WO2010000157A1 - 接入设备的配置方法、装置及系统 - Google Patents

接入设备的配置方法、装置及系统 Download PDF

Info

Publication number
WO2010000157A1
WO2010000157A1 PCT/CN2009/071827 CN2009071827W WO2010000157A1 WO 2010000157 A1 WO2010000157 A1 WO 2010000157A1 CN 2009071827 W CN2009071827 W CN 2009071827W WO 2010000157 A1 WO2010000157 A1 WO 2010000157A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
authentication
access
network
element device
Prior art date
Application number
PCT/CN2009/071827
Other languages
English (en)
French (fr)
Inventor
杨利
陈璟
张爱琴
Original Assignee
深圳华为通信技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳华为通信技术有限公司 filed Critical 深圳华为通信技术有限公司
Publication of WO2010000157A1 publication Critical patent/WO2010000157A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method, an apparatus, and a system for configuring an access device. Background technique
  • IP Internet
  • the home base station can establish a network connection with the gateway inside the core network to perform further network services.
  • the inventor of the present invention finds that since the parameters of the network element device and the access behavior of the access device are not permanently fixed, the participation of the network element device When the change or the access behavior of the access device is migrated, the parameters of the access device need to be manually configured again, which brings great inconvenience to the user.
  • Embodiments of the present invention provide a method, an apparatus, and a system for configuring an access device. Automatic configuration of access devices is possible.
  • a method for configuring an access device including:
  • the access device is configured according to parameters of the network element device.
  • a method for configuring an access device including:
  • An access device mainly includes a transceiver unit and a configuration unit;
  • a transceiver unit configured to send an authentication request to the network side device, and receive an authentication response of the network side device, where the authentication request carries a type of the network element device that the access device needs to access, and the authentication response carries the network element device
  • the parameter of the network element device is obtained by the network side device according to the type of the network element device;
  • the configuration unit is configured to configure, according to the parameter of the network element device carried in the authentication response received by the transceiver unit, the access device.
  • a network side device mainly includes a transceiver unit and an acquisition unit;
  • a transceiver unit configured to receive an authentication request sent by the access device, and send an authentication response to the access device, where the authentication request carries a type of the network element device that needs to be accessed, and the authentication response carries the acquired by the acquiring unit.
  • the acquiring unit is configured to acquire parameters of the network element device according to a type of the network element device carried in the authentication request received by the transceiver unit.
  • a communication system mainly includes an access device
  • the access device is configured to send an authentication request to the network side device, where the authentication request carries the type of the network element device to be accessed, and receives an authentication response sent by the network side device, where the authentication response carries the network element device Parameters, and configuring the access device according to parameters of the network element device.
  • the type of the network element device to be accessed, and then the network side device obtains the parameter of the network element device according to the type of the network element device, and takes the parameter of the network element device in the authentication success response replied to the access device.
  • the access device configures itself according to the parameters of the received network element device, thereby implementing fast automatic configuration of the access device, which brings convenience to the user.
  • Embodiment 1 is a flow chart of a method according to Embodiment 1 of the present invention.
  • Embodiment 3 is a flowchart of a method according to Embodiment 3 of the present invention.
  • Embodiment 4 is a flowchart of a method according to Embodiment 4 of the present invention
  • 5 is a schematic diagram of an access device according to Embodiment 5 of the present invention
  • FIG. 6 is a schematic diagram of a network side device according to Embodiment 6 of the present invention.
  • FIG. 7 is a schematic diagram of a communication system according to Embodiment 7 of the present invention.
  • FIG. 8 is a schematic diagram of a packet format extended by a configuration payload format (Configuration Payload Format) according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a packet format extended by a Configuration Attribute Format according to an embodiment of the present invention.
  • the embodiment of the invention provides a method for configuring an access device.
  • the embodiments of the present invention further provide corresponding devices and systems, namely, an access device, a network side device, and a communication system. The following is a detailed description.
  • the access device may send an authentication request to the network side device according to the policy of the operator, where the authentication request carries the type of the network element device to be accessed; secondly, the authentication response of the network side device is received.
  • the authentication response is a parameter that carries the network element device, where the parameter of the network element device is obtained by the network side device according to the type of the network element device; and finally, according to the parameter pair of the network element device Access the device for configuration.
  • the access device may be an HNB (Home NodeB, a home base station) or an (Access Point, an Access Point device), and the network side device may be a SeGW (Security Gateway).
  • the parameters of the network element device may be The parameters such as the domain name or IP address of the NE device are as shown in Figure 1. The specific process can be as follows:
  • Step 102 Receive an authentication response of the network side, where the authentication response carries a parameter of the network element device that the access device needs to access, where the parameter of the network element device that needs to be accessed is that the network side device according to the requirement Obtained by the type of the access NE device;
  • the access device configures the access device according to the parameters of the network element device, for example, according to parameters such as a domain name or an IP address of the network element device to be accessed.
  • the access device can carry the network to be accessed in the authentication request sent to the network side.
  • the type of the meta-device is obtained, and then the parameters of the network element device to be accessed are obtained from the authentication response replied by the network side, and the self-configuration is performed according to the parameters of the network element device, thereby realizing the fast access device.
  • Automatic configuration bringing convenience to users.
  • An access device configuration method after receiving an authentication request sent by an access device, the network side device acquires the type of the network element device that the access device needs to access according to the type of the network element device that the access device needs to access. And the parameter of the network element device, and the parameter of the obtained network element device is brought to the access device, that is, the authentication response carries the acquired network element device parameter.
  • the access device may be an HNB or an AP, and the network side device may be a SeGW or the like.
  • the parameter of the network element device may be a domain name or an IP address of the network element device. As shown in FIG. 2, the specific process may be: ⁇ Under:
  • the network side device receives the authentication request sent by the access device, where the authentication request carries the type of the network element device that the access device needs to access;
  • the network side device acquires parameters of the network element device according to the type of the network element device.
  • the network side device sends an authentication response to the access device, where the authentication response carries parameters of the network element device.
  • the access device can configure the access device according to the parameters of the received network element device, for example, according to parameters such as the domain name or IP address of the network element device to be accessed.
  • the network side device can obtain the parameter of the network element device according to the type of the network element device that the access device needs to access, and then send the parameter.
  • the authentication response carrying the parameters of the obtained network element device is provided to the access device, thereby implementing fast automatic configuration of the access device, which brings convenience to the user.
  • the sending the authentication request to the network side device is specifically: acquiring a parameter for identifying the network side device, and then sending the authentication request to the network side according to the obtained parameter device.
  • the access device is pre-configured with the parameters of most of the network element devices before it passes the authentication, the illegal intruder may be provided with the opportunity to attack the pre-configured core network element device.
  • the configuration of the core NE device poses a security risk. Therefore, in order to further improve the security of the core network, the parameters of the obtained network element device are carried in the authentication success response of the device.
  • At least one network side device may be provided in advance when the access device is issued, where the network side device may be a Provisioned Security Gateway (Pre-defined Security Gateway), etc., and the parameter used to identify the network side device may be Parameters such as the domain name or IP address of the network side device. Then, when the access device starts to use, the network side device is selected according to the policy of the operator, and the parameter for identifying the network side device is obtained, and the obtained parameter for identifying the network side device is obtained. Establishing a connection with the network side device, and sending an authentication request to the network side device, where the authentication request carries the type of the network element device that the access device needs to access, and after receiving the authentication request, the network side device authenticates the device.
  • the network side device may be a Provisioned Security Gateway (Pre-defined Security Gateway), etc.
  • the parameter used to identify the network side device may be Parameters such as the domain name or IP address of the network side device.
  • the validity of the access behavior of the access device is authenticated. If it is legal, the parameters of the corresponding network element device are obtained according to the type of the network element device that needs to be accessed in the authentication request, and the authentication is successful. The parameter of the network element device that needs to be accessed is brought to the access device in response to the access device, that is, the authentication successfully responds with the parameter of the acquired network element device. Finally, the access device configures its own parameters according to the parameters of the network element device carried in the received authentication success response, thereby completing the automatic configuration process.
  • the access device may re-select another A network side device acquires a parameter for identifying the reselected network side device, and sends an authentication request to the reselected network side device according to the reacquired parameter. For example, a network side device may be reselected at the pre-provided network side device, and ⁇ : for identifying the network side device may be selected, and then the authentication request is retried according to the parameter of the selected network side device. The network side device.
  • the access device is an AP.
  • the network side device that is, the Provisioned SeGW
  • the parameter of the network side device provided is the domain name of the network side device.
  • the domain name of the Provisioned SeGW the AP can obtain the IP address of the Provisioned SeGW through the Public Domain DNS (Domain Name System) according to the domain name of the Provisioned SeGW, and then establish a connection with the Provisioned SeGW according to the IP address of the Provisioned SeGW.
  • the AP sends an authentication request to the Provisioned SeGW, where the authentication request carries the type of the network element device that the AP needs to access.
  • the Provisioned SEGW After receiving the authentication request, the Provisioned SEGW authenticates the AP, and the access behavior of the AP is legal. If the authentication is not valid, the authentication failure response is returned to the AP. Of course, in order to improve the reliability of the initial access, the AP may receive the authentication failure response in the plurality of Provisioned SeGWs provided in advance.
  • the parameter can be one or more, for example, Serving SeGW ( Serving Security Gateway, Service Security Gateway), Serving AG (Service Access Gateway), Serving APM (Service Access Point Device Management), and Serving Clock Server (Service Clock Server), etc.
  • Serving SeGW Serving Security Gateway, Service Security Gateway
  • Serving AG Service Access Gateway
  • Serving APM Service Access Point Device Management
  • Serving Clock Server Service Clock Server
  • the extended Configuration Payload Format can be as shown in Figure 8.
  • Next Payload indicates the attribute of the next payload; RESERVED is all zero-filled; Payload Length is the length of the payload;
  • the CFG Type is an eight-bit binary number (1 octet) indicating the data model to be exchanged in the Configuration Attributes; for example, as shown in Table 1;
  • CFG—REQUEST 1 indicates that an endpoint of IKE requests information from the peer
  • CFG—REPLY 2 indicates that an endpoint of IKE replies to the peer with the information;
  • the RESERVED value is 3 octets in length and should be set to all zeros. As the receiving end, it will be ignored.
  • Configuration Attributes is the configuration type
  • the Attribute Type is the identifier of the Configuration Attribute type.
  • the types are different and the identifiers are different. For example, "INTERNAL-IP4-ADDRESS" identifies a 16-bit private address on the Internet, "INTERNAL-IP4-DNS, which identifies the address of a DNS server on the network;
  • Length is the length
  • Value is the value.
  • the "Value” value of various network element device parameters can be identified by any integer value of 16384 - 32767.
  • the AG has a "value” value of 16666, an APM value of 17777, and so on.
  • the AP sends an authentication request to the Provisioned SeGW, where the authentication request carries the type of the network element device that the AP needs to access.
  • the authentication request may be as follows:
  • IKE AUTH Request[Header, User ID, Configuration Payload(Configuration Attribute,type value 16666..., length: 7),... AUTH];
  • IKE Internet Key Exchange
  • IKE Internet Key Exchange
  • the Provisioned SeGW After receiving the authentication request, the Provisioned SeGW authenticates the legitimacy of the access behavior of the AP.
  • the authentication failure is sent to the AP, and the AP may reselect one of the preset multiple Provisioned SEGWs, and obtain a domain name for identifying the Provisioned SeGW, according to the domain name of the Provisioned SeGW. Sending an authentication request to the reselected Provisioned SEGW;
  • the Provisioned SeGW obtains the parameters of the network element device, such as the domain name or IP address of the network element device, according to the type of the network element device that needs to be accessed in the authentication request. ;
  • the Provisioned SeGW sends an authentication success response to the AP, and the authentication success response carries the parameters of the network element device obtained in step 304.
  • the successful response of the authentication may be as follows:
  • the AP receives the authentication success response, and performs configuration according to the parameters of the network element device carried in the authentication success response, for example, according to parameters such as a domain name or an IP address of the network element device to be accessed.
  • the AP can carry the type of the network element device that the AP needs to access in the authentication request sent to the Provisioned SeGW, and then obtain the parameter of the network element device from the authentication success response replied by the Provisioned SeGW.
  • the fast automatic configuration of the AP is convenient for the user.
  • the parameters of the NE device are obtained after the AP authentication succeeds, ensuring the legitimacy of the AP access behavior, and reducing the illegal intruder of the core network element device. The probability of an attack.
  • the embodiment only uses the access device as the AP and the network side device as the Provisioned.
  • the SeGW, and the network side device parameter preset in the AP when the AP is initially started is described in the case of the domain name of the Provisioned SeGW.
  • the access device may also be a device with similar functions such as an HNB, and the network side device also It may be other network element devices such as the AG.
  • the network side device parameters provided in advance by the AP during the initial startup of the AP may also be parameters such as the IP address of the network side device.
  • the access device is an AP
  • the network-side device Provisioned SeGW is preset
  • the parameter for identifying the Provisioned SeGW is the domain name of the Provisioned SeGW
  • the AP can pass the domain name of the Provisioned SeGW.
  • the network DNS resolves to obtain the IP address of the Provisioned SeGW, and then establishes a connection with the Provisioned SeGW by the IP address of the Provisioned SeGW.
  • the AP sends an authentication request to the Provisioned SeGW, where the authentication request carries the type of the network element device that the AP needs to access.
  • the Provisioned SeGW forwards the authentication request to the AAA (Authentication ⁇ Authorization ⁇ Accounting Server, The authentication, authorization, and accounting server), the AAA server can obtain the user data file from the server such as the home management server to determine the authority of the user, that is, the legality of the access behavior of the AP; if not, Returning the authentication failure response to the AP, the AP may reselect one of the preset multiple Provisioned SeGWs, obtain the domain name for identifying the reselected Provisioned SeGW, and obtain the domain name transmission authentication of the obtained Provisioned SeGW.
  • the AAA Authentication ⁇ Authorization ⁇ Accounting Server
  • the re-selected Provisioned SeGW determines the legality of the access behavior of the AP after receiving the authentication request. If it is legal, the IPSec tunnel is established, and the IP address assigned by the internal network to the AP is obtained. And, can query the server And obtaining the parameter of the network element device that is required to be accessed according to the type of the network element device to be accessed in the authentication request, and then sending the authentication success response to the AP, and carrying the obtained in the authentication success response The parameters of the network element device; in this way, the AP obtains the parameters of the network element device that it needs to access while passing the authentication, so that the AP can be configured according to the parameters of the received network element device.
  • IPsec is a protocol that provides security services at the IP layer. It enables the system to select a security protocol as needed, determine the algorithm used by the service, and place the key required to service the required service to the appropriate location. IPsec is used to protect Protect the path between one or more hosts and hosts, between the security gateway and the security gateway, and between the security gateway and the host.
  • the configuration payload (configuration load) in the authentication request and the authentication success response needs to be extended.
  • the configuration payload configuration load
  • the authentication success response needs to be extended.
  • the AP sends an authentication request to the Provisioned SeGW, where the authentication request carries the type of the network element device that the AP needs to access.
  • the Provisioned SeGW receives the authentication request, and forwards the authentication request to the AAA server.
  • the AAA server may obtain the user data file by using the home management server to determine the user right, that is, authenticate the AP.
  • the AAA server returns the authentication result to the Provisioned SeGW.
  • the Provisioned SeGW After receiving the authentication result, the Provisioned SeGW sends an authentication failure response to the AP, and the AP may reselect another Provisioned SeGW, obtain the parameter of the reselected Provisioned SeGW, and try to send the authentication request again. Re-selected Provisioned SeGW;
  • the Provisioned SeGW queries the server according to the type of the network element device that needs to be accessed in the authentication request, and obtains the parameters of the network element device to be accessed.
  • the Provisioned SeGW sends an authentication success response to the AP, where the authentication success response carries the parameters of the network element device acquired in step 406.
  • the AP receives the authentication success response, and configures the self according to the parameters of the network element device carried in the authentication success response.
  • the AP can also send the type of the network element device that the AP needs to access to the Provisioned SeGW, and then the Provisioned SeGW authenticates the legality of the access behavior, while sending the authentication request to the Provisioned SeGW. If the authentication succeeds, the Provisioned SeGW can obtain the parameters of the network element device according to the type of the network element device, and carry the parameters of the obtained network element device to the AP when the authentication response is successfully sent to the AP, thereby implementing the AP fast.
  • the automatic configuration brings convenience to the user.
  • the parameters of the network element device are obtained after the AP authentication succeeds. The legality of the AP access behavior is ensured, and the probability that the core network element device is attacked by an illegal intruder is reduced.
  • Embodiment 5 Embodiment 5
  • the embodiment of the present invention further provides an access device, as shown in FIG. 5, which mainly includes a transceiver unit 502 and a configuration unit 503, and may further include an obtaining unit 501; an obtaining unit 501, Used to obtain parameters for identifying a network side device;
  • the transceiver unit 502 is configured to send an authentication request to the network side device, and receive an authentication response of the network side device, where the authentication request carries a type of the network element device that the access device needs to access, and the authentication response carries the network element device.
  • the parameter of the network element device is obtained by the network side device according to the type of the network element device.
  • the transceiver unit 502 is further configured to identify the network side according to the acquiring unit 501.
  • the parameter of the device sends a certificate request to the network side device;
  • the configuration unit 503 is configured to configure the access device according to the parameter that carries the network element device in the authentication response received by the transceiver unit 502.
  • the access device is pre-configured with the parameters of most of the network element devices before the authentication device fails to pass the authentication, the illegal intruder may be provided with the opportunity to attack the pre-configured core network element device, and the pre-configured core network may be provided.
  • the device has security risks. Therefore, in order to further improve the security of the core network, the parameters of the obtained network element device are carried in the authentication success response of the device.
  • the acquiring unit 501 of the access device may select one network side device among the network side devices provided in advance, and obtain parameters for identifying the selected network side device, for example, selecting an IP address of the SeGW. And so on, and then establishing a connection with the network side device according to the obtained parameter for identifying the network side device, and the sending and receiving unit 502 sends an authentication request to the network element device, where the authentication request carries the network that the access device needs to access.
  • the type of the meta-device if the access behavior is legal, that is, the authentication is successful, the network-side device obtains the parameters of the corresponding network element device according to the type of the network element device carried in the received authentication request, and Sending the authentication success response to the access device, the authentication success response carries the parameters of the acquired network element device, and then the transceiver unit 502 of the access device receives the authentication success response. Finally, the configuration unit 503 receives the response according to the transceiver unit 502.
  • the parameters of the NE device carried in the authentication success response are configured to configure the access device to complete the automatic access device. Home.
  • the access device may specifically be a home base station, an AP, or the like.
  • the access device can carry the type of the network element device that the access device needs to access in the authentication request sent to the network side device, and then obtain the network element from the authentication success response replied by the network side device.
  • the parameters of the device are configured and the device is configured to implement fast and automatic configuration of the access device, which brings convenience to the user.
  • the parameters of the network element device are obtained after the access device is successfully authenticated, ensuring access.
  • the legality of the device access behavior reduces the probability of the core network element device being attacked by an illegal intruder.
  • the embodiment of the present invention further provides a network side device, as shown in FIG. 6, which mainly includes a transceiver unit 601 and an obtaining unit 602;
  • the transceiver unit 601 is configured to receive an authentication request sent by the access device, and send an authentication response to the access device, where the authentication request carries the type of the network element device that the access device needs to access, and the authentication success response carries the acquiring The parameters of the network element device obtained by the unit 602;
  • the obtaining unit 602 is configured to acquire the parameters of the network element device according to the type of the network element device that needs to be accessed in the authentication request received by the transceiver unit 601.
  • the network side device may further include an authentication unit 603;
  • Authentication unit 603, a transceiver unit 601 receives the authentication request for authentication
  • the obtaining unit 602 is further configured to acquire, according to the type of the network element device carried in the authentication request received by the sending and receiving unit 601, the parameter of the network element device, when the authentication unit 603 is successfully authenticated;
  • authentication unit 603 is also configured to, when the authentication is successful, sends an authentication success response to the access device, the authentication success response carrying the acquisition parameters acquired network element apparatus unit 602.
  • the obtaining unit 602 obtains the parameters of the corresponding network element device according to the type of the network element device that the access device needs to access in the authentication request, and then The transceiver unit 601 sends the authentication response to the access device, and the parameter of the network element device acquired by the obtaining unit 602 is also brought to the access device, so that the access device can then identify itself according to the parameters of the network element device. Configure and establish a connection with the NE device.
  • the access device is pre-configured with most of the parameters of the network element device before the authentication device fails to pass the authentication, the illegal intruder may be provided with the opportunity to attack the pre-configured core network element device, and the pre-configured core network may be provided.
  • Meta-devices pose security risks, so in order to further improve the security of the core network, it can also be After the authentication of the access behavior of the access device is successfully performed, the parameters of the obtained network element device are carried in the authentication success response to the access device.
  • the network side device may specifically be a SeGW, an AG, or an ACL (Access Control List) server or the like. It can be seen that, after receiving the authentication request sent by the access device, the network side device can obtain the parameter of the network element device according to the type of the network element device that the access device needs to access in the authentication request, and then send the parameter. The authentication of the parameter of the obtained network element device is successfully responded to the access device, thereby realizing the rapid automatic configuration of the access device, which brings convenience to the user, and the parameter of the network element device is at the access device. After the authentication succeeds, it is sent to the access device to ensure the legality of the access behavior of the access device and reduce the probability that the core network element device is attacked by the illegal intruder.
  • ACL Access Control List
  • the embodiment of the present invention further provides a communication system, as shown in FIG. 7, which mainly includes an access device 701, and may further include a network side device 702;
  • the access device 701 is configured to send an authentication request to the network side device, where the authentication request carries the type of the network element device that the access device 701 needs to access, and receives the authentication response sent by the network side device 702, where the authentication response carries the
  • the parameters of the network element device are then configured according to the parameters of the network element device;
  • the network side device 702 is configured to receive the authentication request sent by the access device 701, obtain the parameter of the network element device according to the type of the network element device that needs to be accessed, and then send the authentication response to the access device. 701.
  • the authentication response carries the parameters of the obtained network element device.
  • the access device 701 pre-configures the parameters of most of the network element devices before failing to pass the authentication, the illegal intrusion may be given.
  • the device provides the opportunity to attack the pre-configured core network element device, which brings security risks to the pre-configured core network element device. Therefore, in order to further improve the security of the core network, the 701 authentication success response may also be carried in the acquisition.
  • the access device 701 mainly includes a transceiver unit 502 and a configuration unit 503, and may further include an obtaining unit 501.
  • the network side device mainly includes a transceiver unit 601 and an obtaining unit 602. Of course, the authentication unit 603 may also be included.
  • the access device may be a home base station or an AP, and the network side device may be a SeGW, an AG, or an ACL server.
  • the access device 701 can carry the type of the network element device that the access device 701 needs to access in the authentication request sent to the network side device 702. Then, the network side device 702 obtains the network element device according to the type of the network element device. The parameter, and the parameter of the obtained network element device is brought to the access device 701 in the authentication success response replied to the access device 701. Finally, the access device 701 pairs itself according to the parameters of the received network element device.
  • the configuration is implemented to implement the fast automatic configuration of the access device, which is convenient for the user. Moreover, the parameters of the network element device are obtained after the access device 701 is successfully authenticated, and the access device 701 is guaranteed to access the behavior. Legitimacy reduces the probability of core network element devices being attacked by illegal intruders.
  • the embodiment of the present invention has the following beneficial effects:
  • the type of the network element device that the access device needs to access the network element device may be one or more, and then, the network side according to the network element device that needs to access
  • the parameter is obtained by querying the server, and the parameter of the network element device is brought to the access device in the authentication success response to the access device, and the access device is further configured according to the network element device.
  • the parameters are configured or updated to implement the fast automatic configuration of the access device, which brings convenience to the user.
  • the parameters of the network element device are obtained after the access device is successfully authenticated, and the access is guaranteed.
  • the legality of the access behavior of the device reduces the probability that the core network element device is attacked by an illegal intruder and improves its security.
  • the program may be stored in a computer readable storage medium, and the storage medium may include: Read only memory (ROM, Read Only Memory), random / 1 memory (RAM, Random Access Memory), disk or CD.
  • ROM Read only memory
  • RAM Random Access Memory
  • CD Compact Disc

Description

接入设备的配置方法、 装置及系统
本申请要求于 2008 年 7 月 2 日提交中国专利局、 申请号为 200810040281.8、 发明名称为 "接入设备的配置方法、 装置及系统" 的中国专 利申请的优先权， 其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域， 具体涉及接入设备的配置方法、 装置及系统。 背景技术
随着网络业务的蓬勃发展，如何更好地利用现有网络的资源，安全、高速、 便捷地接入网络正在得到广泛地关注。
现有技术中， 当一个新的家庭网络基站接入运营商的核心网络时， 需要在 家庭基站上手动配置其将要接入的核心网的网元设备的参数，例如 IP ( Internet
Protocol, 网际协议）地址等等。 这样家庭基站才能与核心网内部的网关建立 网络连接， 进行进一步的网络业务。
在对现有技术的研究和实践过程中，本发明的发明人发现， 由于网元设备 的参数和接入设备的接入行为都不是永久固定不变，所以当网元设备的参&^ 生变化或接入设备的接入行为发生迁移时 ,就需要重新手动配置接入设备的参 数，这给用户带来极大的不便。
发明内容
本发明实施例提供一种接入设备的配置方法、装置及系统。可以实现接入 设备的自动配置。
一种接入设备的配置方法， 包括：
发送认证请求给网络侧设备，所述认证请求携带需要接入的网元设备的类 型；
接收网络侧设备的认证响应， 所述认证响应携带所述网元设备的参数， 所 述网元设备的参数是所述网络侧设备根据所述网元设备的类型所获取的；
根据所述网元设备的参数为所述接入设备进行配置。
一种接入设备的配置方法， 包括：
接收接入设备发送的认证请求，所述认证请求携带需要接入的网元设备的 类型； 根据所述网元设备的类型获取所述网元设备的参数；
发送认证响应给接入设备， 所述认证响应携带所述网元设备的参数。
一种接入设备， 主要包括收发单元和配置单元；
收发单元， 用于发送认证请求给网络侧设备， 以及接收网络侧设备的认证 响应， 所述认证请求携带接入设备需要接入的网元设备的类型， 所述认证响应 携带所述网元设备的参数，所述网元设备的参数是所述网络侧设备根据所述网 元设备的类型所获取的；
配置单元，用于根据收发单元接收到的认证响应中携带的网元设备的参数 为所述接入设备进行配置。
一种网络侧设备， 主要包括收发单元和获取单元；
收发单元， 用于接收接入设备发送的认证请求， 以及发送认证响应给接入 设备， 所述认证请求携带需要接入的网元设备的类型，所述认证响应携带所述 获取单元获取到的网元设备的参数；
所述获取单元 ,用于根据所述收发单元接收到的认证请求中携带的网元设 备的类型获取所述网元设备的参数。
一种通信系统， 主要包括接入设备；
接入设备， 主要用于发送认证请求给网络侧设备， 所述认证请求携带需要 接入的网元设备的类型，接收网络侧设备发送的认证响应， 所述认证响应携带 所述网元设备的参数 , 以及根据所述网元设备的参数对接入设备进行配置。 要接入的网元设备的类型， 然后， 网络侧设备根据该网元设备的类型获取该网 元设备的参数，并在回复给接入设备的认证成功响应中将该网元设备的参数带 给接入设备，最后，接入设备根据该接收到的网元设备的参数对自身进行配置， 从而实现了接入设备的快速自动配置， 给用户带来了方便。
附图说明
图 1是本发明实施例一的方法流程图；
图 2是本发明实施例二的方法流程图；
图 3是本发明实施例三的方法流程图；
图 4是本发明实施例四的方法流程图； 图 5是本发明实施例五的接入设备的示意图；
图 6是本发明实施例六的网络侧设备的示意图；
图 7是本发明实施例七的通信系统的示意图；
图 8为本发明实施例中对配置载荷的格式（ Configuration Payload Format ) 进行扩展后的报文格式的示意图；
图 9为本发明实施例中对配置类型的格式（ Configuration Attribute Format) 进行扩展后的报文格式的示意图。
具体实施方式
本发明实施例提供一种接入设备的配置方法。本发明实施例还提供相应的 装置和系统， 即一种接入设备、 一种网络侧设备及一种通信系统。 以下分别进 行伴细说明。
实施例一、
一种接入设备的配置方法，接入设备可以根据运营商的策略，发送认证请 求给网络侧设备， 该认证请求携带需要接入的网元设备的类型； 其次， 接收网 络侧设备的认证响应， 该认证响应携带所述网元设备的参数， 其中， 所述网元 设备的参数是该网络侧设备根据所述网元设备的类型所获取的； 最后，根据所 述网元设备的参数对接入设备进行配置。
其中，接入设备可以为 HNB( Home NodeB,家庭基站）或^( Access Point, 接入点设备）等， 网络侧设备可以为 SeGW ( Security Gateway, 安全网关）等， 网元设备的参数可以是网元设备的域名或 IP地址等参数， 如图 1所示， 其具体 流程可以:^下：
101、 发送认证请求给网络侧 , 该认证请求携带需要接入的网元设备的类 型；
102、 接收网络侧的认证响应， 该认证响应携带所述接入设备需要接入的 网元设备的参数，其中， 所述需要接入的网元设备的参数是该网络侧设备根据 所述需要接入的网元设备的类型所获取的；
103、 接入设备根据所述网元设备的参数对接入设备进行配置， 例如根据 需要接入的网元设备的域名或 IP地址等参数进行配置等。
由上可知，接入设备可以在发送给网络侧的认证请求中携带需要接入的网 元设备的类型， 然后，再从网络侧回复的认证响应中获取该需要接入的网元设 备的参数， 并根据该网元设备的参数对自身的进行配置，从而实现了接入设备 的快速自动配置， 给用户带来了方便。
实施例二、
一种接入设备的配置方法， 网络侧设备接收到接入设备发送的认证请求 后，根据该认证请求中携带的接入设备需要接入的网元设备的类型，获取所述 需要接入的网元设备的参数， 并在发送认证响应给接入设备的同时，将所述获 取到的网元设备的参数带给接入设备，即该认证响应中携带所述获取到的网元 设备的参数。
其中， 接入设备可以为 HNB或 AP等， 网络侧设备可以为 SeGW等等， 网元 设备的参数可以是网元设备的域名或 IP地址等参数， 如图 2所示， 其具体流程 可以: ^下：
201、 网络侧设备接收接入设备发送的认证请求， 该认证请求携带接入设 备需要接入的网元设备的类型；
202、 网络侧设备根据所述网元设备的类型获取所述网元设备的参数；
203、 网络侧设备发送认证响应给接入设备， 该认证响应携带所述网元设 备的参数；
此后， 接入设备可以根据该接收到的网元设备的参数对接入设备进行配 置 , 例如根据需要接入的网元设备的域名或 IP地址等参数进行配置等。
由上可知， 网络侧设备可以在接收到接入设备发送的认证请求后，根据该 认证请求中携带的接入设备需要接入的网元设备的类型 ,获取该网元设备的参 数，再发送携带有该获取到的网元设备的参数的认证响应给接入设备，从而实 现了接入设备的快速自动配置， 给用户带来了方便。
实施例三、
根据实施例一和实施例二描述的方法，所述发送认证请求给网络侧设备具 体为： 获取用于标识该网络侧设备的参数， 然后根据所获取的参&^送认证请 求给该网络侧设备。
此外，考虑到若在接入设备未通过认证之前就对其预配置大部分的网元设 备的参数，可能会给非法的入侵者提供攻击预配置核心网元设备的机会，给预 配置核心网元设备带来安全隐患， 所以， 为了进一步提高该核心网的安全性， 设备的认证成功响应中才携带所述获取到的网元设备的参数。
例如， 可以在发放接入设备时就预先提供至少一个网络侧设备， 其中， 该 网络侧设备可以为 Provisioned SeGW(Provisioned Security Gateway, 预置安全 网关)等， 用于标识网络侧设备的参数可以是网络侧设备的域名或 IP地址等参 数。 那么， 当接入设备开始使用时， 可以根据运营商的策略， 从中选择一个网 络侧设备，获取用于标识该网络侧设备的参数， 并 ^居该获取到的用于标识网 络侧设备的参数与该网络侧设备建立连接，发送认证请求给该网络侧设备，此 认证请求携带接入设备需要接入的网元设备的类型，该网络侧设备接收到该认 证请求后， 对其进行认证， 即对该接入设备的接入行为的合法性进行认证， 若 合法，则根据该认证请求中携带的需要接入的网元设备的类型获取相应的网元 设备的参数，并在回复认证成功响应给接入设备的同时将获取到的需要接入的 网元设备的参数带给接入设备，即该认证成功响应携带该获取的网元设备的参 数。 最后，接入设备根据接收到的认证成功响应中携带的网元设备的参数对自 身的参数进行配置， 从而完成自动配置过程。
当然， 如果网络侧确定该接入设备的接入行为不合法时， 即认证失败时， 可以发送认证失败的响应给接入设备， 接入设备接收到该认证失败的响应后 , 可以重新选择另一个网络侧设备，获取用于标识该重新选择的网络侧设备的参 数，并根据该重新获取的参数发送认证请求给该重新选择的网络侧设备。例如， 可以在所述预先提供的网络侧设备重新选择一个网络侧设备，并选择用于标识 该网络侧设备的^：,然后才 据所述选择的网络侧设备的参数重新尝试发送认 证请求给该网络侧设备。
下面将举例作进一步详细说明， 假定接入设备为 AP, 在 AP发放时， 预先 提供了网络侧设备， 即 Provisioned SeGW, 且提供的网络侧设备的参数为网络 侧设备的域名， 在此即为 Provisioned SeGW的域名， 则 AP可以根据该 Provisioned SeGW的域名通过公网 DNS ( Domain Name System, 域名系统）解 析得到该 Provisioned SeGW的 IP地址， 然后 据该 Provisioned SeGW的 IP地址 与该 Provisioned SeGW建立连接。 AP发送认证请求给该 Provisioned SeGW, 该认证请求中携带 AP需要接入 的网元设备的类型，该 Provisioned SEGW接收到此认证请求后，对其进行认证， 即对该 AP的接入行为的合法性进行认证； 若不合法， 则返回认证失败响应给 AP, 当然， 为了提高其初始接入的可靠性， AP可以在收到认证失败响应后， 在所述预先提供的多个 Provisioned SeGW的中重新选择一个， 并获取用于标识 该重新选择的 Provisioned SeGW的域名， 发送认证请求给该重新选择的 Provisioned SeGW; 若合法 , 则建立 IPSec ( Security Architecture for IP network, IP层协议安全结构）隧道， 获得内部网给 AP分配的 IP地址， 并且， 可以通过查 询服务器等途径，根据此认证请求中携带的需要接入的网元设备的类型获取相 应的网元设备的参数， 该获取的网元设备的参数可以是一个， 也可以是多个， 例如可以是 Serving SeGW ( Serving Security Gateway,服务安全网关）、 Serving AG (服务接入网关）、 Serving APM (服务接入点设备管理）和 Serving Clock Server (服务时钟服务器）等等本地接入服务器的地址列表； 然后发送认证成 功响应给 AP , 并在该认证成功响应中携带所述获取的网元设备的参数； 这样 , AP在通过认证的同时， 也就获得了它所需要接入的网元设备的参数， 从而可 以根据该接收到的网元设备的参数进行自身参数的配置。
为了实施以上方法， 需要对认证请求和认证成功响应中的 Configuration Payload (配置载荷 )进行扩展。
( 1 )扩展后的 Configuration Payload Format (配置载荷格式）具体可以如 图 8所示。
其中， Next Payload指示下一个载荷的属性； RESERVED为全零填充的； Payload Length为载荷的长度；
CFG Type为一个八位的二进制数（1 octet), 表示 Configuration Attributes里 面所需要交换的数据模型； 例如表一所示；
表一：
CFG Type Value (值 ) 描述
CFG— REQUEST 1 表示 IKE的一个端点向对端请求信息；
CFG— REPLY 2 表示 IKE的一个端点向对端回复信息； RESERVED值是 3个八位二进制长度， 应该置成全零。 作为接收端来说， 将忽略它。
Configuration Attributes为配置类型
( 2 )扩展后的 Configuration Attribute Format (配置类型的格式）具体可以 如图 9所示。
其中， Attribute Type为 Configuration Attribute类型的标识， 不同类型， 标 识是不同的。 例如 "INTERNAL— IP4— ADDRESS" , 标识 internet上的一个 16bit 位的私有地址 , "INTERNAL— IP4—DNS，，标识的是一个网络上地址解析（DNS ) 服务器的地址；
Length为长度；
Value为值。
(3 ) Configuration Attribute 的设置举例， ^口表二所示。
Figure imgf000009_0001
Figure imgf000009_0002
其中 , 各种网元设备参数的 "Value"值可以用 16384 - 32767中的任一个整 数值来标识。 例如， AG的" value"值为 16666， APM的 Value值为 17777等等。
参见图 3， 其流程具体可以如下：
301、 AP发送认证请求给 Provisioned SeGW, 该认证请求中携带 AP需要接 入的网元设备的类型 , 该认证请求具体可以如下：
IKE AUTH Request[Header, User ID, Configuration Payload(Configuration Attribute,type value= 16666...， length: ...)，... AUTH]；
意思为： IKE—认证请求 [报头， 用户标识， 配置载荷（配置类型，类型值 =16666··.，长度： …） 〜，AUTH值];
其中， IKE ( Internet Key Exchange ) 为 Internet密钥交换协议；
302、 Provisioned SeGW接收到此认证请求后， 对其进行认证， 即对该 AP 的接入行为的合法性进行认证；
303、 若不法， 即认证失败， 则发送认证失败的响应给 AP, AP可以在预置 的多个 Provisioned SEGW中重新选择一个， 并获取用于标识该 Provisioned SeGW的域名， 根据该 Provisioned SeGW的域名发送认证请求给该重新选择的 Provisioned SEGW;
304、 若合法， 即认证成功， 则 Provisioned SeGW根据该认证请求中携带 的需要接入的网元设备的类型获 W目应的网元设备的参数，比如网元设备的域 名或 IP地址等参数；
305、 Provisioned SeGW发送认证成功响应给 AP, 该认证成功响应携带步 骤 304中获取到的网元设备的参数； 该认证成功响应具体可以如下：
IKE AUTH Response [Header, AUTH, Configuration Payload(Configuration Attribute, type value= 16666....value ： http: //wwww.AGl shanghai.com, Sec.Associations, Traffic selectors]；
意思为： IKE认证回复 [报头， AUTH值， 配置载荷（配置类型，类型值 = 16666··.. value： 网元的域名或者 IP地址等];
306、 AP接收该认证成功响应 , 并根据该认证成功响应中携带的网元设备 的参数自身进行配置，例如根据需要接入的网元设备的域名或 IP地址等参数进 行配置等。
由上可知， AP可以在发送给 Provisioned SeGW的认证请求中携带 AP需要 接入的网元设备的类型， 然后， 再从 Provisioned SeGW回复的认证成功响应中 获取该网元设备的参数， 从而实现了 AP的快速自动配置， 给用户带来了方便， 而且， 网元设备的参数是在 AP认证成功之后才获得的， 保证了 AP接入行为的 合法性， 减少了核心网元设备被非法入侵者攻击的概率。
应当理解的是，本实施例只是以接入设备为 AP, 网络侧设备为 Provisioned SeGW,且 AP初始启动时 AP中预置的网络侧设备参数是 Provisioned SeGW的域 名的情况进行描述的，此外，所述的接入设备还可能为 HNB等具有类似功能的 设备， 网络侧设备也可能是 AG等其他网元设备， AP初始启动时 AP中预先提供 的网络侧设备参数还可能是网络侧设备的 IP地址等参数。
实施例四、
在实施例三的基础上，下面将对本发明实施例提供的方法作进一步详细说 明。
假定接入设备为 AP, 在 AP发放时， 预置了若干个网络侧设备 Provisioned SeGW, 且提供的用于标识 Provisioned SeGW的参数为 Provisioned SeGW的域 名， 则 AP可以根据该 Provisioned SeGW的域名通过公网 DNS解析得到该 Provisioned SeGW的 IP地址， 然后 居该 Provisioned SeGW的 IP地址与该 Provisioned SeGW建立连接。
AP发送认证请求给该 Provisioned SeGW, 该认证请求中携带 AP需要接入 的网元设备的类型， 该 Provisioned SeGW接收到该认证请求后， 将该认证请求 转发至 AAA ( Authentication ^ Authorization ^ Accounting Server, 认证、 授权 以及计费服务器）服务器， AAA服务器可以从归属地管理服务器等服务器获 得用户数据文件， 以确定用户的权限， 即对该 AP的接入行为的合法性进行认 证； 若不合法， 则返回认证失败响应给该 AP , AP可以在所述预置的多个 Provisioned SeGW中重新选择一个， 获取用于标识该重新选择的 Provisioned SeGW的域名 , ^居该获取到的 Provisioned SeGW的域名发送认证请求给该重 新选择的 Provisioned SeGW;该重新选择的 Provisioned SeGW收到认证请求后， 对 AP的接入行为的合法性进行判断， 若合法， 则建立 IPSec隧道， 获得内部网 给 AP分配的 IP地址， 并且， 可以通过查询服务器等途径， 根据此认证请求中 携带的需要接入的网元设备的类型获 ^目应的网元设备的参数 ,然后发送认证 成功响应给 AP , 并在该认证成功响应中携带所述获取到的网元设备的参数； 这样， AP在通过认证的同时， 也就获得了它所需要接入的网元设备的参数， 从而可以根据该接收到的网元设备的参数对自身进行配置。
上述 IPsec是在 IP层提供安全服务的协议，它使系统能按需选择安全协 议，决定服务所使用的算法及放置需求服务所需密钥到相应位置。 IPsec 用来保 护一条或多条主机与主机间、安全网关与安全网关间、安全网关与主机间的路 径安全。
为了实施以上方法， 需要对认证请求和认证成功响应中的 Configuration Payload (配置载荷）进行扩展， 具体格式可参见实施例三。
如图 4所示， 其具体流程可以如下：
401、 AP发送认证请求给 Provisioned SeGW, 该认证请求中携带 AP需要接 入的网元设备的类型；
402、 Provisioned SeGW接收该认证请求， 并转发此认证请求给 AAA服务 器；
403、 AAA服务器接收到该认证请求后， 可以通过归属地管理服务器获取 用户数据文件， 以确定用户权限， 即对 AP进行认证；
404、 AAA服务器回复认证结果给 Provisioned SeGW;
405、 Provisioned SeGW接收到该认证结果后， 若认证失败， 则将发送认 证失败的响应给 AP, AP可以重新选择另一个 Provisioned SeGW, 获取该重新 选择的 Provisioned SeGW的参数， 尝试再次发送认证请求给重新选择的 Provisioned SeGW;
406、 若认证成功， 则 Provisioned SeGW根据步骤 402中接收到认证请求中 携带的需要接入的网元设备的类型查询服务器 ,获得所述需要接入的网元设备 的参数;
407、 Provisioned SeGW发送认证成功响应给 AP, 所述认证成功响应携带 步骤 406中获取到的网元设备的参数；
408、 AP接收该认证成功响应 , 并根据该认证成功响应中携带的网元设备 的参数对自身进行配置。
由上可知， AP可以在给 Provisioned SeGW发送认证请求的同时， 将 AP需 要接入的的网元设备的类型也带给了 Provisioned SeGW , 然后 Provisioned SeGW对该接入行为的合法性进行认证， 若认证成功， 则 Provisioned SeGW可 以根据该网元设备的类型获取该网元设备的参数， 并在回复认证成功响应给 AP时携带该获取到的网元设备的参数给 AP, 从而实现了 AP的快速自动配置， 给用户带来了方便， 而且， 网元设备的参数是在 AP认证成功之后才获得的， 保证了 AP接入行为的合法性， 减少了核心网元设备被非法入侵者攻击的概率。 实施例五、
为了更好实施以上方法，本发明实施例还相应地提供了一种接入设备，如 图 5所示， 主要包括收发单元 502和配置单元 503， 还可以包括获取单元 501 ; 获取单元 501 , 主要用于获取用于标识网络侧设备的参数；
收发单元 502 , 主要用于发送认证请求给网络侧设备 , 以及接收网络侧设 备的认证响应 ,该认证请求携带接入设备需要接入的网元设备的类型 ,该认证 响应携带所述网元设备的参数， 需说明的是，该网元设备的参数是所述网络侧 设备根据所述网元设备的类型所获取的； 该收发单元 502还用于根据获取单元 501获取的用于标识网络侧设备的参 «_送认证请求给该网络侧设备；
配置单元 503 ,主要用于根据收发单元 502接收到的认证响应中携带网元设 备的参数对接入设备进行配置。
当然，考虑到若在接入设备未通过认证之前就对其预配置大部分的网元设 备的参数，可能会给非法的入侵者提供攻击预配置核心网元设备的机会，给预 配置核心网元设备带来安全隐患， 所以， 为了进一步提高该核心网的安全性， 设备的认证成功响应中才携带所述获取到的网元设备的参数。
以下， 将举例作进一步详细说明。
接入设备初始启动后， 接入设备的获取单元 501可以在预先提供的网络侧 设备中选择一个网络侧设备， 并获取用于标识该选择的网络侧设备的参数， 比 如选择一个 SeGW的 IP地址等等 , 然后根据该获取的用于标识网络侧设备的参 数与该网络侧设备建立连接， 收发单元 502发送认证请求给该网元设备 , 该认 证请求中携带有接入设备需要接入的网元设备的类型 , 若该接入行为是合法 的， 即认证成功， 则该网络侧设备根据该接收到的认证请求中携带的网元设备 的类型获取与之相应的网元设备的参数， 并发送认证成功响应给接入设备，该 认证成功响应中携带该获取到的网元设备的参数 ,之后 ,接入设备的收发单元 502接收该认证成功响应， 最后， 配置单元 503根据收发单元 502接收到的认证 成功响应中携带的网元设备的参数对接入设备进行配置，以完成接入设备的自 动配置。 该接入设备具体可以为家庭基站或 AP等等。
由上可知，该接入设备可以在发送给网络侧设备的认证请求中携带接入设 备需要接入的网元设备的类型， 然后，再从网络侧设备回复的认证成功响应中 获取该网元设备的参数并对自身进行配置，从而实现了接入设备的快速自动配 置， 给用户带来了方便， 而且， 网元设备的参数是在接入设备认证成功之后才 获得的，保证了接入设备接入行为的合法性， 减少了核心网元设备被非法入侵 者攻击的概率。
实施例六、
本发明实施例还提供一种网络侧设备，如图 6所示， 主要包括收发单元 601 和获取单元 602;
收发单元 601 , 主要用于接收接入设备发送的认证请求， 以及发送认证响 应给接入设备，该认证请求携带接入设备需要接入的网元设备的类型，该认证 成功响应携带所述获取单元 602获取到的网元设备的参数；
获取单元 602，主要用于根据收发单元 601接收到的认证请求中携带的需要 接入的网元设备的类型获取该网元设备的参数。
当然， 该网络侧设备还可以包括认证单元 603；
认证单元 603 , 用于对收发单元 601接收到的认证请求进行认证；
获取单元 602 , 还用于当认证单元 603认证成功时， 根据收发单元 601接收 到的认证请求中携带的网元设备的类型获取所述网元设备的参数；
收发单元 601，还用于当认证单元 603认证成功时，发送认证成功响应给接 入设备， 所述认证成功响应携带获取单元 602获取到的网元设备的参数。
网络侧设备的收发单元 601接收到接入设备发送的认证请求后， 获取单元 602根据该认证请求中携带的接入设备需要接入的网元设备的类型获取相应的 网元设备的参数， 然后， 收发单元 601在发送认证响应给接入设备的同时， 将 该获取单元 602获取到的网元设备的参数也带给接入设备 , 以便之后接入设备 可以根据该网元设备的参数对自身进行配置，并与该网元设备建立连接。当然， 考虑到若在接入设备未通过认证之前就对其预配置大部分的网元设备的参数， 可能会给非法的入侵者提供攻击预配置核心网元设备的机会，给预配置核心网 元设备带来安全隐患， 所以， 为了进一步提高该核心网的安全性， 还可以是在 对接入设备的接入行为的合法性进行认证成功之后 ,在回复给接入设备的认证 成功响应中才携带所述获取到的网元设备的参数。
该网络侧设备具体可以为 SeGW、 AG或 ACL (接入控制列表 )服务器等等。 由上可知，该网络侧设备可以在接收到接入设备发送的认证请求后，根据 该认证请求中携带的接入设备需要接入的网元设备的类型获取该网元设备的 参数， 再发送携带有该获取到的网元设备的参数的认证成功响应给接入设备， 从而实现了接入设备的快速自动配置， 给用户带来了方便， 而且， 网元设备的 参数是在接入设备认证成功之后才发送给接入设备的 ,保证了接入设备接入行 为的合法性， 减少了核心网元设备被非法入侵者攻击的概率。
实施例七、
本发明实施例还相应地提供一种通信系统， 如图 7所示， 主要包括接入设 备 701 , 还可以包括网络侧设备 702;
接入设备 701 , 主要用于发送认证请求给网络侧设备 , 该认证请求携带接 入设备 701需要接入的网元设备的类型， 接收网络侧设备 702发送的认证响应， 该认证响应携带所述网元设备的参数，然后根据所述网元设备的参数对接入设 备进行配置；
网络侧设备 702, 用于接收接入设备 701发送的认证请求，根据所述认证请 求中携带的需要接入的网元设备的类型获取该网元设备的参数，然后发送认证 响应给接入设备 701， 该认证响应携带该获取到的网元设备的参数； 当然， 考 虑到若在接入设备 701未通过认证之前就对其预配置大部分的网元设备的参 数，可能会给非法的入侵者提供攻击预配置核心网元设备的机会，给预配置核 心网元设备带来安全隐患， 所以， 为了进一步提高该核心网的安全性， 还可以 备 701的认证成功响应中才携带所述获取到的网元设备的参数。
其中， 接入设备 701主要包括收发单元 502和配置单元 503， 还可以包括获 取单元 501 ; 网络侧设备主要包括收发单元 601和获取单元 602， 当然， 还可以 包括认证单元 603。
其中， 接入设备具体可以为家庭基站或 AP等， 网络侧设备可以为 SeGW、 AG或 ACL服务器等。 接入设备 701可以在发送给网络侧设备 702的认证请求中携带接入设备 701 需要接入的网元设备的类型， 然后， 网络侧设备 702根据该网元设备的类型获 取该网元设备的参数 , 并在回复给接入设备 701的认证成功响应中将该获取到 的网元设备的参数带给接入设备 701， 最后，接入设备 701根据该接收到的网元 设备的参数对自身进行配置，从而实现了接入设备的快速自动配置，给用户带 来了方便， 而且， 网元设备的参数是在接入设备 701认证成功之后才获得的， 保证了接入设备 701接入行为的合法性， 减少了核心网元设备被非法入侵者攻 击的概率。
总之， 本发明实施例具有以下有益效果： 带接入设备需要接入的网元设备的类型，此网元设备可以是一个或多个，然后， 网络侧根据该需要接入的网元设备的类型 ,通过查询服务器等途径获取到该网 元设备的参数，并在回复给接入设备的认证成功响应中将该网元设备的参数带 给接入设备，接入设备再根据该网元设备的参数对自身进行配置或更新，从而 实现了接入设备的快速自动配置， 给用户带来了方便， 而且， 网元设备的参数 是在接入设备认证成功之后才获得的，保证了接入设备接入行为的合法性， 减 少了核心网元设备被非法入侵者攻击的概率， 完善了其安全性。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步 骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读 存储介质中， 存储介质可以包括： 只读存储器（ROM, Read Only Memory )、 随才/ 1 取记忆体（RAM, Random Access Memory )、 磁盘或光盘等。
以上对本发明实施例所提供的接入设备的配置方法、装置以及系统进行了 上实施例的说明只是用于帮助理解本发明的方法及其核心思想； 同时，对于本 领域的一般技术人员 ,依据本发明的思想，在具体实施方式及应用范围上均会 有改变之处， 综上所述， 本说明书内容不应理解为对本发明的限制。

Claims

权 利 要 求
1、 一种接入设备的配置方法， 其特征在于， 包括：
发送认证请求给网络侧设备，所述认证请求携带需要接入的网元设备的类 型；
接收网络侧设备的认证响应， 所述认证响应携带所述网元设备的参数， 所 述网元设备的参数是所述网络侧设备根据所述网元设备的类型所获取的； 才艮据所述网元设备的参数为所述接入设备进行配置。
2、根据权利要求 1所述的接入设备的配置方法， 其特征在于， 所述发送认 证请求给网络侧设备具体为：
获取用于标识网络侧设备的参数；
根据所获取的参&^送认证请求给对应的网络侧设备。
3、根据权利要求 1所述的接入设备的配置方法， 其特征在于， 所述接收网 络侧设备的认证响应具体为：
接收网络侧设备的认证成功响应 ,所述认证成功响应携带所述网元设备的 所述参数。
4、根据权利要求 3所述的接入设备的配置方法， 其特征在于， 当接收到网 络侧设备的认证失败的响应时 , 还包括：
根据重新获取的用于标识网络侧设备的参数发送认证请求给对应的网络 侧设备。
5、 根据权利要求 2至 4任一项所述的接入设备的配置方法， 其特征在于， 所述获取用于标识网络侧设备的参数具体为：
获取网络侧设备的域名或网际协议地址。
6、 根据权利要求 1至 4任一项所述的接入设备的配置方法， 其特征在于， 所述认证请求携带需要接入的网元设备的类型具体为：
在所述认证请求中的扩展后的配置载荷中携带需要接入的网元设备的类 型。
7、 一种接入设备的配置方法， 其特征在于， 包括：
接收接入设备发送的认证请求，所述认证请求携带需要接入的网元设备的 类型； 才艮据所述网元设备的类型获取所述网元设备的参数；
发送认证响应给接入设备， 所述认证响应携带所述网元设备的参数。
8、根据权利要求 7所述的接入设备的配置方法， 其特征在于， 在根据所述 网元设备的类型获取所述网元设备的参数之前还包括：
对所述接收到的认证请求进行认证；
若认证成功 ,则执行根据所述网元设备的类型获取所述网元设备的参数的 步骤；
所述发送认证响应给接入设备具体为：
发送认证成功响应给接入设备 ,所述认证成功响应携带所述网元设备的参 数。
9、根据权利要求 7所述的接入设备的配置方法， 其特征在于， 所述认证响 应携带所述网元设备的参数具体为：
在所述认证响应中的扩展后的配置载荷中携带所述网元设备的参数。
10、 一种接入设备， 其特征在于， 包括收发单元和配置单元；
所述收发单元， 用于发送认证请求给网络侧设备， 以及接收网络侧设备的 认证响应， 所述认证请求携带接入设备需要接入的网元设备的类型， 所述认证 响应携带所述网元设备的参数，所述网元设备的参数是所述网络侧设备根据所 述网元设备的类型所获取的；
所述配置单元 ,用于根据所述收发单元接收到的认证响应中携带的网元设 备的参数为所述接入设备进行配置。
11、 根据权利要求 10所述的接入设备， 其特征在于， 还包括获取单元； 所述获取单元 , 用于获取用于标识网络侧设备的参数；
所述收发单元，用于根据所述获取单元获取的网络侧设备的参数发送认证 请求给对应的网络侧设备。
12、 根据权利要求 10或 11所述的接入设备， 其特征在于：
所述接入设备具体为家庭基站或接入点设备。
13、 一种网络侧设备， 其特征在于， 包括收发单元和获取单元； 所述收发单元， 用于接收接入设备发送的认证请求， 以及发送认证响应给 接入设备， 所述认证请求携带需要接入的网元设备的类型， 所述认证响应携带 所述获取单元获取到的网元设备的参数；
所述获取单元 ,用于根据所述收发单元接收到的认证请求中携带的网元设 备的类型获取所述网元设备的参数。
14、 根据权利要求 13所述的网络侧设备， 其特征在于， 还包括认证单元； 所述认证单元， 用于对所述收发单元接收到的认证请求进行认证； 所述获取单元，还用于当所述认证单元认证成功时，根据所述收发单元接 收到的认证请求中携带的网元设备的类型获取所述网元设备的参数；
所述收发单元，还用于当所述认证单元认证成功时，发送认证成功响应给 接入设备， 所述认证成功响应携带所述获取单元获取到的网元设备的参数。
15、 根据权利要求 13或 14所述的网络侧设备， 其特征在于：
所述网络侧设备具体为安全网关或接入网关或接入控制列表服务器。
16、 一种通信系统， 其特征在于， 包括接入设备；
所述接入设备， 用于发送认证请求给网络侧设备， 所述认证请求携带需要 接入的网元设备的类型，接收网络侧设备发送的认证响应， 所述认证响应携带 所述网元设备的^：, 以及根据所述网元设备的参数对接入设备进行配置。
17、 根据权利要求 16所述的通信系统， 其特征在于， 还包括网络侧设备； 所述网络侧设备，用于接收接入设备发送的认证请求， 以及根据所述认证 请求中携带的网元设备的类型获取所述网元设备的参数，将所述网元设备的参 数通过认证响应发送给接入设备。
PCT/CN2009/071827 2008-07-02 2009-05-18 接入设备的配置方法、装置及系统 WO2010000157A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200810040281.8 2008-07-02
CN2008100402818A CN101621433B (zh) 2008-07-02 2008-07-02 接入设备的配置方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2010000157A1 true WO2010000157A1 (zh) 2010-01-07

Family

ID=41465482

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/071827 WO2010000157A1 (zh) 2008-07-02 2009-05-18 接入设备的配置方法、装置及系统

Country Status (2)

Country Link
CN (1) CN101621433B (zh)
WO (1) WO2010000157A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102137395B (zh) * 2010-09-09 2014-07-30 华为技术有限公司 配置接入设备的方法、装置及系统
CN102833359A (zh) * 2011-06-14 2012-12-19 中兴通讯股份有限公司 隧道信息获取方法、安全网关及演进家庭基站/家庭基站
CN104219094B (zh) * 2014-08-29 2018-10-26 新华三技术有限公司 一种ap分组配置的方法和设备
CN106713057B (zh) * 2015-07-30 2019-11-29 华为技术有限公司 用于进行隧道检测的方法、装置及系统
CN109936515B (zh) * 2017-12-18 2021-06-04 华为技术有限公司 接入配置方法、信息提供方法及装置
CN111614476A (zh) * 2019-02-22 2020-09-01 华为技术有限公司 设备配置方法、系统和装置
CN110661666B (zh) * 2019-09-29 2022-02-18 中国联合网络通信集团有限公司 一种分组传送网的环网资源建立方法和装置
CN111147471B (zh) * 2019-12-20 2023-02-28 视联动力信息技术股份有限公司 一种终端入网认证方法、装置、系统和存储介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101098319A (zh) * 2006-06-27 2008-01-02 中国移动通信集团公司 基于ip多媒体子系统的家庭网关及其配置方法
CN101106508A (zh) * 2006-07-14 2008-01-16 华为技术有限公司 一种在异构系统中获取用户规格的方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1224221C (zh) * 2003-09-15 2005-10-19 港湾网络有限公司 宽带网络接入设备用户多业务系统实现方法
CN100407625C (zh) * 2005-04-29 2008-07-30 华为技术有限公司 一种根据终端类型进行业务发放的方法
CN1937632B (zh) * 2005-09-23 2011-05-11 中兴通讯股份有限公司 一种应用于宽带无线接入系统中地址分配方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101098319A (zh) * 2006-06-27 2008-01-02 中国移动通信集团公司 基于ip多媒体子系统的家庭网关及其配置方法
CN101106508A (zh) * 2006-07-14 2008-01-16 华为技术有限公司 一种在异构系统中获取用户规格的方法

Also Published As

Publication number Publication date
CN101621433A (zh) 2010-01-06
CN101621433B (zh) 2011-12-21

Similar Documents

Publication Publication Date Title
US11716621B2 (en) Apparatus and method for providing mobile edge computing services in wireless communication system
JP3869392B2 (ja) 公衆無線ｌａｎサービスシステムにおけるユーザ認証方法および該方法をコンピュータで実行させるためのプログラムを記録した記録媒体
CN101127600B (zh) 一种用户接入认证的方法
WO2010000157A1 (zh) 接入设备的配置方法、装置及系统
US20090064291A1 (en) System and method for relaying authentication at network attachment
JP2002314549A (ja) ユーザ認証システム及びそれに用いるユーザ認証方法
JP2020517207A (ja) ネットワークアクセス方法および装置ならびにネットワークデバイス
CN101379795A (zh) 在由认证服务器检查客户机证书的同时由dhcp服务器进行地址分配
WO2011017924A1 (zh) 无线局域网的认证方法、系统、服务器和终端
US8151325B1 (en) Optimizing device authentication by discovering internet protocol version authorizations
WO2006000152A1 (fr) Procede pour la gestion d'equipement d'utilisateur d'acces au reseau au moyen de l'architecture d'authentification generique
WO2010000185A1 (zh) 一种网络认证的方法、装置、系统及服务器
WO2010094244A1 (zh) 一种进行接入认证的方法、装置及系统
WO2006063511A1 (fr) Procede permettant de realiser une authentification synchrone parmi differents dispositifs de commande d'authentification
US20040196977A1 (en) Conveying wireless encryption keys upon client device connecting to network in non-wireless manner
WO2013056619A1 (zh) 一种身份联合的方法、IdP、SP及系统
WO2018196587A1 (zh) 融合网络中的用户认证方法及装置
WO2012051868A1 (zh) 防火墙策略分发方法、客户端、接入服务器及系统
WO2014101449A1 (zh) 一种无线局域网中接入节点的控制方法及通信系统
WO2012034413A1 (zh) 一种双栈用户管理方法及宽带接入服务器
WO2009109118A1 (zh) 一种终端接入控制方法、网络设备及系统
KR100763131B1 (ko) 공중 무선랜 서비스를 위한 망접속 및 서비스 등록 방법
WO2009082910A1 (fr) Procédé et dispositif de configuration de réseau pour un terminal d'utilisateur
EP3226594B1 (en) Method, device and system for obtaining local domain name
WO2012071701A1 (zh) 非3gpp接入网关的选择方法、网络设备及用户设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09771927

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09771927

Country of ref document: EP

Kind code of ref document: A1