WO2011140919A1

WO2011140919A1 - Method, device, server and system for accessing service wholesale network

Info

Publication number: WO2011140919A1
Application number: PCT/CN2011/073409
Authority: WO
Inventors: 钱国锋; 赵志旺; 李猛; 陈艺彪
Original assignee: 华为技术有限公司
Priority date: 2010-08-20
Filing date: 2011-04-28
Publication date: 2011-11-17
Also published as: CN102143136B; CN102143136A

Abstract

The embodiments of the invention provide a method, device, server and system for accessing a service wholesale network. The method includes: a provider edge device receives Internet Protocol over Ethernet (IPOE) authentication information transferred from an IPOE user terminal; the provider edge device performs a first level authentication to the IPOE user terminal according to the received IPOE authentication information; after a successful first level authentication, the provider edge device transfers the IPOE authentication information through the virtual private network tunnel corresponding to the IPOE authentication information, in order to trigger that a broadband remote access server (BRAS) performs a second level authentication and allocates an IP address for accessing the service wholesale network to the IPOE user terminal after a successful second level authentication. The present invention can ensure the IPOE user terminal to access the service wholesale network, and enable the IPOE user terminal to enjoy the service of multiple Internet Service Providers (ISP) in the service wholesale network.

Description

Method, device, server and system for accessing the wholesale network of the service The present application claims to be filed on August 20, 2010, the Chinese Patent Office, the application number is 201010261207.6, and the invention is entitled "Access Method Wholesale Network Method, Equipment, Server and System" The priority of the Chinese Patent Application, the entire contents of which is incorporated herein by reference. Technical field

The embodiments of the present invention relate to communication technologies, and in particular, to a method, device, server, and system for accessing a service wholesale network. Background technique

Currently, Service Wholesale technology has emerged in communication networks. Figure 1 is a block diagram of a business wholesale network in the prior art. Referring to Figure 1, the service wholesale network refers to multiple Internet Service Providers (ISPs) on the physical network of the same Network Service Provider (NSP). The physical network of the NSP is leased to perform business operations, thereby supporting multi-ISP services.

Referring to FIG. 1 , in the service wholesale technology, the user terminal is connected to the Provider Edge (PE) in the NSP network, and the PE receives the service packet of the user, and is no longer based on the destination IP address of the service packet of the user. The address is forwarded by the traditional remote routing server. The access device that forwards the text to the ISP through the virtual private network (VPN) tunnel is the broadband remote access server (Broadband Remote Access Server). , referred to as: BRAS), BRAS carries out corresponding business processing. Therefore, in the service wholesale network, there are two levels of operators, the first level operator is NSP, and the second level operator is ISP.

At present, the Ethernet network-based Internet Protocol over Ethernet (IPOE) interface method appears on the user side of the access device. Currently, there is only one level operator in the system using IPOE interface technology, IPOE The process of the user terminal accessing the network mainly includes: the IPOE user terminal sends the user first packet to the access device, and the access device performs authentication. After the authentication is completed, the IPOE user terminal is directly assigned an IP address, and the third layer used by the IPOE user terminal is determined. Network permissions.

In the process of implementing the present invention, the inventor found that although the business wholesale technology and the IPOE interface technology have good development prospects, the IPOE user terminal is currently unable to access the service wholesale network, for example, there are two levels in the service wholesale network. The characteristics of the operator do not currently have any adaptive access processing for the IPOE user terminal, so that the IPOE user terminal cannot provide multiple ISP services in the service wholesale network. Summary of the invention

The embodiment of the invention provides a method, a device, a server and a system for accessing a wholesale network, and solves the problem that the IPOE user terminal cannot access the service wholesale network in the prior art.

The method for accessing a wholesale network of services provided by the embodiments of the present invention includes:

The PE in the NSP network receives the IPOE protocol authentication information sent by the IPOE user terminal; the PE performs the first-level authentication on the IPOE user terminal according to the received IPOE authentication information;

After the primary authentication succeeds, the PE sends the IPOE authentication information to the BRAS through the VPN tunnel corresponding to the IPOE authentication information, to trigger the BRAS to perform the secondary authentication, and assign the IP to the IPOE user terminal after the secondary authentication succeeds. address.

The PE provided by the embodiment of the present invention includes:

a first receiving module, configured to receive IPOE authentication information sent by the IPOE user terminal, and a first authentication module, configured to perform first-level authentication on the IPOE user terminal according to the IPOE negotiation authentication information;

The first sending module is configured to send the IPOE authentication information to the BRAS through the VPN tunnel corresponding to the IPOE authentication information after the first level authentication succeeds.

The BRAS provided by the embodiment of the present invention includes: a second receiving module, configured to receive IPOE authentication information sent by the PE through the VPN tunnel; and a second authentication module, configured to perform secondary authentication on the IPOE user terminal according to the IPOE negotiation authentication information;

And an allocating module, configured to allocate an IP address to the IPOE user terminal after the second level authentication succeeds. The system for accessing the wholesale network of the service provided by the embodiment of the present invention includes the PE provided by the embodiment of the present invention and the BRAS provided by the embodiment of the present invention.

The method for accessing the wholesale network of the service, the PE, the BRAS, and the system for accessing the wholesale network of the service provided by the embodiment of the present invention, the PE performs the first-level authentication of the NSP network on the IPOE user terminal, and triggers the BRAS to perform the second-level authentication, because the PE The IPOE authentication information is sent to the BRAS through the VPN tunnel corresponding to the IPOE authentication information. Therefore, the request for forwarding the packet to the BRAS through the VPN tunnel in the service wholesale network can be satisfied, and it is also clear that the BRAS after completing the secondary authentication is The IPOE user terminal allocates an IP address, thereby completing the access processing of the IPOE user terminal in the service wholesale network, and ensuring that the IPOE user terminal can access the service wholesale network. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is an architectural diagram of a service wholesale network in the prior art;

2 is a flowchart of a method for accessing a network according to an embodiment of the present invention;

3 is a flow chart of an IPOE user terminal access service wholesale network in Example 1 of the present invention; FIG. 4 is a flow chart of an IPOE user terminal access service wholesale network in Example 2 of the present invention; FIG. 5 is a PE according to an embodiment of the present invention; Schematic diagram of the structure;

6 is a schematic structural diagram of an example 1 of a PE according to an embodiment of the present invention;

7 is a schematic structural diagram of an example 2 of a PE according to an embodiment of the present invention; 8 is a schematic structural diagram of an example 3 of a PE according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of an example 4 of a PE according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of an example 5 of a PE according to an embodiment of the present invention;

11 is a schematic structural diagram of a BRAS according to an embodiment of the present invention;

12 is a schematic structural diagram of an example 1 of a BRAS according to an embodiment of the present invention;

13 is a schematic structural diagram of an example 2 of a BRAS according to an embodiment of the present invention;

14 is a schematic structural diagram of an example 3 of a BRAS according to an embodiment of the present invention;

15 is a schematic structural diagram of an example 4 of a BRAS according to an embodiment of the present invention;

16 is a schematic structural diagram of an example 5 of a BRAS according to an embodiment of the present invention;

17 is a schematic structural diagram of an example 6 of a BRAS according to an embodiment of the present invention;

FIG. 18 is a schematic diagram of a system for accessing a wholesale network of services according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiment of the present invention provides a method for accessing a network. Referring to FIG. 2, the method mainly includes: 201: A PE in an NSP network receives IPOE authentication information sent by an IPOE user terminal. 202: The PE performs the first-level authentication on the IPOE user terminal according to the received IPOE authentication information. 203: After the primary authentication succeeds, the PE sends the IPOE authentication information to the BRAS through the VPN tunnel corresponding to the IPOE authentication information, triggering the BRAS to perform the secondary authentication on the IPOE user terminal, and after the secondary authentication succeeds, the BRAS is the IPOE user terminal. Assign an IP address.

It can be seen that, in the method provided by the embodiment of the present invention, the PE performs the first-level authentication of the NSP network on the IPOE user terminal, and triggers the BRAS to perform the second-level authentication, because the PE passes the IPOE authentication letter. The VPN tunnel corresponding to the information sends the IPOE authentication information to the BRAS. Therefore, it can meet the requirements of forwarding the packet to the BRAS through the VPN tunnel in the service wholesale network, and it is also explicitly allocated by the BRAS to the IPOE user terminal after completing the secondary authentication. The IP address, thus completing the access processing of the IPOE user terminal in the service wholesale network, ensures that the IPOE user terminal can access the service wholesale network.

Optionally, in the implementation of the embodiment of the present invention, the IPOE authentication information may be in two ways: Method 1: The IPOE information carried in the first packet of the user is used as the IPOE authentication information for the first level authentication and the second level authentication.

Method 2: The user information input by the user is used as the IPOE authentication information for the first level authentication and the second level authentication.

The following two specific authentication methods are respectively described in detail for each of the above two authentication methods.

Example 1 :

In this example, the IPOE information carried in the first packet of the user is used as the IPOE authentication information for primary authentication and secondary authentication. Referring to FIG. 3, in this example, the process of the IPOE user terminal accessing the service wholesale network mainly includes:

301: The IPOE user terminal sends the first packet of the user carrying the IPOE information to the NSP network.

PE.

In this example, the IPOE information used for authentication may include a Media Access Control (MAC) address of the IPOE user terminal, and/or a Virtual Local Area Network (Virtual Local Area Network) used by the IPOE user terminal. VLAN) identification. In addition, when the first packet of the user is the first packet of the dynamic host allocation protocol (DHCP), the IPOE information used for authentication may be the OPTION82 field, the MAC address of the IPOE user terminal, and the VLAN identifier used by the IPOE user terminal. Any one or more of them.

302: After receiving the first packet of the user, the PE performs the first-level authentication on the IPOE user terminal according to the IPOE information in the first packet of the user. If the authentication succeeds, the process performs 304. If the authentication fails, the process proceeds to 303.

Optionally, the primary authentication for the IPOE user terminal can be local authentication or remote. The authentication method is carried out, among them,

When the local authentication mode is adopted, the authentication process is specifically as follows: The PE determines whether the IPOE information in the first packet of the user is legal according to the pre-configured legal IPOE information (the legal IPOE information can be configured according to the requirements of the NSP network). If yes, The authentication is successful, otherwise the authentication fails.

The authentication process is specifically as follows: The PE sends the IPOE information in the first packet of the user to the remote authentication server that uses the Remote Authentication Dial In User Service (RADIUS) protocol. The authentication server determines whether the IPOE information sent by the PE is legal according to the pre-configured legal IPOE information. If yes, the PE is successfully authenticated. Otherwise, the PE authentication fails.

303: Reject the IPOE user terminal to access the service wholesale network, and end the current process.

304: The PE sends the user first packet to the BRASc through the VPN tunnel corresponding to the IPOE information in the first packet of the user according to the correspondence between the pre-configured IPOE information and the VPN tunnel.

305: After receiving the first packet of the user, the BRAS performs secondary authentication on the IPOE user terminal according to the IPOE information in the first packet of the user. If the authentication succeeds, the process is performed 306. If the authentication fails, perform 303. among them,

When the local authentication mode is used, the authentication process is specifically as follows: The BRAS determines whether the IPOE information in the first packet of the user is legal according to the pre-configured legal IPOE information (the legal IPOE information can be configured according to the requirements of the ISP network). If yes, The authentication is successful, otherwise the authentication fails.

In the remote authentication mode, the authentication process is specifically as follows: The BRAS sends the IPOE information in the first packet of the user to the remote authentication server using the RADIUS protocol. The authentication server determines the IPOE sent by the BRAS according to the pre-configured legal IPOE information. Whether the information is legal. If yes, the BRAS authentication is successful. Otherwise, the BRAS authentication fails.

306: The BRAS allocates an IP address to the IPOE user terminal; optionally, the BRAS may also return an authentication success notification to the IPOE user terminal. At this point, the IPOE user terminal accesses the service wholesale network successfully.

Through the process shown in Figure 3 above, it can be seen that the PE performs the primary authentication of the NSP network according to the IPOE information carried in the first packet of the user, and the BRAS performs the secondary authentication according to the IPOE information carried in the first packet of the user, and passes the The VPN tunnel corresponding to the IPOE information in the first packet of the user sends the user first packet to the BRAS, so that the request for forwarding the message to the BRAS through the VPN tunnel in the service wholesale network can be satisfied, and after the BRAS completes the secondary authentication, Assigning an IP address to the IPOE user terminal completes the access processing of the IPOE user terminal in the service wholesale network, ensuring that the IPOE user terminal can access the service wholesale network, thereby enabling the IPOE user terminal to enjoy multiple ISPs in the service wholesale network. service.

Example 2:

In this example, the user information entered by the user is used as the IPOE authentication information for the first level and the second level. Referring to FIG. 4, in this example, the process of accessing the service wholesale network by the IPOE user terminal mainly includes:

401: The IPOE user terminal sends the user information used for authentication to the PE in the NSP network. In this embodiment, the user information for authentication may include any one or more of a username, a user password, and a user domain name.

402: After receiving the user information, the PE performs a first-level authentication on the IPOE user terminal according to the user information, and the password authentication succeeds, and the browser performs the 404, the password authentication fails, and executes 403. The authentication process is as follows: The PE is based on the pre-configured legal user information (the legal user information can be configured according to the requirements of the NSP network) to determine whether the user information is legal. If yes, the authentication succeeds. Otherwise, Authentication failed.

In the case of the remote authentication mode, the authentication process is specifically as follows: The PE sends the user information to the remote RADIUS authentication server. The authentication server determines whether the user information sent by the PE is legal according to the pre-configured legal user information. If yes, the PE is successfully authenticated. Otherwise, the PE authentication fails. 403: The IPOE user terminal is denied access to the wholesale network of services, and the current process is terminated.

404: The PE sends the user information to the BRAS through the VPN tunnel corresponding to the user information according to the correspondence between the pre-configured user information and the VPN tunnel.

405: After receiving the user information, the BRAS performs secondary authentication on the IPOE user terminal. If the authentication succeeds, the shell performs a 406, the password authentication fails, and the execution 403 is performed.

Optionally, when the user information received by the BRAS is plaintext (that is, unencrypted information), the secondary authentication may be directly performed according to the user information; when the user information received by the BRAS is encrypted, the BRAS first needs to use the IPOE. The user terminal performs key negotiation, decrypts the user information by using the negotiated key, and then performs secondary authentication on the IPOE user terminal according to the decrypted user information.

Optionally, the process of performing key negotiation between the BRAS and the IPOE user terminal may be:

After receiving the user information sent by the PE, the BRAS initiates an authentication re-consultation indication to the IPOE user terminal. Or,

After receiving the user information sent by the PE, the BRAS waits to receive the DHCP first packet, the IP first packet, or the address resolution protocol (ARP) first packet of the IPOE user terminal forwarded by the PE, and can receive the response after receiving the first packet. In the manner of a message (a DHCP response message, an IP response message, or an ARP response message), an authentication re-negotiation indication is initiated to the IPOE user terminal.

After the above key negotiation process, the IPOE user terminal encrypts the user information using the negotiated key and then sends it to the BRAS again.

After receiving the encrypted user information, the BRAS decrypts the user information using the key negotiated with the IPOE user terminal, and then performs secondary authentication on the IPOE user terminal according to the decrypted user information. In the way, where

When the local authentication mode is used, the authentication process is as follows: The BRAS determines whether the user information sent by the PE is legal according to the pre-configured legal user information. If yes, the authentication succeeds. Otherwise, the authentication is successful. The certificate failed.

When the remote authentication mode is used, the authentication process is specifically as follows: The BRAS sends the user information sent by the PE to the remote RADIUS authentication server. The authentication server determines whether the received user information is based on the pre-configured legal user information. Legitimate, if yes, notify the BRAS that the authentication is successful, otherwise, notify the BRAS that the authentication failed.

406: The BRAS allocates an IP address to the IPOE user terminal; optionally, the BRAS may also return an authentication success notification to the IPOE user terminal.

At this point, the IPOE user terminal accesses the service wholesale network successfully.

It can be seen from the foregoing process shown in FIG. 4 that the PE performs the primary authentication of the NSP network according to the user information, the secondary authentication by the BRAS according to the user information, and the user information is sent to the BRAS through the VPN tunnel corresponding to the user information. Therefore, the requirements for forwarding the message to the BRAS through the VPN tunnel in the service wholesale network can be satisfied, and after completing the secondary authentication, the BRAS allocates an IP address to the IPOE user terminal, and completes the IPOE user terminal in the service wholesale network. The access processing ensures that the IPOE user terminal can access the service wholesale network, so that the IPOE user terminal can enjoy the services of multiple ISPs in the service wholesale network.

After the above description, it can be seen that since there are two levels of operators in the service wholesale network, the two-level operators need to manage the IPOE user terminals, and therefore, after passing through the processes shown in FIG. 3 and FIG. 4 above, the present invention The method for implementing two-level operator management for an IPOE user terminal is further provided in the embodiment, and may include two methods:

Method 1, independent management.

Independent management means that the NSP network and the ISP network independently manage users, and each maintains the state of the IPOE user terminal. For example, the IPOE user terminal is allowed to be in an online state in the NSP network and offline in the ISP network. The specific implementation is as follows: The PE and the BRAS independently monitor and maintain the state of the IPOE user terminal, that is, the PE only maintains the state of the IPOE user terminal in the NSP network; the BRAS only maintains the state of the IPOE user terminal in the ISP network. In the independent management mode, the status of the IPOE user terminal maintained on the PE and BRAS may be different. Mode 2, joint management.

Joint management means that the NSP network and the ISP network jointly manage users and jointly maintain the state of the IPOE user terminals. For example, an IPOE user terminal has the same state in the NSP network and the ISP network, and both are offline or online. Exemplarily, there are two ways to implement federated management:

2A. The PE of the Level 1 carrier monitors the status of the IPOE user terminal maintained by the Level 2 carrier's BRAS to achieve the unified state of the two-level operator maintenance.

For example: After the secondary authentication succeeds, the BRAS sets the status of the IPOE user terminal in the ISP network to go online. After the primary authentication succeeds, the PE listens to the authentication success notification sent by the BRAS to the IPOE user terminal. If it is monitored, it will The state of the IPOE user terminal in the NSP network is set to go online. Subsequently, after the IP and the BRAS listen to the IPOE user terminal to release the IP address, the IPOE user terminal is respectively set to the offline state. In this way, the equipment of the Level 1 carrier and the Level 2 carrier basically does not require any interaction.

2B. The state of maintenance maintained by the two-level operators is unified through information interaction.

For example: The PE periodically sends a status query message to the BRAS, which may be a predefined new protocol message. The status query message includes the IPOE information of the IPOE user terminal (such as MAC address, VLAN information, option82 field, IP address, etc.). After receiving the status query message, the BRAS returns a status query response message to the PE, which carries the IPOE maintained by the BRAS. The status of the user terminal, such as online, idle, offline, arrears, etc.; the PE performs state switching on the IPOE user terminal according to the status of the IPOE user terminal in the received status query response message.

The foregoing method for implementing two-level operator management for an IPOE user terminal may be implemented by assigning an IP address to the IPOE user terminal in the first embodiment and the second embodiment, and the IPOE user terminal accessing the service wholesale network is successful.

An embodiment of the present invention further provides a PE. Referring to FIG. 5, the PE includes:

The first receiving module 501 is configured to receive IPOE authentication information sent by the IPOE user terminal, and the first authentication module 502 is configured to: use the received IPOE authentication information to the IPOE user. The terminal performs the first level authentication;

The first sending module 503 is configured to send the IPOE authentication information to the BRAS through the VPN tunnel corresponding to the IPOE authentication information after the first level authentication succeeds.

Optionally, the foregoing IPOE authentication information may be the IPOE information carried in the first packet of the user, or the user information input by the user.

Optionally, referring to FIG. 6, the foregoing first receiving module 501 may include:

The first receiving submodule 601 is configured to receive a first user packet sent by the IPOE user terminal, where the first packet carries IPOE information;

The first authentication module 502 can include:

The first authentication sub-module 602 is configured to perform first-level authentication on the IPOE user terminal according to the IPOE information in the first packet of the user received by the first receiving sub-module 601.

Optionally, referring to FIG. 7, the foregoing first receiving module 501 may include:

The second receiving sub-module 701 is configured to receive user information sent by the IPOE user terminal. The first authentication module 502 may include:

The second authentication sub-module 702 is configured to perform first-level authentication on the IPOE user terminal according to the user information received by the second receiving sub-module 701.

Optionally, referring to FIG. 8 to FIG. 10, the foregoing PE may further include:

a first state maintenance module 801, configured to maintain a state of the IPOE user terminal in an NSP network; or

The second state maintenance module 901 is configured to: after the first-level authentication succeeds, monitor the authentication success notification sent by the BRAS to the IPOE user terminal, and if the user listens, set the state of the IPOE user terminal maintained in the user to be online. After listening to the IPOE user terminal releasing the IP address, setting the state of the IPOE user terminal to the offline; or

The third state maintenance module 1001 is configured to periodically send a status query message to the BRAS, and perform state switching on the IPOE user terminal according to the status of the IPOE user terminal carried in the received status query response message. For the sake of brevity, the connection between modules/submodules in the figures shows only one of the simplest examples. Of course, there may be other connection relationships between modules/sub-modules in the drawing. For example, the first/second/three-state maintenance module (801, 901, 1001) may also be connected to the first authentication module 502. This is no longer the case - the description, the drawing is no longer - shown.

The embodiment of the present invention further provides a BRAS. Referring to FIG. 11, the BRAS includes: a second receiving module 1101, configured to receive IPOE authentication information sent by the PE through the VPN tunnel; and a second authentication module 1102, configured to use the IPOE according to the IPOE The authentication information performs secondary authentication on the IPOE user terminal;

The allocating module 1103 is configured to allocate an IP address to the IPOE user terminal after the secondary authentication succeeds.

Optionally, the foregoing IPOE authentication information may be IPOE information carried in the first packet of the user, or user information input by the user as IPOE authentication information.

Optionally, referring to FIG. 12, the foregoing second receiving module 1101 may include:

The third receiving sub-module 1201 is configured to receive, by using a VPN tunnel, a first user packet sent by the PE, where the first packet carries IPOE information;

The second authentication module 1102 can include:

The third authentication sub-module 1202 is configured to perform secondary authentication on the IPOE user terminal according to the IPOE information in the user first packet received by the third receiving submodule 1201.

Optionally, referring to FIG. 13, the foregoing second receiving module 1101 may include:

The fourth receiving sub-module 1301 is configured to receive the user information sent by the PE through the VPN tunnel. The second authentication module 1102 may include:

The fourth authentication sub-module 1302 is configured to perform secondary authentication on the IPOE user terminal according to the user information received by the fourth receiving sub-module 1301.

Optionally, referring to FIG. 14, on the basis of the BRAS device structure shown in FIG. 13, the second authentication module 1102 may further include:

The user information processing sub-module 1401 is configured to be received by the fourth receiving submodule 1301. After the user information is the encrypted information, sending an authentication re-negotiation indication to the IPOE user terminal, negotiating a key with the IPOE user terminal, and re-encrypting the sent user information to the IPOE user terminal by using the negotiated key. Decrypting, the decrypted user information is sent to the fourth authentication sub-module 1302.

Optionally, referring to FIG. 15 to FIG. 17, the foregoing BRAS may further include:

a first state management module 1501, configured to maintain a state of the IPOE user terminal in an ISP network; or

The second state management module 1601 is configured to: after the secondary authentication succeeds, set the state of the IPOE user terminal to an online state; after listening to the IPOE user terminal releasing the IP address, setting the state of the IPOE user terminal to be lower Line state; or

The third state management module 1701 is configured to: after periodically receiving the status query message sent by the PE, carry the status of the user terminal maintained by the PE in the status query response message and return it to the PE.

For the sake of brevity, the connection between modules/submodules in the figures shows only one of the simplest examples. Of course, there may be other connection relationships between modules/sub-modules in the drawing. For example, the first/second/three-state management module (1501, 1601, 1701) may also be connected to the second authentication module 1102. This is no longer the case - the description, the drawing is no longer - shown.

The embodiment of the present invention further provides a system for accessing a network. Referring to FIG. 18, the system includes a PE 1801 and a BRAS 1802. The PE 1801 may adopt any PE of the foregoing structure and function according to the embodiment of the present invention. The BRAS 1802 can employ any of the BRASs of the structure and function proposed by the embodiments of the present invention.

A person skilled in the art can understand that all or part of the processing of the foregoing method embodiments can be implemented by hardware related to the program instructions. The foregoing program can be stored in a computer readable storage medium, and the program is executed when executed. The foregoing storage medium includes: ROM, RAM, magnetic disk or optical disk, and the like, which can store program codes.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention, rather than The present invention has been described in detail with reference to the foregoing embodiments, and those skilled in the art should understand that the technical solutions described in the foregoing embodiments may be modified or equivalently substituted for some of the technical features. The modifications and substitutions of the present invention do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A method for accessing a wholesale network of services, characterized in that:

Network service provider Carrier edge device in the NSP network PE receives IPOE authentication information sent by the Ethernet-based Internet Protocol IPOE user terminal;

The PE performs first-level authentication on the IPOE user terminal according to the received IPOE authentication information;

After the first-level authentication succeeds, the PE sends the IPOE authentication information to the broadband remote access server BRAS through the virtual private network VPN tunnel corresponding to the IPOE authentication information, to trigger the BRAS to perform the second IPOE user terminal. Level authentication and assign an IP address to the IPOE user terminal after the secondary authentication succeeds.

The method according to claim 1, wherein the IPOE authentication information is IPOE information carried in a user first packet; or the IPOE authentication information is user information input by a user.

The method according to claim 2, wherein, when the IPOE authentication information is the IPOE information carried in the first packet of the user, the IPOE information is a media access control address, a virtual local area network identifier, and an OPTION 82 field. Any one or more of them.

4. The method of claim 2, wherein

When the IPOE authentication information is user information input by the user, the user information is any one or more of a user name, a user password, and a user domain name.

The method according to any one of claims 1 to 4, further comprising: the PE maintaining only the state of the IPOE user terminal in the NSP network; the BRAS only maintaining the The state of the IPOE user terminal in the Internet Service Provider ISP network.

The method according to any one of claims 1 to 4, further comprising: after the secondary authentication succeeds, the BRAS sets the state of the IPOE user terminal to be online, and the PE is in a After the level authentication succeeds, the authentication success notification sent by the BRAS to the IPOE user terminal is monitored, and if it is monitored, the state of the IPOE user terminal maintained in itself is set to go online; After the PE and the BRAS listen to the IPOE user terminal to release the IP address, the IPOE user terminal is placed in the offline state.

The method according to any one of claims 1 to 4, wherein the method further comprises: the PE periodically sending a status query message to the BRAS, and the BRAS returns a status query response to the PE The message carries the status of the IPOE user terminal maintained by the BRAS, and the PE performs state switching on the IPOE user terminal according to the status of the IPOE user terminal in the received status inquiry response message.

8. A carrier edge device PE, characterized in that:

a first receiving module (501), configured to receive IPOE authentication information sent by an Ethernet-based Internet Protocol IPOE user terminal;

a first authentication module (502), configured to perform first-level authentication on the IPOE user terminal according to the IPOE negotiation authentication information;

The first sending module (503) is configured to send the IPOE authentication information to the broadband remote access server BRAS through the virtual private network VPN tunnel corresponding to the IPOE authentication information after the first level authentication succeeds.

The PE according to claim 8, wherein the first receiving module (501) comprises:

a first receiving sub-module (601), configured to receive a user first packet sent by the IPOE user terminal, where the user first packet carries the IPOE information;

The first authentication module (502) includes:

The first authentication sub-module (602) is configured to perform first-level authentication on the IPOE user terminal according to the IPOE information in the first packet of the user received by the first receiving sub-module (601).

a second receiving sub-module (701), configured to receive user information sent by the IPOE user terminal; the first authentication module (502) includes: The second authentication sub-module (702) is configured to perform first-level authentication on the IPOE user terminal according to the user information received by the second receiving sub-module.

The PE according to any one of claims 8 to 10, wherein the PE further comprises:

The first state maintenance module (801) is configured to maintain a state of the IPOE user terminal in a network service provider NSP network.

The second state maintenance module (901) is configured to: after the first-level authentication succeeds, monitor the authentication success notification sent by the BRAS to the IPOE user terminal, and if it is monitored, set the state of the IPOE user terminal maintained in the user to After the IPOE user terminal is released to release the IP address, the IPOE user terminal is placed in the offline state.

The third state maintenance module (1001) is configured to periodically send a status query message to the BRAS, and perform state switching on the IPOE user terminal according to the status of the IPOE user terminal in the received status query response message.

14. A broadband remote access server BRAS, comprising:

a second receiving module (1101), configured to receive, by using a virtual private network VPN tunnel, an Ethernet-based Internet Protocol IPOE authentication information sent by a carrier edge device PE;

a second authentication module (1102), configured to perform secondary authentication on the IPOE user terminal according to the IPOE negotiation authentication information;

The allocating module (1103) is configured to allocate an IP address to the IPOE user terminal after the secondary authentication succeeds.

15. The BRAS of claim 14 wherein:

The second receiving module (1101) includes: a third receiving sub-module (1201), configured to receive, by using a VPN tunnel, a first user packet sent by the PE, where the first packet of the user carries IPOE information;

The second authentication module (1102) includes:

The third authentication submodule (1202) is configured to perform secondary authentication on the IPOE user terminal according to the IPOE information in the first packet of the user received by the third receiving submodule.

16. The BRAS of claim 14 wherein:

The second receiving module (1101) includes:

The fourth receiving sub-module (1301) is configured to receive the user information sent by the PE through the VPN tunnel; the second authentication module (1102) includes:

The fourth authentication submodule (1302) is configured to perform secondary authentication on the IPOE user terminal according to the user information received by the fourth receiving submodule.

The BRAS according to claim 16, wherein the second authentication module (1102) further includes:

a user information processing sub-module (1401), configured to send an authentication re-negotiation indication to the IPOE user terminal after the user information received by the fourth receiving sub-module (1301) is encrypted information, The IPOE user terminal negotiates a key; decrypts the user information re-encrypted by the IPOE user terminal by using the negotiated key, and sends the decrypted user information to the fourth authentication sub-module (1302).

The BRAS according to any one of claims 14 to 17, wherein the BRAS further comprises:

The first state management module (1501) is configured to maintain a state of the IPOE user terminal in an Internet service provider ISP network.

a second state management module (1601), configured to: after the secondary authentication succeeds, set the state of the IPOE user terminal to an online state; after listening to the IPOE user terminal releasing the IP address, The state of the IPOE user terminal is the offline state.

The third state management module (1701) is configured to: after periodically receiving the status query message sent by the PE, carry the status of the IPOE user terminal maintained by the PE in the status query response message and return the status to the PE.

A system for accessing a wholesale network of services, comprising: the operator edge device PE (1801) according to any one of claims 8 to 13, and the broadband according to any one of claims 14 to 20. Remote access server BRAS (1802).