WO2013064052A1

WO2013064052A1 - User access method, access service router, and user access system

Info

Publication number: WO2013064052A1
Application number: PCT/CN2012/083709
Authority: WO
Inventors: 王彪; 潘云波; 魏元
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-11-03
Filing date: 2012-10-29
Publication date: 2013-05-10
Also published as: CN103095657A

Abstract

A user access method, an access service router (ASR), and a user access system. The method comprises: the ASR receiving a request message requesting for the acquisition of identity information and transmitted by a user terminal when an access authentication is performed by same via an access network (AN); the ASR identifying the user type of the user terminal, and returning the corresponding identity information on the basis of the user type of the user terminal. The ASR comprises a receiver module, a determination module, and a distribution module. The user access system comprises the AN, an authentication, authorization, and accounting (AAA) server, and the ASR, where the AN is configured to receive an access request of the user terminal, to forward the access request to the AAA server, and to complete an access authentication via the AAA server. The user access method, the ASR, and the user access system allow for deployment using an existing AN, for minimal modifications to the existing network, and for compatibility with non-identified network users.

Description

User access method, access service router and user access system

Technical field

The invention relates to an identification network in the communication field, and particularly relates to a user access method, an access service router (ASR) and a user access system.

BACKGROUND OF THE INVENTION The existing Internet has not been able to meet the needs of today's information society, which seriously hinders the further development of information networks. It is urgent to break through, leapfrogging and designing a new network architecture to solve the existing Internet presence. Serious drawbacks. In recent years, countries around the world have started research work on new network systems. On this basis, the identification network system is proposed to meet the needs of the future Internet in terms of universal service, mobility, security, controllability and manageability. . The identification network architecture is a new network architecture different from the Open Systems Interconnection (OSI) 7-layer network system and the Internet 4-layer network system. The identification network system organically integrates users, services and network resources into one, and realizes network integrated access and provides universal services for users. In the identification network, the identity and location of the user are separated. In the network structure diagram of the identification network shown in Figure 1, the host is the host, and the access identifier (Access Identifier, AID) is configured as the identity identifier for the user; The Access Service Router (ASR) is used to configure the router ID (RID) as the location identifier. All Host hosts are registered and authenticated by the ASR and access the network. The Host accesses the ASR and the behavior of leaving the ASR. The ASR needs to send the identity and location register (ILR) to the Identifer and Location Register (ILR). The ILR saves the mapping relationship between the AID and the RID configured by the Host for the user, <AID, RID>, and provides a response to the query mapping relationship.

The communication between the Host and the Host is implemented by encapsulating and routing the RID on the ASR. The original packet between the Host and the Host is encapsulated in the payload Payload. After the packet reaches the destination ASR, the destination ASR performs the packet. Decapsulate and then forward the original message to the destination Host. As shown in Figure 2, the process of forwarding packets between the source Host1 and the destination Host2 is as follows: First, the source Hostl sends the packet to the source ASR1, and the source ASR1 uses the RID to encapsulate the packet. The post-source ASR1 sends the encapsulated packet to the destination ASR2. Finally, after the packet reaches the destination ASR2, the packet is decapsulated on the destination ASR2 and forwarded to the destination Host2.

Currently, in an existing network, a user accessing a network generally includes the following steps:

1. UE associated access network (Access Network, referred to as AN);

2. The AN authenticates the UE;

3. Assign an address to the UE.

However, since existing networks such as WLAN, WiMAX, and fixed networks do not classify user identities and locations, the access network or access method cannot support the identification network. Therefore, there is an urgent need to propose a method and apparatus for enabling an identification network to be deployed using an existing access network, minimizing the transformation of the existing network, and continuing to be compatible with current non-identifying network users (or, referred to as ordinary users). .

SUMMARY OF THE INVENTION The embodiments of the present invention provide a user access method, an access service router ASR, and a user access system, which can be deployed by using an existing access network, and the transformation of the existing network is minimized, and the non-identification network is compatible. user.

In order to solve the above technical problem, the present invention provides a user access method, including: an access service router (ASR) receiving a request for acquiring identity information sent by a user terminal after performing access authentication through an access network (AN) Message; and

The ASR distinguishes the user type of the user terminal, and returns corresponding identity information according to the user type of the user terminal.

The user types include: a normal user and an identification network user.

The identity information includes an access identifier (AID) of the user terminal of the identification network or an IP address of the normal user terminal.

The step of distinguishing the user type of the user terminal by the ASR includes:

The ASR queries the Authentication Authorization Accounting (AAA) server for the AID of the user terminal, and if the query is made, the user terminal is considered to be the identification network user, and if not, the user terminal is considered to be the end. The end is a normal user.

The step of the ASR returning corresponding identity information according to the user type of the user terminal includes:

If the user terminal is an identification network user, return the AID of the user terminal to the user terminal;

If the user terminal is a normal user, the user terminal is assigned an IP address, and the IP address is returned to the user terminal.

The step of the ASR assigning an IP address to the user terminal includes:

The ASR acts as a Dynamic Host Setup Protocol (DHCP) server or a DHCP relay, and assigns an IP address to the user terminal. An embodiment of the present invention further provides an access service router, including:

a receiving module, configured to receive a request message for requesting the user terminal to obtain the identity information; a determining module, configured to determine a user type of the user terminal, and send the determination result to the allocation module; and an allocating module configured to The judgment result returns corresponding identity information to the user terminal.

The user types include: a normal user and an identification network user.

The determining module is configured to determine the user type of the user terminal by: querying an authentication authorization charging (AAA) server for an AID of the user terminal, and if queried, determining that the user terminal is an identification network user If not found, the user terminal is determined to be a normal user.

The allocation module is configured to return corresponding identity information to the user terminal according to the determination result by:

If the result of the determination is that the user terminal is an identification network user, then the user terminal is

The AID is returned to the user terminal;

If the result of the determination is that the user terminal is a normal user, the user terminal is assigned an IP address. Addressing, and returning the IP address to the user terminal.

The allocation module is configured to be a dynamic host setup protocol (DHCP) server or a DHCP relay, and assign an IP address to the user terminal.

An embodiment of the present invention further provides a user access system, including: an access network (AN), an authentication and authorization accounting (AAA) server, and an access service router, as described above, where the AN is set to: receive The access request of the user terminal forwards the access request to the AAA server, and completes the access authentication by using the AAA server.

Compared with related technologies, the user access method, the access service router ASR, and the user access system provided by the present invention can be deployed by using an existing access network, and the transformation of the existing network is minimized, and the non-identification network is compatible. The user can distinguish the identity network user from the existing network common user and assign corresponding identity information to it. 1 is a schematic diagram of a network structure of an identification network; FIG. 2 is a flowchart of forwarding a message between a source Host1 and a destination Host2 in the identification network; FIG. 3 is a flowchart of a user access method in the embodiment; FIG. 5 is a schematic structural diagram of a user access system in an embodiment; FIG.

6 is a flow chart of a user access method in an application example.

Preferred embodiment of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

Embodiments As shown in FIG. 3, this embodiment provides a user access method, including the following steps: S101: the user terminal performs access network (AN) authentication;

In this step, the user terminal requests access to the AN and completes the authentication through the AAA server. When the AAA server performs authentication, the AAA server stores the authentication information of the user and the user identification information. The user identification information includes an access identifier (AID) of the user terminal.

S102: The access service router (ASR) receives a request message that is sent by the user terminal to obtain identity information after performing access authentication by using an access network (AN);

The identity information requested by the user includes an AID identifying the network user or an IP address of the ordinary user.

S103: The ASR distinguishes the user type of the user terminal, and returns corresponding identity information according to the user type of the user terminal.

In this embodiment, the existing access network is deployed to minimize the modification to the existing network, and the non-identifying network users are compatible. Therefore, the user types include: ordinary users (ie, non-identifying network users) and identification network users.

The ASR queries the AAA server for the AID of the user terminal. If the query is made, the user is considered to be the identity network user, otherwise it is an ordinary user.

As a preferred manner, the ASR may send a query request message to the AAA server to obtain the AID of the user terminal, and after receiving the query request message, the AAA server responds the locally stored user identification information by query. The message is returned to the ASR.

The ASR returns the corresponding identity information according to the user type of the user terminal, including: if the user is an identity network user, the ASR returns the AID of the user terminal to the user terminal;

If the user is a normal user, the ASR allocates an IP address to the user terminal, and returns the IP address to the user terminal.

In this embodiment, the IP address allocation operation of the common user terminal is performed by the ASR. The ASR may have a DHCP function, and the DHCP protocol is used to assign an IP address to the user terminal, but not necessarily the same physical entity as the DHCP server. For example, the ASR may be DHCP relay. Of course, it is not excluded that the ASR uses the protocol customized by the identification network to assign an IP address to the user terminal. As shown in FIG. 4, this embodiment provides an access service router (ASR) for allocating identity information to a user, including:

a receiving module, configured to receive a request message that the user terminal requests identity information;

The identity information includes an access identifier (AID) of the user terminal of the identification network or an IP address of the ordinary user terminal.

a judging module, configured to determine a user type of the user terminal, and send the judgment result to the distribution module; wherein the user type of the user terminal includes: a common user and an identification network user.

The determining module determines the user type of the user terminal by querying the AAA server for the access identifier (AID) of the user terminal. If the query is made, the user is determined to be the identification network user, otherwise the user is the ordinary user.

As a preferred mode, the determining module is configured to send a query request message to the AAA server to obtain an AID of the user terminal, and the receiving module is further configured to receive the query response message returned by the AAA server, and The AID of the user carried in the query response message.

And an allocation module, configured to return corresponding identity information to different types of user terminals according to the determination result.

If the result of the determination is that the user is an identification network user, the allocation module returns the AID of the user terminal to the user terminal;

If the result of the determination is that the user is a normal user, the allocation module assigns an IP address to the user terminal, and returns the IP address to the user terminal.

In this embodiment, the IP address allocation operation of the common user terminal is performed by the ASR allocation module, and the allocation module may have a DHCP function, and the DHCP protocol is used to assign an IP address to the user terminal, but not necessarily the same physical entity as the DHCP server. The entity can also be a DHCP relay. Of course, it is not excluded to assign an IP address to the user terminal by using a protocol customized by the identification network.

In addition, as shown in FIG. 5, the present invention further provides a user access system, which is applied to an identification network, and includes: an AN, an AAA server, and an access service router ASR as described above.

The AN is directly associated with the AAA server. After receiving the access request sent by the user terminal UE, the AN forwards the access request to the AAA server, and performs the AAA server. Access authentication. After the authentication succeeds, the authentication success response is returned to the UE through the AN.

In an application example, as shown in FIG. 6, the method for user access includes the following steps:

S201: The user terminal UE requests to access the AN;

S202: The AN is connected to the AAA server, and the AAA server authenticates the UE, and after completing the authentication, returns a successful authentication response to the AN;

Wherein the AAA server during the authentication, the user authentication information and the user identification information stored in local memory; wherein the user information includes a user identifier of an access identifier (AID) ₀

S203: The AN returns an authentication success response to the UE.

S204: The UE requests an IP address/AID from the ASR.

The ordinary UE only needs an IP address, and the IP address is the identity information of the ordinary user; the identity network UE needs an AID, and the AID is the identity information of the identity network user.

S205: After receiving the request from the UE, the ASR queries the AAA server for the access identifier AID of the UE.

S206: The AAA server queries whether the AID of the UE is stored locally, and if yes, sends the AID to the ASR.

S207: If the ASR receives the AID of the UE returned by the AAA server, the AID returns the AID to the UE, otherwise allocates an IP address to the UE, and returns the IP address to the UE.

In step S207, if the UE is an identity network user, the ASR sends the AID information acquired from the AAA server to the UE; if the UE is a normal user, the ASR acts as a DHCP server, or a DHCP relay, and allocates an IP address to the UE.

At this point, the ASR assigns the identity information to the user, and the user accesses the AN.

As can be seen from the foregoing embodiments, the user access method, the access service router ASR, and the user access system provided in the foregoing embodiments are deployed by using an existing access network, and the ASR of the identification network is introduced. The modification of the existing network may be reduced, and the compatibility with the non-identifying network users may be implemented. The identification network user and the current network common user may be distinguished, and the identification network user is assigned an AID, and the ordinary user is assigned an IP address.

One of ordinary skill in the art will appreciate that all or part of the steps in the above methods may be passed through the program. The instructions are related to hardware completion, and the program can be stored in a computer readable storage medium such as a read only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. In view of the present invention, various other modifications, equivalents, improvements, etc., should be made without departing from the spirit and scope of the invention. It is included in the scope of protection of the present invention.

Industrial applicability

Compared with related technologies, the user access method, the access service router ASR, and the user access system provided by the embodiments of the present invention can be deployed by using an existing access network, thereby minimizing the transformation of the existing network, and is compatible with The identification network user can distinguish the identification network user from the existing network common user and assign corresponding identity information to it.

Claims

Claim

1. A user access method, comprising:

An access service router (ASR) receives a request message for requesting identity information sent by a user terminal after performing access authentication through an access network (AN);

2. The method of claim 1 wherein

The user types include: a normal user and an identification network user.

3. The method of claim 1, wherein

4. The method of claim 3, wherein

The ASR queries the Authentication Authorization Accounting (AAA) server for the AID of the user terminal. If the ASR is queried, the user terminal is considered to be an identification network user. If not, the user terminal is considered to be an ordinary user.

5. The method of claim 4, wherein

6. The method of claim 5, wherein

The step of the ASR assigning an IP address to the user terminal includes:

The ASR acts as a Dynamic Host Setup Protocol (DHCP) server or a DHCP relay. Assigning an IP address to the user terminal.

7. An access service router, comprising:

a receiving module, configured to receive a request message that the user terminal requests to obtain identity information; a determining module, configured to determine a user type of the user terminal, and send the determination result to the allocation module;

And an allocation module, configured to return corresponding identity information to the user terminal according to the determination result.

8. The access service router of claim 7, wherein

The user types include: a normal user and an identification network user.

9. The access service router of claim 7, wherein

10. The access service router of claim 9, wherein

11. The access service router of claim 10, wherein

The AID is returned to the user terminal;

If the result of the determination is that the user terminal is a normal user, the user terminal is assigned an IP address, and the IP address is returned to the user terminal.

12. The access service router of claim 11, wherein

The allocation module is configured to act as a Dynamic Host Setup Protocol (DHCP) server or

A DHCP relay allocates an IP address to the user terminal.

13. A user access system, comprising: an access network (AN), authentication and authorization charging (AAA) The server and the access service router according to any one of claims 7 to 12, wherein the AN is configured to: receive an access request of the user terminal, and forward the access request to the AAA server, Access authentication is completed by the AAA server.