WO2012142867A1

WO2012142867A1 - Authentication notification method and system

Info

Publication number: WO2012142867A1
Application number: PCT/CN2012/071293
Authority: WO
Inventors: 尤建洁
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-04-21
Filing date: 2012-02-17
Publication date: 2012-10-26
Also published as: CN102752746A; CN102752746B

Abstract

Disclosed are an authentication notification method and system. The method includes: when user equipment (UE) accesses a broadband forum (BBF) access network and passes authentication, an authentication, authorization and accounting unit (AAA) of the BBF sending the media access control (MAC) address of the UE to a broadband network gateway (BNG) control device; or when the UE accesses the BBF access network and requests an IP address, the BNG checking whether or not the UE has passed authentication, and when determining that there is no authentication information about the UE, the BNG obtaining the authentication information about the UE from the AAA; or when the UE accesses the BBF access network and requests an IP address, a residential gateway (RG) checking whether or not the UE has passed authentication, and when determining that the UE has passed authentication, the RG notifying the BNG that the UE has passed authentication. According to the present solution, the BNG can learn whether or not the UE requesting access has passed authentication in time.

Description

Authentication notification method and system

The present invention relates to the field of mobile communications, and in particular, to an authentication notification method and system. Background technique

With the development of network technologies and the demand of users for services, terminals are gradually multi-modeled, and access to different types of access networks can be selected to carry diverse services. Different network connections have different characteristics and transmission capabilities to better meet the diverse needs of users. At present, multimode terminals can realize seamless connection between different types of wireless access networks, such as cellular universal mobile communication system (UMTS, Universal Mobile Telecommunications System), enhanced data rate GSM evolution technology (EDGE, Enhanced Data Rate for GSM Evolution), a seamless connection between General Packet Radio Service (GPRS) and Wireless Local Area Networks (WLAN) in IEEE 802.11. WLANs provide high data rates in a small range of homes and hotspots, while cellular networks offer greater flexibility and ubiquitous coverage, but at lower data rates; if combined with the advantages of both, users will Benefited from. Within the coverage of WLAN access points, multimode terminals use WLAN for data access and Voice over Internet Protocol (VoIP) applications, while also using overlapping cellular networks for voice calls or media access.

At present, the International Standards Organization is working on the standardization of network architecture. For example, the 3rd Generation Partnership Project (3GPP) defines the mobile network architecture. The Broadband Forum (BBF, Broadband Forum) defines a fixed network architecture; In the defined fixed network architecture, there are mainly two methods for authentication and address allocation after the user equipment (UE, User Equipment) accesses the BBF access network: 1 is a schematic flowchart of a method for authentication and address allocation in the prior art. As shown in FIG. 1, the UE sends an authentication packet to a broadband network gateway control device (BNG, Broadband Network Gatewny), and finally to authentication, authorization, and accounting. The AAA (Authentication Authorization Accounting) completes the authentication, and the dynamic host configuration protocol (DHCP) server assigns an IP address to the UE. The specific process is as follows:

The UE initiates a DHCP Discovery (DHCP Discovery) request message to the BNG, and the request message carries a selection field of code 60 (Option 60); the intermediate network device marks the selection field coded as 82 (Option 82) according to the relevant specification; then BNG Receive the request packet from the UE, mark Option 82, and forward the DHCP relay request packet to the DHCP server. After receiving the request packet from the UE, the DHCP server extracts the relevant information in the request packet, constructs the user name (User name) and the NAS port identifier (Nas-Port-ID) required for authentication, and sends it to the remote user dial-up authentication system. (RADIUS, Remote Authentication Dial In User Service) for authentication. RADIUS authenticates the UE. If the authentication fails, the ACK message is returned to the DHCP server. The DHCP server replies with a DHCP command to the BNG. If the authentication succeeds, the authentication information is sent back to the DHCP server. And carrying the relevant attributes of the UE; the DHCP server allocates a corresponding IP address to the UE according to different service information of the UE, and then the user can use the service normally; wherein, for different devices, the BNG may be a broadband remote access server (BRAS, Broadband) Remote Access Server) or Service Router (SR).

2 is a schematic flowchart of the authentication of the residential gateway (RG, Residence Gateway) in the prior art. As shown in FIG. 2, in the authentication process, the UE sends the authentication packet to the RG, and the RG encapsulates the authentication packet. , sent to the AAA; if the authentication is passed, the AAA will save the media access control address (MAC, Medium/Media Access Control) of the UE, and in the address allocation phase, the AAA assigns an IP address to the UE according to the MAC address.

The prior art has the following defects: In the authentication process, the UE sends the authentication packet to the RG. After the RG encapsulation process, the authentication message is sent to the AAA to complete the UE authentication (ie, the authentication passes through the mode in FIG. 2 without going through the BNG); however, in the address allocation phase, the DHCP server allocates the IP address to the user. In this case, since the BNG does not know whether the UE is authenticated, the DHCP server cannot be triggered to allocate an IP address to the UE. Summary of the invention

In view of this, the main purpose of the present invention is to provide an authentication notification method and system, and the BNG can know in time whether the UE requesting access has passed the authentication.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The present invention provides an authentication notification method, including:

When the UE accesses the Broadband Forum (BBF) access network and passes authentication, the BBF Authentication, Authorization, and Accounting Unit (AAA) transmits the MAC address of the UE to the Broadband Network Gateway Control Device (BNG).

In the above method, the method further includes:

When the UE requests an IP address, and the BNG determines that the UE passes the authentication, the BNG triggers a Dynamic Host Setup Protocol (DHCP) server to assign an IP address to the UE.

In the above method, the requesting IP address of the UE is: the UE requests an IPv6 address by using a Router Solicitation message, or the UE requests an IPv6 address through a DHCP Solicit (DHCP Solicit) request, or the UE discovers through DHCP (DHCP Discover 4) Request an IPv4 address.

When the UE accesses the BBF to access the network and requests the IP address, the BNG checks whether the UE passes the authentication. When the BNG determines that there is no authentication information of the UE, the BNG obtains the authentication information of the UE from the AAA.

In the above method, the method further includes:

After determining that the UE passes the authentication according to the authentication information, the BNG triggers the DHCP server to allocate an IP address for the UE. In the above method, the UE requests an IP address as:

The UE requests the IPv6 address through the Router Solicitation 4, or the UE requests the IPv6 address through the DHCP Solicit, or the UE requests the IPv4 address through the DHCP Discover 4 message.

When the UE accesses the BBF to access the network and requests the IP address, the residential gateway (RG) checks whether the UE passes the authentication. When it is determined that the UE passes the authentication, the RG notifies the BNG that the UE passes the authentication.

In the above method, the method further includes:

The BNG triggers the DHCP server to assign an IP address to the UE.

In the above method,

The UE requests the IP address as follows: the UE requests the IPv4 address through the DHCP Discover message; the RG notifies the BNG that the UE is authenticated as: The RG sends the DHCP Discover message to the BNG.

The invention provides an authentication notification system, including: BBF AAA and BNG; wherein, the BBF AAA is used to send the MAC address of the UE to the BNG when the UE accesses the BBF access network and passes the authentication;

BNG, used to receive the MAC address of the UE.

In the above system,

The BNG is further configured to: when the UE requests an IP address, and determine that the UE passes the authentication, trigger the DHCP server to allocate an IP address to the UE.

The present invention provides an authentication notification system, including: BNG and AAA;

The BNG is configured to: when the UE accesses the BBF to access the network, and requests the IP address, check whether the UE passes the authentication, and when it is determined that there is no authentication information of the UE, obtain the authentication information of the UE from the AAA;

AAA, used to provide the UE with authentication information for the BNG. In the above system, the BNG is further configured to: when determining that the UE passes the authentication according to the authentication information, trigger the DHCP server to allocate an IP address for the UE.

The present invention provides an authentication notification system, including: RG and BNG;

RG, configured to: when the UE accesses the BBF to access the network, and requests the IP address, check whether the UE passes the authentication, and when it is determined that the UE passes the authentication, notify the BNG that the UE passes the authentication;

The BNG is configured to receive a notification that the UE passes the authentication.

In the above system, the BNG is further configured to trigger a DHCP server to allocate an IP address to the UE.

The authentication notification method and system provided by the present invention, when the UE accesses the BBF access network and passes the authentication, the BBF AAA sends the MAC address of the UE to the BNG; or when the UE accesses the BBF access network and requests the IP address, the BNG check Whether the UE passes the authentication, and when the BNG determines that there is no authentication information of the UE, the UE obtains the authentication information of the UE from the AAA; or when the UE accesses the BBF access network and requests the IP address, the RG checks whether the UE passes the authentication. When it is determined that the UE is authenticated, the RG notifies the BNG that the UE passes the authentication, so the BNG may receive the UE's MAC address from the AAA, or query the UE's authentication information, or receive the UE's notification of the UE's authentication through the RG. If the UE is authenticated, the DHCP server can be triggered to allocate an IP address to the UE in time.

After the UE sends the authentication packet to the RG, the authentication packet is sent to the AAA to complete the UE through the RG encapsulation process, that is, the authentication process does not pass through the BNG, and the technical solution proposed in the present invention can still be implemented. The DHCP server allocates an IP address to the UE to further compensate for the deficiencies in the prior art. DRAWINGS

1 is a schematic flow chart of a method for authentication and address allocation in the prior art;

2 is a schematic flow chart of authentication in the prior art via RG;

3 is a schematic flowchart of Embodiment 1 of an authentication notification method according to the present invention; 4 is a schematic flowchart of Embodiment 2 of the method for implementing the authentication notification according to the present invention; FIG. 5 is a schematic flowchart of Embodiment 3 of the method for implementing the authentication notification according to the present invention;

6 is a schematic flowchart of Embodiment 4 of implementing an authentication notification method according to the present invention;

7 is a schematic flowchart of Embodiment 5 of implementing an authentication notification method according to the present invention;

8 is a schematic flowchart of Embodiment 6 of the method for implementing authentication in the present invention;

9 is a schematic flowchart of Embodiment 7 of the method for implementing authentication in the present invention;

FIG. 10 is a schematic flowchart of Embodiment 8 of an authentication notification method according to the present invention; FIG.

11 is a schematic structural diagram of Embodiment 1 of implementing an authentication notification system according to the present invention;

12 is a schematic structural diagram of Embodiment 2 of implementing an authentication notification system according to the present invention;

FIG. 13 is a schematic structural diagram of Embodiment 3 of implementing an authentication notification system according to the present invention. detailed description

The basic idea of the present invention is: when the UE accesses the BBF access network and passes the authentication, the BBF AAA sends the MAC address of the UE to the BNG; or when the UE accesses the BBF access network and requests the IP address, the BNG checks the UE. Whether the authentication is performed, when the BNG determines that there is no authentication information of the UE, and obtains the authentication information of the UE from the AAA; or when the UE accesses the BBF access network and requests the IP address, the RG checks whether the UE passes the authentication, when determining When the UE passes the authentication, the RG notifies the BNG that the UE passes the authentication.

The invention will be further described in detail below with reference to the drawings and specific embodiments.

The present invention provides a method for the authentication notification. FIG. 3 is a schematic flowchart of the first embodiment of the method for implementing the authentication notification according to the present invention. When a UE that is not a BBF accesses the BBF and accesses the network, the method includes the following steps:

Step 301: The RG interacts with the BBF AAA to complete the authentication.

Step 302: The non-BBF UE sends an authentication protocol start (EAPoL-Start) message to the RG, and performs authentication through the 802.1X protocol. Step 303: After receiving the EAPoL Start message sent by the UE, the RG sends an EAP Identity Request message to the UE, to notify the UE to report the username.

Step 304: After receiving the EAP Identity Request message sent by the RG, the UE sends an EAP Identity Response message to the RG, where the message carries the user name.

Step 305: The RG encapsulates the received EAP Identity Response message into a RADIUS Access Request message, and sends the RADIUS Access Request message to the BBF AAA.

Step 306: The BBF AAA forwards the RADIUS Access Request message received from the RG to the home AAA according to the Network Address Identifier (NAI).

Step 307: After receiving the RADIUS Access Request message sent by the BBF AAA, the Home AAA replies to the RADIUS Access Response message to the BBF AAA, where the message carries the EAP Identity Response message.

Step 308: The BBF AAA forwards the received RADIUS Access Response packet to the RG.

Step 309: The RG unblocks the EAP frame from the received RADIUS Access Response message, and sends the EAP frame to the UE.

Step 310: After receiving the EAP frame sent by the RG, the UE sends a packet to the RG, and the packet carries a Challenged Password.

Step 311: After receiving the packet replied by the UE, the RG encapsulates the EAP frame obtained by the decapsulation into a RADIUS Access Request message and sends the EAP frame to the BBF AAA, where the received Challenged Password is carried.

Step 312: The BBF AAA forwards the received RADIUS Access Request message to the Home AAA.

Step 313: If the UE requesting access to the BBF access network passes the authentication, the Home AAA The RADIUS Access Accept message is sent to the BBF AAA. If the UE requesting access to the BBF access network does not pass the authentication, the RADIUS Access Accept message is not returned to the BBF AAA, and the process ends.

Step 314: The BBF AAA forwards the RADIUS Access Accept message to the RG.

Step 315, the BBF AAA sends the MAC address of the authenticated UE to the BNG, where

The BBF AAA sends the MAC address of the authenticated UE to the BNG to inform the BNG that the UE has passed the authentication, so that when the BNG receives the IP address request from the UE, the DHCP server can be triggered to perform IP address allocation.

Step 316: The RG decapsulates the EAP frame and sends an EAP Success message to the UE.

4 is a schematic flowchart of Embodiment 2 of the method for implementing the authentication notification according to the present invention. On the basis of the first embodiment, when the UE requests an IPv6 address through a Router Solicitation message, and the BNG determines that the UE passes the authentication, the BNG triggers. A specific implementation method for the DHCP server to allocate an IPv6 address to the UE. As shown in FIG. 4, the method includes the following steps:

Step 401: The UE sends a Router Solicitation message to the BNG, where the MAC address of the UE is carried.

Step 402: After receiving the Router Solicitation message, the BNG checks whether the MAC address of the UE is authenticated. If the authentication succeeds, the DHCP Request message is sent to the DHCP server to trigger the DHCP server to allocate an IP address to the UE. If the authentication is not passed, the BNG sends a reject message to the UE, and the process ends.

Step 403, after being triggered, DHCP server returns a DHCP response (DHCP the Reply) message to the BNG, packet carries the IPv6 address prefix {Frame-IPv ⁶ -Prefix}.

Step 404: After receiving the DHCP Reply message replied by the DHCP server, the BNG sends a Router Advertisement message to the UE, where the IPv6 address prefix {Frame-IPv6-Prefix} is carried. Step 405: The BNG sends a RADIUS Accounting Start message to the AAA. After receiving the RADIUS Accounting Start message, the AAA starts charging. The accounting can be used, for example, to count the user online time.

FIG. 5 is a schematic flowchart of Embodiment 3 of the method for implementing the authentication notification according to the present invention. On the basis of the first embodiment, when the UE requests an IPv6 address through a DHCP Solicit message, and the BNG determines that the UE passes the authentication, the BNG triggers. A specific implementation method for the DHCP server to allocate an IPv6 address to the UE. As shown in FIG. 5, the method includes the following steps:

Step 501: The UE sends a DHCP Solicit message to the BNG, where the UE carries the MAC address of the UE.

Step 502: After receiving the DHCP Solicit message, the BNG checks whether the MAC address of the UE is authenticated. If the authentication is performed, the DHCP Solicit message is sent to the DHCP server. If the authentication fails, the BNG sends a reject message to the UE. Process.

Step 503: After receiving the DHCP Solicit message sent by the BNG, the DHCP server returns a DHCP Advertise message to the BNG.

Step 504: After receiving the DHCP Advertise message replied by the DHCP server, the BNG forwards the packet to the UE.

Step 505: After receiving the DHCP Advertise message sent by the BNG, the UE sends a DHCP Request message to the BNG.

Step 506: The BNG sends the DHCP Request message received from the UE to the DHCP server.

Step 507: After receiving the DHCP Request message sent by the BNG, the DHCP server sends a DHCP Reply message to the BNG, where the message carries an IPv6 address {Frame-IPv6-Address}.

After step 508, the server receives the DHCP reply DHCP Reply messages, the BNG forwards the DHCP Reply message to the UE, the packet is still carries the IPv6 address ^{{Frame-IPv 6 - Address}} .

Step 509, the BNG sends a RADIUS Accounting Start message to the AAA, and receives the packet. After the RADIUS Accounting Start packet, AAA starts accounting.

FIG. 6 is a schematic flowchart of Embodiment 4 of the method for implementing an authentication notification according to the present invention. On the basis of Embodiment 1, when a UE requests an IPv4 address through DHCP Discovery (DHCP Discover), and the BNG determines that the UE passes the authentication, the BNG is determined. A specific implementation method for triggering a DHCP server to allocate an IPv4 address to the UE is as follows: As shown in FIG. 6, the method includes the following steps:

Step 601: The UE sends a broadcast DHCP Discover message on the physical subnet for searching for an available DHCP server.

Step 602: The DHCP Discover message is a broadcast message, so the RG can receive the message from the UE, and the RG forwards the received DHCP Discover message to the BNG.

Step 603: The BNG checks whether the MAC address of the UE is authenticated. If the authentication is successful, the BNG sends the received DHCP Discover message to the DHCP server. If the authentication fails, the BNG sends the rejected message to the UE through the RG. End the process.

Step 604: After receiving the DHCP Discover message, the DHCP server is equivalent to receiving an IP lease request from the BNG for the DHCP server, so the DHCP server provides an IP lease and reserves an IP address for the UE, and then replies to the BNG. DHCP Request message, which carries the IPv4 address {IPv4 Address}.

Step 605: After receiving the DHCP Offer message replied by the DHCP server, the BNG forwards the packet to the RG, which still carries the IPv4 address {IPv4 Address}.

Here, when the UE requests an IP address, the IP address returned by the BNG to the UE is an IPv6 address or the IPv4 address is determined according to the protocol type.

Step 606: After receiving the DHCP Offer message sent by the BNG, the RG sends a DHCP Offer message to the UE, where the IPv4 address {IPv4 Address} is carried.

Step 607: The UE sends a DHCP Request message to the RG and all other DHCP servers, where the IP of the DPCH server that provides the IP lease is used to notify all other DHCP servers that they have accepted an IP lease. Step 608: The RG forwards the DHCP Request message received by the UE to the BNG.

Step 609: After receiving the DHCP Request message, the BNG sends a DHCP Request message to the DHCP server.

Step 610: After receiving the DHCP Request message sent by the BNG, the DHCP server returns a DHCP Ack (DHCP Ack) message to the BNG.

Step 611: After receiving the DHCP Ack reply from the DHCP server, the BNG replies to the DHCP Ack message to the RG.

Step 612, after receiving the DHCP Ack packet, the RG replies to the DHCP Ack packet to the UE. Step 613: The BNG sends a RADIUS Accounting Start packet to the AAA. After receiving the RADIUS Accounting Start packet, the AAA starts charging.

7 is a schematic flowchart of Embodiment 5 of the method for implementing an authentication notification according to the present invention. A non-BBF UE accesses a BBF access network, and requests an IPv6 address through a Router Solicitation message, and the BNG checks whether the UE passes the authentication. The UE obtains the authentication information of the UE, and obtains the authentication information of the UE from the AAA. After determining that the UE passes the authentication according to the authentication information, the BNG triggers the DHCP server to allocate an IPv6 address to the UE. As shown in FIG. 7, the method includes the following steps. :

Step 701: The UE sends a Router Solicitation message request to the BNG, where the MAC address of the UE is carried.

Step 702: After receiving the request for the Router Solicitation message sent by the UE, the BNG checks whether the MAC address of the UE is authenticated. The UE does not pass the authentication in advance, or the UE passes the authentication, but the AAA does not send the MAC address of the UE to the UE. BNG. Therefore, when the BNG checks whether the MAC address of the UE is authenticated, the BNG finds that there is no authentication information of the UE, that is, the BNG does not know whether the UE is authenticated, and the BNG sends an inquiry authentication information packet to the AAA, where the MAC address of the UE is carried. .

Step 703, after receiving the query authentication information packet sent by the BNG, the AAA according to the The MAC address is used to query the local authentication information of the UE corresponding to the MAC address, and the authentication information is sent to the BNG. The authentication information is that the UE passes the authentication and the UE does not pass the authentication.

Step 704: When the authentication information received by the BNG is that the UE passes the authentication, the BNG sends a DHCP Request message to the DPCH server. If the authentication fails, the BNG replies to the UE and rejects the response.

Step 705: After receiving the DHCP Request message sent by the BNG, the DHCP server returns a DHCP Reply message, which carries the IPv6 address prefix {Frame-IPv6-Prefix}.

Step 706: After receiving the DHCP Reply message replied by the DHCP server, the BNG sends a Router Advertisement message to the UE, where the IPv6 address prefix {Frame-IPv6-Prefix} is carried.

Step 707: The BNG sends a RADIUS Accounting Start packet to the AAA. After receiving the RADIUS Accounting Start packet, the AAA starts charging.

FIG. 8 is a schematic flowchart of Embodiment 6 of the method for implementing the authentication notification according to the present invention. The non-BBF UE accesses the BBF access network, requests the IPv6 address through the DHCP Solicit message, and the BNG checks whether the UE passes the authentication. The UE obtains the authentication information of the UE, and obtains the authentication information of the UE from the AAA. After determining that the UE passes the authentication according to the authentication information, the BNG triggers the DHCP server to allocate an IPv6 address to the UE. As shown in FIG. 8, the method includes the following steps. :

Step 801: The UE sends a DHCP Solicit message to the BNG, where the MAC address of the UE is carried.

Step 802: After receiving the Router Solicitation message sent by the UE, the BNG checks whether the MAC address of the UE is authenticated. The UE does not pass the authentication in advance, or the UE passes the authentication, but the AAA does not send the MAC address of the UE to the BNG. Therefore, when the BNG checks whether the MAC address of the UE is authenticated, the BNG finds that there is no authentication information of the UE, that is, the BNG does not know whether the UE is authenticated, and the BNG sends an inquiry authentication information packet to the AAA, where the BNG carries The MAC address of the UE.

Step 803: After receiving the query authentication information packet sent by the BNG, the AAA queries the locally stored authentication information of the UE corresponding to the MAC address according to the MAC address, and sends the authentication information to the BNG. The authentication information is the UE. Passed authentication and the UE did not pass the certification.

Step 804: When the authentication information received by the BNG is that the UE passes the authentication, the BNG sends a DHCP Solicit message to the DPCH server. If the authentication fails, the BNG replies to the UE rejecting the response message.

Step 805: After receiving the DHCP Solicit message sent by the BNG, the DHCP server returns a DHCP Advertise message to the BNG.

Step 806: After receiving the DHCP Advertise message replied by the DHCP server, the BNG forwards the DHCP Advertise message to the UE.

Step 807: After receiving the DHCP Advertise message sent by the BNG, the UE sends a DHCP Request message to the BNG.

Step 808: After receiving the DHCP Request message sent by the UE, the BNG sends the DHCP Request message to the DHCP server.

Step 809: After receiving the DHCP Request message sent by the BNG, the DHCP server sends a DHCP Reply message to the BNG, which carries the IPv6 address {Frame-IPv6-Address}.

Step 810: After receiving the DHCP Reply message replied by the DHCP server, the BNG sends a DHCP Reply message to the UE, which still carries the IPv6 address {Frame-IPv6-Address}.

Step 811: The BNG sends a RADIUS Accounting Start packet to the AAA. After receiving the RADIUS Accounting Start packet, the AAA starts charging.

FIG. 9 is a schematic flowchart of Embodiment 7 of the method for implementing the authentication notification according to the present invention. The non-BBF UE accesses the BBF access network, requests the IPv4 address through the DHCP Discover message, and the BNG checks whether the UE passes the authentication. When the authentication information of the UE is obtained, the authentication information of the UE is obtained from the AAA, and after determining that the UE passes the authentication according to the authentication information, the BNG is triggered. A specific implementation method for the DHCP server to allocate an IPv4 address to the UE. As shown in FIG. 9, the method includes the following steps:

Step 901: The UE sends a broadcast DHCP Discover message on the physical subnet for searching for an available DHCP server.

Step 902: The DHCP Discover message is a broadcast message, so the RG can receive the message from the UE, and the RG forwards the DHCP Discover message received by the UE to the BNG.

Step 903: After receiving the DHCP Discover message sent by the UE, the BNG checks whether the MAC address of the UE is authenticated. The UE does not pass the authentication in advance, or the UE passes the authentication, but the AAA does not send the MAC address of the UE to the BNG. Therefore, when the BNG checks whether the MAC address of the UE is authenticated, the BNG finds that there is no authentication information of the UE, that is, the BNG does not know whether the UE passes the authentication, and the BNG sends a query authentication information packet to the AAA, where the MAC address of the UE is carried.

Step 904: After receiving the query authentication information packet sent by the BNG, the AAA queries the locally stored authentication information of the UE corresponding to the MAC address according to the MAC address, and sends the authentication information to the BNG. The authentication information is the UE. Passed authentication and the UE did not pass the certification.

Step 905: When the authentication information received by the BNG is that the UE passes the authentication, the BNG sends the DHCP Discover message to the DHCP server. If the authentication fails, the BNG replies to the UE rejecting the response message.

Step 906: After receiving the DHCP Discover message, the DHCP server is equivalent to receiving the IP lease request from the BNG for the DHCP server, so the DHCP server provides an IP lease and reserves an IP address for the UE, and then replies to the BNG. DHCP Offer packet carrying the IPv4 address {IPv4 Address}.

Step 907: After receiving the DHCP Offer message replied by the DHCP server, the BNG forwards the packet to the RG, which still carries the IPv4 address {IPv4 Address}.

Step 908, after receiving the DHCP Offer message sent by the BNG, the RG replies to the DHCP with the UE. Offer message, which carries the IPv4 address {IPv4 Address}.

Step 909: The UE sends a DHCP Request message to the RG and all other DHCP servers, where the IP of the DPCH server providing the IP lease is used to notify all other DHCP servers that they have accepted an IP lease.

Step 910: The RG forwards the DHCP Request message received by the UE to the BNG.

Step 911: After receiving the DHCP Request message, the BNG sends a DHCP Request message to the DHCP server.

Step 912: After receiving the DHCP Request message sent by the BNG, the DHCP server returns a DHCP Ack message to the BNG.

Step 913: After receiving the DHCP Ack reply from the DHCP server, the BNG replies to the DHCP Ack message to the RG.

Step 914: After receiving the DHCP Ack packet, the RG replies to the DHCP Ack packet to the UE. Step 915: The BNG sends a RADIUS Accounting Start packet to the AAA. After receiving the RADIUS Accounting Star packet, the AAA starts charging.

10 is a schematic flowchart of Embodiment 8 of the method for implementing an authentication notification according to the present invention. A non-BBF UE accesses a BBF access network, requests an IP address, and the RG checks whether the UE passes the authentication. When it is determined that the UE does not pass the authentication, the refusal is performed. When the UE is authenticated, the RG notifies the BNG that the UE is authenticated, and the BNG triggers the DHCP server to allocate an IP address to the UE. As shown in FIG. 10, the method includes the following steps:

Step 1001: The UE sends a broadcast DHCP Discover message on the physical subnet for searching for an available DHCP server.

Step 1002: The RG can receive the packet from the UE. After receiving the DHCP Discover message, the RG checks whether the MAC address of the UE passes the authentication. If the authentication fails, the RG does not pass the authentication. The process of rejecting the UE is terminated, and the process ends; if the authentication is passed, the RG sends the DHCP Discover message to the BNG. Step 1003: After receiving the DHCP Discover message sent by the RG, the BNG determines that the UE is authenticated, and can allocate an IP address to the UE. Therefore, the BNG directly forwards the DHCP Discover message to the DHCP server, and triggers the DHCP server to allocate an IP address to the UE. .

Step 1004: After receiving the DHCP Discover message, the DHCP server is equivalent to receiving the IP lease request from the BNG for the DHCP server, so the DHCP server provides an IP lease and reserves an IP address for the UE, and then replies to the BNG. DHCP Offer packet carrying the IPv4 address {IPv4 Address}.

Step 1005: After receiving the DHCP Offer message replied by the DHCP server, the BNG forwards the packet to the RG, which still carries the IPv4 address {IPv4 Address}.

Step 1006: After receiving the DHCP Offer message sent by the BNG, the RG replies to the UE with DHCP.

Offer message, which carries the IPv4 address {IPv4 Address}.

Step 1007: The UE sends a DHCP Request message to the RG and all other DHCP servers, where the IP of the DPCH server providing the IP lease is used to notify all other DHCP servers that they have accepted an IP lease.

Step 1008: The RG forwards the DHCP Request message received by the UE to the BNG.

Step 1009: After receiving the DHCP Request message, the BNG sends a DHCP Request message to the DHCP server.

Step 1010: After receiving the DHCP Request message sent by the BNG, the DHCP server returns a DHCP Ack message to the BNG.

Step 1011: After receiving the DHCP Ack replied by the DHCP server, the BNG reply

The DHCP Ack packet is sent to the RG.

Step 1012: After receiving the DHCP Ack packet, the RG replies to the DHCP Ack packet to the UE. Step 1013: The BNG sends a RADIUS Accounting Start packet to the AAA. After receiving the RADIUS Accounting Start packet, the AAA starts charging.

The AAA in the above-described Embodiment 2 to Embodiment 8 is BBF AAA. In order to implement the method in the first embodiment to the fourth embodiment, the present invention further provides an authentication notification system. FIG. 11 is a schematic structural diagram of Embodiment 1 of the present invention for implementing an authentication notification system. As shown in FIG. 11, the system includes: BBF AAA111 and BNG112; among them,

BBF AAA111, configured to send the MAC address of the UE to the BNG 112 when the UE accesses the BBF access network and passes the authentication;

The BNG 112 is configured to receive a MAC address of the UE.

The BNG 112 is further configured to: when the UE requests an IP address, and determine that the UE passes the authentication, trigger the DHCP server to allocate an IP address to the UE.

In order to implement the method in the fifth embodiment to the seventh embodiment, the present invention further provides an authentication notification system. FIG. 12 is a schematic structural diagram of Embodiment 2 of the present invention for implementing an authentication notification system. As shown in FIG. 12, the system includes: BNG121 and AAA122; among them,

The BNG121 is configured to: when the UE accesses the BBF to access the network, and requests the IP address, check whether the UE passes the authentication, and when it is determined that there is no authentication information of the UE, obtain the authentication information of the UE from the AAA 122;

The AAA 122 is configured to provide the UE with the authentication information of the BNG.

The BNG 121 is further configured to: after determining that the UE passes the authentication according to the authentication information, trigger the DHCP server to allocate an IP address to the UE.

The present invention further provides an authentication notification system, and FIG. 13 is a schematic structural diagram of Embodiment 3 of the present invention for implementing an authentication notification system. As shown in FIG. 13, the system includes: RG131 and BNG132; among them,

RG131, configured to: when the UE accesses the BBF to access the network, and requests the IP address, check whether the UE passes the authentication, and when it is determined that the UE passes the authentication, notify the BNG 132 that the UE passes the authentication;

The BNG 132 is configured to receive a notification that the UE passes the authentication.

The BNG 132 is further configured to: trigger a DHCP server to allocate an IP address to the UE. The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included. Within the scope of protection of the present invention.

Claims

Claim

1. An authentication notification method, characterized in that the method comprises:

When the UE accesses the broadband forum (BBF) access network and passes the authentication, the BBF authentication, authorization, and accounting unit (AAA) sends the MAC address of the UE to the broadband network gateway control device (BNG).

2. The method according to claim 1, wherein the method further comprises: when the UE requests an IP address, and the BNG determines that the UE passes the authentication, the BNG triggers a Dynamic Host Setup Protocol (DHCP) server as the UE. Assign an IP address.

The method of claim 2, wherein the UE requests an IP address: the UE requests an IPv6 address through a Router Solicitation message, or the UE requests an IPv6 through a DHCP Solicit message. The address, or the UE, through DHCP Discovery (DHCP Discover), requests the IPv4 address.

4. An authentication notification method, characterized in that the method comprises:

The method according to claim 4, wherein the method further comprises: after determining that the UE passes the authentication according to the authentication information, the BNG triggers the DHCP server to allocate an IP address to the UE.

The method according to claim 4, wherein the UE requests the IP address to be: the UE requests the IPv6 address through the Router Solicitation, or the UE requests the IPv6 address through the DHCP Solicit, or the UE passes the DHCP. Discover 4 requests an IPv4 address.

7. An authentication notification method, characterized in that the method comprises:

When the UE accesses the BBF access network and requests the IP address, the residential gateway (RG) checks whether the UE passes the authentication. When it is determined that the UE passes the authentication, the RG notifies the BNG that the UE passes the authentication.

8. The method according to claim 7, wherein the method further comprises:

The BNG triggers the DHCP server to assign an IP address to the UE.

9. The method of claim 7 wherein:

10. An authentication notification system, the system comprising: BBF AAA and BNG; wherein

The BBF AAA is used when the UE accesses the BBF to access the network and passes the authentication, and sends the MAC address of the UE to the BNG.

BNG, used to receive the MAC address of the UE.

11. The system of claim 10, wherein:

12. An authentication notification system, characterized in that the system comprises: BNG and AAA;

AAA, used to provide UE authentication information for BNG.

The system according to claim 12, wherein the BNG is further configured to: when determining that the UE passes the authentication according to the authentication information, trigger the DHCP server to allocate an IP address to the UE.

14. An authentication notification system, the system comprising: RG and BNG; wherein RG, configured to: when the UE accesses the BBF access network, and requests the IP address, check whether the UE passes the authentication, and when the UE is determined to pass the authentication, notify the BNG that the UE passes the authentication; and the BNG is used to receive the UE. Notification of certification.

The system according to claim 14, wherein the BNG is further configured to trigger a DHCP server to allocate an IP address to the UE.