WO2014067334A1

WO2014067334A1 - Data packet management method, device and system

Info

Publication number: WO2014067334A1
Application number: PCT/CN2013/082495
Authority: WO
Inventors: 范亮; 王怀滨; 梁乾灯; 陈勇
Original assignee: 中兴通讯股份有限公司
Priority date: 2012-10-29
Filing date: 2013-08-28
Publication date: 2014-05-08
Also published as: CN103796245A; CN103796245B

Abstract

Disclosed are a data packet management method, device and system, the method comprising: a BNG device authenticates a user identity via an AAA server, and stores the authorization information and identifier information of the authenticated user after the user identity is successfully authenticated; the BNG device receives an accounting start request transmitted by a WLAN device; the BNG device matches the identifier information carried in the accounting start request with the identifier information of the authenticated user, and determines the authorization information according to the identifier information of the authenticated user after the matching succeeds; and the BNG device identifies the data packet of the user according to the identifier information of the user, and manages the data packet according to the authorization information of the user. The present invention can quickly deploy a BNG device to realize user service and traffic management without changing the current WLAN network architecture for user authentication and address allocation, thus improving WLAN network service quality.

Description

Data message management method, device and system

TECHNICAL FIELD The present invention relates to the field of communications, and in particular, to a data packet management method, apparatus, and system. BACKGROUND With the rapid development of Internet applications and smart terminals, the demand for users to access the Internet for office, communication, and entertainment activities through various intelligent terminals, such as smart phones and tablet computers, is also widely spread. Wireless Local Area Networks (WLAN) access to the network is one of the most important means. 1 is a schematic diagram of a topology of a conventional WLAN network according to the related art, and FIG. 2 is a schematic diagram of a topology of another conventional WLAN network according to the related art. As shown in FIG. 1 and FIG. 2, a conventional WLAN network includes an access point. (Access Point, referred to as AP), Access Controller (AC), Authentication Authorization Accounting (AAA), and Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol). Referred to as a network element such as a DHCP server, the user terminal device can access the network through the AP and/or AC after passing the identity authentication. When the WLAN network adopts the 802.1x authentication mode or the "PPPoE+PSK" mode for user identity authentication, the AP or the AC device acts as the authentication point of the user. After the user identity authentication is passed, the user is assigned an IP address through the built-in or external DHCP server. PPPoE (PPP over Ethernet) is a point-to-point protocol (PPP) on the Ethernet, and the PSK (Pre-Shared Key) is a pre-shared key. With the development of network convergence, the convergence of WLAN networks and fixed broadband networks has become one of the mainstream trends in the future. The huge advantage of Broadband Network Gateway (BNG) devices in user management has become the improvement of WLAN network service quality. FIG. 3 is a schematic diagram of a network topology of a WLAN and a fixed broadband network convergence manner according to the related art, and FIG. 4 is a schematic diagram of a network topology of another WLAN and fixed broadband network fusion manner according to the related art, FIG. According to another network topology diagram of a WLAN and a fixed broadband network convergence manner according to the related art, FIG. 3, FIG. 4 and FIG. 5 respectively describe network topology structures of three WLAN and fixed broadband network fusion modes, and various types of users. The terminal accesses the fixed broadband network through the WLAN network and the wired link, and the refined control of the user service is unified by the broadband network gateway BNG. At the same time, the WLAN network may also have a network address translation (NAT) function, and the network assigns a private network address to the user. Conversion of address and public IP address. In the network architecture shown in FIG. 3, FIG. 4, and FIG. 5, if the network architecture and process of the current WLAN network user authentication and address allocation are not changed, if the BNG device does not participate in the user's address allocation process, the BNG cannot be caused. The user is identified, and the BNG cannot manage the user's business and traffic according to the user's authorization information. In view of the problem that the BNG cannot identify the user in the case where the BNG device does not participate in the user address allocation process in the related art, an effective solution has not been proposed yet. SUMMARY OF THE INVENTION Embodiments of the present invention provide a data packet management method, apparatus, and system to solve at least the above problems. According to an aspect of the embodiments of the present invention, a data packet management method is provided, where the method includes:

The BNG device performs user identity authentication through the AAA server, and stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds; the BNG device receives the charging start request sent by the WLAN device; wherein the charging start request carries The identification information of the user; the BNG device matches the identification information carried in the charging start request and the identification information of the authenticated user, and after the matching is successful, determines the authorization information according to the identification information of the authenticated user; The device identifies the data packet of the user according to the identification information of the user, and manages the data packet according to the authorization information of the user.

The BNG device performs user identity authentication through the AAA server, and stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds. The BNG device sends the user authentication message to the AAA server. After receiving the user authentication message, the AAA server receives the user authentication message. After the user identity authentication succeeds, the BNG device receives the authorization information of the authenticated user sent by the AAA server, and stores the identifier information of the authenticated user according to the user authentication message.

After the BNG device stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds, the method further includes: the BNG device sending the authorization information of the authenticated user to the WLAN device.

Before the BNG device receives the foregoing charging start request sent by the WLAN device, the method further includes: after receiving the network protocol IP address request of the user, the WLAN device allocates an IP address to the user.

After the WLAN device receives the IP address request from the user, assigning the IP address to the user includes: after receiving the IP address request of the user, the WLAN device allocates the IP address to the user in the local address pool; or the WLAN device receives the user. After the IP address is requested, the above user is assigned the above IP address through the dynamic host configuration protocol DHCP server. After the WLAN device receives the IP address request from the user, the assigning the IP address to the user includes: After receiving the IP address request of the user, the WLAN device allocates the IP address assigned by the AAA server to the user through the authorization information to the user.

After the WLAN device receives the IP address request from the user, assigning the IP address to the user includes: After receiving the IP address request of the user, the WLAN device allocates a private network IP address for the user and a public network IP for network address translation. Address and port number segment.

After the WLAN device allocates an IP address to the user, the method further includes: the WLAN device storing the public network IP address and the port number segment.

Receiving, by the BNG device, the charging start request sent by the WLAN device, the BNG device receiving the foregoing charging start request sent by the WLAN device, where the charging start request carries the foregoing identification information of the user, where the identification information includes the user The MAC address, and the above public IP address and the above port number segment.

The BNG device identifies the data packet of the user according to the identification information of the user, and the BNG device identifies the user according to the IP address in the user data packet.

The BNG device identifies the data packet of the user according to the identifier information of the user, and further includes: the BNG device identifies the user according to the IP address and the port number information in the user data packet. The method further includes: when the public network IP address and/or the port number segment is increased, the BNG device receives the charging update message sent by the WLAN device; wherein the charging update message carries the changed identification information. The method further includes: when the public network IP address and/or the port number segment is decreased, or the network address translation NAT generation entry for network address translation is aged, the BNG device receives the charging update message sent by the WLAN device; The charging update message carries the changed identification information. The method further includes: when the NAT generation entry for the network address translation is updated, the BNG device receives the charging update message sent by the WLAN device; wherein the charging update message carries the changed identification information. The WLAN device is an AC or an AP. According to another aspect of the present invention, a data message management apparatus is provided, which is applied to a broadband network gateway BNG device, and the device includes: an authentication module, configured to perform user identity authentication through an AAA server, and After the authentication succeeds, the authorization information and the identification information of the authenticated user are stored; the request receiving module is configured to receive the charging start request sent by the WLAN device; wherein the charging start request carries the identification information of the user; the matching module is set to Matching the identification information carried in the foregoing charging start request and the above-mentioned authenticated The identification information of the user, and after the matching is successful, determining the authorization information according to the identification information of the authenticated user; the message identification module is configured to identify the data packet of the user according to the identification information of the user; The method is configured to manage the data packet according to the authorization information of the user. The above-mentioned authentication module includes: a message sending unit, configured to send a user authentication message to the AAA server; wherein the user authentication message is used to notify the AAA server to perform user identity authentication; and the storage unit is configured to receive the AAA server to send The authorization information of the authenticated user is stored, and the identifier information of the authenticated user is stored according to the user authentication message. The device further includes: an authorization information sending module, configured to send the authorization information of the authenticated user to the WL AN device. The request receiving module includes: a receiving unit, configured to receive the charging start request sent by the WLAN device, where the charging start request carries the identifier information of the user, where the identifier information includes a MAC address of the user, And the public network IP address and port number segment. The packet identification module includes: a first identification unit configured to identify a user according to an IP address in the user data packet. The message identification module further includes: a second identification unit configured to identify the user according to the IP address and the port number information in the user data packet. The device further includes: a first receiving module, configured to receive, after the public network IP address and/or the port number segment, the charging update message sent by the WLAN device; wherein the charging update message carries Identification information after the change. The device further includes: a second receiving module, configured to receive, when the public network IP address and/or the port number segment is reduced, or the network address translation NAT generating entry for network address translation is aged, receiving the WLAN device sending The charging update message; wherein the charging update message carries the changed identification information. The device further includes: a third receiving module, configured to receive, after the NAT generation item update for network address translation, the charging update message sent by the WLAN device; wherein the charging update message carries a change Identification information. The WLAN device is an access controller AC or an access point AP. According to still another aspect of the embodiments of the present invention, a data packet management system is provided, including: the foregoing management device, further comprising a WLAN device, where the WLAN device includes: an address allocation module, configured to receive an IP address of the user After the request, the above user is assigned an IP address. The address allocation module includes: a first allocating unit configured to: after receiving the IP address request of the user, assign an IP address to the user in a local address pool; or, the second allocating unit is configured to receive the IP of the user After the address request, the above user is assigned an IP address through the dynamic host configuration protocol DHCP server. The address allocation module further includes: a third allocating unit, configured to: after receiving the IP address request of the user, assign the IP address assigned by the authentication and authorization accounting AAA server to the user by using the authorization information. The address allocation module further includes: a fourth allocating unit configured to: after receiving the IP address request of the user, allocate a private network IP address for the user, and a public network IP address and a port number segment for network address translation. The WLAN device further includes: a storage module, configured to store the public network IP address and the port number segment. According to the embodiment of the present invention, the BNG device stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds, and the BNG device receives the charging start request that is sent by the WLAN device and carries the identification information of the user, and the BNG device matches the identification information. And the identification information of the authenticated user, and after the matching is successful, determining the authorization information according to the identifier information of the authenticated user; the BNG device identifies the data packet of the user according to the identifier information of the user, according to the user The authorization information manages the foregoing data packet, and solves the problem that the BNG cannot identify the user when the BNG device does not participate in the user address allocation process in the related art, so that the network architecture of the current WLAN network user authentication and address allocation can be changed without changing. And the process of the process, quickly deploy BNG equipment to manage user services and traffic, and improve the service quality of WLAN networks.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the accompanying drawings, FIG. 1 is a schematic diagram of a topology of a conventional WLAN network according to the related art; FIG. 2 is a schematic diagram of a topology of another conventional WLAN network according to the related art; 3 is a schematic diagram of a network topology of a WLAN and a fixed broadband network convergence manner according to the related art; FIG. 4 is a schematic diagram of another network topology of a WLAN and a fixed broadband network fusion manner according to the related art.

FIG. 5 is a schematic diagram of a network topology in which a WLAN and a fixed broadband network are fused according to the related art.

6 is a flowchart of a method for managing a data packet according to an embodiment of the present invention; FIG. 7 is a schematic diagram of a method for WLAN user fixed network access according to an embodiment of the present invention; FIG. 8 is an AC straight according to Embodiment 1 of the present invention; FIG. 9 is a schematic flowchart of data packet encapsulation and forwarding according to the first embodiment of the present invention; FIG. 10 is a schematic flowchart of data packet encapsulation and forwarding according to the first embodiment of the present invention; FIG. 11 is a schematic flowchart of data packet encapsulation and forwarding according to Embodiment 2 of the present invention; FIG. 12 is a flowchart of processing a data packet in a fat AP scenario according to Embodiment 3 of the present invention; FIG. 13 is a block diagram showing a data packet encapsulation and forwarding according to a third embodiment of the present invention; FIG. 14 is a block diagram showing a structure of a data packet management apparatus according to an embodiment of the present invention; A structural block diagram of a management system for data messages of an embodiment. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The embodiment of the invention provides a method, a device and a system for managing data packets, which are described in detail below through specific embodiments. This embodiment provides a method for managing data packets. FIG. 6 is a flowchart of a method for managing data packets according to an embodiment of the present invention. As shown in FIG. 6, the process includes the following steps (step S602-step S608). The SNG device performs user identity authentication through the AAA server, and stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds; Step S604, the BNG device receives the charging start request sent by the WLAN device, where the charging start request carries the identification information of the user. Step S606: The BNG device matches the identification information carried in the charging start request and the authenticated The identification information of the user, and after the matching is successful, determining the authorization information according to the identification information of the authenticated user; Step S608, the BNG device identifies the data packet of the user according to the identification information of the user, according to the authorization of the user The information is managed by the above data message. After the user identity authentication succeeds, the BNG device stores the authorization information and the identification information of the authenticated user, and the BNG device receives the charging start request that is sent by the WLAN device and carries the identification information of the user, and the BNG device matches the identification information and The identification information of the authenticated user is determined, and after the matching is successful, the authorization information is determined according to the identification information of the authenticated user; the BNG device identifies the data packet of the user according to the identification information of the user, according to the authorization of the user. The information is used to manage the foregoing data packet, and solves the problem that the BNG cannot identify the user when the BNG device does not participate in the user address allocation process in the related art, so that the network architecture of the current WLAN network user authentication and address allocation can be changed. In the case of the process, the BNG device is quickly deployed to implement user service and traffic management and improve the service quality of the WLAN network. The above WLAN device may be an AC or an AP. The BNG device performs user identity authentication through the AAA server, and stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds. The BNG device obtains the authorization information and the identification information and stores the BNG. In a preferred embodiment, the BNG device sends a user authentication message to the AAA server; after receiving the user authentication message, the AAA server performs user identity authentication; after the user identity authentication succeeds, the BNG device receives the above-mentioned authenticated certificate sent by the AAA server. Authorization information of the user, and storing the identification information of the authenticated user according to the foregoing user authentication message. In the above manner, the BNG obtains the authorization information and the identification information respectively, matches the identification information for the subsequent BNG device, and determines the authorization information providing basis based on the identification information. After the BNG device stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds, the method further includes: the BNG device sends the authorization information of the authenticated user to the WLAN device. Before the BNG device receives the charging start request sent by the WLAN device, the method further includes: after receiving the IP address request of the user, the WLAN device allocates an IP address to the user. For a process in which a WLAN device allocates an IP address to a user, the following preferred embodiments are available: First preferred embodiment: After receiving the IP address request of the user, the WLAN device assigns an IP address to the user, including: After the user's IP address is requested, it is used in the local address pool. The user allocates the above IP address; or, after receiving the IP address request of the user, the WLAN device allocates the IP address to the user through the dynamic host configuration protocol DHCP server. The second preferred embodiment: after the WLAN device receives the IP address request of the user, the assigning the IP address to the user further includes: after receiving the IP address request of the user, the WLAN device allocates the AAA server to the user by using the authorization information. The IP address is assigned to the above user. The third preferred embodiment: after the WLAN device receives the IP address request of the user, assigning the IP address to the user further includes: after receiving the IP address request of the user, the WLAN device allocates a private network IP address to the user, and is used for The public IP address and port number segment of the network address translation. After the WLAN device allocates an IP address to the user, the method further includes: the WLAN device storing the public network IP address and the port number segment.

The receiving, by the BNG device, the charging start request sent by the WLAN device includes: the BNG device receiving the charging start request sent by the WLAN device; wherein the charging start request carries the foregoing identification information of the user, where the identifier information includes the MAC of the user Address, and the above public network IP address and the above port number segment. The foregoing BNG device identifies the data packet of the user according to the identifier information of the user, where the BNG device identifies the user according to the IP address in the user data packet. Alternatively, the BNG device identifying the data packet of the user according to the identifier information of the user further includes: the BNG device identifies the user according to the IP address and the port number information in the user data packet. In a preferred embodiment of the present embodiment, when the public network IP address and/or the port number segment is increased, the BNG device receives the charging update message sent by the WLAN device, where the charging update message carries a change. After the identification information. When the public network IP address and/or the port number segment is reduced, or the network address translation NAT generation entry for network address translation is aged, the BNG device receives the charging update message sent by the WLAN device; wherein, the charging update is performed. The message carries the changed identification information. When the NAT generation entry for the network address translation is updated, the BNG device receives the charging update message sent by the WLAN device, where the charging update message carries the changed identification information. The above user identity authentication includes one of the following authentication methods: EAP (Extensible Authentication Protocol) - MD5 (Message Digest Algorithm Revision 5), EAP-SIM (Subscriber Identity Module) , ΕΑΡ-ΑΚΑ (Authentication and Key Agreement), EAP-PEAP (Protected EAP, Protected EAP), EAP-TLS (Transport Layer Security), EAP-TTLS (Tunneled Transport Layer Security), PPP and B EAP authentication, Point-to-Point Protocol Protocol, referred to as PPP) and Pre-shared Key (PSK) authentication. The data packet management method introduced in this embodiment mainly relates to the functional field of the data communication network, and the following

The method of WLAN user fixed network access is introduced. FIG. 7 is a schematic diagram of a method for WLAN user fixed network access according to an embodiment of the present invention. As shown in FIG. 7, the method includes the following steps (step S702-step S710): Step S702, the WLAN device acts as an authenticator, and the user identity is used. The authentication packet is sent to the BNG device. Further, the WLAN device may be an AC or an AP; further, the user authentication mode includes various EAP authentication modes for 802.1x authentication, such as EAP-MD5, EAP-SIM, EAP-AKA, EAP-PEAP, EAP-TLS. EAP-TTLS, etc. Further, the user authentication mode also includes PPP+EAP authentication and PPP+PSK authentication. Step S704: The BNG device performs authentication of the user identity through the AAA server as the authentication proxy. After the authentication succeeds, the BNG device stores the authorization information and the identification information of the user. Further, the authentication proxy function of the BNG device includes a Radius Proxy function and a Diameter authentication proxy function; further, the BNG device optionally transmits the authorization information of the user to the WLAN device while storing the authorization information of the user; The user's identification information includes the user MAC address and/or the IP address assigned by the AAA server to the user through the authorization information, and/or VPN instance information, and/or the public network IP address and port number assigned by the AAA server to the user through the authorization information. Segment combination. Step S706, the user obtains an IP address through the WLAN device. Further, the WLAN device may allocate an IP address to the user in the local address pool, or apply for a user IP address to the DHCP server, or assign the IP address assigned by the AAA server to the user through the authorization information; further, the WLAN device may The private network address assigned to the user is sent to the user, and a public network IP address and port number segment for performing network address translation for the user is allocated and stored on the WLAN device. Step S708: After the user authentication passes and the IP address is successfully assigned, the WLAN device sends a charging start request to the BNG device, and carries the identification information of the user. Further, the process of authenticating the user and obtaining the IP address is in no particular order; further, when the WLAN device allocates a private network IP address to the user and performs network address translation on the data packet of the user, the WLAN device also needs to have The following features. When the public network address and/or port block used for translation of the user network address is increased (for example, a public network address and a port block are added for the user), the WLAN device notifies the BRAS by using a charging start message or a charging update message. , carrying the changed user identification information. When the public network address and/or port block used for translation of the user network address is reduced (for example, if the user goes offline or reduces a public network address and port block of the user) or the NAT generation entry ages, the WLAN device passes the charging. The stop message or the charging update message informs the BRAS to carry the user identification information. When the NAT generation entry for the translation of the user network address is aging updated, the WLAN device notifies the BRAS through the charging update message, and carries the user identification information. Step S710: The BNG device receives the charging start request, finds the stored user authorization information by using the user identification information, and manages the user service traffic according to the user authorization information and the identification information. The above-mentioned broadband network gateway BNG also includes a BRAS (Broadband Remote Access Server), an SR (Service Router, a full service router), a NAS (Network Access Server), and the like. Three preferred embodiments of the embodiments of the present invention in different application scenarios are respectively described below. Of course, the embodiments of the present invention are not limited to the following three embodiments, and the following three embodiments are merely described as preferred embodiments. Embodiment 1 This embodiment describes a method for processing data packets in an AC direct connection scenario. The AC is between the AP and the BNG, and the AC functions as the 802.1x authenticator of the user, and the user is assigned an IP address. FIG. 8 is a flowchart of a method for processing a data packet in an AC direct-hanging scenario according to the first embodiment of the present invention. As shown in FIG. 8, the method includes the following steps (step S802-step S826): Step S802, user terminal The authentication request is initiated by sending an EAPoL-Start. Step S804: After receiving the EAPoL-Start message, the AC sends an EAP-Request/Identity message to the user terminal, and requests the user terminal to send the username to the BRAS. Step S806, the user terminal sends an EAP-Response/Identity message to the AC, including the username. Step S808: The AC encapsulates the EAP-Response/Identity message into the RADIUS Access-Request message and sends the message to the BRAS. After receiving the Radius Access-Request message sent by the AC, the BRAS sends a new Radius Access-Request message through the Radius Proxy function. Give AAA. Step S810, the AAA generates an EAP-Request, which is carried in the RADIUS Access-Challenge message and sent to the BRAS, and the Radius Proxy function is used to form a new RADIUS Access-Challenge message.

The AC, AC sends the message to the user terminal. Step S812: After receiving the EAP-Request, the user terminal sends the Challenged-Pass-word to the AC. The AC performs the Radius packet encapsulation and sends a BRAS. The BRAS uses the Radius Proxy function to re-encapsulate the Radius packet and send it to the AAA. In step S814, the AAA determines whether the user is legal. If the authentication succeeds, the authorization information of the user is sent to the BRAS in the authentication success message. Step S816: The BRAS sends an authentication success message to the AC, and stores the user authorization information and the user MAC address information in the authentication message, and the AC sends an 802.1x authentication success message to the user. Step S818: The user sends a DHCP Discover message to the AC to request an IP address, and the AC allocates an IP address to the user in the local address pool or allocates an IP address to the user through the DHCP server. Step S820, the AC sends an accounting start message to the BRAS, carrying the user's MAC address and IP address. Step S822, after receiving the charging start message, the BRAS matches the MAC address of the user and the stored MAC address of the authenticated user, finds the authorization information of the user, and records the IP address information of the user, and the BRAS sends an accounting start message to the AAA. . Step S824, the AAA sends a charging start success message to the BRAS, and the BRAS encapsulates a new charging start success message by the Radius Proxy function and sends the message to the AC. Step S826: The user accesses the network, and the BRAS identifies the user according to the IP address information in the received user data packet, and processes the user data packet according to the authorization information of the user. For example, the BRAS can limit the rate of the user data packets according to the user bandwidth in the authorization message, or perform priority mapping on the user data packets according to the user priority in the authorization message. Based on the method for processing data packets in the AC direct-attached scenario, the following describes the flow of data packet encapsulation and forwarding after the user obtains an IP address, and FIG. 9 is a schematic diagram of a data packet encapsulation and forwarding process according to the first embodiment of the present invention. A flow chart of data packet encapsulation and forwarding is shown in FIG. 9. The process includes the following steps (step S902 - step S908): Step S902, the user sends a data packet to the service network, and the source MAC address is the MAC address of the user. The destination MAC address is the MAC address MAC2 of the user-side interface of the AC, the source IP address is the IP address of the user, and the destination IP address is the service IP address IP2 accessed by the user. Step S904: The AP transparently transmits the user data packet. Step S906: After receiving the data packet, the AC modifies the source MAC address and the destination MAC address of the packet, and the source MAC address is modified to be the MAC address MAC3 of the interface connected to the AC and the BRAS, and the destination MAC address is modified to be the MAC address of the BRAS and the AC interface. Address MAC4. Step S908: After receiving the data packet, the BRAS identifies the user according to the source IP address, and processes the packet according to the authorization information of the user, such as priority mapping, buffering, discarding, etc., for example, the BRAS determines that the processed packet can be After the service network forwards, the source MAC address and the destination MAC address of the packet are changed again. The source MAC address is changed to the MAC address MAC5 of the network side interface of the BRAS, and the destination MAC address is the MAC address MAC6 of the interface connected to the BRAS by the network side device. Embodiment 2 This embodiment describes a method for processing data packets in an AC direct-connection scenario. The AC is between the AP and the BNG.

As the user's 802.1x authenticator, the AC assigns a private network IP address to the user and performs network address translation on the user's data packets. 10 is a flowchart of a method for processing a data packet in an AC direct-hanging scenario according to the second embodiment of the present invention. As shown in FIG. 10, the method includes the following steps (step S1002 - step S1026): Step S1002 to step S1016 The specific process is similar to the step S802 to the step S816 of the foregoing embodiment, and is not described here. Step S1018: The user sends a DHCP Discover message requesting an IP address to the AC, and the AC allocates a private network IP address to the user, and the AC allocates a public network IP address and port number segment for performing network address translation to the user and stores the On the AC device. Step S1020: The AC sends an Accounting Start message to the BRAS, carrying the user's MAC address, public network IP address, and port number segment. Step S1022: After receiving the charging start message, the BRAS matches the MAC address of the user and the stored MAC address of the authenticated user, finds the authorization information of the user, and records the public IP address and port number segment of the user, and the BRAS to the AAA Send a billing start message. Step S1024, the AAA sends a charging start success message to the BRAS, and the BRAS encapsulates a new charging start success message by the Radius Proxy function and sends the message to the AC. Step S1026: The user accesses the network, and the BRAS identifies the user according to the IP address and port number information in the received user data packet, and processes the user data packet according to the authorization information of the user. For example, the BRAS can limit the rate of the user data packets according to the user bandwidth in the authorization message, or perform priority mapping on the user data packets according to the user priority in the authorization message. In addition, when the public network address and/or port block used for translation of the user network address is increased (for example, a public network address and a port block are added for the user), the AC notifies by using an accounting start message or a charging update message. BRAS, carrying the changed user identification information. When the public network address and/or port block used for translation of the user network address is reduced (for example, if the user goes offline and reduces a public network address and port block of the user), the AC passes the charging stop message or the charging update message. Notify the BRAS to carry user identification information. When the NAT generation entry for the user network address translation is aged and updated, the AP notifies the BRAS through the charging update message, and carries the user identification information. Based on the method for processing data packets in the AC direct-attached scenario, the following describes the flow of data packet encapsulation and forwarding after the user obtains an IP address. FIG. 11 is a schematic diagram of a data packet encapsulation and forwarding process according to the second embodiment of the present invention. A flow chart of data packet encapsulation and forwarding is shown in FIG. 11. The process includes the following steps (step S1102-step S1108): Step S1102, the user sends a data packet to the service network, and the source MAC address is the MAC address of the user.

The destination MAC address is MAC address MAC2 of the user-side interface of the AC. The source IP address is the IP address of the user's private IP address. The destination IP address is the IP address of the service IP address. The source port is Port1 and the destination port is Port 2. In step S104, the AP transparently transmits the user data packet. Step S1106: After receiving the data packet, the AC modifies the source MAC address and the destination MAC address of the packet, and the source MAC address is modified to be the MAC address MAC3 of the interface connected between the AC and the BRAS, and the destination MAC address is modified to be the interface between the BRAS and the AC. MAC address MAC4; modify the source IP address and source port number of the packet, change the source IP address to the public IP address IP3 assigned to the user, and select an idle port number from the port number segment assigned to the user. Port3 is the new source port number for the message. Step S1108: After receiving the data packet, the BRAS identifies the user according to the source IP address and the port number, and processes the packet according to the authorization information of the user, such as priority mapping, buffering, discarding, etc., for example, the BRAS judges the processed report. If the text can be forwarded to the service network, the source MAC address and destination MAC address of the packet are changed again. The source MAC address is changed to the MAC address MAC5 of the network side interface of the BRAS. The destination MAC address is the MAC address of the interface connected to the BRAS. MAC6. Embodiment 3 A wireless access point (AP) is an important component of a WLAN network, and its working mechanism is similar to a hub (HUB) in a wired network, and the wireless terminal can perform data transmission between the terminals through the AP. It can also communicate with the wired network through the "WAN" port of the AP. Generally, the industry divides APs into fat APs and 痩APs. Fat APs are commonly used in SOHO home networks or small wireless LANs. After a wired network is connected to the home, a fat AP can be deployed for indoor coverage. The indoor wireless terminal can access the INTERNETS through the fat AP. The following is a method for processing data packets in a fat AP scenario. The AP is directly connected to the BNG device. The AP functions as the 802.1x authenticator of the user. It also assigns the private network IP address to the user and performs network address translation on the data packets of the user. FIG. 12 is a flowchart of a method for processing a data packet in a fat AP scenario according to a third embodiment of the present invention. As shown in FIG. 12, the method includes the following steps (step S1202-step S1226): Step S1202 User to AP A DHCP Discover message is sent to request an IP address. The AP assigns a private network IP address to the user and sends it to the user. Steps S1204 to S1218 are the authentication process of the user. The specific process is similar to the step S802 to the step S816 of the foregoing embodiment, except that the AP replaces the AC in the step S802 to the step S816 as an authenticator, and details are not described herein again. Step S1220: After the user is authenticated by the identity, the AP allocates a public network IP address and a port number segment for performing network address translation to the AP and stores the same on the AP device. The AP sends an accounting start message to the BRAS, carrying the user's MAC address. Address, public network IP address, and port number segment; Step S1222, after receiving the charging start message, the BRAS matches the user's MAC address and the stored MAC address of the authenticated user, finds the user's authorization information, and records the user's public network. The IP address and the port number segment, and the BRAS sends an accounting start message to the AAA; in step S1224, the AAA sends a charging start success message to the BRAS, and the BRAS encapsulates a new charging start success message by the Radius Proxy function and sends the message to the AP; Step S1226 The user accesses the network, and the BRAS identifies the user according to the IP address and port number information in the received user data packet, and processes the user data packet according to the authorization information of the user. For example, the BRAS can limit the rate of the user data packets according to the user bandwidth in the authorization message, or perform priority mapping on the user data packets according to the user priority in the authorization message. In addition, when the public network address and/or the port block for the translation of the user network address is increased (for example, a public network address and a port block are added to the user), the AP notifies the charging start message or the charging update message. BRAS, carrying the changed user identification information. When the public network address and/or port block used for translation of the user network address is reduced (for example, if the user goes offline or reduces a public network address and port block of the user) or the NAT generation entry ages, the AP stops by charging. The message or charging update message informs the BRAS to carry the user identification information. When the NAT generation entry for the user network address translation is aged and updated, the AP notifies the BRAS through the charging update message, and carries the user identification information. The data packet processing method in the fat AP scenario is described in the foregoing embodiment. The following describes the data packet encapsulation and forwarding process after the user obtains the IP address. FIG. 13 is a data according to Embodiment 3 of the present invention. As shown in FIG. 13, the flow includes the following steps (step S1302 - step S1306): Step S1302, the user sends a data packet to the service network, and the source MAC address is the MAC address of the user. The MAC address is the MAC address MAC2 of the user interface of the AC device, the source IP address is the private IP address IP1 of the user, the destination IP address is the service IP address IP2 accessed by the user, the source port is Port1, and the destination port is Port2 _; Step S1304, After receiving the data packet, the AP modifies the source MAC address and destination MAC address of the packet. The source MAC address is modified to be the MAC address MAC3 of the interface connected between the AP and the BRAS, and the destination MAC address is modified to be the MAC address MAC4 of the interface connected to the BRAS and the AP. Modify the source IP address and source port number of the packet, and change the source IP address to the public IP address IP3 assigned to the user, and from the port number segment assigned to the user. Select an idle port number Port3 as the new source port number of the packet; the AP sends the modified data packet directly to the BRAS device; Step S1306, after receiving the data packet, the BRAS identifies the source IP address and port number. The user processes the packet according to the authorization information of the user, such as priority mapping, buffering, and discarding. If the BRAS determines that the processed packet can be forwarded to the service network, the source MAC address and destination MAC address of the packet are changed again. The address, the source MAC address is modified to the MAC address MAC5 of the network side interface of the BRAS, and the destination MAC address is the MAC address MAC6 of the interface connected to the BRAS by the network side device. Corresponding to the management method of the data packet introduced in the foregoing embodiment, the embodiment provides a device for managing a data packet, and the device can be generally disposed on the BNG device side to implement the foregoing embodiment. FIG. 14 is a structural block diagram of a data message management apparatus according to an embodiment of the present invention. As shown in FIG. 14, the apparatus includes: an authentication mode Block 10, request receiving module 20, matching module 30, message identification module 40, and management module 50. The structure is described below. The authentication module 10 is configured to perform user identity authentication through the AAA server, and store the authorization information and the identification information of the authenticated user after the user identity authentication succeeds. The request receiving module 20 is connected to the authentication module 10 and configured to receive the WLAN device. a charging start request; wherein the charging start request carries the identification information of the user; the matching module 30 is connected to the request receiving module 20, and is configured to match the identification information carried in the charging start request and the authenticated user. Identifying the information, and after the matching is successful, determining the authorization information according to the identification information of the authenticated user; the message identification module 40 is connected to the matching module 30, and configured to perform the data message of the user according to the identification information of the user. The management module 50 is connected to the message identification module 40 and configured to manage the data message according to the authorization information of the user. After the user identity authentication succeeds, the BNG device stores the authorization information and the identification information of the authenticated user, and the BNG device receives the charging start request that is sent by the WLAN device and carries the identification information of the user, and the BNG device matches the identification information and The identification information of the authenticated user is determined, and after the matching is successful, the authorization information is determined according to the identification information of the authenticated user; the BNG device identifies the data packet of the user according to the identification information of the user, according to the authorization of the user. The information is used to manage the foregoing data packet, and solves the problem that the BNG cannot identify the user when the BNG device does not participate in the user address allocation process in the related art, so that the network architecture of the current WLAN network user authentication and address allocation can be changed. In the case of the process, the BNG device is quickly deployed to implement user service and traffic management and improve the service quality of the WLAN network. The above WLAN device may be an AC or an AP. For example, the authentication module 10 includes: a packet sending unit, configured to send a user authentication packet to the AAA server, where the authentication module 10 obtains the authorization information and the identifier information and stores the information. The user authentication message is used to notify the AAA server to perform user identity authentication. The storage unit is configured to receive the authorization information of the authenticated user sent by the AAA server, and store the authenticated user according to the user authentication message. Identification information. Through the above structure, the BNG obtains the authorization information and the identification information respectively, matches the identification information for the subsequent BNG device, and determines the basis of the authorization information according to the identification information. After the BNG device stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds, the device further includes: an authorization information sending module, configured to send the authorization information of the authenticated user to the WLAN. device. In a preferred embodiment of the present embodiment, the request receiving module 20 includes: a receiving unit, configured to receive the charging start request sent by the WLAN device, where the charging start request carries the identification information of the user The foregoing identification information includes the MAC address of the user, and a public network IP address and a port number segment. In a preferred embodiment of the present embodiment, the message identification module 40 includes: a first identification unit configured to identify a user according to an IP address in a user data packet. The message identification module 40 further includes: a second identification unit configured to identify the user according to the IP address and port number information in the user data message. In a preferred embodiment of the present embodiment, the device further includes: a first receiving module, configured to receive a charging update message sent by the WLAN device if the public network IP address and/or the port number segment are increased; The charging update message carries the changed identification information. The device further includes: a second receiving module, configured to receive, when the public network IP address and/or the port number segment is reduced, or the network address translation NAT generating entry for network address translation is aged, receiving the WLAN device sending The charging update message; wherein the charging update message carries the changed identification information. The device further includes: a third receiving module, configured to receive a charging update message sent by the WLAN device when the NAT for generating a network address is updated, wherein the charging update message carries a change Identification information. Corresponding to the management method of the data packet introduced in the foregoing embodiment, this embodiment provides a data packet management system, which is used to implement the foregoing embodiment. FIG. 15 is a structural block diagram of a data packet management system according to an embodiment of the present invention. As shown in FIG. 15, the system includes the data packet management device introduced in the foregoing embodiment, and further includes a WLAN device, where the WLAN device includes: The address assignment module 60 is configured to assign an IP address to the user after receiving the network protocol IP address request of the user. In the preferred embodiment of the present embodiment, the address allocation module 60 includes: a first allocating unit, configured to allocate an IP address to the user in the local address pool after receiving the IP address request of the user; or, the second The allocating unit is configured to allocate an IP address to the user through the dynamic host configuration protocol DHCP server after receiving the IP address request of the user. The address allocation module 60 further includes: a third allocating unit, configured to: after receiving the IP address request of the user, assign the IP address assigned by the authentication and authorization charging AAA server to the user by using the authorization information to the user. The address allocation module 60 further includes: a fourth allocating unit configured to: after receiving the IP address request of the user, allocate a private network IP address for the user, and a public network IP address and a port number segment for network address translation. In a preferred embodiment of the present embodiment, the WLAN device further includes: a storage module, configured to store the public network IP address and the port number segment. As can be seen from the above description, the embodiments of the present invention prevent the BNG device from participating in the network architecture, user authentication, and address allocation process of the WLAN network by changing the existing technologies and network devices. The user address allocation process causes the BNG to fail to identify the user, which in turn causes the BNG to fail to perform user service and traffic management according to the user's authorization information, thereby realizing the service and traffic management of the WLAN user accessing the user from the fixed broadband network. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

1. A method for managing data packets, including:

The broadband network gateway BNG device authenticates the authorized AAA server for user identity authentication, and stores the authorization information and identification information of the authenticated user after the user identity authentication succeeds;

The BNG device receives the charging start request sent by the WLAN device of the wireless local area network; wherein the charging start request carries the identification information of the user;

The BNG device matches the identification information carried in the charging start request and the identification information of the authenticated user, and after the matching is successful, determines the authorization information according to the identification information of the authenticated user;

The BNG device identifies the data packet of the user according to the identification information of the user, and manages the data packet according to the authorization information of the user.

The method according to claim 1, wherein the BNG device performs user identity authentication by using the AAA server, and storing the authorization information and the identification information of the authenticated user after the user identity authentication succeeds includes:

The BNG device sends a user authentication message to the AAA server;

After receiving the user authentication packet, the AAA server performs user identity authentication; after the user identity authentication succeeds, the BNG device receives the authorization information of the authenticated user sent by the AAA server, and according to the The user authentication message stores the identification information of the authenticated user.

The method according to claim 1, wherein, after the BNG device stores the authorization information and the identification information of the authenticated user after the user identity authentication succeeds, the method further includes:

The BNG device sends the authorization information of the authenticated user to the WLAN device.

The method according to claim 1, wherein, before the BNG device receives the charging start request sent by the WLAN device, the method further includes:

After receiving the network protocol IP address request of the user, the WLAN device allocates an IP address to the user.

5. The method according to claim 4, wherein after the WLAN device receives the IP address request of the user, assigning the IP address to the user includes:

After receiving the IP address request of the user, the WLAN device allocates the IP address to the user in the local address pool; or

After receiving the IP address request of the user, the WLAN device allocates the IP address to the user through a dynamic host configuration protocol DHCP server.

The method according to claim 4, wherein after the WLAN device receives the IP address request of the user, the assigning the IP address to the user further includes:

After receiving the IP address request of the user, the WLAN device allocates the IP address assigned by the AAA server to the user by using the authorization information to the user.

After receiving the IP address request of the user, the WLAN device allocates a private network IP address to the user, and a public network IP address and port number segment for network address translation.

The method according to claim 7, wherein, after the WLAN device allocates an IP address to the user, the method further includes:

The WLAN device stores the public network IP address and the port number segment.

The method of claim 7, wherein the receiving, by the BNG device, the charging start request sent by the WLAN device comprises: the BNG device receiving the charging start request sent by the WLAN device; The charging start request carries the identifier information of the user, where the identifier information includes a MAC address of the user, and the public network IP address and the port number segment.

The method according to claim 5 or 6, wherein the identifying, by the BNG device, the data packet of the user according to the identifier information of the user includes:

The BNG device identifies the user according to the IP address in the user data packet.

The method according to claim 7, wherein the identifying, by the BNG device, the data packet of the user according to the identifier information of the user further includes: The BNG device identifies the user according to the IP address and port number information in the user data packet.

The method according to claim 7, wherein the method further comprises:

When the public network IP address and/or the port number segment is increased, the BNG device receives the charging update message sent by the WLAN device, where the charging update message carries the changed identification information.

The method according to claim 7, wherein the method further comprises:

When the public network IP address and/or port number segment is reduced, or the network address translation NAT generation entry for network address translation is aged, the BNG device receives the charging update message sent by the WLAN device; The charging update message carries the changed identification information.

The method according to claim 7, wherein the method further comprises:

The BNG device receives the charging update message sent by the WLAN device, and the charging update message carries the changed identification information.

The method according to any one of claims 1 to 14, wherein the WLAN device is an access controller AC or an access point AP.

16. A data message management device, applied to a broadband network gateway BNG device, comprising:

The authentication module is configured to perform user identity authentication through the authentication and authorization charging AAA server, and store the authorization information and the identification information of the authenticated user after the user identity authentication succeeds;

The request receiving module is configured to receive a charging start request sent by the WLAN device of the wireless local area network; wherein the charging start request carries the identification information of the user;

And the matching module is configured to match the identifier information carried in the charging start request and the identifier information of the authenticated user, and after the matching is successful, determine the authorization information according to the identifier information of the authenticated user;

a message identification module, configured to identify the data message of the user according to the identification information of the user;

The management module is configured to manage the data packet according to the authorization information of the user. The device according to claim 16, wherein the authentication module comprises: a message sending unit, configured to send a user authentication message to the AAA server, where the user authentication message is used to notify the AAA server to perform user identity authentication;

The storage unit is configured to receive the authorization information of the authenticated user sent by the AAA server, and store the identifier information of the authenticated user according to the user authentication message.

18. The device according to claim 16, wherein the device further comprises:

The authorization information sending module is configured to send the authorization information of the authenticated user to the WLAN device.

The device according to claim 16, wherein the request receiving module comprises:

a receiving unit, configured to receive the charging start request sent by the WLAN device, where the charging start request carries the identifier information of the user, where the identifier information includes a MAC address of the user , and the public network IP address and port number segment.

The device according to claim 16, wherein the message identification module comprises:

The first identifying unit is configured to identify the user according to the IP address in the user data packet.

The device according to claim 16, wherein the message recognition module further comprises:

The second identification unit is configured to identify the user according to the IP address and port number information in the user data message.

The device according to claim 16, wherein the device further comprises: a first receiving module, configured to receive, when the public network IP address and/or the port number segment is increased, receive the WLAN device to send The charging update message, wherein the charging update message carries the changed identification information.

The device according to claim 16, wherein the device further comprises:

The second receiving module is configured to receive the charging update sent by the WLAN device if the public network IP address and/or the port number segment is reduced, or the network address translation NAT generating entry for network address translation is aged. The charging update message carries the changed identification information. The device according to claim 16, wherein the device further comprises: a third receiving module, configured to receive a charging update message sent by the WLAN device in a case that the NAT is generated for the network address translation, where the charging update message carries the changed identification information .

The apparatus according to any one of claims 16 to 24, wherein the WLAN device is an access controller AC or an access point AP.

A data message management system, comprising the data message management device according to any one of claims 16 to 25, further comprising a wireless local area network WLAN device, wherein the WLAN device comprises:

The address allocation module is configured to allocate an IP address to the user after receiving the network protocol IP address request of the user.

27. The system of claim 26, wherein the address allocation module comprises:

a first allocating unit, configured to allocate an IP address to the user in a local address pool after receiving the IP address request of the user; or

The second allocating unit is configured to allocate an IP address to the user through the dynamic host configuration protocol DHCP server after receiving the IP address request of the user.

The system of claim 26, wherein the address allocation module further comprises:

And a third allocation unit, configured to: after receiving the IP address request of the user, assign the IP address assigned by the authentication authorization charging AAA server to the user by using the authorization information.

The fourth allocating unit is configured to, after receiving the user's IP address request, allocate the private network IP address to the user, and the public network IP address and port number segment used for network address translation.

The system of claim 26, wherein the WLAN device further comprises:

And a storage module, configured to store the public network IP address and the port number segment.