32从中提取用户标识 信息以及用户身份认证信息， 认证装置 33根据该用户标识信息以及 用户身份认证信息， 对用户设备 1进行身份认证以生成认证结果， 用 以判断该用户设备 1是否为该类组播业务的合法用户。
当用户设备 1通过身份认证后， 查找装置 34根据用户标识信息 在其组播业务接入权限表中查找用户设备 1所请求的某类组播业务的 接入权限， 当该网络认证设备 3查找到用户设备 1所请求的某类組播 业务的接入权限后， 第二生成装置 35根据用户设备 1的网络标识信 息 （该网络标识信息包括 IP地址， MAC地址， DSL端口号）形成该 用户设备 1的网络端口信息（DSL端口号）与该用户设备 1所请求的 某类组播业务接入权限的映射关系， 以生成与该用户设备 1相对应的 组播业务授权信息。 进一步地， DSL端口号用于指示网络接入设备 2 通过该 DSL端口向用户设备 1提供其所申请的某类组播业务中的某 项組播业务。 当生成组播业务授权信息后， 第三发送装置 36将与用 户设备 1相对应的组播业务授权信息以及认证结果一同发送至网络接 入设备 2。
网络接入设备 2中的第一接收装置 122接收到来自网络认证设备 3发送的组播业务授权信息和认证结果后， 存储装置 123以网络端口 信息（DSL端口号）以及认证会话标识信息为索引， 存储与用户设备 1相对应的組播业务接入权限并将认证结果转发至用户设备 1。
在一个优选的实施例中， 网络认证设备 3中的查找装置 34在根 据用户标识信息在其组播业务接入权限表中查找用户设备 1所请求的 某类组播业务的接入权限的同时， 也可以在其组播业务接入权限表中 查找与该类组播业务相关联的某类网络业务的接入权限， 并通过第三 发送装置 36将与用户设备 1所请求的某类组播业务相关联的一类或 多类网絡业务的接入权限与用户设备 1所请求的某类组播业务的接入 在一种变化例中， 控制装置中的第三发送装置 36也可以不将认 证结果发送至网络接入设备 2, 而仅仅将组播业务授权信息发送至网 络接入设备 2, 因为网络接入设备 2仅仅凭借接收到组播业务授权信 息就可以知晓该用户设备 1 已通过身份认证， 而用户设备 1仅凭其在 预定的某一段时间内未收到认证结果来判断其通过身份认证。 当然， 在这种情况下， 当用户设备 1没有通过身份认证时， 第三发送装置 36 会发送其未通过身份认证的认证结果至网络接入设备 2， 并经由网络 接入设备 2将未通过身份认证的认证结果发送至用户设备 1 , 因此， 在这种情况下， 用户设备 1仅凭其在预定的某一段时间内是否收到认 证结果来判断其是否通过身份认证即可。
以上对本发明的具体实施例进行了描述。 需要理解的是， 本发明 并不局限于上述特定实施方式， 本领域技术人员可以在所附权利要求 的范围内做出各种变形或修改。

Claims

权 利 要 求
1.一种在接入网络的网络接入设备中用于控制用户设备接入组播 业务的方法， 其特征在于， 包括以下步骤：
a. 判断接收到的来自所述用户设备的消息；
b. 如果所述接收到的来自所述用户设备的消息为服务认证请求 消息， 则向网络认证设备获取与所述用户设备相对应的组播业务授权 信息， 其中， 所述服务认证请求消息用于所述用户设备申请某类组播 业务；
c 如果所述接收到的来自所述用户设备的消息为组播业务请求 消息， 则根据保存的与所述用户设备相对应的组播业务授权信息判断 所述用户设备是否有接入所述組播业务的权限，
- 当所述用户设备有接入所述组播业务的权限时向所述用户设备 提供所述組播业务， 其中， 所述组播业务请求消息用于所述用户设备 申请某项組播业务。
2. 根据权利要求 1所述的方法， 其特征在于， 所述步骤 b中所述 向网络认证设备获取与所述用户设备相对应的组播业务授权信息， 还 包括以下步驟：
bl . 发送所述服务认证请求消息至所述网络认证设备；
b2. 接收来自所述网络认证设备的与所述用户设备相对应的所述 组播业务授权信息；
b3. 存储与所述用户设备相对应的所述组播业务授权信息。
3. 根据权利要求 1或 2所述的方法， 其特征在于， 所述步骤 b3 还包括： 以用户端口标识信息以及认证会话标识信息为索引， 存储与 所述用户设备相对应的组播业务接入权限。
4. 根据权利要求 1至 3中任一项所述的方法， 其特征在于， 还包 括以下步骤：
A. 接收来自所述用户设备的组播业务取消请求消息；
B. 根据所述组播业务取消请求消息， 删除存储于所迷网络接入 设备中的所述用户设备所请求删除的所述组播业务的接入权限。
5. 根据权利要求 4所述的方法， 其特征在于， 所述步骤 B还包 括以下步骤：
B 1. 从所述組播业务取消请求消息中提取所述认证会话标识信
'¾· ,
B2. 根据所述认证会话标识信息， 删除与该认证会话标识信息相 对应的所述组播业务的接入权限。
6.一种在接入网络的网络认证设备中用于控制用户设备接入组播 业务的方法， 其特征在于， 包括以下步骤：
i. 接收经由网络接入设备转发的来自所述用户设备的服务认证请 求消息；
ii. 根据所述服务认证请求消息，生成与所述用户设备相对应的组 播业务授权信息。
in. 将所述组播业务授权信息发送至所述网絡接入设备。
7. 根据权利要求 6所述的方法， 其特征在于， 所述步骤 ii还包 括以下步骤：
iil . 从所述服务认证请求消息中提取用户身份认证信息， 用户标 识信息以及所述用户设备的网络标识信息；
H2. 根据所述用户身份认证信息以及所述用户标识信息， 对所述 用户设备进行身份认证；
113. 当所述用户设备通过身份认证， 则根据所述用户标识信息， 查找所述用户设备的接入权限；
114. 根据所述用户设备的网络标识信息以及所述用户设备的接入 权限， 生成与所述用户设备相对应的所述组播业务授权信息。
8.一种在接入网络的网络接入设备中用于控制用户设备接入組播 业务的控制装置， 其特征在于， 包括：
第一判断装置， 用于判断接收到的来自用户设备的消息； 获取装置， 用于如果所述接收到的来自所述用户设备的消息为服 务认证请求消息， 则向网络认证设备获取与所述用户设备相对应的组 播业务授权信息， 其中， 所述服务认证请求消息用于所述用户设备申 请某类组播业务；
第二判断装置， 用于如果所述接收到的来自所述用户设备的消息 为组播业务请求消息， 则根据保存的与所述用户设备相对应的所述组 播业务授权信息判断所述用户设备是否有接入所述组播业务的权限， 第一发送装置， 用于当所述用户设备有接入所述组播业务的权限 时向所述用户设备提供所述组播业务， 其中， 所述组播业务请求消息 用于所述用户设备申请某项组播业务。
9. 根据权利要求 8所述的控制装置， 其特征在于， 所述获取装置 还包括：
第二发送装置， 用于发送所述服务认证请求消息至所述网络认证 设备；
第一接收装置， 用于接收来自所述网络认证设备的与所述用户设 备相对应的所述组播业务授权信息；
存储装置， 用于存储与所述用户设备相对应的所述组播业务授权 信息。
10. 根据权利要求 8或 9所述的控制装置， 其特征在于， 所述存 储装置用于以用户端口标识信息以及认证会话标识信息为索引，存储 与所述用户设备相对应的组播业务接入权限。
1 1. 根据权利要求 8至 10中任一项所述的控制装置，其特征在于， 还包括：
第二接收装置，用于接收来自用户设备的组播业务取消请求消息； 第一删除装置， 用于根据所述组播业务取消请求消息， 删除存储 于所述网络接入设备中的所述用户设备所请求删除的所述组播业务 的接入权限。
12. 根据权利要求 11所述的控制装置， 其特征在于， 所述第一删 除装置还包括：
第一提取装置， 用于从所述组播业务取消请求消息中提取认证会 话标识信息； 第二删除装置， 用于根据所述认证会话标识信息， 删除与该认证 会话标识信息相对应的所述组播业务的接入权限。
13. 一种在接入网络的网络认证设备中用于控制用户设备接入组 播业务的辅助控制装置， 其特征在于， 包括：
第三接收装置， 用于接收经由网络接入设备转发的来自所述用户 设备的服务认证请求消息；
第一生成装置， 用于根据所述服务认证请求消息， 生成与所述用 户设备相对应的组播业务授权信息。
第三发送装置， 用于将所述组播业务授权信息发送至所述网络接 入设备。
14. 根据权利要求 13所述的辅助控制装置， 其特征在于， 所述第 一生成装置还包括：
第二提取装置， 用于从所述服务认证请求消息中提取用户身份认 证信息， 用户标识信息以及所述用户设备的网络标识信息；
认证装置， 用于根据所述用户身份认证信息以及所述用户标识信 息， 对所述用户进行身份认证；
查找装置， 用于当所述用户设备通过身份认证， 则根据所述用户 标识信息， 查找所述用户设备的接入权限；
第二生成装置， 用于根据所述用户设备的网络标识信息以及所述 用户设备的接入权限， 生成与所述用户设备相对应的所述组播业务授 权信息。
15. 一种在接入网络中用于控制用户设备接入组播业务的组播接 入系统， 包括网络接入设备以及网络认证设备， 其中， 所述网络接入 设备包括如权利要求 8至 12中任一项所述的用于控制用户设备接入 组播业务的控制装置， 所述网络认证设备包括如权利要求 13和 14中 任一项所述的用于控制用户设备接入组播业务的辅助控制装置。
PCT/CN2008/000304 2007-09-29 2008-02-04 Procédé et dispositif permettant de commander l'accès d'un dispositif utilisateur à un service multidiffusion dans un réseau d'accès WO2009043220A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CNA2007100466919A CN101399718A (zh) 2007-09-29 2007-09-29 接入网络中控制用户设备接入组播业务的方法和装置
CN200710046691.9 2007-09-29

Publications (1)

Publication Number Publication Date
WO2009043220A1 true WO2009043220A1 (fr) 2009-04-09

Family

ID=40517992

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/000304 WO2009043220A1 (fr) 2007-09-29 2008-02-04 Procédé et dispositif permettant de commander l'accès d'un dispositif utilisateur à un service multidiffusion dans un réseau d'accès

Country Status (2)

Country Link
CN (1) CN101399718A (zh)
WO (1) WO2009043220A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102223584A (zh) * 2011-06-24 2011-10-19 百视通网络电视技术发展有限责任公司 一种视频播放认证系统及其方法
CN110868467A (zh) * 2019-11-12 2020-03-06 广州大白互联网科技有限公司 一种基于网证平台的网证同步方法、系统及存储介质
CN111970135A (zh) * 2020-07-09 2020-11-20 北京航空航天大学 一种台风追踪探测仪器信息共享方法

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102783088B (zh) * 2010-04-02 2016-01-20 上海贝尔股份有限公司 快速地通知移动节点的离开的方法和装置
CN102378115A (zh) * 2010-08-16 2012-03-14 杭州华三通信技术有限公司 组播接入控制方法、系统和装置
CN102104607B (zh) * 2011-03-10 2013-11-06 易程（苏州）软件股份有限公司 访问业务的安全控制方法、装置及系统
CN102970613B (zh) * 2012-11-22 2015-11-25 杭州华三通信技术有限公司 Iptv网络中的接入层交换机及其处理方法
CN103458062A (zh) * 2013-08-26 2013-12-18 杭州华三通信技术有限公司 一种网络协议ip地址获取方法及设备
CN106059994B (zh) * 2016-04-29 2020-02-14 华为技术有限公司 一种数据传输方法及网络设备
CN108076459B (zh) * 2016-11-08 2021-02-12 北京华为数字技术有限公司 网络接入控制方法、相关设备及系统
CN108124258A (zh) * 2016-11-29 2018-06-05 深圳市中兴微电子技术有限公司 一种终端通信业务的控制方法及网络监控装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1510862A (zh) * 2002-12-26 2004-07-07 华为技术有限公司 一种对网络用户进行认证和业务管理的方法
CN1756210A (zh) * 2004-09-29 2006-04-05 上海贝尔阿尔卡特股份有限公司 一种接入网中的组播接入控制方法和设备
CN1859179A (zh) * 2005-10-28 2006-11-08 华为技术有限公司 一种用户组播权限的管理方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1510862A (zh) * 2002-12-26 2004-07-07 华为技术有限公司 一种对网络用户进行认证和业务管理的方法
CN1756210A (zh) * 2004-09-29 2006-04-05 上海贝尔阿尔卡特股份有限公司 一种接入网中的组播接入控制方法和设备
CN1859179A (zh) * 2005-10-28 2006-11-08 华为技术有限公司 一种用户组播权限的管理方法

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102223584A (zh) * 2011-06-24 2011-10-19 百视通网络电视技术发展有限责任公司 一种视频播放认证系统及其方法
CN110868467A (zh) * 2019-11-12 2020-03-06 广州大白互联网科技有限公司 一种基于网证平台的网证同步方法、系统及存储介质
CN110868467B (zh) * 2019-11-12 2022-06-03 广州大白互联网科技有限公司 一种基于网证平台的网证同步方法、系统及存储介质
CN111970135A (zh) * 2020-07-09 2020-11-20 北京航空航天大学 一种台风追踪探测仪器信息共享方法

Also Published As

Publication number Publication date
CN101399718A (zh) 2009-04-01

Similar Documents

Publication Publication Date Title
WO2009043220A1 (fr) Procédé et dispositif permettant de commander l'accès d'un dispositif utilisateur à un service multidiffusion dans un réseau d'accès
US8125980B2 (en) User terminal connection control method and apparatus
US9225706B2 (en) Multiple access point zero sign-on
US8028324B2 (en) Method for transmitting policy information between network equipment
US11843602B2 (en) Embedded authentication in a service provider network
JP5736511B2 (ja) ゼロサインオン認証
KR101432686B1 (ko) 업링크 멀티캐스트 서비스를 제어하기 위한 방법 및 장치
JP5876877B2 (ja) 電気通信ネットワーク及び電気通信ネットワークと顧客構内機器との間の接続の効率的な使用のための方法及びシステム
KR100738526B1 (ko) 다중 영구가상회선 접속환경을 위한 중간 인증관리 시스템및 그 방법
US20060117174A1 (en) Method of auto-configuration and auto-prioritizing for wireless security domain
US20090043891A1 (en) Mobile WiMax network system including private network and control method thereof
KR20060056956A (ko) 재전송을 이용한 네트워크로의 액세스 제어
JP2004135281A (ja) 安定したマルチキャストフロー
JP2004180316A (ja) ８０２．１ｘプロトコルベースマルチキャスト制御方法
JP2008518533A (ja) モバイルユーザーをトランスペアレントに認証してウェブサービスにアクセスする方法及びシステム
US20080134315A1 (en) Gateway, Network Configuration, And Method For Conrtolling Access To Web Server
JP2005516544A (ja) 制御されたマルチキャストのシステム及び実行方法
WO2010000185A1 (zh) 一种网络认证的方法、装置、系统及服务器
US7853705B2 (en) On demand session provisioning of IP flows
WO2008000192A1 (fr) Procédé d'accès au réseau de terminaux, système d'accès au réseau et équipement de passerelle
JP2014504391A (ja) クロスアクセスログインコントローラ
CN112383500B (zh) 一种对涉及投屏设备的访问请求进行控制的方法及系统
WO2013040957A1 (zh) 单点登录的方法、系统和信息处理方法、系统
WO2009021460A1 (fr) Procédé de rapport d'un résultat de mise en œuvre de politique, système de communication par réseau et équipement
WO2013056619A1 (zh) 一种身份联合的方法、IdP、SP及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08706482

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 08706482

Country of ref document: EP

Kind code of ref document: A1