WO2012051868A1

WO2012051868A1 - Firewall policy distribution method, client, access server and system

Info

Publication number: WO2012051868A1
Application number: PCT/CN2011/075986
Authority: WO
Inventors: 万齐根
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-10-20
Filing date: 2011-06-20
Publication date: 2012-04-26
Also published as: CN101977187A; CN101977187B

Abstract

The present invention discloses a firewall policy distribution method, client, access server and system for broadband access protocols. The firewall policy distribution method includes: a client sends access protocol messages to an access server, wherein the access protocol messages carry the firewall policy configuration request information (S102); the client receives response messages which respond to the access protocol messages and are sent from the access server, wherein the response messages carry the firewall policy configuration response information corresponding to the access authority of the client (S104); and the client configures firewall rules of itself according to the firewall policy configuration response information (S106). The present invention realizes the distribution of firewall policies by utilizing network configuration interaction processes of the broadband access protocols and enables a client to configure the firewall rules of itself dynamically. With the utilization of the current broadband access protocols, the distribution of the firewall policies is very convenient and distribution resources are saved.

Description

The present invention relates to the field of communications, and in particular to a firewall policy distribution method, a client, an access server, and a system. BACKGROUND A firewall policy generally refers to restricting a user's access to certain information items or restricting the use of certain control functions by a user according to the user identity and the predefined domain to which the user belongs, so as to achieve the purpose of controlling the user network access control. rule. At present, there are two main schemes for access control of broadband access clients in network operation and maintenance: 1) Using network management software, using Tr069 (wide IP or network management protocol), SNMP (Simple Network Management Protocol) The network management protocol is used to manually configure the access control lists of different pre-defined domain clients. 2) Separately set up a firewall policy distribution server, access the client built-in channel and server communication, obtain firewall information, or server push firewall. Strategy. The above two solutions have some shortcomings: The first solution is time-consuming and labor-intensive, and the whole process requires manual operation; the second solution requires additional resource consumption, such as a firewall policy distribution server, and the client software must establish a built-in channel. SUMMARY OF THE INVENTION A primary object of the present invention is to provide a firewall policy distribution method, a client, an access server, and a system to at least solve the above problem of inconvenient distribution of firewall policies and requiring additional resources. According to an aspect of the present invention, a firewall policy distribution method is provided, including: a client sends an access protocol packet to an access server, where the access protocol packet carries a firewall policy configuration request message; The response message sent by the access server in response to the access protocol message, where the response message carries the firewall policy configuration response information corresponding to the access authority of the client; the client configures the response information according to the firewall policy configuration. Its own firewall rules. Before the client receives the response packet sent by the access server and responds to the access protocol packet, the method further includes: the access server acquiring the information of the client from the received access protocol packet, and determining, according to the information of the client, Client access rights, where the client information includes at least one of the following: media access control address MAC, carrier code, user classification code; access server will encapsulate the firewall policy configuration response information corresponding to the client's access rights In the response message, and sent to the client. Broadband access cut, negotiated for dynamic host configuration, and negotiate DHCP. The access protocol packet is a dynamic host configuration protocol discovery packet or a dynamic host configuration protocol request packet. The firewall policy configuration request information is encapsulated in an option of DHCP discovery or DHCP request. The response message is a dynamic host. The configuration of the configuration, the provision of the network or the configuration of the dynamic host, and the confirmation of the firewall policy configuration are encapsulated in the option of DHCP providing 4 or DHCP confirmation. After the client configures its own firewall rules according to the firewall policy configuration response information, the client also includes: During a predetermined time interval, the client sends a firewall policy renewal request to the access server, wherein the firewall policy renews the lease. The request message is used to request the access server to renew the firewall policy of the client; the client receives the firewall policy lease response message sent by the access server and responds to the firewall policy renewal request message; the client according to the firewall policy lease response report The article extends its configured firewall rules or invalidates its configured firewall rules. The broadband access protocol is the point-to-point protocol PPP. The access protocol packet is a peer-to-peer IP control protocol PPP IPCP configuration request packet, and the firewall policy configuration request information is encapsulated in the option of the PPP IPCP configuration request. The response message is a peer-to-peer IP control protocol PPP IPCP configuration response. The firewall policy configuration response information is encapsulated in the PPP IPCP configuration response option. According to another aspect of the present invention, a firewall policy distribution client is provided, including: a first sending module, configured to send an access protocol packet to an access server, where the access protocol packet carries a firewall policy The first receiving module is configured to receive the response from the access server, where the response message carries the firewall policy configuration response information corresponding to the access right of the client; the firewall module is set according to the firewall. The policy configuration response information configures the client's firewall rules. According to still another aspect of the present invention, a firewall policy distribution access server is provided, including: a second receiving module, configured to receive an access protocol message from a client, where the access protocol The packet carries the firewall policy configuration request information. The second sending module is configured to send a response packet to the client in response to the access protocol packet, where the response packet carries a firewall policy corresponding to the access authority of the client. Configuring the response information; the privilege module is configured to determine the access rights of the client according to the information of the client carried in the access protocol packet, where the information of the client is at least one of the following: MAC (Media Access Control) address information, Carrier Code Vendor ID, User Classification ID. According to a further aspect of the present invention, a firewall policy distribution system is provided, including: a client and an access server, where the client includes: a first sending module, configured to send an access protocol packet to the access server, The access protocol packet carries the firewall policy configuration request information. The first receiving module is configured to receive the response packet from the access server. The firewall module is configured to configure the firewall rule of the client according to the firewall policy configuration response information. The access server includes: a second receiving module, configured to receive an access protocol message from the client; and a second sending module, configured to send a response to the client in response to the access to the tenth message. The response module carries the firewall policy configuration response information corresponding to the client access right; the permission module is configured to determine the access authority of the client according to the information of the client carried in the access protocol packet, where the client information At least one of the following is included: MAC (Media Access Control) address information, carrier code Vendor ID, and user classification code User Classified ID. Through the invention, the network configuration interaction process of the broadband access protocol is used, and the access server distributes the firewall policy corresponding to the client's authority to the client, so that the client can automatically and dynamically configure its own firewall rule when the broadband access is performed. . The use of existing broadband access protocols makes the distribution of firewall policies very convenient and saves distribution resources. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a flowchart of a firewall policy distribution method according to an embodiment of the present invention; FIG. 2 is a block diagram showing a firewall policy distribution client according to an embodiment of the present invention; FIG. 4 is a structural block diagram of a firewall policy distribution system according to an embodiment of the present invention; 5 is a schematic diagram of a firewall policy distribution of a DHCP protocol according to an embodiment of the present invention; FIG. 6 is a schematic diagram of a packet format of a firewall option of a DHCP protocol according to an embodiment of the present invention; FIG. 7 is a PPP diagram of an embodiment of the present invention; Schematic diagram of the firewall policy distribution of the protocol; FIG. 8 is a schematic diagram showing the format of the PPP IPCP Configuration Request data in the embodiment of the present invention; FIG. 9 is a schematic diagram showing the format of the PPP IPCP Configuration NAK data in the embodiment of the present invention; FIG. 10 is a schematic diagram showing the format of a PPP IPCP firewall option data according to an embodiment of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. In a TCP/IP network, each host must have access to the network, and must first perform network access, such as IP address, subnet mask, gateway, DNS (Domain Name System, domain name). System) The configuration of these parameters is essential. These configuration information are carried in the option of the Broadband Access Protocol. For example, DHCP (Dynamic Host Configuration Protocol) Protocol, PPP IPCP (Point to point protocol Internet Protocol Control Protocol, 10 peer-to-peer discussions on the Internet 10 to control ten meetings). In the embodiment of the present invention, the firewall policy information is encapsulated in the option options of the access protocols in a certain format. When the client network accesses, the access server automatically distributes the firewall policy to different through the broadband access protocol. Levels, users of different predefined domains, make the distribution of firewall policies more direct and convenient. FIG. 1 is a flowchart of a method for distributing a firewall policy according to an embodiment of the present invention. As shown in FIG. 1, the method includes: Step S102: A client sends an access protocol packet to an access server, where an access protocol packet is used. Carrying firewall policy configuration request information. Step S104: The client receives the response packet sent by the access server and responds to the access protocol packet, where the response message carries the firewall policy configuration response information corresponding to the access authority of the client. Step S106, the client configures its own firewall rule according to the firewall policy configuration response information. In the above method, by using the network configuration interaction process of the broadband access protocol, the access server distributes the firewall policy corresponding to the client's authority to the client, so that the client can automatically and dynamically during the broadband access. Configure your own firewall rules. The use of existing broadband access protocols makes the distribution of firewall policies very convenient and saves distribution resources. FIG. 2 is a block diagram showing a structure of a firewall policy distribution client according to an embodiment of the present invention. As shown in FIG. 2, the client 100 includes: a first sending module 102, a first receiving module 104, and a firewall module 106. The first sending module 102 is connected to the first receiving module 104 and the firewall module 106, and the first sending module 102 is configured to send an access protocol packet to the access server, where the sent access protocol packet carries a firewall policy. The first receiving module 104 is configured to receive the response message from the access server, where the response message carries the firewall policy configuration response information corresponding to the access authority of the client; the firewall module 106 and the first The sending module 102 is connected to the first receiving module 104, and the firewall module 106 is configured to configure the firewall rules of the client by using the firewall policy configuration response information. Through the above-mentioned client, the firewall protocol configuration request information is carried in the access protocol packet, so that the firewall configuration is distributed by using the network configuration interaction process of the broadband access protocol, so that the client can automatically and dynamically configure its own firewall rule. . The use of existing broadband access protocols makes the distribution of firewall policies very convenient and saves distribution resources. FIG. 3 is a structural block diagram of a firewall policy distribution access server according to an embodiment of the present invention. As shown in FIG. 3, the access server 200 includes: a second sending module 202, a second receiving module 204, and a rights module 206. The second receiving module 204 is connected to the second sending module 202 and the privilege module 206, and the second receiving module 204 is configured to receive the access protocol packet from the client, where the access protocol packet carries the firewall policy configuration request information. The second sending module 204 is configured to send a response message to the client in response to the access protocol message, where the response message carries firewall policy configuration response information corresponding to the access authority of the client; The two sending module 202 is connected to the second receiving module 204. The privilege module 206 is configured to determine the access authority of the client according to the MAC address information of the client encapsulated in the access protocol packet. Through the foregoing access server, the firewall policy configuration response information corresponding to the access authority of the client is encapsulated in the response message of the access protocol, thereby implementing the firewall policy distribution by using the network configuration interaction process of the broadband access protocol. , allowing clients to automatically configure their own firewall rules dynamically. The use of existing broadband access protocols makes the distribution of firewall policies very convenient and saves distribution resources. FIG. 4 is a structural block diagram of a firewall policy distribution system according to an embodiment of the present invention. As shown in FIG. 4, the distribution system includes: a client 100 and an access server 200 coupled to each other, where the client 100 includes: The module 102 is configured to send an access protocol packet to the access server 200, where the access protocol packet carries firewall policy configuration request information, and the first receiving module 104 is configured to receive the response packet from the access server 200. The firewall module 106 is configured to configure the firewall rule of the client 100 according to the firewall policy configuration response information. The access server 200 includes: a second receiving module 204 configured to receive an access protocol message from the client 100; and a second sending module 202 configured to send a response to the client 100 in response to the access protocol message The message, wherein the response message carries firewall policy configuration response information corresponding to the access permission of the client 100; the permission module 206 is configured to determine the network access permission of the client 100 according to the MAC address information of the client 100. Through the foregoing distribution system, the firewall policy configuration request information and the firewall policy configuration response information are respectively encapsulated in the broadband access protocol packet and the response packet, so that the network configuration interaction process using the broadband access protocol will correspond to the client's authority. The firewall policy is distributed to the client so that the client can automatically and dynamically configure its own firewall rules when broadband access is available. The use of existing broadband access protocols makes the distribution of firewall policies very convenient and saves distribution resources. FIG. 5 is a schematic diagram of a firewall policy distribution process of a DHCP protocol according to an embodiment of the present invention. The terminal device includes a DHCP client and a firewall module, and the terminal device accesses the Internet through the DHCP mode. The interaction process between the terminal device and the DHCP server is as shown in FIG. 5: Steps S502 to S508 are the negotiation phase of the DHCP, and the negotiation process is a prior art. , not described in detail here. The difference is that, in this embodiment, the DHCP Discovery message and the DHCP Request message in the Parameter Request List of the DHCP Client are carried in the firewall request to request the DHCP server to send firewall information. Support for firewall options, you can ignore the option.

After receiving the DHCP Discovery and DHCP Request messages, the DHCP server checks the parameter request list and sends the corresponding firewall information to the firewall field in a certain format. The DHCP Request and DHCP ACK messages are sent to the DHCP client. After receiving the DHCP ACK, the DHCP client parses the firewall option area data, and the parsed data is transmitted to the firewall module in step S510. The firewall module executes the firewall rule on the terminal device, and the firewall rule is valid for half of the lease.

When the DHCP client is half of the lease time, the DHCP client sends a DHCP Request message to the DHCP server for renewal. The DHCP server performs a lease response through the DHCP ACK in step S514. If the lease renewal is successful, the DHCP client notifies the message in step S516. The firewall module extends the effective time of the corresponding firewall rule to half of the new lease time. If the lease renewal fails, the firewall rule is invalid, and the next round of DHCP interaction is performed. The interaction steps are the same as the above steps. The above-mentioned firewall renewal is performed in synchronization with the IP address renewal of the DHCP protocol in the actual application, but the firewall renewal option is added in the DHCP Request 4. In the above step S502, the DHCP Discovery message sent by the DHCP client carries the option55 option table. The p parameter request table parameter request list, the parameter request list includes: ^ subnet mask (option 1), gateway router (option 3), i or server name server (option 6), Host name host name ( option 12 ), domain name domain name ( option 15 ), time server server ( option 4 ), carrier code Vendor ID (option 60 ), user classification code (User category ID (option 77), In the embodiment, a firewall option option (130) is added to the option list. In the above step S504, the DHCP server replies to the DHCP Offer 4, providing DHCP. The corresponding request information of the client. In this embodiment, the DCHP client level is judged by the source MAC address or the Vendor ID or the User Classified ID and other host information, and the firewall information of the corresponding option 130 is provided. In the above step S508 to the step In SS510, after the DHCP Client receives the final ACK of the DHCP server, it will use the firewall in the DHCP option. Item information, dynamically configure client firewall FIG. 6 shows a schematic diagram of the packet format of the DHCP protocol firewall options embodiment of the present invention, shown in Figure 6:

The DHCP firewall option code is 130, which is 0x82, which occupies one byte. Of course, the signature can be any value that is not used in the range of 0-255 in the DHCP standard access protocol. The DHCP firewall option can include both firewall pass and reject. Two sub-options, the sub-option codes are 1 and 2, respectively, occupying one byte; the sub-option data length Len is 2 bytes; the firewall data is Len bytes. In the firewall data shown in this embodiment, the source address/subnet mask is 5 bytes, the port number is 2 bytes, the protocol is 2 bytes, and the destination address/subnet mask is 5 bytes. The length is 14 bytes. The IP address/subnet mask data is in a format similar to 192.168.1.0/24. In the above firewall option data, if a certain data area, such as source address/subnet mask, port number, protocol or destination port/subnet mask area is all 0, it means that it corresponds to any value, that is, any source address. / Subnet mask, any port number, any protocol, any destination port/subnet mask. Of course, each sub-option of the DHCP firewall can contain multiple consecutive rules, and the sub-option data length must be an integer multiple of 14 bytes. The firewall option is placed at the end of all DHCP options with the DHCP option terminator "Oxff". Figure 7 shows the firewall policy distribution of the PPP protocol according to the embodiment of the present invention. The implementation of the PPP protocol includes two phases of LCP (Link Control). Protocol, Link Control Protocol and NCP (Network Control Protocol) phase, the network configuration is reflected in the NCP phase, and the configuration of parameters such as DNS, WINS (Windows Internet Naming Server, Windows Internet Naming Server) The firewall policy for this example is distributed by adding two firewall options to the PPP client request: filter ( Accept ) 141 and filter ( DROP ) 142. The firewall options are 2 in length, including the option code and the length field. After the firewall option field is found in the received IPCP request, the PPP server judges the PPP client level by the source MAC address information, account information and other host information, and sends a PPP IPCP configuration NAK packet to the corresponding firewall. Option information; information format includes signature, length, and firewall data. When PP P client connection) After the IPCP configuration NAK, network parameters such as IP, DNS, WINS and firewall rules are automatically configured.

The implementation of the PPP protocol specifically includes the following steps: Step S702: The LCP negotiates, and the content of the negotiation includes an option defined in the RFC (Request For Comments) 1661. Step S704, after the LCP negotiation, the establishment phase is established, and the PAP (Password) is started.

Authentication Protocol, Password Authentication Protocol, or CHAP (Challenge Handshake Authentication Protocol). The PAP is a two-way handshake authentication and the password is plain text. The PAP authentication process is as follows: Send the user name with the password to the authenticator. The authenticator checks whether the user has the password, and then sends the corresponding response. CHAP is a three-way handshake authentication, and the password is ciphertext (key). The CHAP authentication is sent by the authenticator to randomly generate 4 , documents, which are given to be authenticated. The authenticated party encrypts the ciphertext with its own password using the MD5 (Message Digest Algorithm 5) algorithm, and the Authenticator encrypts the password and the random packet with the MD5 algorithm. The ciphertext of the two returns the response of the response according to the comparison result. In step S706, the network phase negotiation (NCP) is performed when the authentication succeeds, and the IPCP negotiation (such as the negotiation of the IP address and the DNS address, etc.) is mainly performed in the IP access. This embodiment adds firewall negotiation at this stage. Step S708, according to the result of the negotiation, the configuration of the firewall, and of course, the configuration of parameters such as an IP address and a DNS. Step S710, if the negotiation is successful, the link is established, and the network layer data packet can be transmitted. FIG. 8 is a schematic diagram showing the format of the PPP IPCP Configuration Request data in the embodiment of the present invention, as shown in FIG. 8: The signature of the 艮文 is 0x01, and the 艮文 is PPP IPCP configuration Request 4 ;文; The code is followed by the IP address option Option 1 (IP Address); Option 129 is the primary DNS address option; option 131 is the alternate DNS address option; the above options are consistent with the existing PPP IPCP protocol standard (refer to RFC 1877) „ In this embodiment, the option 141 and option 142 firewall options are added. Of course, the option number of the firewall option may be any value not used in the PPP access protocol; where option 141 represents a firewall accept option and option 142 represents a firewall. The Drop option. The option 141 and option 142 options both include the signature ( ) field and the length ( Len ) field. The code and Len fields are 2 bytes in total. When requested, the code of the option 141 and option 142 options and the data of the Len field are selected. The default is 0, which means that the client requests the firewall information of the server. Figure 9 shows the PPP IPCP Config of the embodiment of the present invention. The uration NAK data 4 艮 text format diagram, in the PPP protocol, the access server transmits the configuration information to the client through the PPP IPCP Configuration NAK 4 , text, PPP IPCP Configuration NAK data message format is shown in Figure 9: The feature code is 0x03 for the IPCP configuration NAK 4艮, and the signature code is followed by the configuration data field, for example, the IP Address field, the primary DNS address field, and the alternate DNS address i or. In this embodiment, Option 141 and option 142 firewall option data i or , and include the length of the respective option. The data format of the firewall option area is: firewall option signature 1 byte (141 or 142), suboption data length 1 byte, and firewall data Len-2 bytes. FIG. 10 is a schematic diagram showing the format of the PPP IPCP firewall option data in the embodiment of the present invention. As shown in FIG. 10, the specific format of the firewall data option is as follows: The firewall data is the source address/subnet mask (5) Byte), Port number (2 bytes), Protocol (2 bytes), Destination address/Subnet mask (5 bytes), 14 bytes total.

The IP address/subnet mask data is similar to the 192.168.1.0/24 format. The firewall option data length Len-2 must be an integer multiple of 14. The firewall option can contain multiple consecutive rules, firewall option data, and some data. For example, if the source address/subnet mask, port number, protocol, or destination port/subnet mask area is all 0, it means that it corresponds to any value, that is, any source address/subnet mask, any port number. , any protocol, any destination port/subnet mask. In the above embodiment, the access server can manage the access of the broadband access client to the special service by: the broadband access protocol i3⁄4J server side will have special services (such as MSN, QQ, P2P, special website, etc.) The common server address is filled in with the destination IP address of the response message. The common port is filled in the port number area, and the protocol is filled in the protocol area. The firewall option code is 0x82. If the server does not have firewall option data, it means that these services are allowed by default, and if the server has a firewall rejection option (DROP), it means to reject these services. The automatic configuration of the firewall policy in the foregoing embodiment includes the access control of the access layer to the upper layer network, and the access of the downstream device to the access end. By controlling the control of the access device by the downstream device, it is possible to control the multi-user NAT (Network Address Translate) to share the Internet. Generally, the access terminal needs to allocate an address to the downstream, and the server replies with a single source IP address or a source IP address range in the address pool to fill the source IP address field; the client configures according to the reply packet. Single-user or single-address access to the access end to achieve the purpose of controlling multi-user shared Internet access. Through the above-mentioned embodiments of the present invention, the network configuration process of the broadband access protocol is used to distribute the firewall policy, and the firewall rules of different levels of clients are dynamically configured when the client accesses the broadband, and the firewall policy can be conveniently implemented. Distribution can save resources. In addition, through the above embodiments of the present invention, a simple method for opening and closing a specific service is also provided. And control the client's system to support the capacity of the access host, providing a way to control multi-user shared Internet access. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A firewall policy distribution method for a broadband access protocol, comprising:

The client sends an access protocol packet to the access server, where the access protocol packet carries firewall policy configuration request information;

The client receives a response message sent by the access server in response to the access protocol message, where the response message carries a firewall policy configuration corresponding to the access right of the client. Response information

The client configures its own firewall rules according to the firewall policy configuration response information.

2. The firewall policy distribution method according to claim 1, wherein the method further comprises, before the client receives a response message sent by the access server in response to the access protocol message Includes:

The access server obtains the information of the client from the received access protocol packet, and determines the access authority of the client according to the information of the client, where the information of the client includes at least one of the following : media access control address MAC, carrier code, user classification code;

The access server encapsulates the firewall policy configuration response information corresponding to the access authority of the client in the response message and sends the response to the client.

The firewall policy distribution method according to claim 2, wherein the broadband access protocol is a dynamic host configuration switch and a DHCP policy.

The firewall policy distribution method according to claim 3, wherein the access protocol protocol is a dynamic host configuration protocol discovery protocol or a dynamic host configuration protocol request message, and the firewall policy configuration The request information is encapsulated in an option of the DHCP discovery or the DHCP request message; the response message provides a dynamic host configuration protocol or a dynamic host configuration protocol confirmation message, and the firewall policy configuration The response information is encapsulated in an option of the DHCP offer message or the DHCP acknowledgement message.

The firewall policy distribution method according to claim 3, wherein after the client configures its own firewall rule according to the firewall policy configuration response information, the method further includes: During a predetermined time interval, the client sends a firewall policy renewal request to the access server, where the firewall policy renewal request is used to send to the access server The server requests to renew the firewall policy of the client; the client receives a firewall policy lease response message sent by the server in response to the firewall policy renewal request message;

The client extends the configured firewall rules or invalidates the configured firewall rules according to the firewall policy lease response message.

The firewall policy distribution method according to claim 2, wherein the broadband access protocol is a point-to-point protocol PPP.

The firewall policy distribution method according to claim 6, wherein the access protocol protocol is a point-to-point IP control protocol PPP IPCP configuration request message, and the firewall policy configuration request information is encapsulated in the PPP IPCP configuration. In the option of requesting a message, the response is a point-to-point IP control, and the PPP IPCP configuration response message is encapsulated in the PPP IPCP configuration response.

8. A firewall policy distribution client for broadband access protocols, including:

The first sending module is configured to send an access protocol packet to the access server, where the access protocol carries the firewall policy configuration request information;

The first receiving module is configured to receive the response packet from the access server, where the response packet carries firewall policy configuration response information corresponding to the access authority of the client;

The firewall module is configured to configure the firewall rule of the client according to the firewall policy configuration response information.

A firewall policy distribution access server for a broadband access protocol, comprising: a second receiving module, configured to receive an access protocol message from the client, where the access protocol is The document carries firewall policy configuration request information;

The second sending module is configured to send a response packet to the client in response to the access protocol packet, where the response packet carries a firewall policy configuration response message corresponding to the access authority of the client. ; The privilege module is configured to determine the access authority of the client according to the information about the client carried in the access protocol packet, where the information of the client includes at least one of the following: a media access control address MAC, an operator Code, user classification code. A firewall policy distribution system for a broadband access protocol, including a client and an access server,

The client includes:

a first receiving module, configured to receive the response message from the access server; and a firewall module configured to configure a firewall rule of the client according to the firewall policy configuration response information;

The access server includes:

a second receiving module, configured to receive the access protocol packet from the client, where the second sending module is configured to send the response packet in response to the access protocol message to the client, The response packet carries firewall policy configuration response information corresponding to the client access right;

The privilege module is configured to determine the access right of the client according to the information about the client carried in the access protocol packet, where the information of the client includes at least one of the following: a media access control address MAC, a carrier code , user classification code.