WO2012119386A1

WO2012119386A1 - Authentication method, device and system in access network

Info

Publication number: WO2012119386A1
Application number: PCT/CN2011/078317
Authority: WO
Inventors: 李克嘉; 赵胜涛
Original assignee: 华为技术有限公司
Priority date: 2011-08-12
Filing date: 2011-08-12
Publication date: 2012-09-13
Also published as: CN103392333A

Abstract

Provided are an authentication method, device and system in an access network. The method includes: sending a discovery message to a plurality of authentication server; receiving a response message from an authentication servers, obtaining from the response message the MAC address of the authentication server sending the same, and storing the obtained MAC address of the authentication server in an authentication server list; receiving a discovery message from a user terminal, selecting one MAC address from a plurality of MAC addresses in the authentication server list, and sending the discovery message from the user terminal to the corresponding authentication server according to the selected MAC address so as to authenticate the user terminal.

Description

Authentication method, device and system in access network

The present invention relates to the field of communications, and in particular, to an authentication method, device, and system in an access network. Background technique

In broadband access authentication, there are two methods widely used: Ethernet over IP (IPOE) and Ethernet bearer-to-peer protocol (PPPOE).

The IPOE mode authentication is mainly implemented by the Dynamic Host Configuration Protocol (DHCP). DHCP was originally mainly used for local area network (LAN) applications. Through the DHCP client on the user terminal, the automatic discovery mechanism was used to try to contact the DHCP server on the network.

When the DHCP client logs in to the network for the first time, it sends a DHCP DISCOVER packet to the network. Since the DHCP client does not know which network it belongs to, the source address of the DHCP DISCOVER packet is 0.0.0.0 and the destination address. Then it is 255.255.255.255, and then attach the information of DHCP discover to broadcast to the network.

When the DHCP server listens to the DHCP DISCOVER packet sent by the DHCP client, it selects the first vacant IP from the address range that has not yet been leased, and responds to the DHCP client with a DHCP. OFFER message, according to the DHCP server settings, the DHCP OFFER message will contain a lease term information.

If the DHCP client receives responses from multiple DHCP servers on the network, it will only pick one of the DHCP OFFERs (usually the one that arrived first) and will send a DHCP REQUEST message to the network, telling all DHCP servers that it will accept Which DHCP server provides the IP address.

DHCP itself does not have the function to be used for authentication, but DHCP can cooperate with other technologies to implement authentication, such as DHCP+WEB mode, DHCP+client mode, and use of DHCP+OPTION extension word. Segments are authenticated, all of which are collectively referred to as DHCP+ authentication. The OPTION fields used as DHCP extensions are mainly OPTION60 and OPTION82. The information of the Vendor and the Service Option in the OPTION60 is the information carried by the user terminal when the DHCP request is initiated. The network device only needs to transparently transmit. The function is to identify the type of the user terminal, thereby identifying the user service type, and the DHCP server. Different service IP addresses can be assigned accordingly. The OPTION82 information is inserted by the network device in the DHCP message sent by the user terminal, and is mainly used to identify the access location of the user terminal.

The PPPOE workflow consists of two P-segments for discovery and session.

In the Discovery P segment, the client host broadcasts a PADI message with the destination address being the broadcast address of the Ethernet network, the CODE field value being 0x09, and the SESSION-ID field value being 0x0000. PADI is used to make the requested services to the access server.

The access server receives the PADI message and sends a PADO message in response to the request. The value of the CODE field is 0x07, and the value of the SESSION-ID field is still 0x0000. PADO contains a tag for the access server name type and one or more service name type tags indicating the types of services that can be provided to the client host.

The client host selects a suitable PADO in multiple PADO packets that may be received, and then sends a PPPOE valid discovery request PADR message to the selected access server, where the CODE field is 0x19, and the SESSIONJD field value is still 0x0000. The PADR must contain a service name type tag that determines the type of service requested from the access server.

After receiving the PADR packet, the access server prepares to start the PPP session. It sends a PPPOE valid discovery session to acknowledge the PADS packet. The value of the CODE field is 0x65, and the value of the SESSION-ID field is a unique PPPOE session identification number generated by the access server. When the client host receives the PADS confirmation, both parties enter the PPP session phase.

Since multiple DHCP servers or BRASs are often used in the network, when IPOE or PPPOE is used for access authentication, when a user dials, all the servers that receive the request message (DHCP DISCOVER or PADI) will send a response message. (DHCP OFFER or PADO). The user terminal often selects the first received DHCP OFFER or PADO for subsequent sessions. Which DHCP server or BRAS the user terminal selects for subsequent authentication depends entirely on which server's response message arrives first, and cannot actively take the initiative. Control, in actual use, subject to network transfer The influence of objective factors such as delay can not achieve the effect of "even burden", which is easy to cause most users to concentrate on a certain server. Summary of the invention

An embodiment of the present invention provides an authentication method in an access network, where the access network includes multiple authentication servers, and the method includes:

Sending a discovery message to the plurality of authentication servers;

Receiving a response packet of the authentication server, obtaining a MAC address of the authentication server that sends the response packet from the response packet, and storing the obtained MAC address of the authentication server in the authentication server list;

Receiving a discovery message from the user terminal, selecting a MAC address from the plurality of MAC addresses of the authentication server list, and sending the discovery message from the user terminal to the corresponding authentication server according to the selected MAC address to The user terminal performs authentication. An embodiment of the present invention provides an access device, where the access device is connected to multiple authentication servers, and the access device includes:

a first network side port, configured to send a discovery packet to the multiple authentication servers;

a second network-side port, configured to receive a response packet of the authentication server, obtain a MAC address of the authentication server that sends the response packet from the response packet, and store the obtained MAC address of the authentication server in the authentication server list. ;

The packet processing unit receives the discovery packet from the user terminal, selects one MAC address from the plurality of MAC addresses of the authentication server list, and sends the discovery packet from the user terminal to the corresponding authentication according to the selected MAC address. The server authenticates the user terminal. An embodiment of the present invention provides an authentication system in an access network, including an access device and multiple authentication servers, where the access device is connected to the multiple authentication servers.

The access device sends a discovery packet to the multiple authentication servers, receives a response packet from the authentication server, and obtains a MAC address of the authentication server that sends the response packet from the response packet. Storing the obtained MAC address of the authentication server in the authentication server list; receiving the discovery message from the user terminal, selecting one MAC address from the multiple MAC addresses of the authentication server list, and coming from the user according to the selected MAC address The discovery message of the terminal is sent to the corresponding authentication server to authenticate the user terminal.

The method, the device, and the device provided by the embodiment of the present invention are controlled by the access device, and can implement the controllable load sharing in multiple authentication servers. The unicast of the discovery packet of the user terminal to the corresponding authentication server is performed. , can eliminate too many OFFER messages, reducing the waste of bandwidth and CPU resources. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments or the description of the prior art will be briefly described below, and obviously, in the following description The drawings are only some of the embodiments of the present invention, and other drawings may be obtained from those skilled in the art without departing from the drawings.

FIG. 1 is a network architecture diagram according to an embodiment of the present invention;

2 is a flowchart of a method according to an embodiment of the present invention

FIG. 3 is an interaction diagram of a method according to an embodiment of the present invention;

4 is an interaction diagram of a method according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an access device according to an embodiment of the present invention. Specific embodiment

BRIEF DESCRIPTION OF THE DRAWINGS The technical solutions in the embodiments of the present invention will be described in detail with reference to the accompanying drawings. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative work are within the scope of the present invention. An embodiment of the present invention provides an authentication method in an access network, where the access network is as shown in FIG. 1. In FIG. 1, the access device 10 is connected to multiple authentication servers 20, 22, and 24.

A flowchart of the method provided in this embodiment is shown in FIG. 2, and includes: Step 200: Send a discovery packet to the multiple authentication servers.

In this embodiment, the access device 10 may send a DHCP-based discovery message or a PPPOE-based discovery message to multiple authentication servers 20, 22, and 24.

Step 202: Receive a response packet of the authentication server, obtain a MAC address of the authentication server from the response packet, and store the obtained MAC address in the authentication server list.

Step 204: Receive a discovery message from the user terminal, select a MAC address from multiple MAC addresses in the authentication server list, and send the discovery message from the user terminal to the corresponding authentication server for authentication.

Specifically, the access device may select one MAC address from the multiple MAC addresses according to the port attribute of the connection user terminal, the weight attribute of the authentication server, the parity of the MAC address of the authentication server, and a combination of one or more of the Hash algorithms. .

The method provided by the embodiment of the present invention can effectively implement the controllable load sharing in multiple authentication servers. The unicasting of the discovery message of the user terminal to the corresponding authentication server can eliminate excessive response packets. Reduce bandwidth and waste of CPU resources. Specifically, an embodiment of the present invention provides an authentication method in an access network, where the access network is as shown in FIG. 1. In FIG. 1, the authentication server is a DHCP server.

The method includes:

Step 300: The access device constructs a DHCP DISCOVER message to be broadcast in the network.

The source address of the DHCP DISCOVER packet constructed by the access device is 0.0.0.0, and the destination address is

Step 302: The access device receives the DHCP OFFER packet of the DHCP server, extracts the MAC address in the packet, and saves the MAC address in the authentication server list.

The structure of the authentication server list can be as follows:

The access device can also extract the IP address of the DHCP server from the DHCP OFFER packet. The IP address obtained is saved in the list of authentication servers.

Step 304: The access device receives the DHCP DISCOVER message sent by the user terminal; the source address of the DHCP DISCOVER message from the user terminal is 0.0.0.0, and the destination address is

Step 306: Select a MAC address from the list of authentication servers, and send the DHCP DSCOVER packet from the user terminal to the corresponding DHCP server.

Specifically, the access device replaces the destination address of the DHCP DISCOVER packet of the user terminal with the selected MAC address, and unicasts the DHCP DISCOVER text to the corresponding DHCP server. „In the specific selection, the access device may adopt an average allocation. For example, if the DHCP DISCOVER message of the first user terminal is unicast to the first DHCP server, the DHCP DISCOVER message of the second user terminal is unicast to the second DHCP server, and so on.

The access device may also be based on the weight attribute of the DHCP server. For example, a weight value is set for each DHCP server, and the weight is divided according to the weight value. For example, if the weight of the DHCP server 30 is 2, the DHCP server sends a DHCP DISCOVER packet to the next DHCP server.

The access device may also select a corresponding DHCP server according to the parity of the port that receives the DHCP DISCOVER message. The policy needs to configure the correspondence between the port parity and the MAC address of the DHCP server on the access device in advance. .

The access device can also adopt the Hash algorithm to select a MAC address according to the result of the Hash algorithm. This policy needs to configure the correspondence between the Hash algorithm result and the MAC on the access device.

The access device can also adopt the method of time sharing. For example, if a DHCP server is selected first, the DHCP DISCOVER packet of the user terminal is sent to the DHCP server. If the OFFER packet of the DHCP server is not received within a certain period of time, the switch is switched. Go to the next DHCP Server.

The method provided in this embodiment may further include:

Step 308: Regularly broadcast a DHCP DISCOVER message or send a Ping detection message, and update the authentication server list according to the received response message.

The time when the access device periodically broadcasts DHCP DISCOVER packets can be set, for example, once every hour, and the list of authentication servers is updated according to the received OFFER packets.

The access device can also ping the DHCP server in the authentication server list. Specifically, you can set a counter to send ping probe packets to each DHCP server. The number of response timeouts of the server is counted. If the access device receives a response message from a DHCP server, the counter is cleared and the ping detection of the DHCP server is stopped. If the response is not received for a certain period of time (such as 5 seconds) The DHCP server response message adds 1 to the counter and continues to send the Ping probe. If the response timeout count exceeds 3 times, the DHCP server is considered to be in an abnormal state.

When the access device determines that a DHCP server is in an abnormal state, the user terminal that is in the DHCP server is notified to re-apply for an IP address. The access device may send a ForceRenew packet to the user terminal to notify the user terminal to release the applied application. IP address and re-apply for an IP address.

The authentication method provided in this embodiment obtains the MAC address of the DHCP server by constructing a DHCP DISCOVER message, and after receiving the DHCP DISCOVER message of the user terminal, the DHCP DISCOVER message is unicast to a DHCP server, which can be effectively Controllable load sharing in the DHCP server can also eliminate excessive OFFER messages and reduce the waste of bandwidth and CPU resources. An embodiment of the present invention provides an authentication method. The method provided may be based on the architecture of FIG. 1. The authentication server in this embodiment may be a Broadband Remote Access Server (BRAS).

The methods provided include:

Step 400: The access device constructs a PADI message and broadcasts in the network.

PADI packet constructed by the access device. The destination address is the broadcast address of the Ethernet. The CODE field value is 0x09, and the SESSION-ID field value is 0x0000.

Step 402: The access device receives the responding PADO packet, obtains the MAC address of the BRAS, and saves the obtained MAC address in the authentication server list.

The list of authentication servers in this embodiment can be as follows:

Step 404: Receive a PADI message of the user terminal.

Step 406: Select a MAC address from the list of authentication servers, and receive the received PADI message. Forwarded to the corresponding BRAS;

After receiving the PADI message from the user terminal, the access device replaces the broadcast address in the PADI message with the selected MAC address and sends it to the corresponding BRAS.

In the specific selection, the access device may adopt an average allocation method, such as unicasting the PADI message of the first user terminal to the first BRAS, and unicasting the PADI message of the second user terminal to the second BRAS. , And so on.

The access device may also be based on the weight attribute of the BRAS, such as setting a weight value for each BRAS on the access device, and performing traffic distribution according to the weight value. For example, if the weight of the BRAS 30 is 2, the PRAS message is unicast twice to the BRAS 30 before switching to the next BRAS.

The access device may also select a corresponding BRAS according to the parity of the port that receives the PADI message. The policy needs to configure the correspondence between the port and the MAC of the BRAS on the access device.

The access device can also adopt the method of time sharing. For example, first select a BRAS, and send the PADI message of the user terminal to the BRAS. If the PADO packet of the BRAS is not received within a certain period of time, switch to the next BRAS. .

The access device can also select the corresponding MAC address according to the OPTION 60 information in the PADI message. This policy needs to configure the correspondence between the OPTION 60 and the MAC on the access device.

The method provided in this embodiment may further include:

Step 408: Send a Ping detection packet to the BRAS in the authentication server list, and update the authentication server list according to the response message of the BRAS.

Specifically, a counter is set to send a Ping probe packet to each BRAS, and the interval for sending the Ping detection packet may be 1 second, and the response timeout number of each BRAS is counted, if the access device receives a certain BRAS. The response message clears the counter and stops the ping detection of the BRAS; if the response message of the BRAS is not received after a certain time (such as 0.5 seconds), the counter is incremented by 1, and the ping detection packet is continuously sent. If the response timeout count exceeds 2 times, the BRAS is considered to be in an abnormal state.

When the access device determines that a certain BRAS is in an abnormal state, the MAC address of the corresponding BRAS is deleted from the authentication server list, and the user terminal belonging to the BRAS is notified to go offline again. Specifically, the access device sends the PADT to the user terminal. Message. The user terminal will enter after receiving the PADT message. Line redial.

The authentication method provided in this embodiment obtains the MAC address of the BRAS by constructing a PADI message, and after receiving the PADI message of the user terminal, unicasts the PADI message to a BRAS, which can be effectively implemented in multiple BRASs. Controlled load sharing can also eliminate excessive PADO packets, reducing bandwidth and CPU resource waste. An embodiment of the present invention provides an access device, where the access device is connected to multiple authentication servers, as shown in FIG. 5, including:

The first network side port 500 is configured to send a discovery packet to the multiple authentication servers.

The first network side port 500 can send a DHCP based discovery message or a PPPOE based discovery message to multiple authentication servers.

The second network side port 502 is configured to receive a response packet of the authentication server, obtain a MAC address of the authentication server that sends the response packet from the response packet, and store the obtained MAC address of the authentication server in the authentication server. List.

The first network side port 500 in this embodiment may be further configured to send a probe packet to the multiple authentication servers to detect the status of the multiple authentication servers, and refresh the list of the authentication servers according to the detection result.

Specifically, the ping probe packet is sent to multiple authentication servers, and the authentication server list is updated according to the response packet.

The first network side port 500 can also periodically broadcast a discovery message to the network, and update the authentication server list according to the response message.

The message processing unit 504 receives the discovery message from the user terminal, selects one MAC address from the plurality of MAC addresses of the authentication server list, and sends the discovery message from the user terminal to the corresponding one according to the selected MAC address. The authentication server authenticates the user terminal.

Specifically, the message processing unit 504 may: after receiving the discovery message from the user terminal, replace the broadcast address in the discovery message with the selected MAC address, and send the message to the corresponding authentication server.

The access device in this embodiment may be a Digital Subscriber Line Access Multiplexer (DSLAM), an Optical Line Terminal (OLT), or an Integrated Service Access Network (Multi-Service Access Network). , MSAN) equipment, etc.

The access device provided in this embodiment acquires the MAC address of the authentication server by constructing the discovery packet. After receiving the discovery packet of the user terminal, the device unicasts the packet to an authentication server, which can effectively implement load balancing in multiple authentication servers and eliminate excessive response packets. Packets, reducing bandwidth and waste of CPU resources.

A person skilled in the art can understand that all or part of the steps of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, such as ROM/RAM, magnetic. Disc or CD.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. The scope of protection of the present invention should be construed as the scope of protection of the present invention.

Claims

Claim

An authentication method in an access network, where the access network includes multiple authentication servers, and the method includes:

Sending a discovery message to the plurality of authentication servers;

Receiving a response packet of the authentication server, obtaining a media access control MAC address of the authentication server that sends the response packet from the response packet, and storing the obtained MAC address of the authentication server in the authentication server list;

Receiving a discovery message from the user terminal, selecting a MAC address from the plurality of MAC addresses of the authentication server list, and sending the discovery message from the user terminal to the corresponding authentication server according to the selected MAC address to The user terminal performs authentication.

The method according to claim 1, wherein the discovery message is a discovery message based on a dynamic host configuration protocol (DHCP) or a discovery message based on an Ethernet bearer point-to-point PPPoE protocol.

The method according to claim 1 or 2, wherein the sending the discovery message from the user terminal to the corresponding authentication server to authenticate the user terminal according to the selected MAC address comprises:

And replacing the broadcast address in the discovery packet from the user terminal with the selected MAC address, and sending the discovery message from the user to the corresponding authentication server according to the selected MAC address to authenticate the user terminal.

The method according to any one of claims 1-3, wherein the method further comprises: broadcasting a probe packet, and refreshing the authentication server list according to the response packet of the probe packet.

The method according to claim 4, wherein the method further comprises:

When it is determined that an authentication server is abnormal, the user terminal that belongs to the authentication server that handles the abnormal state is notified to re-apply for an IP address.

The method according to any one of claims 1-3, wherein selecting one of the plurality of MAC addresses of the authentication server list comprises:

The authentication service is based on a combination of one or more of a port attribute of the user terminal, a weight attribute of the authentication server, a parity of a MAC address of the authentication server, and a hash algorithm. One of the multiple MAC addresses of the server list is selected.

The method according to claim 2, wherein, when the discovery message is based on DHCP, selecting one MAC address from a plurality of MAC addresses of the authentication server list, selecting one MAC address.

An access device, where the access device is connected to multiple authentication servers, the access device includes:

a second network side port, configured to receive a response packet of the authentication server, obtain a media access control MAC address of the authentication server that sends the response message from the response packet, and store the obtained MAC address of the authentication server in the In the list of authentication servers;

The packet processing unit receives the discovery packet from the user terminal, selects one MAC address from the plurality of MAC addresses of the authentication server list, and sends the discovery packet from the user terminal to the corresponding authentication according to the selected MAC address. The server authenticates the user terminal.

The access device according to claim 8, wherein the first network side port is further configured to send a probe message to the plurality of authentication servers to detect a status of the multiple authentication servers. And refreshing the list of authentication servers according to the detection result.

An authentication system in an access network, comprising an access device and a plurality of authentication servers, wherein the access device is connected to the plurality of authentication servers, wherein

The access device sends a discovery packet to the plurality of authentication servers; receives a response packet from the authentication server, and obtains, by the response packet, a media access control MAC address of the authentication server that sends the response packet, Storing the obtained MAC address of the authentication server in the authentication server list; receiving the discovery message from the user terminal, selecting one MAC address from the multiple MAC addresses of the authentication server list, and coming from the user according to the selected MAC address The discovery message of the terminal is sent to the corresponding authentication server to authenticate the user terminal.