WO2009082978A1

WO2009082978A1 - Access network protecting method, system and access edge node

Info

Publication number: WO2009082978A1
Application number: PCT/CN2008/073811
Authority: WO
Inventors: Zhenting Yang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-12-28
Filing date: 2008-12-29
Publication date: 2009-07-09
Also published as: CN101471898B; CN101471898A

Abstract

An access network protecting method, including: a virtual access edge node sends or receives or detects a switch indication; when the virtual access edge node sends the switch indication, it rests or deletes the service control data record corresponding to the access session which need to stop; or, when the virtual access edge node receives or detects the switch indication, it activates the service control data corresponding to the access session which need to activate. An access network protecting system, a virtual access edge node and an access edge node. There are at least two virtual access edge nodes in the network, when one of virtual access edge nodes that providing the session access service is malfunction, the access service switches to the other virtual access edge node, so as to ensure that the access service runs normally, provide a redundancy protect mechanism for access service and increase the reliability of the network.

Description

Technical field

The present invention relates to the field of communications, and in particular, to a method, a system for accessing a network, a virtual access edge node, and an access edge node. Background technique

Network access management and control is an important part of network functionality. Generally, users are controlled and managed by creating user access sessions, including user access authentication, authorization, and accounting. At present, access management and control are performed on users of broadband networks mainly by establishing a Point to Point Protocol (PPP) session. However, due to some limitations of PPP session access, Internet Protocol (IP) session access has emerged.

The typical single access network system architecture is depicted in Figure 1, including user terminals, access nodes, access aggregation nodes, access edge nodes, and AAA servers/DHCP servers. The user equipment may include a User Equipment (UE) and a Residential Gateway (RG) device; the access node includes a Digital Subscriber Line Access Multiplexer (DSLAM), and a wireless base station. (Base Station, BS), etc.; access aggregation nodes include Ethernet switches, etc.; Access Edge Nodes, 包括 include access gateways, Broadband Network Gateways (BNGs), broadband remote access servers

(Broadband Remote Access Server, BRAS) and other networks give access to network servers (NAS) devices, IP edge devices, and so on. Policy server includes authentication and accounting

(Authentication, Authorization and Accounting, AAA) server or dynamic host configuration protocol (DHCP) server, policy server Store the control policy and deploy the policy to the access node (AN) or AEN. For example, the AAA server configures the subscriber's subscriber profile to the NAS device such as BNG or BRAS to control the user access session. . Control policies mainly include Quality of Service (QoS), multicast rights, and deep packet inspection (DPI). A Layer 2 Control Mechanism (L2CM) or an Access Node Control Protocol (ANCP) connection is a session used by the access network to perform control policy deployment.

A user access session refers to a connection established between a user terminal and an access edge node, such as an IP session. An IP session represents an IP-based access session associated with an IP address. The IP address is the key to identifying an IP session, which is typically dynamically assigned by a DHCP server. IP sessions mainly include the creation of sessions, the maintenance of sessions, and the termination of sessions.

The Layer 2 Control Mechanism (L2CM) or the Access Node Control Protocol (ANCP) is an important network edge control mechanism. ANCP is a protocol that implements L2CM. Device control and management are performed between the network edge devices by establishing an L2CM or ANCP device to control the access session. The L2CM or ANCP mechanism generally includes two peer functions: a control function body and a report execution function body. The control function body controls and manages the report execution function body through the ANCP protocol, such as parameter configuration for the report execution function body, the report execution function body is responsible for responding to the control request, and the report execution function body actively reports some status information to the control function body. Such as access link status information (digital subscriber line bandwidth, etc.).

The reliability or stability of the network has become an important indicator for the network. With the emergence of new demanding services, existing IP user access sessions and ANCP devices control access sessions are prone to single points of failure. The phenomenon of denial of service occurs, and the reliability and stability of the service cannot meet the needs of users. Summary of the invention

In view of this, the embodiments of the present invention provide a method, a system, and an access edge node for protecting an access network, which can provide redundancy protection for access services in the access network.

In an aspect, an embodiment of the present invention provides a method for protecting an access network, where the method includes: when a first virtual access edge node member in a backup group receives a handover indication message, according to the handover indication message, The corresponding stored service control data provides a corresponding IP user access session service and/or a device control access session service to replace the second virtual access edge node member in the same backup group.

On the other hand, an embodiment of the present invention provides an access edge node, where the system includes at least one backup group, where the backup group includes at least a first virtual access edge node member and a second virtual access edge. a node member, the first virtual access edge node member is configured to provide an access service for the user, and the second virtual access edge node member is configured to: when the access service fails, according to the received inclusion switch And the switching indication of the identity, performing an access service switching, to replace the first virtual access edge node member.

An embodiment of the present invention further provides a protection system for an access network, where the system includes at least one backup group, where the backup group includes at least two virtual access edge nodes, and the virtual access edge node is connected. The ingress edge node establishes an access session for the user and performs an access session switch, where the access edge node includes:

a service providing module, configured to provide user access session management and/or device control access session management according to activated service control data in the data storage module; and activate corresponding service control data in the data storage module according to the notification of the handover processing module ;

a data storage module, configured to store service control data and member status information;

a switching processing module, configured to notify the service providing module according to the received first switching indication Corresponding service control data in the live data storage module;

And a member management module, configured to manage member status information of the backup group where the virtual access edge node is located in the data storage module, and send a first handover indication to the handover processing module when the member status is faulty.

In the embodiment of the present invention, at least one AEN is added to the access network. When one AEN in use fails, the other AEN can switch the access service on the faulty AEN to ensure the normal operation of the access service. The incoming service provides a redundant protection mechanism that increases the reliability of the network. DRAWINGS

1 is a schematic structural diagram of an access network system in the prior art;

2 is a schematic diagram of an architecture of a specific embodiment of a protection system for an access network according to the present invention; FIG. 3 is a schematic diagram of a specific embodiment of a virtual access edge node of FIG. 2; FIG. 4 is a schematic diagram showing the composition of a specific embodiment of the switching processing module of FIG. 3;

5 is a schematic diagram showing the composition of a specific embodiment of the member management module in FIG. 3;

6 is a schematic diagram of another embodiment of a virtual access edge node in FIG. 2. FIG. 6.1 is a schematic diagram of a specific embodiment of the data backup module in FIG. 6. FIG. 7.0 is a protection diagram of an access network according to the present invention. FIG. 7 is a schematic flowchart diagram of a second specific embodiment of a method for protecting an access network according to the present invention; FIG. 8 is a specific implementation of a method for implementing member management by a member management module in FIG. Schematic diagram of the process;

FIG. 9 is a schematic flowchart diagram of a third specific embodiment of a method for protecting an access network according to the present invention; 10 is a schematic flowchart of a fourth embodiment of a method for protecting an access network according to the present invention; FIG. 11 is a schematic flowchart of a fifth embodiment of a method for protecting an access network according to the present invention; FIG. 13 is a schematic diagram of a specific embodiment of a method for implementing a VAEN by a virtual road entity; FIG.

Figure 14 is a schematic illustration of one embodiment of the composition of various corresponding messages in the present invention. detailed description

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. In the drawings to which reference is made, the same components in the different drawings are denoted by the same reference numerals.

2 is a schematic diagram showing the composition of a specific embodiment of a protection system for an access network according to the present invention. The access network protection system has at least one backup group, and the backup group includes at least two members of a virtual access edge node (VAEN), wherein the VAEN provides a user access session. Accessing services such as management or access control policy deployment (device control access session management), and controlling the access service to switch between members of the backup group in which the VAEN is located, for example: when in the access network When the VAEN of the user establishment session cannot continue to serve the user access session due to a fault or the like, the session can be switched to other VAENs in the backup group to protect the access session. User access session management provided by VAEN includes user access session creation, maintenance, and termination management. The device control access session management provided by VAEN includes management report execution function device, such as: DSLAM, report status information, management report execution function device configuration access control policy, such as: multicast permission table, access control list, and so on.

The backup group members can be used as the primary VAEN and the standby VAEN, that is, in the active/standby mode, or the backup members are mutually backup, that is, in the load sharing protection mode. Working in primary and backup protection Only one VAEN in the backup group in the mode is in the active state. Only the VAEN in the active state provides the access service, and the VAEN in the standby state provides protection. In the load sharing protection mode, the VAENs in the backup group protect each other. As shown in Figure 2, the backup group includes two VAEN (VAEN1 and VAEN2) members. VAEN1 and VAEN2 can work in active/standby protection or load sharing protection mode. When one of the backup group members fails, for example, VAEN1, switch. That is, the access service provided by the original VAEN1 is switched to VAEN2, and the failure includes failure of VAEN1 or failure of the connection link of the VAEN1 to the AN connection link or connection to the user terminal.

In actual implementation, VAEN can be a logical entity. Different VAENs in the same backup group can be located in the same physical AEN device. For example: Different VAENs can be implemented on different boards of AEN, or can be distributed in multiple independent AENs. In the device, but an AEN device includes at least one VAEN. In a specific implementation, the VAEN can be a virtual router (VR) or a logical partition of the AEN.

The access network protection system may further include an AN and/or a user terminal, and the AN has a connection link between at least one VAEN, and the AN may use different connection links (ie, a redundant connection link) with different VAENs. The same connection link can also be used. The connection link includes a physical connection link or a logical connection link, and the logical connection link refers to a logical channel implemented on the physical connection link, for example: Virtual Local Area Network (VLAN), ? j Permanent Virtual Circuit (PVC), Label Switched Path (LSP), Operational Backbone Transfer (PBT) channel, etc. The user terminal can be connected to the AN through the access line, and the AN is connected to the VAEN; or the user terminal is directly connected to the VAEN through the access line.

Referring to FIG. 3, it is a schematic diagram of a composition of a specific embodiment of the virtual access edge node in FIG. 2. The virtual access edge node (VAEN) 20 includes a service providing module 200, a handover processing module 202, Member management module 204, data storage module 206, wherein:

The service providing module 200 is configured to provide access services such as user access session management and/or device control access session management, and specifically includes creating or deleting a service control data record being used. The service control data record includes a user access session data record, a control policy data record, a topology information data record, and the like. As shown in FIG. 3.0, the service providing module 200 may further include a user access session management sub-module 2002 and/or a policy deployment management sub-module 2004. The user access session management sub-module 2002 is configured to provide a user access session management service, including: creating or terminating a user access session, charging a user access session, and forwarding a user access session message. Specifically, the user terminal negotiates with the user terminal to create or delete a user access session data record, and performs charging for the user access session, forwarding the user access session, and the like according to the user access session data record. The policy deployment management sub-module 2004 is used to provide device control access session management, including creating or updating a control policy data record or topology information data record being used. Specifically, the control policy may be configured for the AN or the AN topology information may be collected or the AN policy execution feedback information may be collected.

The handover processing module 202 is configured to process the handover indication and perform a corresponding traffic handover. When the service is switched from the other VAEN to the VAEN, the service switching may include: according to the received handover indication, the notification service providing module 200 activates the dormant service control data record, and the service providing module 200 may The activated service control data provides an access session service service. When the service is switched from the VAEN to the other VAEN, the service switching includes sending a handover indication, notifying the service providing module 200 to sleep or delete the corresponding service control data record, and the service providing module 200 stops providing the access corresponding to the service control data record. Conversational business.

The member management module 204 is configured to manage member status information of the backup group, and trigger a handover processing indication according to the member status of the backup group managed by the member.

The data storage module 206 is configured to store service control data and member status information of the backup group. Member status tracking records may also be included in the member status information of the backup group. The stored service control data includes the service control data record being used and the dormant service control data record.

As shown in FIG. 4, the handover processing module 202 of the virtual access edge node 20 may further include a handover indication submodule 2020 and a handover smoothing submodule 2022. The handover indication sub-module 2020 is configured to send or receive a handover indication. When the session is switched from another VAEN to the local VAEN, the handover indication sub-module 2020 can be configured to receive a handover indication. When the session is switched from the local VAEN to another VAEN, the handover indication is performed. Sub-module 2020 can be used to send a handover indication. The handover smoothing sub-module 2022 is configured to perform handover smoothing processing according to the handover indication of the handover indication sub-module 2020, that is, to determine the dormant traffic control data record according to the handover instruction and perform handover processing according to the data. When the session is switched from the other VAEN to the local VAEN, the handover smoothing sub-module 2022 can be used to complete the handover smoothing process of the session switching from the other VAEN to the local VAEN according to the handover indication received by the handover indication sub-module; when the session is switched from the VAEN to the other At the time of VAEN, the switching smoothing sub-module 2022 can be used to complete the switching process of the present VAEN according to the switching instruction.

As shown in FIG. 5, the member management module 204 further includes a member registration sub-module 2040, a member maintenance sub-module 2042, and a member aging sub-module 2044. The member registration sub-module 2040 is used for members to negotiate registration and record member status information, and the member maintenance sub-module 2042 is used to monitor the member status, including its own status and peer member status. The member aging sub-module 2044 is configured to: after the member maintenance sub-module 2042 monitors the member status failure, set the member of the status failure to be unavailable or remove the member from the backup group, and send the switching indication to the handover indication sub-module 2020. .

As shown in FIG. 6, the virtual access edge node 20 may further include a data backup module 208, configured to process backup data, such as sending backup service control data or receiving backup service control data, and processing the received backup service control data. . As shown in FIG. 6.0, the data backup module 208 further includes a batch backup sub-module 2082 and a real-time backup sub-module 2084, and the batch backup sub-module 2082 is used. Receiving the instructions of the member management module, and processing the backup service control data in batches according to the instructions, such as batch backup service data. For details, refer to the description of the session protection method. The real-time backup sub-module 2084 is used to process backup service control data in real time, such as real-time backup service data. For details, refer to the description of the session protection method.

Two or more virtual access edge nodes 20 having the above functions may form a backup group, and virtual access edge nodes are mutually protected for backup, and different virtual access edge nodes 20 are implemented by backup stored in the data storage module. The protection of the session is controlled by the member management module, the switching processing module, and the data backup module. This effectively improves the reliability of the network.

A specific embodiment of the present invention also provides a method for protecting an access network. The access network includes at least one backup group, and the backup group includes at least two members, such as VAEN1 and VAEN2, and the two VAENs have the function of VAEN in the system as described above, and the protection is through backup. The group member VAEN provides backup protection for access services such as user access session management and/or access policy deployment (device control access session management), that is, the service providing modules of VAEN1 and VAEN2 can alternately provide access session management and/or Access policy deployment (device control access session management). As shown in Figure 7.0, the access network protection method includes:

5070. The first virtual access edge node member in the backup group receives the handover indication message.

The first virtual access edge node activates the corresponding stored service control data according to the handover indication message, and provides a corresponding IP user access session service and/or a device control access session service to replace the same backup. The second virtual access edge node member in the group.

For example, when the access session provided by the VAEN1 needs to be switched to the VAEN2, the method includes: when receiving the handover indication message, the VAEN2 activates the corresponding service control data and provides the corresponding IP user according to the handover indication message. The access session service and/or device controls the access session service to replace VAEN1 in the same backup group. Further, FIG. 7 is a schematic flowchart of a second specific embodiment of a method for protecting an access network according to the present invention, which mainly includes the following processes:

S701, member registration processing. Before the backup group member provides backup protection, members of the backup group must register, that is, record the member status information of the backup group. This information can be recorded by creating a backup group member status record record table. The member of the backup group refers to the virtual access edge node in the backup group. The member status information of the backup group can be pre-configured and saved in the AEN (that is, member registration is performed in advance). The member status information of the backup group can include member ID, member priority, member registration mode, member backup group ID, virtual gateway, Virtual BFD network and so on. The members of the backup group ID of all members form a backup group. AEN can configure one or more backup group members (ie VAEN).

The member registration mode can include dynamic registration or static registration. Static registration refers to static creation, such as manual configuration, backup group member status tracking records. Dynamic registration means that members dynamically create backup group member status tracking records through member registration messages. In this example, after the member VAEN1 starts, it monitors the member registration message. After VAEN2 starts, it sends a member registration message. VAEN1 creates a backup group member status tracking record according to the received message. VAEN1 responds to the registration message of VAEN2, and VAEN2 also receives the message of VAEN1. You can create a backup group member status trace record. The backup group member status trace record includes a list of members that are currently available (normal status) for the backup group. The member registration sub-module is responsible for handling member registrations (for example: receiving or responding to member registration messages) and triggering the data storage module to store member status trace records.

The member status tracking record table also includes the protection mode of the member. The protection mode mainly includes the active/standby protection mode or the load sharing protection mode. In the active/standby mode, the members in the backup group are classified into the active state and the standby state. When registering, the VAEN in the active state provides access session services, while the standby state provides backup protection. In the load sharing protection mode, the status of the members in all the backup groups is equal. When registering, the access session service can be provided by any member of the backup group (which can be according to a certain policy), that is, the VAEN in the backup group. Provide services together and provide backup protection to each other. In the specific embodiment of the method, this step is optional, that is, when the backup group member has been pre-registered, the registration does not need to be repeated before the session is switched.

5702, batch backup processing. After the registration of a member of a backup group is completed, the batch backup process is required. Generally, the VAEN is used to start the VAEN batch backup service control data. The registered VAEN receives the service control data and caches the service control data.

In this example, VAEN1 backs up the business control data in bulk to VAEN2. The service control data includes user access session data records and/or control policy data records or topology information data records being used. Specifically, the batch backup submodule of VAEN1 obtains the service control data being used from the data storage module of the VAEN (ie, VAEN1), and then encapsulates the service control data into the batch backup message, and sends the message to the VAEN2, VAEN2 batch backup. The submodule receives the batch backup message, obtains the service control data, and notifies the service providing module to cache the service control data, that is, saves as the dormant service control data record. This step is optional depending on the actual application.

5703, real-time backup processing. VAEN's service control changes (for example: the service provision module creates or terminates a user access session, collects new topology information from the AN, or collects new policy enforcement feedback information from the AN, VAEN's ongoing service control data When the record changes, the service providing module notifies the real-time backup sub-module to encapsulate the changed service control data into the real-time backup message, and then sends the message to VAEN2, and the real-time backup sub-module of VAEN2 receives the real-time backup message and obtains the service control parameter. The service providing module of the VAEN2 is notified to manage the dormant service control data record in the data storage module, for example: adding a dormant service control data record or removing a dormant service control data record. This step is optional depending on the actual application.

5704, switching processing. The VAEN receives the handover indication message, and performs switching or smoothing processing of the access service according to the handover indication.

In this example, VAEN1 sends a handover indication message to VAEN2, and the handover indication message includes a handover indicator. The switching identifier indicates the switching range, for example, switching all user access sessions created by VAEN1 or a certain user access session. After receiving the handover indication, the VAEN2 performs the handover of the access service: the handover smoothing submodule of the VAEN2 extracts the dormant service control data record according to the handover indication, for example: extracts all the service control data records corresponding to the session from the VAEN1 backup according to the handover identifier. And then notifying the service providing module to activate the service control data, and the service providing module continues to provide the service by using the activated service control data (the dormant service control data record is switched to the service control data being used), if VAEN2 is in the primary backup mode, VAEN2 The switch smoothing sub-module also activates the service provisioning module to begin providing services. At the same time, the VAEN1 can perform the session switching process, which specifically includes: the handover indication module of the VAEN1 triggers the handover smoothing submodule to perform handover according to the handover indication, notifies the service providing module to sleep or delete the service control data record determined by the handover indication, and the service providing module stops providing The dormant or deleted service control data record corresponds to the service of the session.

On the other hand, the handover indication may also be sent by the other devices in the access network to the handover smoothing sub-module of VAEN2. If VAEN2 detects a failure of VAEN1, it can generate a handover indication message and send it to the handover smoothing submodule of VAEN2 for session switching processing.

Before the VAEN2 completes the handover process, the user or the AN may send an access session switch message to the user or the AN of the access session to notify the user or the AN that the current access session needs to be switched. The session switching message is used to perform the switching process of the present.

In the foregoing method for protecting an access network, a plurality of virtual access edge nodes are provided to provide a backup access path for an access session, so that backup access can be used when a connection failure occurs in a session. The path serves the access session and improves the reliability of the network. At the same time, the virtual access edge node used in the access path of the backup can be implemented on the same physical device, which can implement backup protection without adding hardware, and realizes and saves resources.

Based on the foregoing specific embodiment of the protection method of the access network, the present invention further provides a backup group. A member management method, which can be implemented by the member management module described above. Referring to FIG. 8, the method mainly includes the following steps:

5801, members maintain processing. The member maintenance process mainly monitors and tracks the member status, and triggers the switching processing operation when the member status failure is detected. Monitoring member status includes monitoring the status of this VAEN status or other VAEN (ie, the remote VAEN) in the backup group, for example, VAEN1 monitors its own status or the status of member VAEN2 in this backup group. The VAEN can maintain the status of the member through the member maintenance message. That is, the member sends the message periodically. If the member does not receive the message from the peer in the specified time, the status of the peer member is determined to be faulty.

5802, member aging processing. After the member status fault is detected, the member is aged, that is, the member is unavailable or the member is removed (for example: the corresponding member is deleted in the backup group member status record), and the switching indication is sent to the switching indicator. Module. The handover indicator included in the handover indication may be a state failure member identifier.

Based on the method for access network protection according to FIG. 7 and FIG. 8, the present invention further provides a method for protecting a hot backup of a user access session of an access network. Referring to FIG. 9, the method further includes the following steps:

S901. Create a user access session (in this example, an IP session) and notify the backup user of the access session. In this example, after the user access session management sub-module of VAEN1 detects that the user terminal accesses the network request, it negotiates with the user terminal, and VAEN1 creates an IP session (creates and saves the IP session record being used) to provide a user for the user terminal. Access session management service. The user access session management submodule of VAEN1 notifies the data backup module to perform data backup after the IP session is created.

S902, real-time backup processing. In this example, VAEN1 sends a real-time backup message, and after receiving the message, VAEN2 caches the IP session (creates and stores the sleeping IP session record). Specifically, the data backup module of VAEN1 receives the IP session backup notification, checks the peer VAEN2 with the normal state, and the real-time backup submodule of the data backup module of VAEN1 encapsulates the IP session parameters into the real-time backup message. In, then send the message to VAEN2, after receiving the message, VAEN2 caches the IP session (creates and stores the sleeping IP session record). IP session parameters may include IP address, link identifier (PVC, VLAN, access location, etc.), MAC address, lifetime, account name (User-Name), configuration parameters (QoS parameters, multicast rights control table, DPI policy) Etc.), backup type (hot backup or cold backup), survival mechanism parameters (BFD network IP address, My/Your Discriminator local/peer BFD ID, time interval, etc.), gateway ID, etc. Batch backups can also be performed before this real-time backup processing.

5903. Switching instruction processing. When VAEN1 detects a user access session failure, or receives a network management command sent by another network device (including a handover indication in the instruction), or a VAEN1 failure, the handover indication notification VAEN2 performs a handover process. VAEN1 can detect the interruption of the IP session through the survival mechanism or the line failure of the AN reporting user access session to determine the access session failure. The specific implementation may be: after the VAEN1 user access session management submodule detects that the user access session is faulty or the member maintenance submodule detects the VAEN1 fault, notifies the handover indication submodule, and the handover indication submodule constructs a handover indication message according to the fault condition, and then Send to VAEN2.

5904. Switching smoothing processing. In this example, VAEN2 receives the handover indication, parses the handover indication message, and obtains the handover identifier, for example: IP session identifier or member identifier; of course, VAEN2 can trigger VAEN2 to perform handover processing by detecting the state of VAEN1, and start switching or smoothing processing. , this process includes:

a. VAEN2 sends an ARP (Address Resolution Protocol) request message to the user, and the request message can be used to refresh the data forwarding table of the aggregation network or the AN. The ARP request message source IP and MAC address are the gateway IP and MAC address, and the destination IP and MAC address can be the broadcast address or the address of the IP session. VAEN2 can send ARP request messages according to the gateway, interface or user access session. For example: VAEN2 sends the message one by one according to the dormant IP session record, or sends an ARP request message in one VLAN. This step is optional. b. VAEN2 notifies the AN to perform protection switching. Specifically, it can be: VAEN2 controls the access session to notify the AN protection switching information through the ANCP/L2CM device. After receiving the handover notification, the AN starts the handover process, including the destination path of the AN to switch the DHCP relay or the destination path of the IP session. This step is also an optional step.

c. VAEN2 activates the IP session. The VAEN2 obtains the IP parameters from the dormant IP session record, sets the data forwarding table of the IP session, starts the accounting, and starts the negotiation of the survival mechanism. For example, renegotiating the BFD monitoring connection or starting the ARP probe or neighbor according to the BFD parameters of the backup. Unreachable detection of the NUD, where the renegotiation of the BFD monitoring connection includes the VAEN2 sending the BFD control packet to the user terminal, and the BFD control packet parameters are obtained from the backup BFD parameters. The source IP address of the BFD control packet remains the same as that before the handover. Or establish a security association (IKE negotiation).

The IP session is switched to VAEN2, and the user continues to use the user access session for communication, such as file download or web browsing.

Based on the foregoing protection method, the IP session of the user terminal can be switched between different VAENs, and the user access session is continually maintained during the handover process. The method can effectively solve the failure of the VAEN or the link failure of the access user. The problem of providing access services to users.

Based on the specific embodiment of the method for accessing the session hot backup protection according to FIG. 9, the present invention provides a method for real-time backup of an IP session in detail, which provides consistent IP session data for the backup group members, and ensures that the IP session is backed up. Smooth switching between group members. As shown in FIG. 10, the method mainly includes the following steps:

S1001 to S1004 and VAEN negotiate with the user terminal to create an IP session. In this example, VAEN1 finally creates an IP session for the user terminal. The specific process can be:

S1001, the user access session management submodule of the service providing module of the VAEN receives the DHCP discovery (Discovery) message sent by the user terminal, and the VAEN can process the DHCP message according to its own state and configuration, for example: VAEN can discard the message, or The message is forwarded immediately or delayed. The DHCP discovery message sent by the user terminal may be broadcasted. VAEN1 or VAEN2 may receive the DHCP discovery message. In this example, VAEN2 discards the message according to its own state, and VAEN1 forwards the message to the DHCP server.

51002, VAEN1 forwards the DHCP offer (Offer) message, the user access session management submodule of the service providing module of VAEN1 forwards the message as a DHCP relay or proxy, and VAEN1 receives the DHCP offer message sent by the DHCP server in response to the DHCP discover message. VAEN1 forwards the DHCP offer message to the user terminal.

51003, VAEN1 forwards a DHCP request (Request) message, the user access session management sub-module of the service providing module of VAEN1 forwards the message as a DHCP relay or proxy, and VAEN1 receives the DHCP request message sent by the user terminal, and VAEN1 forwards the DHCP request message. To the DHCP server.

51004. VAEN1 forwards the DHCP acknowledgement (ACK) message and creates an IP session. VAEN1 receives the DHCP acknowledgement message sent by the DHCP server, parses the message to obtain the IP session parameters, and then creates and stores the IP session record being used. VAEN1 forwards the DHCP acknowledgment message to the user terminal. At the same time, VAEN1 triggers real-time backup. The specific implementation may be that the user access session management sub-module notifies the real-time backup sub-module to create a real-time backup of the user access session. VAEN1 can select the protection mode according to the user level. For example, if the user corresponding to the IP session is an important customer, the hot backup protection is used. For customers with low level, the protection or cold backup protection can be omitted (for details, see the subsequent description). In this example, the IP session implements hot backup protection.

51005, VAEN1 real-time backup created IP session. The specific implementation may be that the real-time backup sub-module encapsulates the IP session parameters into a real-time backup message and sends a real-time backup message to VAEN2. The real-time backup message may further include a data type and an operation type, the data type may be an IP session, and the operation type is a creation operation. After receiving the real-time backup message, VAEN2 parses the real-time backup message and obtains the IP address. S1006 to S1007 and VAEN1 negotiate with the user terminal to update the IP session parameters. The specific process may be:

51006. VAEN1 forwards a DHCP Request message, and the DHCP request message sent by the user terminal received by VAEN1 is forwarded to the DHCP server. The DHCP request message is used by the user terminal to request an update of the IP session parameters, such as an IP address lease.

51007. The VAEN1 forwards the DHCP acknowledgement message and updates the IP session. The VAEN1 receives the DHCP acknowledgement message sent by the DHCP server, parses the message to obtain the IP session update parameter, and then updates the IP session record. VAEN1 forwards the DHCP acknowledgment message to the user terminal. At the same time, VAEN1 triggers real-time backup. Specifically, the user access session management sub-module notifies the real-time backup sub-module to perform real-time backup of the update session.

51008, VAEN1 backs up the updated IP session in real time. The real-time backup sub-module encapsulates the IP session parameters into real-time backup messages and sends real-time backup messages to VAEN2. The real-time backup message may also include an update operation type. After receiving the real-time backup message, VAEN2 obtains the cached sleep IP session record according to the IP session parameters, and finally updates the cached sleep IP session record parameters.

51009. Terminate IP session processing. VAEN1 receives the DHCP release message sent by the user terminal or detects the IP session terminal through the survival mechanism. VAEN1 terminates the IP session and deletes the IP session record. At the same time, VAEN1 triggers real-time backup. Specifically, the user access session management sub-module notifies the real-time backup sub-module to terminate the session real-time backup.

51010, VAEN1 real-time backup terminates the IP session. The real-time backup sub-module encapsulates the IP session parameters into real-time backup messages and sends real-time backup messages to VAEN2. The real-time backup message may also include a termination operation type. After receiving the real-time backup message, VAEN2 obtains the cached dormant IP session record according to the IP session parameters, and finally deletes the cached IP session (delete the dormant IP session record).

User access session protection method using real-time backup (hot backup), due to the session being used The related data is backed up in real time to other virtual access edge nodes in the backup group, so that when the session is in use and the session needs to be switched, the current session can be switched to other virtual access edge nodes in the backup group in real time. On the user side, there is no interruption in the session.

The method for protecting the cold backup of the user access session is described in detail in the following, and the method mainly includes the following steps:

51101. Create a user access session (in this example, an IP session) and notify the backup access session. In this example, VAEN1 creates a user access session.

51102. Switching indication processing. VAEN1 detects a user access session failure or network management command or VAEN1 failure, and then sends a handover indication, which can notify VAEN2 to perform handover processing. The VAEN1 fault includes an uplink interface failure of the VAEN1 connected to the IP network or a downlink interface failure of the connection access aggregation network. When VAEN2 detects VAEN1 abnormality, it can also trigger its own switching process.

51103. Switching smoothing processing. In this example, VAEN2 receives the handover indication, parses the handover indication message, and acquires the handover identifier, and starts the handover process. The switching process includes:

a. VAEN2 sends an ARP message or a neighbor discovery ND message for refreshing the data forwarding table to the user terminal. This step is optional.

b. VAEN2 notifies the AN to perform protection switching. This step is also an optional step.

c. VAEN2 sends an online notification message to the user terminal to indicate that the terminal is back online (ie, re-establishes an IP session). VAEN2 can send an online notification message according to the VLAN or according to the user access session. The online notification message includes a DHCP update message or a BFD message, and the destination address of the message may be a broadcast or multicast address.

51104. Rebuild the IP session. After the user terminal receives the online notification message, it is re-switched. VAEN2 negotiates to establish an IP session.

Based on the above protection method, the IP session of the user terminal can be switched between different VAENs. This method can effectively solve the problem of refusing to provide access services to users after the VAEN failure.

With the above-mentioned cold backup method, the related data of the session being used is backed up to the other virtual access edge nodes in the backup group at the beginning of the session establishment and/or at the time of session switching, and when the session is in use, the user's The session interruption is being used. After the other virtual access edge nodes acquire the relevant data, they can notify the user to go online again and use the new session to communicate.

Based on the specific embodiment of the protection method of the access network described in FIG. 7, the present invention also describes a method for protecting the access control session of the device of the L2CM or the ANCP of the access network. Referring to FIG. 12, the method mainly includes the following steps:

S1201, VAEN1 first establishes an L2CM or ANCP control access session with the AN (referred to as L2C connection 1 in this example). The L2C connection 1 can be established using the General Switch Management Protocol (GSMP) adjacency protocol, that is, the policy deployment management submodule of VAEN1 and the AN establish an L2C connection through the GSMP protocol. The control connection is used for policy deployment and collects topology information or policy execution feedback information. The policy feedback information includes information such as multicast charging and permission control response.

51202. VAEN2 establishes an L2CM or ANCP control access session with the AN (referred to as L2C connection 2 in this example). In this example, L2C connection 2 is established after L2C connection 1 is established.

51203, VAEN1 member registration processing. VAEN1 receives the member registration indication message sent by the AN, and performs member registration processing according to the message. The member registration indication message in this example may be a GSMP Adjacency Update message. After the AN completes establishing the L2C connection 2, the AN sends a contiguous update message to notify VAEN1. After receiving the adjacency update message, VAEN1 parses the message to obtain the member information. For example, by adding the number of connections (Code) field of the adjacency update message, the member is added, and VAEN1 is in the member state. The new member is activated in the state trace record. VAEN1 may activate a new member based on the member ID carried in the member registration indication message or activate the new member according to a pre-configured default value.

51204, VAEN2 member registration processing. VAEN2 sets its own state according to the pre-configured protection mode, such as standby protection mode or load sharing protection mode.

It should be noted that S1203 and S1204 can be registered by sending a member registration message between VAEN1 and VAEN2, and can also be directly registered by default when the L2C connection is established in S1201 or S1202 (that is, a new member is activated in the member status tracking record). .

Further, after VAEN1 or VAEN2 completes the member registration process, VAEN1 or VAEN2 can also perform batch backup processing. In this example, VAEN1 will use topology information, policy execution feedback information, and control policy (or called configuration parameters). Batch backup to VAEN2, VAEN2 cache topology information, policy execution feedback information, control strategy.

The processing of the real-time backup of the topology information is described in steps S1205 and S1206 and S1207:

51205, topology information processing. In this example, VAEN1 receives the topology information report sent by the AN. After processing the topology information report, VAEN1 can trigger the real-time backup processing of the topology information. Generally, after detecting the topology change event, the AN sends a topology information report, for example, the interface rate or state of the AN changes, the AN sends a topology information report, and the VAEN1 policy management module adjusts the control parameters according to the topology information.

S1206 and S1207, real-time backup topology information. In this example, after processing the topology information report, VAEN1 sends a real-time backup message containing the topology information to VAEN2. After receiving the real-time backup message, VAEN2 caches the topology information.

Steps S1208, S1209, S1210, and S1211 describe the process of real-time backup of policy deployment:

S1208, control policy configuration. In this example, VAEN1 sends a configuration request message to control the policy. Slightly configured. The control policy mainly includes the control policy of the user accessing the session, for example, the multicast permission of the user access session, the address filtering table of the user access session, and the like.

S1209, configuration confirmation processing. In this example, VAEN1 receives a configuration confirmation message from the AN response configuration request. Trigger control policy real-time backup processing.

S1210 and S1211, real-time backup control strategy. In this example, VAEN1 sends a real-time backup message containing the control policy to VAEN2. After receiving the real-time backup message, VAEN2 caches the control policy.

S1212 and S1213 describe the switching process:

51212. Switching indication processing. In this example, VAEN2 receives the switching instruction and starts the switching process. The handover indication in this example is the GSMP Adjacency Update message. Specifically, the AN detects the L2C connection 1 failure, sends an Adjacency Update message to VAEN2, and VAEN2 switches according to this message. Of course, VAEN1 can send a switching indication directly to VAEN2.

51213, Switching smoothing processing. In this example, VAEN2 performs switching and smoothing processing according to the received switching indication, and may mainly include:

a, VAEN2 and AN to control data synchronization. The AN can send control policy data, topology information, and policy execution information to VAEN2 through 12CM synchronization messages. VAEN can check the consistency of these control data to prevent inconsistent data.

b. VAEN2 sets the control strategy of this and activates the topology information base.

c. VAEN2 can activate the user access session according to the cached user access session data (for example, a dormant IP session record). The cached user access session control data is derived from the synchronization data sent by the AN or the user access session control data backed up by VAEN1 to VAEN2.

Based on the specific embodiment of the protection method of the access network described in FIG. 7, the present invention also describes the implementation of the virtual router element (VRE) in the Virtual Router Redundancy Protocol (VRRP). VAEN's functional system, the above VAEN pair It should be a logical VRRP virtual routing entity in the AEN device or device. The virtual routing IDs of the virtual routing entities are equal to each other to form a backup group. VAEN runs virtual routing redundancy protocols such as VRRP, as shown in Figure 13. There are two AEN devices in the access in this example: AEN 1301 and AEN 1302. AEN 1301 and AEN 1302 respectively contain at least one virtual routing entity supporting the VRRP protocol, such as: VRE1 of AEN 1301 and VRE2 of AEN 1302. VEN1 of AEN 1301 corresponds to VAEN 130101, and VRE2 of AEN 1302 corresponds to VAEN 130201. The virtual router IDs (VRIDs) of VRE1 and VRE2 are equal. In this example, the VRID is 1.

VRE records are saved as members of the backup group (ie VAEN130101 and VAEN130201). The VRE record includes the virtual router ID, the priority, the virtual IP address, and the actual IP address. When the VAEN provides user access session management for the user terminal, the virtual IP address of the VRE acts as the gateway address of the access session established by the user terminal. In this example, the record of VRE2 is: virtual route identifier: 1, priority 200, virtual IP address: 20.1.1.1, actual IP address: 20.1.1.253. The record of VRE1 is: Virtual route identifier: 1, Priority 255, Virtual IP address: 20.1.1.1, Actual IP address: 20.1.1.254. Generally, when VRE is used as VAEN, the VAEN of the backup group uses the active/standby protection mode. The steps to VAEN member management and access session protection are explained in detail below:

Member registration: VAEN uses the VRRP protocol Advertisement message for member registration. The state of VAEN remains synchronized with the state of VRE, ie VAEN and VRE include three states: initialization, active, and standby.

In member registration, as described above, different priorities can be set for members in the standby group, and members with higher priority (in this case, VRE) become the active state. In this example, VRE1 is used as the main. When the protection mode is in the active/standby mode, the standby VAEN does not directly provide services (for example: the user terminal cannot directly establish an IP session with the standby VAEN). For example: User terminal 1 and VAEN 130101 establish IP session 1, user terminal 2 and VAEN 130101 establish IP session 2, VAEN130101 provides access for user terminal Service. The gateway addresses of IP session 1 and IP session 2 are both virtual IP addresses of VAEN 130101. The IP address of IP session 1 is 20.1.1.20.

Batch backup: After the primary VAEN receives the standby VAEN registration and the registration process is completed, the primary VAEN backs up the service control data to the standby VAEN. In this example, the VAEN130101 sends a batch backup message to the VAEN130201. The destination address of the batch backup message backup is the address of the standby VAEN. The address can be pre-configured or obtained through the member registration message. In this example, the member registration message is obtained. The destination address of the batch backup message of VAEN130101 to VAEN130201 is 20.1.1.253.

Real-time backup: After the main VAEN's service control data is changed, the active VAEN backs up the service control data to the standby VAEN. In this example, VAEN130101 sends a real-time backup message to VAEN130201, and the real-time backup message destination address is the same as the batch backup.

Member Maintenance: VAEN uses the VRRP protocol Advertisement message to maintain membership status. The state of the VAEN remains in sync with the state of the VRE.

Handover processing: When the state of the VRE is switched from standby to active state, the VAEN starts to switch the smoothing process, for example: Activate the IP session.

The specific implementation protocols of the member registration message, the member maintenance message, the handover indication message, the batch backup message, and the real-time backup message described in the specific embodiments of the present invention may be selected according to actual conditions, including but not limited to VRRP, GSMP, Diamiter ( Extended License Agreement), H.248, Common Open Policy Service (COSS), Hot Standby Router Protocol (HSRP), SNMP (Trouble Network Management Protocol). For example: member registration message and member maintenance message can use VRRP advertisement message or SNMP trace (TRAP) message; batch backup message and real-time backup message SNMP setting (Set) or extract (Get) message.

Referring to FIG. 14, an embodiment of the present invention provides the foregoing member registration message, member maintenance message, and cut The specific implementation format of the backup protection message, such as the indication message, the batch backup message, and the real-time backup message: the message includes at least a bearer header 1401 and a message content 1402, the bearer header 1401 is used for path finding of the message, and the message content 1402 is used to carry the member. Information or business control data;

The bearer header 1401 may include a link header 1401A (eg, an Ethernet header) and/or an IP header 1401B. The bearer header 1401 may further include a UDP header (header) or the like; the IP header 1401B further includes a destination IP 1401 IB and a source IP 14012B. .

The message content 1402 includes at least a message type 1402A and a data record 1402C, and the message content 1402 may further include an operation type 1402B. The message type 1402A mainly includes a member registration message, a member maintenance message, a real-time backup message, a batch backup message, a handover indication message, and the like. The operation type 1402B mainly includes creation, update, deletion, and the like. The data record 1402C may further include a type 14021C, a length 14022C, and a data 14023C. The length 14022C is the actual length of the data 14023C. A message can contain one or more data records 1402C. The data 14023C may further include a plurality of sub-data records, the sub-data records mainly including subtypes, sub-lengths, and sub-data.

For member registration messages, the destination address of the IP header or link header of the first 1401 header may be a multicast address (for example: multicast or broadcast address). The source address of the IP header or link header of the bearer header 1401 is the sender address. Message Content 1402 Data The 1402C record contains member information such as VAEN flag, VAEN priority, VAEN capability parameter, VAEN status, and so on.

For the member maintenance message and the handover indication message, the destination address of the IP header or link header of the bearer header 1401 is generally the address of the destination VAEN. 7 The source address of the IP header or link header of the header 1401 is the sender address. Message Content 1402 Data The 1402C record contains member information or handover indication information, such as VAEN identification, access session identification, and the like.

For real-time backup or bulk backup messages, the bearer header 1401 is consistent with the definition of the bearer header in the member maintenance message. The data 1402C of the message content 1402 records the packaged service control data, for example: IP session parameters or topology information or control policies. The specific encapsulation may be: Type 14021C is an IP session record, and data 14023C encapsulates sub-data records of multiple IP session parameters, for example, the address is 20.1.1.20. The 14023C data encapsulation of the IP session with the gateway being 20.1.1.1 includes subtype 1 as an IP session. The identifier, the sub-length 1 is 4, the sub-data 1 is 20.1 丄 20, the sub-type 2 is the gateway address, the sub-length 2 is 4, and the sub-data 2 is 20.1.1.1.

In a specific embodiment of the present invention, at least one backup group is provided for the access network, and at least two VAENs are in the backup group, and the VAENs can be backed up and protected, access session management, and/or access policy deployment. The access service can be switched between the VAENs of the backup group, so that when one of the VAENs in use fails, the other VAEN can switch the access service on the faulty VAEN, thereby ensuring the normal operation of the service and increasing the connection. The reliability of access to the network.

The above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, and the equivalent changes made by the claims of the present invention are still within the scope of the present invention.

Claims

Rights request

An access edge node, wherein the access edge node establishes an access session for the user and performs an access session switch, where the access edge node includes:

And a switching processing module, configured to notify the service providing module to activate corresponding service control data in the data storage module according to the received first switching indication;

a member management module, configured to manage member status information of the backup group where the virtual access edge node is located in the data storage module, and when the member status is faulty, send a first switching indication including the switching identifier to the switching process Module.

2. The access edge node of claim 1 wherein:

The switching processing module is further configured to send a second handover indication, and notify the service providing module to sleep or delete a corresponding service control data record in the data storage module;

The service providing module is further configured to: hibernate or delete a corresponding service control data record in the data storage module according to the notification of the switching processing module, and stop providing user access session management corresponding to the dormant or deleted service control data record. And/or device control access session management.

The access edge node according to claim 2, wherein the switching processing module comprises:

a switching indication submodule, configured to receive a first handover indication or send a second handover indication;

a switching smoothing submodule, configured to: when the switching indication submodule receives the first switching indication, Notifying the service providing module to activate corresponding service control data in the data storage module according to the switching instruction; or, when the switching indication sub-module sends the second switching indication, notifying the service providing module to sleep or The corresponding service control data record in the data storage module is deleted.

4. The access edge node of claim 1, wherein the member management module comprises:

a member registration sub-module, configured to register with each other and record member status information; a member maintenance sub-module, configured to monitor a status of a member in the backup group where the access edge node is located; and a member aging sub-module, configured to be a member-maintainer When the module monitors the member status failure, the member of the status failure is set to be unavailable or the member is removed from the backup group where the virtual access edge node is located, and the handover processing module is notified to send a handover indication message.

The access edge node according to any one of claims 1 to 4, wherein the access edge node further comprises:

The data backup module is configured to process the backup data, including sending the used service control data stored in the data storage module as backup service control data; or receiving the backup service control data and notifying the data storage module to save.

The access edge node according to claim 5, wherein the data backup module comprises:

The batch backup sub-module is configured to encapsulate the used service control data stored in the data storage module as backup service control data into the batch backup message for sending; or receive the batch backup message including the backup service control data and notify the data The storage module saves the service control data.

7. The access edge node of claim 5, wherein the data backup module comprises:

Real-time backup submodule for encapsulating changed service control data into real-time backup messages Transmitting; or receiving a real-time backup message containing the changed service control data and notifying the service providing module to modify the service control data in the data storage module.

A protection system for an access network, the system includes at least one backup group, and the backup group includes at least a first virtual access edge node member and a second virtual access edge node member. The member of the first virtual access edge node is configured to provide an access service for the user; and the member of the second virtual access edge node is configured to switch according to the received handover identifier when the access service fails. Instructing to perform an access service handover to replace the first virtual access edge node member.

The access network protection system according to claim 8, further comprising an access node respectively connected to the at least two virtual access edge node members, the access node and different virtual access The same or different connection links are used between members of the edge nodes.

The access network protection system according to claim 8, wherein the at least two virtual edge access node members in the same backup group are located in the same physical access edge node, where each virtual An edge access node member is a logical partition of the physical access edge node;

Or each of the at least two virtual edge access node members is a virtual router.

A method for protecting an access network, the method comprising:

When receiving the handover indication message including the handover identifier, the first virtual access edge node member in the backup group activates the corresponding service control data stored according to the handover indication message, and provides a corresponding IP user access session service and/or Or the device controls the access session service to replace the second virtual access edge node member in the same backup group.

The method of claim 11, wherein before the first virtual access edge node member receives the handover indication message, the method further includes:

Registering first and second virtual access edge node members in the backup group, recording the first sum Status information of the second virtual access edge node member.

The method of claim 12, wherein before the first virtual access edge node member receives the handover indication message, the method further includes a backup processing step, where the backup processing step includes:

The first access edge node member receives the backup message sent by the second access edge node member, parses the backup message, and performs corresponding backup processing.

The method of claim 13, wherein the step of performing the backup process comprises: after the registration is completed, the member of the first virtual access edge node receives the batch sent by the member of the second virtual access edge node Backing up the message, parsing the batch backup message, obtaining the service control data being used, and performing corresponding backup processing;

Or the first virtual access edge node member receives the real-time backup message sent by the second virtual access edge node, and parses the batch backup, when the service control of the second virtual access edge node member changes. Messages, get changed business control data and perform corresponding backup processing.

The method according to any one of claims 11-14, wherein the handover indication message, the batch backup message, and the real-time backup message comprise a path-finding bearer header for the message and a bearer member information or service control data. Message content;

The specific implementation protocols of the handover indication message, the batch backup message, and the real-time backup message include: virtual route redundancy protocol VRRP, switch management protocol GSMP, extended authorization protocol Diamiter, H.248, universal open policy service COPS, hot backup routing protocol HSRP, single network management protocol SNMP.

The method according to claim 11, wherein when the first virtual access edge node member in the backup group receives the handover indication message, the corresponding stored service control data is activated according to the handover indication message. Provide corresponding IP user access session service and/or device control access session service Services include:

Receiving, by the first virtual access edge node, a handover indication message, and sending an address resolution protocol request message to the user, to refresh the data forwarding table of the aggregation network or the access node;

The first virtual access edge node member notifies the access node to perform protection switching;

After the access node completes the handover, the first virtual access node member activates the corresponding stored dormant service control data according to the handover indication message, and provides a corresponding IP user access session service.

The method according to claim 11, wherein when the first virtual access edge node member in the backup group receives the handover indication message, the corresponding stored service control data is activated according to the handover indication message. Providing a corresponding IP user access session service and/or device control access session service includes:

The first virtual access edge node sends an address resolution protocol request message to the user to refresh the data forwarding table of the aggregation network or the access node;

The first virtual access edge node notifies the access node to perform protection switching;

The first virtual edge access node sends an online notification message to the user terminal to instruct the terminal to go online again;

The first virtual edge access node activates the corresponding stored service control data according to the handover indication message, and reestablishes the IP user access session with the re-authenticated user terminal.