WO2009067871A1

WO2009067871A1 - Method, system and device for user access security control

Info

Publication number: WO2009067871A1
Application number: PCT/CN2008/072243
Authority: WO
Inventors: Qinfeng Gu; Jiaofeng Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-11-28
Filing date: 2008-09-02
Publication date: 2009-06-04
Also published as: CN101188614A; CN101188614B

Abstract

A Method, a system and a device for user access security control are provided. The method comprises: receiving an access request message which contains the user link ID; parsing the access request message to obtain the user link ID; judging whether the access request message satisfies the preset access condition according to the user link ID ; if so, permitting the user corresponding to the user link ID to access. The system includes user nodes, an access device and a control device. The access device includes a receiving module, an identifier inserting module and a transmitting module. The control device includes a receiving module, a parsing module and a processing module. The user link can be identified uniquely under the multi-service mode by configuring logic interface on BNG devices, thereby the security control policy such as access control, bandwidth control and multicast control for a single user link is performed by the user link ID information according to the preset security control policy of the logic interface.

Description

Method, system and device for user access security control

The present invention relates to the field of communications, and in particular, to a method, system and device for user access security control. Background technique

With the development of broadband access technology, the access methods and access technologies of the network have undergone great changes. The network is also developed into a multi-service bearer network by a traditional network that provides only Internet access services. 1 is a schematic diagram of networking of a broadband access technology provided by the prior art, where a TV set-top box, a VoIP (Voice over Internet Protocol) terminal, a PC connected to a Tnternet, and a mobile phone terminal, a handheld multimedia terminal, etc. The user completes unified access through the RG (Residential Gateway), and the RG passes the telephone twisted pair or ADSL (Asymmetric Digital Subscriber Line)/VDSL (very-high-data-rate Digital Subscriber). Line, high-speed digital subscriber line) and other technologies are connected to the DSLAM (Digital Subscriber Line Access Multiplexer), where the DSLAM is a Layer 2 device used to complete the aggregation of user access links and implement xDSL. (ADSL/VDSL) and uplink Ethernet link conversion; then DSLAM accesses BNG (Broadband Network Gateway) through the access network, where BNG can be BRAS (Broadband Remote Access Server, broadband remote access service) Equipment), can also be a road to provide business In the network, BNG is used to implement PPPoE (PPP over Ethernet, PPP protocol carried on Ethernet), which is usually used to implement PC access to the Internet. It is used to implement DHCP (Dynamic Host Configuration Protocol). Protocol) access, usually to achieve access management of TV set-top boxes, VoIP terminals, etc.; BNG is also used by ASP (Appl ication Service Provider) / ISP (Internet Service Provider, Internet Access Service Provider) Different service data flows are distributed to corresponding users, and services provided by ASP/ISP include IPTV, Internet access, VoIP, and the like. The network also includes a policy server, a gateway server, and the like that implement user/service management by issuing control policies to various gateway devices in the network.

It can be seen that BNG is a core node in the network that handles functions such as user access management, service distribution, and service policy implementation.

Referring to FIG. 2, a schematic diagram of user service access mapping provided by the prior art is provided. After accessing the RG, the user services are connected to the DSLAM through different VCs (Virtual Circuits). The TV set-top box service is accessed through VC1 access, VoIP services through VC2 access, and PC services through VC3. DSLAM completes VC to VLAN mapping At the time of shooting, the prior art provides two mapping models:

1) N: 1 model: The same service type, mapped to the same S-VLAN, that is, the traffic of the same service type of all users on one DSLAM, when the BNG arrives, the BNG is through the same S-VLAN. Recognized.

2) 1 : 1 model: DSLAM assigns a unique combination of S-VLAN + C-VLAN for each service type, generally S-VLAN to identify the service, C-VLAN to identify the user, that is, a DSLAM, the user's Data message arrival for each type of service

In BNG, BNG is uniquely determined by a combination of S-VLAN + C-VLAN.

The inventors have found in the process of implementing the present invention that the prior art has at least the following disadvantages and deficiencies:

The BNG identifies the user link of the access through VLAN/QinQ (extended 802.1Q), and the security control is also

The VLAN/QinQ is granular. In the multi-service mode, the BNG cannot uniquely identify the user link through VLAN/QinQ, and thus cannot implement security control on a single user link. Summary of the invention

In order to enable the BNG to implement security control on a single user link, an embodiment of the present invention provides a method, system, and device for user access security control. The technical solution is as follows:

An embodiment of the present invention provides a method for a user to access security control, where the method includes:

Receiving an access request message, where the access request message carries a user link identifier;

Parsing the access request packet to obtain the user link identifier;

Determining, according to the user link identifier, whether the access request packet meets a preset access condition;

If yes, the user corresponding to the user link identifier is allowed to access.

The embodiment of the invention further provides a system for user access security control, the system comprising:

a user node, configured to send an access request message;

An access device, configured to receive an access request message sent by the user node, insert a user link identifier in the access request message sent by the user node, and send an access request message inserted into the user link identifier. ;

The control device is configured to: after receiving the access request message inserted by the access device and inserting the user link identifier, perform the analysis to obtain the user link identifier; and determine the access request according to the user link identifier. Whether the packet meets the preset access condition, and if yes, allows the user node corresponding to the user link identifier to access.

An embodiment of the present invention further provides an access device, where the device includes:

a receiving module, configured to receive an access request message sent by the user node;

The identifier insertion module is configured to insert a user link identifier in the access request message received by the receiving module, and send a request message, where the sending module inserts the user link identifier into the access request message.

An embodiment of the present invention further provides a control device, where the device includes: a receiving module, configured to receive an access request message sent by the access device, where the access request message carries a user link identifier;

a parsing module, configured to parse the access request packet received by the receiving module to obtain the user link identifier, and the processing module, configured to determine, according to the user link identifier obtained by the parsing module, the access request packet Whether the preset access condition is met, and if so, the user corresponding to the link identifier of the user is allowed to access.

The beneficial effects of the technical solutions provided by the embodiments of the present invention are:

By configuring a logical interface on the BNG device, the user link can be uniquely identified in the multi-service mode, thereby implementing security control on a single user link according to the user link identification information on the pre-configured logical interface. DRAWINGS

FIG. 1 is a schematic diagram of networking of a broadband access technology provided by the prior art;

2 is a schematic diagram of user service access mapping provided by the prior art;

3 is a flowchart of a method for user access security control provided by Embodiment 1 of the present invention;

4 is a flowchart of a method for user access security control provided by Embodiment 2 of the present invention;

5 is a flowchart of a method for user access security control provided by Embodiment 3 of the present invention;

6 is a schematic diagram of a system for user access security control provided by Embodiment 4 of the present invention;

7 is a detailed schematic diagram of a system for user access security control provided by Embodiment 4 of the present invention;

8 is a schematic diagram of an access device according to Embodiment 5 of the present invention;

9 is a schematic diagram of a control device according to Embodiment 6 of the present invention;

FIG. 10 is a detailed schematic diagram of a control device according to Embodiment 6 of the present invention; FIG.

Figure 11 is another schematic diagram of the control device provided in Embodiment 6 of the present invention. detailed description

The embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

According to the technical solution provided by the embodiment of the present invention, the BNG can uniquely identify the user link identification information in the multi-service mode, and implement security control on a single user link. The method for user access security control provided by the embodiment of the present invention includes:

Receiving an access request message, the access request message carrying the user link identifier; parsing the access request message to obtain the user link identifier; determining whether the access request message satisfies the preset access condition according to the user link identifier; Yes, the user access corresponding to the user link identifier is allowed. The technical solutions provided by the embodiments of the present invention are described in detail below according to the specific security control policy: Embodiment 1

Referring to FIG. 3, an embodiment of the present invention provides a method for user access security control, and the steps are as follows:

Step 101: The BNG obtains a user link identifier.

The BNG can obtain the user link identifier information in the following two ways:

1) Manually configure the device information of the DSLAM through the command line on the BNG. The DSLAM device information includes: the frame number, slot number, and port number of the device. The DSLAM can uniquely identify a user link to the DSLAM by using the frame number + slot number + port number. The reference command line format is as follows:

Access-loop-circuit-identifier dslaml-atm-frame-slot/port: [vpi. vci].

The access-loop-circuit-identifier is a command word, which indicates that a user link identifier needs to be configured on the BNG, and then a string corresponding to each identifier. The dslaml identifier indicates a DSLAM node name, and the atm indicates the RG and DSLAM chain. The road layer is ATM, the frame is the frame number of the DSLAM, the slot is the slot number in the DSLAM, the port is the port number of the DSLAM, and the vpi. vci is the optional PVC (Permanent Virtual Circuit) information.

2) The link information reporting function provided by the Access Node Control Protocol (ANCP) protocol is implemented. The ANCP protocol is used as the transport layer protocol to provide the control information transmission between the BNG and the DSLAM. When the user activates the RG and activates the user link, the DSLAM reports the user link information of the user to the ANCP protocol. The BNG, where the user link information includes a user link status, a user link identifier, and related user link parameters. The ANCP protocol is defined as follows:

Type (Access- Loop- Circuit- ID = 0x01) ' The maximum length is 64. The default format of the protocol is: access-Node-Identifier atm slot/port [: vlan-id]

Step 102: The BNG creates a corresponding logical link identifier (ie, a logical interface) for the user link identifier according to the obtained user link identifier.

The logical link identifier may be a user link identifier or a logical interface created according to the user link identifier. The logical link identifier is a logical interface as an example. The logical interface created by the BNG uniquely corresponds to the user link identifier. When creating an interface, refer to the command line as follows:

Interface user—丄 ine dslaml— atm_frame_s丄 ot/port: [vpi. vci]

After the BNG creates a logical interface, it can implement the security control policy on the created logical interface.

Step 103: User X initiates an access request through DHCP, that is, sends a DHCP access request message.

The user initiates an access request through the DHCP protocol or the PPPoE protocol for the service type of the user. For example, if the PC user requests to access the Internet, the PPPoE protocol initiates an access request. When a user requests access to an IPTV service or a VoIP phone terminal user requests access to a VoIP service, The access request is initiated through the DHCP protocol. This embodiment uses the user X to initiate an access request through DHCP as an example, but does not limit the type of the access request.

Step 104: The DSLAM receives the DHCP access request packet sent by the user X, inserts the user link identifier into the received DHCP access request packet, and forwards the DHCP access request packet after the user link identifier is inserted. To BNG.

The agent-Circuit-ID option is used in the packet to indicate the identifier of the line that the user accesses. When receiving the DHCP access request message sent by the user X, the DSLAM knows which frame, slot, and port the access request message is received by, and correspondingly, inserts a corresponding user link identifier. The format of the user link identifier must be the same as the format of the user link identifier preset by the BNG.

Step 105: The BNG receives the DHCP access request packet that is sent by the DSLAM and carries the user link identifier, and determines whether the corresponding logical interface can be found according to the user link identifier carried in the DHCP access request packet. Step 106 is performed, otherwise, step 107 is performed.

Step 106: The BNG creates a user access entry bound to the logical interface, saves the information of the user X, and executes the step.

108.

The information of the user X and the corresponding logical interface identifier may be stored in the user access table, and the information of the user X includes the MAC (Media Access Control) address, IP address, authentication, charging, and the like of the user X. information.

Step 107: The BNG discards the received access request packet, prohibits the user X from accessing, and ends.

Step 108: The BNG returns a DHCP response message to the DSLAM, where the DHCP response message carries the user link identification information.

Step 109: The DSLAM receives the DHCP response packet returned by the BNG, deletes the user link identifier information carried in the DHCP response packet, and forwards the DHCP response packet with the user link identifier information to the user X.

Step 110: After the DHCP I is completed, User X successfully accesses the BNG and ends.

After the user accesses the BNG device, the user can also perform security control on the user. E.g:

1) When bandwidth control is required for the user X, the BNG can also configure a bandwidth parameter for the created logical interface, where the bandwidth parameter specifically includes an uplink bandwidth parameter and a downlink bandwidth parameter.

After user X successfully accesses the BNG, user X sends a data packet, which carries the user's MAC address and IP address, and the BNG searches for the user based on the user's MAC address and IP address carried in the received data packet. Accessing the table, finding the corresponding logical interface, and performing bandwidth control on the data packet according to the uplink bandwidth parameter configured by the logical interface; when the device (such as ASP) providing the service in the network sends the data packet to the user X through the BNG According to the user MAC address carried in the data packet, the user access table is searched, and the corresponding logical interface is found, and the bandwidth of the data packet sent to the user X is performed according to the downlink bandwidth parameter configured on the logical interface. control. 2) When you need to implement access control on user X, you can use the traffic policy traffic-policy command to configure an access control policy on the BNG logical interface.

After user X successfully accesses the BNG, user X sends a data packet, which carries the user's MAC address and IP address, and the BNG searches for the user based on the user's MAC address and IP address carried in the received data packet. Accessing the table, finding the logical interface corresponding to the user X, performing flow control on the data packet sent by the user X according to the access control policy configured by the logical interface; and providing the service device (such as ASP) in the network to the user through the BNG When X sends a data packet, it searches for the user access table according to the MAC address of the user X carried in the data packet, and finds the logical interface corresponding to the user X. The next hop address of the data packet is the user X corresponding to the BNG device. The logical interface performs flow control on the data packet sent to the user X through the BNG according to the access control policy configured by the logical interface.

3) When the user X requests the IGMP (Internet Group Management Protocol) to be added to the multicast group, the BNG can also configure the multicast control policy on the logical interface, that is, configure the multicast control list.

After user X successfully accesses the BNG, user X sends an IGMP message request, and the message request carries the user MAC address. After receiving the TGMP message sent by user X, the RNG searches the user access table according to the MAC address. The logical interface corresponding to the user X determines whether the user X is allowed to join the multicast group according to the multicast control list configured on the logical interface. If yes, the BNG allows the user X to join the multicast group, and the user X sends an IGMP message request. Send multicast data traffic; otherwise, discard user X to send IGMP packet request.

The method provided by the embodiment of the present invention can configure the logical interface on the BNG device to uniquely identify the user link in the multi-service mode, thereby implementing the security control policy configured on the logical interface, according to the user link identification information. A single user link implements security controls such as access control, bandwidth control, flow control, and multicast control. Example 2

Referring to FIG. 4, an embodiment of the present invention provides a method for user access security control, and the steps are as follows:

Step 201: The BNG acquires a user link identifier.

Step 202: The BNG creates a corresponding logical link identifier (ie, a logical interface) for the user link identifier information according to the obtained user link identifier.

The embodiment of the present invention uses a logical link identifier as a logical interface as an example for description.

Step 203: The BNG limits the number of sessions of the user's session IP session on the logical interface, that is, the upper limit of the IP session of the preset user.

Step 204: User X initiates an access request through DHCP, that is, sends a DHCP access request message.

Step 205: The DSLAM receives the DHCP access request packet sent by the user X, and receives the DHCP access request packet. The user link identifier is inserted, and the DHCP access request packet inserted into the user link identifier is forwarded to the BNG.

Step 206: The BNG receives the DHCP access request packet that is sent by the DSLAM and carries the user link identifier, and determines whether the corresponding logical interface can be found according to the user link identifier carried in the access request packet. Step

207, otherwise, step 208 is performed.

Step 207: Determine whether the number of IP sessions of the user X is smaller than the IP of the preset user on the logical interface.

The upper limit of the session, if yes, then step 209 is performed, otherwise step 208 is performed.

Step 208: The BNG discards the received access request packet, prohibits the user X from accessing, and ends.

Step 209: The BNG creates a user access entry bound to the logical interface, and saves the information of the user X. The BNG returns a response packet to the DSLAM, where the response packet carries the user link identifier.

Step 210: The DSLAM receives the DHCP response packet returned by the BNG, deletes the user link identifier carried in the packet, and forwards the DHCP response packet with the user link identifier to the user X.

Step 211: After the DHCP negotiation is complete, user X successfully accesses the BNG. The BNG device adds 1 to the number of recorded IP sessions of the user.

After the user accesses the RNG device, the user can be securely controlled. E.g:

After user X successfully accesses the BNG, user X sends a data packet, which carries the user's MAC address and IP address, and the BNG searches for the user based on the user's MAC address and IP address carried in the received data packet. Accessing the table, finding the corresponding logical interface, and performing bandwidth control on the data packet according to the uplink bandwidth parameter configured by the logical interface; when the device providing the service in the network (such as ASP) sends the datagram to the user X through the BNG And searching for the user access table according to the user MAC address carried in the data packet, and finding the corresponding logical interface, and performing the data packet sent to the user X according to the downlink bandwidth parameter configured on the logical interface. Bandwidth control.

2) When the access control control is required for the user X, the traffic control is performed, and the access control policy can be configured on the BNG logical interface by using the traffic-policy command.

After user X successfully accesses the BNG, user X sends a data packet carrying the user MAC address and

The information such as the IP address, the BNG searches the user access table according to the user MAC address and IP address carried in the received data packet, and finds the logical interface corresponding to the user X. According to the access control policy configured by the logical interface, the user X The data packet is sent for traffic control. When a device (such as an ASP) that provides a service in the network sends a data packet to the user X through the BNG, the user access table is searched according to the MAC address of the user X carried in the data packet. The logical interface corresponding to the user X is found, and the next hop address of the data packet is a logical interface corresponding to the user X on the BNG device, and the data packet sent to the user X through the BNG is performed according to the access control policy configured by the logical interface. flow control. 3) When the user X requests the IGMP (Internet Group Management Protocol) to be added to the multicast group, the BNG can also configure the multicast control policy on the logical interface, that is, configure the multicast control list.

After user X successfully accesses the BNG, user X sends an IGMP message request, and the message request carries the user MAC address. After receiving the IGMP message request sent by user X, the BNG searches the user access table according to the MAC address. The logical interface corresponding to the user X determines whether the user X is allowed to join the multicast group according to the multicast control list configured on the logical interface. If yes, the BNG allows the user X to join the multicast group, and the user X sends an IGMP message request. Send multicast data traffic; otherwise, discard user X to send IGMP packet request.

The method provided by the embodiment of the present invention can configure the logical interface on the BNG device to uniquely identify the user link in the multi-service mode, thereby implementing the security control policy configured on the logical interface, according to the user link identification information. A single user link implements security controls such as access control, bandwidth control, flow control, and multicast control. Example 3

Referring to FIG. 5, an embodiment of the present invention provides a method for a user to access security control, and the steps are as follows:

Step 301: The BNG obtains the user link identifier.

Step 302: The BNG creates a corresponding logical link identifier (ie, a logical interface) for the user link identifier according to the obtained user link identifier.

Step 303: The BNG configures different user types on the logical interface through different keywords. The reference command line is as follows: [BNG] terminal-type voip dhcp-option-60 include VoIP

Step 304: User X initiates an access request through DHCP, that is, sends a DHCP access request message.

User X initiates an access request through DHCP. For example, the DHCP access request carries the keyword VoIP-ISP-1, indicating that user X is the VoIP terminal of ISP-1.

Through steps 302 and 303, the user and the BNG are simultaneously defined keywords of different types of users.

Step 305: The DSLAM receives the DHCP access request packet sent by the user X, inserts the user link identifier into the DHCP access request packet, and forwards the DHCP access request packet after the user link identifier is inserted. BNG.

Step 306: The BNG receives the DHCP access request packet that is sent by the DSLAM and carries the user link identifier information, and determines whether the corresponding logical interface can be found according to the user link identifier carried in the DHCP access request packet. Step 307 is performed, otherwise, step 308 is performed.

Step 307: The BNG determines whether the keyword carried in the DHCP access request packet of the user X matches the keyword configured on the logical interface. If yes, the process proceeds to step 309. Otherwise, the process proceeds to step 308. Step 308: The BNG discards the received access request packet, prohibits the user X from accessing, and ends.

Step 309: The BNG creates a user access entry bound to the logical interface, and saves the information of the user X. The device returns a DHCP response packet to the DSLAM, where the DHCP response packet carries the user link identifier.

Step 310: The DSLAM receives the DHCP response packet returned by the BNG, deletes the user link identifier carried in the packet, and forwards the response packet of the user link identifier to the user X.

Step 311: After the DHCP negotiation is completed, user X successfully accesses the BNG and ends.

After the user accesses the BNG device, the user can be securely controlled. E.g:

The IP address and other information, the BNG searches the user access table according to the user MAC address and IP address carried in the received data packet, finds the corresponding logical interface, and uses the uplink bandwidth parameter configured according to the logical interface to the datagram. When the device that provides the service (such as ASP) sends a data packet to the user X through the BNG, the user accesses the user access table according to the user's MAC address carried in the data packet, and finds the corresponding logical interface. The bandwidth control is performed on the data packet sent to the user X according to the downlink bandwidth parameter configured on the logical interface.

2) When the access control control is required for the user X, the traffic control is performed, and the access control policy can be configured on the BNG logical connection U by using the traffic-policy command.

After user X successfully accesses the BNG, user X sends a data packet, which carries the user's MAC address and IP address, and the BNG searches for the user based on the user's MAC address and IP address carried in the received data packet. Accessing the table, finding the logical interface corresponding to the user X, performing flow control on the data packet sent by the user X according to the access control policy configured by the logical interface; and providing the service device (such as ASP) in the network to the user through the BNG When X sends a data packet, the user access table is searched according to the MAC address of the user X carried in the data packet, and the logical interface corresponding to the user X is found. The hop address of the data packet is the user X corresponding to the BNG device. The logical interface performs flow control on the data packet sent to the user X through the BNG according to the access control policy configured by the logical interface.

After user X successfully accesses the BNG, user X sends an IGMP message request, and the message request carries the user MAC address. After receiving the IGMP message request sent by user X, the BNG searches the user access table according to the MAC address. The logical interface corresponding to the user X determines whether the user X is allowed to join the multicast group according to the multicast control list configured on the logical interface. If yes, the BNG allows the user X to join the multicast group, and the user X sends an IGMP message request. Send multicast stream The user X sends an IGMP message request.

The method provided by the embodiment of the present invention can directly identify the user link in the multi-service mode by configuring the logical interface on the BNG device, thereby implementing the security control policy configured on the logical interface, according to the user link identification information. Implement security control such as access control, bandwidth control, flow control, and multicast control for a single user link.

The foregoing describes a method for creating a logical interface in the embodiment of the present invention, and any security control such as access control, flow control, bandwidth control, and multicast control implemented on a BNG or the like based on logical link identifiers. It is within the scope of the invention. Example 4

Referring to FIG. 6, an embodiment of the present invention provides a system for user access security control, where the system includes:

a user node 601, configured to send an access request message;

The access device 602 is configured to receive an access request message sent by the user node 601, insert a user link identifier in the access request message sent by the user node 601, and send an access request message inserted into the user link identifier.

The control device 603 is configured to: after receiving the access request message inserted by the access device 602 and inserting the user link identifier, perform the analysis to obtain the user link identifier; determine whether the access request message satisfies the preset according to the user link identifier. The access condition, if yes, allows the user node 601 corresponding to the user link identifier to access.

Wherein, referring to FIG. 7, the control device 603 includes:

The first receiving module 6031 is configured to receive an access request message sent by the access device 602.

The first parsing module 6032 is configured to parse the access request packet received by the first receiving module 6031 to obtain a user link identifier.

The first determining module 6033 is configured to determine, according to the user link identifier that is parsed by the first parsing module 6032, whether the logical link identifier corresponding to the user link identifier can be found.

The first processing module 6034, when the result of the determination by the first determining module 6033 is that the logical link identifier corresponding to the user link identifier can be found, the user node 601 corresponding to the user link identifier is allowed to access.

Wherein, referring to FIG. 7, the control device 603 includes:

The second receiving module 6035 is configured to receive an access request message sent by the access device 602.

The second parsing module 6036 is configured to parse the access request packet received by the second receiving module 6035 to obtain a user link identifier.

The searching module 6037 is configured to search, according to the second parsing module 6036, the user link identifier to find a logical link identifier corresponding to the user link identifier.

The second determining module 6038 is configured to determine that the logical link identifier that is found by the first searching module 6037 is accessed by the user. Whether the number of sessions reaches a preset threshold;

The second processing module 6039 is configured to allow the user node 601 corresponding to the user link identifier to access when the second judgment module 6038 determines that the number of the accessed user sessions does not reach the preset threshold, and the received The number of incoming user sessions is increased by one.

Wherein, referring to FIG. 7, the control device 603 includes:

The third receiving module 60310 is configured to receive an access request message sent by the access device 602.

The third parsing module 60311 is configured to parse the access request packet received by the third receiving module 60310 to obtain a user link identifier.

The second search module is configured to search for the logical link identifier corresponding to the user link identifier by using the user link identifier according to the third parsing module 60311.

The third judging module 60313 is configured to determine whether the user type carried in the access request packet is consistent with the preset user type on the logical link identifier found by the second searching module 60312;

The third processing module 60314 is configured to: when the third determination module 60313 determines that the result is that the user type carried in the access request message is consistent with the preset user type on the logical link identifier found by the first search module 60312 The user node 601 corresponding to the user link identifier is allowed to access.

The system provided by the embodiment of the present invention can implement the logical link identifier (which can be implemented in the form of creating a logical connection U) on the control device, and can uniquely identify the user link in the multi-service mode, thereby implementing pre-configured The security control policy corresponding to the logical link identifier implements security control policies such as access control, bandwidth control, flow control, and multicast control for a single user link according to the user link identification information. Example 5

Referring to FIG. 8, an embodiment of the present invention provides an access device, where the device includes:

The receiving module 701 is configured to receive an access request message sent by the user node.

The identifier insertion module 702 is configured to insert a user link identifier in the access request message received by the receiving module 701. The sending module 703 is configured to send an access request message after the identifier insertion module 702 inserts the user link identifier. The access device provided by the embodiment of the present invention can receive the access request message sent by the user contact, insert the user link identifier in the received access request message, and send the access after the user link identifier is inserted. Request a message. The device may also insert other information, such as a user type, into the received access request message.

Example 6

Referring to FIG. 9, an embodiment of the present invention provides a control device, where the device includes:

The receiving module 801 is configured to receive an access request message sent by the access device, where the access request message carries the user link. Identification

The parsing module 802 is configured to parse the access request packet received by the receiving module 801 to obtain a user link identifier. The processing module 803 is configured to determine, according to the user link identifier parsed by the parsing module 802, whether the access request packet satisfies a preset. The access condition, if yes, allows the user corresponding to the link identifier of the user to access.

Wherein, referring to FIG. 10, the processing module 803 includes:

The first determining unit 8031 is configured to determine, according to the user link identifier that is parsed by the parsing module 802, whether the logical link identifier corresponding to the user link identifier can be found.

The first processing unit 8032 is configured to allow the user corresponding to the user link identifier to access when the first determination unit 8031 determines that the logical link identifier corresponding to the user link identifier can be found.

Wherein, referring to FIG. 10, the processing module 803 includes:

The first searching unit 8033 is configured to: according to the parsing module 802, parse the user link identifier to find a logical link identifier corresponding to the user link identifier;

The second determining unit 8034 is configured to determine whether the number of user sessions that the logical link identifier that is found by the first searching unit 8033 has reached a preset threshold;

The second processing unit 8035 is configured to allow the user corresponding to the user link identifier to access when the number of the user sessions that have been accessed by the second determining unit 8034 is not reached, and the access is The number of user sessions is increased by 1.

Wherein, referring to FIG. 10, the processing module 803 includes:

The second searching unit 8036 is configured to search, according to the parsing module 802, the user link identifier to find a logical link identifier corresponding to the user link identifier.

The third determining unit 8037 is configured to determine whether the user type carried in the access request packet and the second searching unit

The default user type on the logical link identifier found by the 8036 is the same;

The third processing unit 8038 is configured to: when the third determining unit 8037 determines that the result is the user type carried in the access request message and the preset user type on the logical link identifier found by the second searching unit 8036. Allows the user to access the corresponding user ID.

After the user accesses the control device, it can also perform security control on the accessed user. At this time, see the figure.

11, the control device also includes:

The first recording module 804 is configured to: when the processing module 803 allows the user corresponding to the user link identifier to access, the media access control address, the IP address, the user link identifier, and the logical link identifier of the user according to the access request message. Recorded in the user access list;

The first configuration module 805 is configured to configure a control policy for the logical link identifier according to the logical link identifier recorded by the recording module 803 in the user access table. The first control module 806 is configured to: when receiving the data packet sent by the user, search for a corresponding logical link identifier in the user access table of the recording module according to the media access control address and the IP address carried in the data packet, Controlling data packets according to the corresponding control policy of the logical link identifier that is found;

The second control module 807 is configured to: when receiving the data packet sent to the user, search for a corresponding logical link identifier in the recording module according to the media access control address carried in the data packet sent to the user, according to the The logical link identifies the corresponding control policy and controls the data packets sent to the user.

The control policy configured by the foregoing configuration module may be an access control policy or/and a bandwidth control policy, and correspondingly, may perform flow control or bandwidth control of data packets. The embodiment of the present invention does not limit the type of control policy configured by the configuration module.

When the user X requests IGMP on-demand to join the multicast group, referring to FIG. 11, the control device further includes: a second recording module 808, configured to: when the processing module 803 allows the user corresponding to the user link identifier to access, according to the access request The packet records the user's media access control address, IP address, user link identifier, and logical link identifier in the user access table.

The first-configuration module 809 is configured to configure a multicast control policy for the logical link identifier according to the logical link identifier recorded by the first-recording module 808.

The multicast control module 8010 is configured to: when receiving a network group management protocol packet sent by the user to join the multicast group, according to the media access control address carried in the network group management protocol packet, the user access table in the recording module The corresponding logical link identifier is searched for, and the multicast control policy corresponding to the logical link identifier is found to determine whether the user is allowed to join the multicast group. If yes, the user is allowed to join the multicast group.

The configuration of the logical link identifier (which can be implemented in the form of creating a logical interface) is provided on the control device according to the embodiment of the present invention, and the user link can be uniquely identified in the multi-service mode, thereby implementing the pre-configured logical chain. The corresponding security control policy of the road identifier implements security control policies such as access control, bandwidth control, flow control, and multicast control for a single user link according to the user link identification information.

The technical solution provided by the foregoing embodiment of the present invention can identify a user link in a multi-service mode by configuring a logical link identifier on a similar control device such as a BNG, thereby implementing a logical link identifier corresponding to the pre-configured logical link. The security control policy implements security control policies such as access control, bandwidth control, traffic control, and multicast control for a single user link according to user link identification information.

Some steps in the embodiment of the present invention may be implemented by using software, and the corresponding software program may be stored in a readable storage medium, such as an optical disk or a hard disk.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., which are within the spirit and principles of the present invention, should be included in the protection of the present invention. Within the scope.

Claims

Claim

A control device, the device comprising:

The receiving module (801) is configured to receive an access request message sent by the access device, where the access request message carries a user link identifier;

The parsing module (802) is configured to parse the access request packet received by the receiving module (801) to obtain the user link identifier;

The processing module (803) is configured to determine, according to the user link identifier that is parsed by the parsing module (802), whether the access request packet meets a preset access condition, and if yes, allow the user link identifier to correspond to User access.

The control device according to claim 1, wherein the processing module (803) comprises: a first determining unit (8031), configured to parse the user link identifier according to the parsing module (802) The judgment is ¹ ? The logical link identifier corresponding to the user link identifier can be found;

a first processing unit (8032), configured to allow the user link identifier to be corresponding when the result of the first determining unit (8031) is that the logical link identifier corresponding to the user link identifier can be found. User access.

The control device according to claim 1, wherein the processing module (803) comprises: a first searching unit (8033), configured to perform a user link identifier search according to the parsing module (802) a logical link identifier corresponding to the user link identifier;

a second determining unit (8034), configured to determine whether the number of user sessions that the logical link identifier that is found by the first searching unit (8033) has reached a preset threshold;

a second processing unit (8035), configured to allow the user link identifier when the second judgment unit (8034) determines that the number of the accessed user sessions does not reach the preset threshold. The corresponding user accesses, and increases the number of the accessed user sessions by one.

The control device according to claim 1, wherein the processing module (803) comprises: a second searching unit (8036), configured to perform a user link identifier search according to the parsing module (802) a logical link identifier corresponding to the user link identifier;

The third determining unit (8037) is configured to determine whether the user type carried in the access request packet is consistent with a preset user type on the logical link identifier found by the second searching unit (8036);

a third processing unit (8038), configured to: when the third determining unit (8037) determines that the result is that the type of the user carried in the access request message and the logical link identifier that is found by the searching unit When the user types are the same, the user corresponding to the link identifier of the user is allowed to access.

The control device according to claim 1, wherein the device further comprises:

a first recording module (804), configured to: when the processing module (803) allows the user corresponding to the user link identifier During the access, the media access control address, the IP address, the user link identifier, and the logical link identifier of the user are recorded in the user access table according to the access request message;

The configuration module (805) is configured to configure a control policy for the logical link identifier according to the logical link identifier recorded in the user access table by the first recording module (804).

The first control module (806) is configured to: when receiving the data packet sent by the user, according to the media access control address and the IP address carried in the data packet, the user of the first recording module (804) Querying the corresponding logical link identifier in the entry table, and controlling the data packet according to the control policy corresponding to the found logical link identifier; the second control module (807) is configured to receive the Searching for the corresponding logical link identifier in the first recording module (804) according to the media access control address carried in the data packet sent to the user according to the data packet of the user, according to the found logic A control policy corresponding to the link identifier controls the data packet sent to the user.

The control device according to claim 1, wherein the device further comprises:

a second recording module (808), configured to: when the processing module (803) allows the user corresponding to the user link identifier to access, the user access control address and the TP address according to the access request message The user link identifier and the logical link identifier are recorded in the user access table.

The second configuration module (809) is configured to configure a multicast control policy for the logical link identifier according to the logical link identifier recorded by the second recording module (808).

The multicast control module (8010) is configured to: when receiving the network group management protocol packet sent by the user to join the multicast group, according to the media access control address carried in the network group management protocol packet The user access table of the second recording module (808) searches for the corresponding logical link identifier, and determines whether the user is allowed to join the multicast group according to the multicast control policy corresponding to the found logical link identifier. If yes, allow The user joins a multicast group.

A method for user access security control, characterized in that the method comprises:

Parsing the access request packet to obtain the user link identifier;

The method for the user to access the security control according to claim 7, wherein the determining, according to the user link identifier, whether the access request packet meets a preset access condition comprises:

Determining whether the logical link identifier corresponding to the user link identifier can be found;

If yes, the default access conditions are met.

Finding a logical link identifier corresponding to the user link identifier;

Checking whether the number of user sessions that have been accessed by the logical link identifier reaches a preset threshold. If the preset threshold is not met, the preset access condition is met;

Correspondingly, the step of allowing the user access corresponding to the user link identifier further includes:

The number of the accessed user sessions is increased by one.

The user access security control method according to claim 7, wherein the access request message further carries a user type;

Correspondingly, the step of determining, according to the user link identifier, whether the access request packet meets a preset access condition comprises:

Finding a logical link identifier corresponding to the user link identifier;

Determining whether the user type carried in the access request packet is consistent with the preset user type of the logical link identifier, and if yes, the preset access condition is met.

The method for the user to access the security control according to claim 7, wherein the step of allowing the user access corresponding to the user link identifier further comprises:

Recording, according to the access request message, the media access control address, the IP address, the user link identifier, and the logical link identifier of the user in the user access table, and configuring a control policy for the user corresponding to the logical link identifier;

When the data packet sent by the user is received, the corresponding logical link identifier is searched in the user access table according to the media access control address and the IP address carried in the data packet, according to the discovered logical link. Identifying a corresponding control policy, and controlling the data packet;

When the data packet sent to the user is received, the corresponding logical link identifier is searched in the user access table according to the media access control address carried in the data packet sent to the user, according to the The control policy corresponding to the discovered logical link identifier controls the data packet sent to the user.

The method for accessing security control of a user according to claim 11, wherein the control policy is specifically:

Access control policies, and / or bandwidth control policies.

Recording, according to the access request message, the media access control address, the IP address, the user link identifier, and the logical link identifier of the user in the user access table, and configuring multicast control for the user corresponding to the logical link identifier. Strategy When receiving a network group management protocol packet sent by the user to join the multicast group, the device searches for the corresponding logical link in the user access table according to the media access control address carried in the network group management protocol packet. The identifier determines whether the user is allowed to join the multicast group according to the multicast control policy corresponding to the logical link identifier that is found. If yes, the user is allowed to join the multicast group.

A system for user access security control, characterized in that the system comprises:

a user node (601), configured to send an access request message;

The access device (602) is configured to receive an access request message sent by the user node (601), insert a user link identifier in the access request message sent by the user node (601), and send the inserted user The access request message of the link identifier;

The control device (603) is configured to: after receiving the access request message that is sent by the access device (602) and insert the user link identifier, perform the parsing to obtain the user link identifier; according to the user link identifier Determining whether the access request packet meets a preset access condition, and if yes, allowing the user node (601) corresponding to the user link identifier to access.

The system for accessing security control of a user according to claim 14, wherein the control device (603) comprises:

The first receiving module (6031) is configured to receive an access request message sent by the access device (602), and the first parsing module (6032) parses the receiving received by the first receiving module (6031) The incoming request message obtains the user link identifier;

a first determining module (6033), configured to determine, according to the user link identifier that is parsed by the first parsing module (6032), whether the logical link identifier corresponding to the user link identifier can be found;

a first processing module (6034), when the first determining module (6033) determines that the logical link identifier corresponding to the user link identifier is found, the user node corresponding to the user link identifier is allowed. (601) Access.

a second receiving module (6035), configured to receive an access request message sent by the access device (602), and a second parsing module (6036) configured to parse the received end of the second receiving module (6035) The incoming request message obtains the user link identifier;

The first search module (6037) is configured to: according to the second parsing module (6036), parse the user link identifier to find a logical link identifier corresponding to the user link identifier;

a second judging module (6038), configured to determine whether the number of user sessions that the logical link identifier that is found by the first searching module (6037) has reached a preset threshold; a second processing module (6039), configured to allow the user link identifier when the second judgment module (6038) determines that the number of the accessed user sessions does not reach the preset threshold. The corresponding user node (601) accesses and increases the number of the accessed user sessions by one.

a third receiving module (60310), configured to receive an access request message sent by the access device (602), and a third parsing module (60311), configured to parse the received end of the third receiving module (60310) The incoming request message obtains the user link identifier;

a second search module (60312), configured to perform, according to the third parsing module (60311), the user link identifier to obtain a logical link identifier corresponding to the user link identifier;

The third judging module (60313) is configured to determine whether the user type carried in the access request packet is consistent with a preset user type on the logical link identifier found by the second searching module (60312);

a third processing module (60314), configured to: when the third determining module (60313) determines that the result is a user type carried in the access request message and the first-find module (60312) finds When the preset user types on the logical link identifier are the same, the user node (601) corresponding to the user link identifier is allowed to access.

18. An access device, the device comprising:

The receiving module (701) receives, by using ten, an access request message sent by the user;

An identifier insertion module (702), configured to insert a user link identifier in an access request message received by the receiving module (701);

The sending module (703) is configured to send an access request message after the identifier insertion module (702) inserts the user link identifier.