WO2009079895A1

WO2009079895A1 - Method for allocating a secondary ip address based on dhcp access authentication

Info

Publication number: WO2009079895A1
Application number: PCT/CN2008/000462
Authority: WO
Inventors: Zhenfu Zhao; Senlin Bao; Yunzhao Shi
Original assignee: Zte Corporation
Priority date: 2007-12-14
Filing date: 2008-03-07
Publication date: 2009-07-02
Also published as: CN101184099B; CN101184099A

Abstract

A method for allocating a secondary IP address based on DHCP access authentication includes steps of that: A DHCP server receives a DHCP finding message of a DHCP user equipment, a DHCP user equipment is triggered to process an access authentication, An authentication result and authorization information for the user equipment passed through the access authentication are recorded. When the DHCP server receives a DHCP request message from a user equipment which did not pass through or did not support the access authentication, the DHCP server allocates a dynamic IP address with only local access authority to the DHCP user equipment, when the DHCP server receives a DHCP request message from a DHCP user equipment passed through the access authentication, by transmitting an unanswered message for allocating the IP address to the DHCP user equipment passed through the access authentication, a secondary IP address request is triggered again, and according to the authentication result and authorization information for the DHCP user equipment passed through the access authentication, a dynamic IP address with corresponding access authority is allocated to the DHCP user equipment, the allocation of the secondary IP address is completed.

Description

Based on the dynamic host configuration association access card

TECHNICAL FIELD The present invention relates to the field of communications, and more particularly to a secondary IP address allocation method based on dynamic host configuration protocol access authentication. BACKGROUND With the development of Ethernet technology, Ethernet technology has gradually expanded from a local area network to a metropolitan area network and an inter-city network, and a dynamic host configuration protocol (DHCP) application model has gradually expanded to the city i or And intercity, gradually become the network IP address management technology selected by operators when conducting business. For example, the IP TV (IPTV) service carried out by China Netcom is basically based on DHCP to realize the dynamic access of users. However, since the DHCP protocol itself only implements the dynamic allocation and management of the network IP address, it does not support the user-based access authentication and authorization process. Therefore, when the operator conducts services such as IPTV, the corresponding broadband access device must The user access authentication is implemented by means of 802.1x, Web PortaK static configuration, etc., which brings complexity to the service access of the terminal device users and increases the research and development cost of the device. SUMMARY OF THE INVENTION In view of one or more of the problems described above, the present invention provides a secondary IP address allocation method based on Dynamic Host Configuration Protocol (DHCP) access authentication. The secondary IP address allocation method based on the dynamic host configuration protocol access authentication according to the embodiment of the present invention includes the following steps: Step 1: When the dynamic host configuration protocol server receives the dynamic host configuration protocol from the dynamic host configuration protocol user equipment When the message (DHCPDISCOVER) is found, the dynamic host configuration protocol user equipment is authenticated for access authentication. Step 2: When the dynamic host configuration protocol server receives the dynamic host configuration protocol request message from the dynamic host configuration protocol user equipment (DHCPREQUEST) According to the authentication result and authorization information of the dynamic host configuration protocol user equipment, the dynamic host configuration protocol user equipment that does not pass or does not support the access authentication is assigned a dynamic IP address with only local access rights, and the access authentication is performed. Dynamic Host Configuration Protocol user equipment, triggering the dynamics of access authentication by not answering the assigned IP address message (DHCPNAK)

1 P 18339 The host configuration protocol user equipment re-initiates the secondary IP address application process, and assigns the dynamic IP address with the corresponding access rights to the user equipment according to the authentication result and authorization information of the dynamic host configuration protocol of the access authentication. Secondary IP address assignment. Step 1 includes: Step a, when the dynamic host configuration protocol server receives the dynamic host configuration protocol discovery message (DHCPDISCOVER) from the dynamic host configuration protocol user equipment, returning to the dynamic host configuration protocol user equipment and carrying the required dynamic host A dynamic host configuration protocol providing message (DHCPOFFER) for configuring the protocol user equipment for access authentication; step b, the dynamic host configuration protocol user equipment submits the dynamic host configuration protocol providing message (DHCPOFFER) to the dynamic host configuration protocol server Accessing the authentication attribute information; and in step c, the dynamic host configuration protocol server performs access authentication on the dynamic host configuration protocol user equipment according to the access authentication attribute information, and the authentication result of the dynamic host configuration protocol user equipment that passes the access authentication and Authorization information is recorded. In the case that the dynamic host configuration protocol server supports multiple access authentication methods, the dynamic host configuration protocol providing message also carries a list of multiple access authentication methods and corresponding authentication authorization attribute options, and in step b The dynamic host configuration protocol user equipment selects a matching access authentication method from multiple access authentication methods, and submits access authentication attribute information corresponding to the selected access authentication method to the dynamic host configuration protocol server. In the case that there is no matching access authentication method in multiple access authentication methods, the dynamic host configuration protocol user equipment does not perform processing related to access authentication. The dynamic host configuration protocol server identifies multiple access authentication methods by different uniquely determined option values. The secondary IP address allocation method based on the dynamic host configuration protocol access authentication according to the embodiment of the present invention may further include: when the dynamic host configuration protocol server receives the dynamic host configuration protocol rejection message (DHCPDECLINE) from the dynamic host configuration protocol user equipment. And/or dynamic host configuration protocol release message (DHCPRELEASE), reclaims the dynamic IP address assigned to the Dynamic Host Configuration Protocol user device. The invention can strictly control the effective dynamic IP address allocation according to the user access authentication result of the DHCP, and assign the dynamic IP address of different network segments to the user who passes the authentication and the non-passing, thereby improving the efficiency of the DHCP user's address allocation, thereby facilitating the efficiency of the DHCP user's address allocation. Reduce network management complexity and improve network management efficiency.

2 P18339 BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a flowchart of a process for a dynamic host configuration protocol server (DHCP SERVER) to allocate a dynamic IP address with limited access rights according to an embodiment of the present invention; FIG. 2 is a DHCP SERVER allocation according to an embodiment of the present invention. A flowchart of a process for a dynamic IP address having access to an external network; and FIG. 3 is a schematic diagram of a network architecture applying the method shown in FIGS. 1 and 2. The main idea of the IP address allocation method based on the DHCP access authentication provided by the present invention is: assigning a default network segment having only local access rights to a DHCP user equipment that does not support access authentication or fails access authentication. The dynamic IP address does not trigger the secondary IP address assignment process. After the authentication and authorization information of the user equipment is recorded, the DHCP user equipment sends a dynamic host configuration protocol denial (DHCPNAK) message to the DHCP user equipment (DHCP CLIENT), triggering the DHCP CLIENT to re-initiate the secondary DHCP. Address request. At this time, the DHCP server (DHCP SERVER) allocates the dynamic IP address of the network segment with higher authority according to the authentication pass status of the DHCP user device that has been recorded, thereby implementing the secondary dynamic IP address according to the DHCP access authentication result. Assignment function. When the DHCP SERVER receives the dynamic host configuration protocol request (DHCPREQUEST) message sent by the DHCP CLIENT, the DHCP user equipment that does not support the access authentication or fails the access authentication does not respond to the DHCPNAK, and refuses to allocate the dynamic IP address. Directly respond to the Dynamic Host Configuration Protocol Acknowledgement (DHCPACK) message, assigning the default dynamic IP address of the network segment with only local access rights, thus not triggering the secondary IP address allocation process. For the DHCP user equipment that passes the access authentication, the DHCP SERVER needs to record the authentication result and authorization information of the user equipment, and then sends a DHCPNAK to the DHCP CLIENT, triggering the DHCP CLIENT to re-initiate the secondary DHCP address request, when the DHCP CLIENT initiates the dynamic again. During the dynamic IP address application process of the DHCP configuration message discovery (DHCPDISCOVER) message, the DHCP SERVER allocates the dynamic IP address of the network segment with the corresponding access rights to the DHCP authentication status of the recorded DHCP user equipment. Secondary dynamic IP address of the authentication result

3 P18339 With the function. Specifically, the DHCP address-based authentication IP address allocation method according to the present invention includes the following steps: Step 1: The DHCP CLIENT initiates a DHCPDISCOVER message to search for a DHCP SERVER capable of providing dynamic IP address allocation. After receiving the DHCPDISCOVER message, the DHCP SERVER enters the DHCP Hoster Protocol (DHCPOFFER) message returned to the DHCP CLIENT according to the authentication requirements, and enters the option to identify the DHCP CLIENT for access authentication. In the case that the DHCP CLIENT supports multiple access authentication methods, the DHCP SERVER can enter the list of supported access authentication methods and corresponding authentication and authorization attributes in the DHCPOFFER message (for example, when using CHAP, the challenge value needs to be carried at the same time. ). In this way, the DHCP CLIENT can select a matching access authentication method for access authentication according to its own capability support situation. Among them, different access authentication methods are identified by a uniquely determined option value. After receiving the DHCPOFFER message returned by the DHCP SERVER, the DHCP CLIENT ignores the subsequent access authentication process if it cannot identify the relevant access authentication option. If it can identify and process the corresponding access authentication option, it will use its own Capability support, 4 Mbps matching access authentication method for access authentication processing; if there is no access authentication method that can be supported by itself, the subsequent access authentication processing is ignored, and only the dynamic IP address is applied; CLIENT finds its own matching and supportable access authentication method, and then according to the need of access authentication method, submits the corresponding access authentication attribute (for example, user name, key, etc.) to the DHCP SERVER for access. Certification. Step 2: When the DHCP SERVER receives the dynamic host configuration protocol request (DHCPREQUEST) message sent by the DHCP CLIENT, the DHCP user equipment that does not support the access authentication or fails the access authentication does not respond to the DHCPNAK message, and refuses to allocate the dynamic IP address. Instead, it directly responds to the DHCPACK message and assigns the default dynamic IP address of the network segment with only local access rights. This does not trigger the secondary IP address allocation process. When the DHCP SERVER receives the DHCPREQUEST message sent by the DHCP CLIENT, the DHCP SERVER needs to record the authentication result and authorization information of the user equipment for the DHCP user equipment that passes the access authentication, and then triggers the DHCP CLIENT by sending a DHCPNAK message to the DHCP CLIENT. The secondary DHCP address request is initiated. When the DHCP CLIENT receives the DHCP NAK message and initiates the DHCP dynamic IP address application process, the DHCP SERVER allocates the dynamic IP address of the network segment with the corresponding authority according to the recorded authentication status of the DHCP user equipment. . When the DHCP SERVER receives the dynamic host configuration protocol sent by the DHCP CLIENT

4 P18339 After the DHCP DECLINE message and/or the Dynamic Host Configuration Protocol Release (DHCPRELEASE) message, the external network access rights obtained before the DHCP CLIENT are reclaimed. Specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Referring to FIG. 1, a process of assigning a dynamic IP address with limited access rights to a dynamic host configuration protocol server according to an embodiment of the present invention is illustrated. As shown in FIG. 1, the process specifically includes the following steps:

S102, DHCP CLIENT 1 in subnet 1 initiates a DHCPDISCOVER message to search for a DHCP SERVER capable of providing dynamic IP address allocation.

S104: After receiving the DHCPDISCOVER message, the DHCP SERVER on the broadband access router performs normal DHCP message processing, and submits a dynamic IP address to the DHCP CLIENT1 that can allocate the network segment 192.168.0.0/24 with only local access rights, and according to the authentication. If you need to enter the DHCPOFFER message, you need to identify the DHCP CLIENT 1 access authentication. The option needs to identify the access authentication method that you support or provide, including the selected 4 Mbps handshake authentication protocol. Authentication Protocol (CHAP for short) access authentication method, and the challenge value required for CHAP access authentication, and then send a DHCPOFFER message to DHCP CLIENT 1.

SI 06, DHCP CLIENT 1 after the DHCPOFFER message returned by DHCP SERVER, it is recognized that the DHCP SERVER needs to perform CHAP-based access authentication processing, and then extracts attributes such as 4 megabytes related to CHAP access authentication for CHAP correlation calculation. And enter the CHAP calculation result in the DHCPREQUEST message, and submit it to the DHCP SERVER for access authentication.

S108, after the DHCP SERVER is in the DHCPREQUEST message of the DHCP CLIENT, if the access authentication option is found, the related user access authentication information is removed, and the authentication, authorization, and accounting are performed. , the tube is called AAA) to initiate access authentication.

S110: After receiving the authentication result returned by the AAA server, the DHCP SERVER checks the authentication result and records the network access authority information.

S112, because the authentication is unsuccessful, the DHCP SERVER continues to allocate the dynamic IP address of the network segment 192.168.0.0/24 with restricted network access rights, but does not allow DHCP CLIENT 1

5 P 18339 Visit the eve network.

S1 14, when the DHCP CLIENT1 access network is completed or shuts down, the DHCPRELEASE message is sent to notify the offline; when the DHCP SERVER receives the DHCPRELEASE message sent by the DHCP CLIENT 1, the dynamic IP address and the intranet access obtained before the DHCP CLIENT 1 is recovered. Permissions. Referring to FIG. 2, a process in which a DHCP SERVER allocates a dynamic IP address having an external network access authority according to an embodiment of the present invention will be described. As shown in FIG. 2, the process specifically includes the following steps:

S202, DHCP CLIENT2 in subnet 1 initiates a DHCPDISCOVER message to search for a DHCP SERVER capable of providing dynamic IP address allocation. S204, after receiving the DHCPDISCOVER message, the DHCP SERVER on the broadband access router performs normal DHCP message processing, and provides the dynamic IP address of the network segment 192.168.0.0/24 with only local access rights to the DHCP CLIENT2, and according to the authentication requirement, In the DHCPOFFER message, enter the option to identify the DHCP CLIENT2 access authentication. The option needs to identify the access authentication method supported or provided by the option, including the selected CHAP access authentication method and the CHAP access authentication office. A property such as a challenge value is required, and then a DHCPOFFER message is sent to DHCP CLIENT2.

S206, DHCP CLIENT2 recognizes that the DHCP SERVER needs to perform CHAP-based access authentication processing after the DHCPOFFER message returned by the DHCP SERVER, and extracts the CHAP access authentication-related challenge value and other attributes for CHAP correlation calculation, and The CHAP calculation result is entered in the DHCPREQUEST message and submitted to the DHCP SERVER for access authentication.

S208: After receiving the DHCPREQUEST message of the DHCP CLIENT2, the DHCP SERVER, if it finds that the access authentication option exists, takes out the relevant user access authentication information, and initiates access authentication to the AAA server. S210, after receiving the authentication result returned by the AAA server, the DHCP SERVER checks the iiL result and records the network access authority information.

S212, because the access authentication succeeds, the DHCP SERVER triggers the DHCP CLIENT2 to initiate a secondary IP address request, and directly responds to the DHCP CLIK message to the DHCP CLIENT2, so that the DHCP CLIENT2 initiates the IP address application process again.

6 P 18339 S214, DHCP CLIENT2 in subnet 1 initiates a DHCPDISCOVER message to search for a DHCP SERVER capable of providing dynamic IP address allocation.

S216, after receiving the DHCPDISCOVER message, the DHCP SERVER on the broadband access router selects a dynamic IP address of the network segment that provides access to the external network according to the recorded information that the user has passed the authentication, and then sends the DHCPOFFER message to the DHCP. CLIENT2.

S218, after receiving the DHCPOFFER message returned by the DHCP SERVER, the DHCP CLIENT2 requests the DHCP SERVER to allocate a dynamic IP address.

S220, after the DHCP SERVER is in the DHCPREQUEST message of the DHCP CLIENT2, the user recorded by the residence has passed the authentication information, and the dynamic IP address of the network segment 10.40.0.0/16 with the access permission of the external network is allocated, and the DHCPACK is returned to the DHCP CLIENT2. Message. After DHCP CLIENT2 assigns a dynamic IP address twice, it obtains a new assigned dynamic IP address with external network access rights, thus implementing a secondary dynamic IP address allocation function based on the DHCP access authentication result.

S222: After receiving the DHCPDECLINE and DHCPRELE ASE messages sent by the DHCP CLIENT2, the DHCP SERVER recovers the external network access rights obtained before the DHCP CLIENT2, and recovers the corresponding dynamic IP address. Referring to Figure 3, the network architecture of the method shown in Figures 1 and 2 will be described. As shown in Figure 3, the network includes: access routers, egress routers, switches, subnet 1, and subnet 2. The steps of implementing an IP address allocation method based on DHCP access authentication in the ZXR10 series broadband access router are described below. Among them, the access router in the network has a built-in DHCP SERVER to implement dynamic access of DHCP user equipment. To facilitate the management of services, set the IP address of the network segment with access to the external network to 10.40.0.0/16, and set the IP address of the network segment with only local access rights to 192.168.0.0/24. Only the DHCP CLIENT that passes the access authentication can assign the IP address of the 10.40.0.0/16 network segment with external network access to the external network. Otherwise, only the network segment with the local network access permission of 192.168.0.0/24 can be assigned. The IP address is accessed by the local area network. Among them, a method according to an embodiment of the present invention is used between a DHCP CLIENT and a DHCP SERVER in a network. In Figure 3, two ZXR10 router devices are used, which are broadband access routers and egress routers. Among them, the broadband access router also serves as a broadband access service while completing the function of the router.

P18339 The function of the Broadband Remote Access Server (BRAS) is to use the embedded DHCP SERVER to complete the allocation and access of the dynamic IP addresses of all internal subnet users. The access router accesses the Internet (INTERNET) through the uplink interface GEI-2/1, and connects to switch 1 and switch 2 through the downlink interface FEI-1/1 to access the DHCP user equipment of subnet 1 and subnet 2. In order to simplify the processing steps for implementing the DHCP access authentication-based IP address allocation method between the DHCP CLIENT and the DHCP SERVER, the broadband access router in the figure and the DHCP CLIENT 1 of the subnet 1 are described as an example. As shown in FIG. 3, the method for implementing IP address allocation based on DHCP access authentication between DHCP CLIENT 1 and DHCP SERVER includes the following steps: 1) DHCP CLIENT 1 in subnet 1 initiates a DHCPDISCOVER message, and the search can provide dynamic IP address allocation. DHCP SERVER,

2) After receiving the DHCPDISCOVER message, the DHCP SERVER on the broadband access router performs normal DHCP dynamic IP address allocation, and according to the authentication needs, enters the DHCPOFFER message to identify the user that needs to access the DHCP CLIENT 1 for access authentication. The option needs to identify the access authentication method supported by the option, including the selected CHAP access authentication method, and the challenge value required for CHAP access authentication.

3) After receiving the DHCPOFFER message returned by the DHCP SERVER, the DHCP CLIENT 1 recognizes that the DHCP SERVER needs to perform the CHAP-based access authentication process, and extracts the CHAP access authentication-related challenge value and other attributes for CHAP-related calculation, and is in the DHCPREQUEST. The CHAP calculation result is entered in the message and submitted to the DHCP SERVER for authentication.

4) When the DHCP SERVER receives the DHCPREQUEST message sent by the DHCP CLIENT 1, the DHCP CLIENT1 input incorrect authentication information causes the access authentication to fail, and the J DHCP SERVER directly responds to the DHCPACK message, and the allocation only has local access rights. Dynamic IP address of the network segment 192.168.0.0/24; When the DHCP SERVER receives the DHCPREQUEST message sent by the DHCP CLIENT 1, the access authentication passes, then the DHCP SERVER needs to record the authentication result and authorization information of the user equipment, and then pass the DHCP to the DHCP device. CLIENT 1 sends a DHCPNAK message, triggers DHCP CLIENT 1 to re-initiate a secondary DHCP address request; when DHCP CLIENT 1 receives the DHCPNAK message, it will initiate the DHCP dynamic IP address application process again. The new process includes basic DHCPDISCOVER, DHCPOFFER,

8 P18339 DHCPREQUEST, DHCPACK, etc. interaction; DHCP SERVER assigns a dynamic IP address of the network segment 10.40.0.0/16 with specific permissions according to the recorded authentication status of the DHCP user equipment.

5) When the DHCP SERVER receives the DHCPDECLINE and DHCPRELEASE messages sent by DHCP CLIENT 1, it reclaims the access rights of the external network obtained before DHCP CLIENT 1, and returns the corresponding dynamic IP address. It can be seen that, according to the DHCP access authentication result, the present invention directly allocates a dynamic IP address of a network segment having only local access rights to a DHCP user message that does not support the access authentication or fails the access authentication. The DHCP user device that passes the access authentication sends a DHCPNAK message to the DHCP CLIENT, triggers a secondary DHCP address request of the DHCP CLIENT, and assigns a dynamic IP address of the network segment with the corresponding access authority, thereby implementing DHCP-based access authentication. The result of the secondary dynamic IP address allocation function. Broadband access network equipment such as a wireless access controller (Access Controller, AC), a broadband access router (Broadband Access Server, BAS), a broadband access router, etc. After the method of the present invention is implemented, the effective dynamic IP address allocation can be strictly controlled according to the user access authentication result of the DHCP, and the dynamic IP addresses of different network segments are allocated to the user equipments that pass the authentication and fail, and the DHCP user equipment is improved. Address allocation efficiency; At the same time, it is also beneficial to reduce the complexity of network management and improve network management efficiency. The above is only the embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. All modifications, equivalents, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the appended claims.

9 P18339

Claims

A method for assigning secondary IP addresses based on dynamic host configuration protocol access authentication, which is characterized in that:

Step 1: When the dynamic host configuration protocol server receives the dynamic host configuration protocol discovery message from the dynamic host configuration protocol user device, triggering the connection to the dynamic host configuration protocol user device;

Step 2: When the dynamic host configuration protocol server receives the dynamic host configuration protocol request message from the dynamic host configuration protocol user equipment, the authentication result and the authorization information of the user equipment of the dynamic host configuration protocol are not passed or The dynamic host configuration protocol user device that does not support access authentication allocates a dynamic IP address with only local access rights, and triggers the re-initiation of the secondary IP address request by sending a non-acknowledgement assigned IP address message to the dynamic host configuration protocol user equipment of the access authentication. The process, and assigning a dynamic IP address with a corresponding access right according to the authentication result and the authorization information of the dynamic host configuration protocol user equipment of the access authentication, completes the secondary IP address allocation of the user. The secondary IP address allocation method according to claim 1, wherein the step 1 includes:

Step a, when the dynamic host configuration protocol server receives the dynamic host configuration protocol discovery message from the dynamic host configuration protocol user equipment, returning to the dynamic host configuration protocol user equipment The host configuration protocol user equipment provides a message for the dynamic host configuration protocol of the access authentication option;

Step b: After receiving the dynamic host configuration protocol providing message, the dynamic host configuration protocol user equipment submits access authentication attribute information to the dynamic host configuration protocol server;

Step c: The dynamic host configuration protocol server performs access authentication on the dynamic host configuration protocol user equipment according to the access authentication attribute information, and performs authentication result on the dynamic host configuration protocol user equipment that passes the access authentication. And authorize information for recording. The secondary IP address allocation method according to claim 2, wherein in the case that the dynamic host configuration protocol server supports multiple access authentication methods, the dynamic host is configured

10 P18339 The protocol providing message also carries a list of the multiple access authentication methods and an option of the corresponding ijy certificate 4 authorized attribute.

The secondary IP address allocation method according to claim 3, wherein, in the case that the dynamic host configuration protocol server supports multiple access authentication methods, in the step b, the dynamic host The configuration protocol user equipment selects a matching access authentication method from the multiple access authentication methods, and submits access authentication attribute information corresponding to the selected access authentication method to the dynamic host configuration protocol server.

The secondary IP address allocation method according to claim 4, wherein, in the case where the matched access authentication method does not exist in the multiple access authentication methods, the dynamic host configuration The protocol user equipment does not perform processing related to access authentication.

The secondary IP address allocation method according to claim 5, wherein the dynamic host configuration protocol server identifies the plurality of access authentication methods by different uniquely determined option values.

The secondary IP address allocation method according to any one of the preceding claims, further comprising:

Retrieving the dynamic host configuration protocol user equipment allocation when the dynamic host configuration protocol server receives a dynamic host configuration protocol reject message and/or a dynamic host configuration protocol release message from the dynamic host configuration protocol user equipment Dynamic IP address.

11 P18339