WO2015184853A1

WO2015184853A1 - Authentication method and apparatus for ipv6 stateless auto-configuration

Info

Publication number: WO2015184853A1
Application number: PCT/CN2015/072585
Authority: WO
Inventors: 郑坤; 岳雪梅
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-10-20
Filing date: 2015-02-09
Publication date: 2015-12-10
Also published as: CN105591848A

Abstract

An authentication method and apparatus for IPv6 stateless auto-configuration, which relates to the field of communications and solves the problem that for ND protocol access of IPv6 stateless auto-configuration, the power-on authentication cannot be performed because there is no special option. The authentication method for IPv6 stateless auto-configuration is applied in an access entity and comprises: acquiring a router request (RS) message in which an access information option is inserted; sending the RS message to a broadband remote access server (BRAS) entity by means of a neighbor discovery (ND) protocol, and the BRAS entity authenticates the RS message; and receiving a router advertisement (RA) message returned by the BRAS entity, the RA message carrying the access information option and a network parameter allocated by the BRAS entity and having an IPv6 address prefix. In this manner, the IPv6 stateless auto-configuration of a user terminal is implemented, and limitations of the stateless auto-configuration in authentication are solved.

Description

IPv6 stateless automatic configuration authentication method and device

Technical field

The present invention relates to the field of communications, and in particular, to an IPv6 (Sixth Edition of Internet Protocol) authentication method and apparatus for stateless automatic configuration.

Background technique

With the emergence of IPv4 (short for Internet Protocol Version 4, the fourth edition of the Internet Protocol), and the emergence of address resources, IPv6 (short for Internet Protocol Version 6, the sixth edition of the Internet Protocol) will gradually replace IPv4. IPv6 has the characteristics of plug-and-play. Without any manual intervention, a node can join the network to obtain network parameters such as IPv6 address prefix, DNS (short name for domain name service, domain name service). The network parameters of the nodes working on the IPv6 network are configured in two ways: stateful automatic configuration through the DHCPv6 (Dynamic Host Configuration Protocol for IPv6) protocol; NDP (Neighbor Discovery Protocol, Neighbor Discovery Protocol) Perform stateless automatic configuration.

BRAS (short for Broadband Remote Access Server, Broadband Remote Access Server) is an access gateway for broadband network applications. It is a bridge between the broadband access network and the backbone network, providing basic access means and management functions of the broadband access network. It is located at the edge of the network, provides broadband access services, and achieves convergence and forwarding of multiple services. It can meet the requirements of different users for transmission capacity and bandwidth utilization. Therefore, it is the core device for broadband users to access. The BRAS authenticates the user first, and the authentication allows the user to access the broadband network. If the authentication fails, the user is denied access to the broadband network.

The BRAS access method is different and the authentication method is different. IPv4 BRAS is divided into PPPoX (abbreviated as the base of the two layer protocol point to point, point-to-point based on any Layer 2 protocol) and IPoX (IP access based on Layer 2 protocol, and Layer 2 protocol X can be Ethernet Ethernet) It can be an asynchronous transfer mode ATM, or other Layer 2 protocol). The PPPoX access PPP protocol itself provides the authentication protocol. The IPoX access is different according to the access protocol. The IPv4 DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol) access provides WEB authentication and DHCP option authentication. .

IPv6 BRAS access is also divided into PPPoX and IPoX. The authentication of PPPoX access is the authentication protocol provided by the PPP protocol itself. IPoX's DHCPv6 (stateful auto-configuration) mode provides WEB authentication and option authentication (also called boot authentication); IPoX's NDP (stateless auto-configuration) mode provides access to WEB authentication.

WEB authentication process: Firstly, the network parameter allocation protocol (DHCP, DHCPv6, NDP allocates network parameters, the IP address in the assigned network parameters is limited, only the WEB server used for authentication can be accessed, and the Internet cannot be accessed; when the user accesses the WEB website When the BRAS redirects the accessed webpage to the WEB server for authentication; the user logs in the username and password to the authentication WEB server for authentication, and the restricted IP address assigned by the user becomes unrestricted after the authentication is passed, and the user can then Access to the Internet, authentication failure The restricted IP address assigned by the user is still limited and the user cannot access the Internet.

For the personal computer terminal, the WEB method can be used for authentication, and the terminal that cannot access the WEB for the TV set-top box obviously cannot perform WEB authentication. This application scenario typically uses option authentication for DHCP and DHCPv6 protocols. Option authentication refers to the option of inserting the user name and password information into the protocol packet requesting the network parameter. Before assigning the network address parameter, use the username and password in the option to authenticate, the authentication successfully assigns network parameters, and the authentication fails without assigning the network. The parameter, the terminal that failed the authentication cannot access the broadband network because there is no network parameter assigned.

Due to the terminal of the TV set-top box, the IPv6 stateless auto-configured NDP access cannot perform the option authentication or the WEB authentication, thereby limiting the IPv6 stateless automatic configuration of the broadband access application scenario.

Summary of the invention

The purpose of the embodiments of the present invention is to provide an IPv6 stateless automatic configuration authentication method and device, which solves the problem of IPv6 stateless automatic configuration NDP access, and the option authentication cannot be performed because there is no special option.

In order to solve the above technical problem, an IPv6 stateless automatic configuration authentication method provided by an embodiment of the present invention is applied to an access entity, where the authentication method includes:

Obtaining a router requesting an RS message inserted with an access information option;

Transmitting the RS message to the broadband remote access server BRAS entity by using a neighbor discovery ND protocol;

Receiving a router advertisement RA message returned by the BRAS entity, where the RA message carries the access information option and a network parameter with an IPv6 address prefix allocated by the BRAS entity.

Optionally, the access entity is an access device of the user terminal, and the step of acquiring the router requesting the RS message by inserting the access information option includes:

Acquiring and listening to the forwarded router request RS message of the user terminal;

And monitoring access information of the port corresponding to the user terminal and the access device;

The monitored access information is inserted into the RS message as an access information option.

Optionally, the network parameter further includes: a domain name service DNS address, and the step of receiving the router advertisement RA message returned by the BRAS entity includes:

Receiving the RA message returned by the BRAS entity, and determining that the access information option is included in the RA message, deleting the access information option;

Sending the deleted RA message to the user terminal according to the allocated IPv6 address prefix and the DNS address.

Optionally, when the access entity is a user terminal, the step of acquiring a router requesting an RS message by inserting an access information option includes:

Obtaining an RS message of the user terminal;

The pre-configured access information option is inserted directly into the RS message.

Optionally, the method further includes: after obtaining the router requesting the RS message by inserting the access information option,

A timeout timer is obtained that times the time of the router advertisement RA message returned from the broadband remote access server BRAS entity.

Optionally, the method further includes: if the returned RA message is not received within the preset timeout period, restoring the state of the user terminal before applying for authentication.

Optionally, the using the neighbor discovery ND protocol to send the RS message to the broadband remote access The steps of the server BRAS entity include:

The access information option is configured as an ND protocol option, and the ND protocol option is encapsulated into the RS message, and the RS message is sent to the BRAS entity for authentication.

In order to solve the above technical problem, the embodiment of the present invention further provides an IPv6 stateless automatic configuration authentication apparatus, which is applied to an access entity, where the authentication apparatus includes:

a first obtaining module, configured to acquire a router requesting an RS message with an option of inserting an access information;

a sending module, configured to send the RS message to the broadband remote access server BRAS entity by using a neighbor discovery ND protocol;

The receiving module is configured to receive a router advertisement RA message returned by the BRAS entity, where the RA message carries the access information option and a network parameter with an IPv6 address prefix allocated by the BRAS entity.

Optionally, when the access entity is an access device of the user terminal, the first acquiring module includes:

a first obtaining unit, configured to acquire and listen to the forwarded router request RS message of the user terminal;

a second acquiring unit, configured to monitor access information of the user terminal and a port corresponding to the access device;

The first processing unit is configured to insert the monitored access information into the RS message as an access information option.

Optionally, the network parameter further includes: a domain name service DNS address, and the receiving module includes:

The first neighbor discovery ND unit is configured to receive the RA message returned by the BRAS entity, and determine that the access information option is deleted when the RA message includes the access information option;

a sending unit, configured to send according to the allocated IPv6 address prefix and the DNS address Sending the deleted RA message to the user terminal.

Optionally, when the access entity is a user terminal, the first acquiring module includes:

a third acquiring unit, configured to acquire an RS message of the user terminal;

A second processing unit is arranged to directly insert the pre-configured access information option into the RS message.

The IPv6 stateless automatic configuration authentication device further includes:

The second obtaining module is configured to acquire a timeout timer for timing the time of returning the router advertisement RA message.

The processing module is configured to restore the state of the user terminal before applying for authentication if the returned RA message is not received within the preset timeout period.

Optionally, the sending module includes:

The second ND unit is configured to configure the access information option as an ND protocol option, and encapsulate the ND protocol option into the RS message, and send the RS message to the BRAS entity for authentication.

In order to solve the above technical problem, an embodiment of the present invention further provides a computer program, including program instructions, which can be implemented when the program instructions are executed.

In order to solve the above technical problem, an embodiment of the present invention further provides a carrier carrying the computer program.

The beneficial effects of the above technical solutions are as follows:

After the RS message with the option of inserting the access information is sent to the BRAS entity for authentication, the RA message carrying the network parameter with the IPv6 address prefix returned by the BRAS entity is received, and the authentication and address allocation are completed. In this way, the IPv6 stateless automatic configuration authentication of the user terminal is implemented, and the limitation of the stateless automatic configuration in the authentication is solved.

BRIEF abstract

1 is a schematic diagram of basic steps of an IPv6 stateless automatic configuration authentication method according to an embodiment of the present invention;

2 is a schematic diagram of inserting access information in an RS message when an access entity is an access device according to an embodiment of the present invention;

FIG. 3 is a diagram of an interaction process when an access entity is an access device according to an embodiment of the present invention;

4 is a flow chart of steps of performing authentication by a BRAS entity according to an embodiment of the present invention;

FIG. 5 is a flowchart of processing of an access entity and a BRAS entity according to an embodiment of the present invention;

6 is a schematic structural diagram of an IPv6 stateless automatic configuration authentication apparatus according to an embodiment of the present invention;

7 is a unit composition of an access entity and a BRAS entity according to an embodiment of the present invention;

8 is an interaction process between an access entity and a BRAS entity when the authentication is passed according to an embodiment of the present invention;

9 is an interaction process between an access entity and a BRAS entity when the authentication fails;

FIG. 10 is a schematic diagram of an example of a deployment networking according to an embodiment of the present invention.

Preferred embodiment of the invention

The detailed description will be made below in conjunction with the accompanying drawings and embodiments.

The embodiment of the present invention provides an IPv6 stateless automatic configuration authentication method and device for the IPv6 stateless automatic configuration of the NDP access failure authentication (option authentication) in the related art, and inserts the access through the access device. The RS of the information option authenticates the BRAS entity, or the user terminal directly initiates stateless autoconfiguration, and sends an RS message with the access information inserted to the BRAS entity for authentication, and the address is assigned after the authentication is passed. In this way, the IPv6 stateless automatic configuration authentication of the user terminal is implemented, and the limitation of the stateless automatic configuration in the authentication is solved.

An entity of an embodiment of the present invention includes two entities (an access entity and a BRAS entity). The access entity may be a user terminal (such as a set top box) or an access device (such as a switch) of the user terminal. The BRAS entity is a broadband access resource management point and an authentication point of the user terminal, and is responsible for the network parameter. Number assignment and authentication of the user terminal.

As shown in FIG. 1 to FIG. 5, the IPv6 stateless automatic configuration authentication method in the embodiment of the present invention is applied to an access entity, including:

Step 101: Obtain a router requesting an RS message inserted with an access information option.

The access information option refers to the access location information option. If the access entity is a switch or listens for an RS message, and the port receives or forwards the RS message, the port is the access location information and will be accessed. The location information generation option is inserted into the RS message and forwarded. If the access entity is a set-top box, the set-top box needs to enter the number of the set-top box in advance, and the set-top box inserts the number in the RS message because the set-top box has a different number (identification of which or which set-top box). The authentication server compares and parses the difference between the inserted information and the early entry. After the authentication is passed, the address is assigned.

Step 102: Send the RS message to the broadband remote access server BRAS entity by using a neighbor discovery ND protocol, where the BRAS entity authenticates the RS message.

The stateless automatic configuration is initiated by sending an RS message.

Step 103: Receive a router advertisement RA message returned by the BRAS entity, where the RA message carries the access information option and a network parameter with an IPv6 address prefix allocated by the BRAS entity.

The ND (Neighbor Discovery) protocol is a key protocol of IPv6, and is an upgrade and improvement of some protocols of IPv4, such as ARP (Address Resolution Protocol, Address Resolution Protocol), ICMP (abbreviation of Address Resolution Protocol). Abbreviation of Internet Control Message Protocol, Internet Control Message Protocol, etc. The ND protocol includes: prefix discovery, neighbor unreachable monitoring, duplicate address monitoring, and address autoconfiguration.

The ND protocol packet contains an option field, which can be filled with one or more options. For example, when the address is automatically configured, the DNS server address is delivered through the ND protocol option. The ND protocol defines some standard options. The private options can also be defined as needed to extend the functionality of the ND protocol. It can be seen that the ND protocol has good scalability.

The RS message obtained in step 101 is sent to the BRAS entity for execution by step 102, and the RS message is authenticated by the BRAS entity, and then the step 103 returns to the BRAS entity. The RA message after the certificate, so that the extended ND protocol option can be used to support the carrying of the access information, and the IPv6 stateless automatic configuration can implement the booting authentication, and solve the limitation of the stateless automatic configuration in the authentication, which not only provides various The way the address is assigned, and it is convenient for configuration.

As shown in FIG. 2, in the IPv6 stateless automatic configuration authentication method of the embodiment of the present invention, when the access entity is the access device of the user terminal, step 101 includes:

Step 201: Acquire and listen to the forwarded router request RS message of the user terminal.

Step 202: Monitor access information of the user terminal and a port corresponding to the access device.

Step 203: Insert the intercepted access information into the RS message as an access information option.

In the IPv6 stateless automatic configuration authentication method of the embodiment of the present invention, the network parameter further includes: a domain name service DNS address, and correspondingly, step 103 includes:

Step 21: Receive the RA message returned by the BRAS entity, and determine that the access information option is deleted when the RA message includes the access information option;

Step 22: Send the deleted RA message to the user terminal according to the allocated IPv6 address prefix and the DNS address.

When the access entity is the access device of the user terminal, the RS message is forwarded through the step 201, and the access information is received or forwarded through the port connected to the user terminal by the access device, and the corresponding port is accessed through step 202 to obtain the access information. Then, in step 203, the access information option is inserted into the RS message, and the RS message is sent to the BRAS entity for authentication. In step 21, the authentication access RA message returned by the BRAS entity is received, and the access information is deleted. Optionally, the RA message is forwarded to the user terminal via step 22. By extending the ND protocol option to support carrying information, IPv6 stateless auto-configuration can implement boot authentication, and solve the limitation of the stateless auto-configuration in authentication. It not only provides multiple ways to allocate addresses, but also facilitates configuration. use.

As shown in FIG. 3, the interaction process when the access entity in the embodiment of the present invention is an access device is as follows:

Step 301: The RS message is sent when the terminal is powered on, and the IPv6 address is applied, and the interface ID of the terminal is 221:97ff:fe85:9204.

Step 302: The switch switch1 listens to the RS message on the port port 5. Through the switch The name and the user terminal are connected to the port of the switch to generate the authentication information, which can be "switch1:port5". The authentication information is configured as an ND protocol option and encapsulated into the RS message. The switch forwards the encapsulated RS message to the BRAS.

Step 303: The BRAS receives the RS message and parses the authentication information, which is "switch1:port5". The BRAS encapsulates the authentication information into an authentication message and sends it to the authentication server.

Step 304: The authentication server receives the authentication message and parses the authentication information. According to the authentication information "switch1:port5", the authentication server passes the authentication and responds to the BRAS authentication success message.

Step 305: The BRAS receives the authentication success message, allocates an IPv6 address prefix, and may be 2001::/64, and encapsulates the prefix and the authentication information option into the RA message and sends the message to the terminal.

Step 306: The switch listens to the RA message, deletes the authentication information option from the RA message, and forwards the RA message after deleting the authentication information option.

Step 307: The user terminal receives the RA message, parses the prefix 2001::/64, and generates an IPv6 address according to the interface ID of the user terminal, and the generated IPv6 address may be 2001::221:97ff:fe85:9204/64.

At this point, the user terminal applied for an IPv6 address after boot authentication. The deployment example only exemplifies the application of the address, and the application of other network parameters is similar.

When the access entity is a user terminal, in the IPv6 stateless automatic configuration authentication method of the embodiment of the present invention, step 101 includes:

Step 31: Obtain an RS message of the user terminal.

In step 32, the pre-configured access information option is directly inserted into the RS message.

Pre-configuring access information refers to access location information.

The user terminal may refer to a user terminal connected to the access device, or may be an independent user terminal, or may be a user terminal connected to the non-access function device, and the RS message inserted into the access information option may be It can be sent through an independent user terminal or a user terminal connected to the access device, or can be sent through an access device connected to the user terminal, and the configuration is pre-selected according to the user.

When the access entity is a user terminal, the user terminal needs to request to apply for authentication, so it is necessary to determine whether the requested message is responsive. Therefore, in the IPv6 stateless automatic configuration authentication method in the embodiment of the present invention, step 101 further includes :

Step 41: Obtain a timeout timer for timing the time when the returned router advertises the RA message.

The timing of returning the RA message is determined by the timeout timer to determine whether the application request is responsive, which improves the accuracy of the authentication.

Optionally, in the method for authenticating the IPv6 stateless automatic configuration in another embodiment of the present invention, when performing step 103, the method further includes:

Step 51: If the returned RA message is not received within the preset timeout period, the state of the user terminal before applying for authentication is restored.

If the RA message is received after the preset time length is greater than the preset time length, the message is considered invalid and discarded.

The preset time may be obtained according to multiple experiments, or the user may set according to requirements, and any length of time for ensuring data validity belongs to the protection scope of the present invention.

Optionally, in the IPv6 stateless automatic configuration authentication method of the embodiment of the present invention, the step 102 includes:

Step 61: Construct the access information option as an ND protocol option, and encapsulate the ND protocol option into the RS message, and send the RS message to the BRAS entity for authentication.

The access information is inserted into the extended ND protocol option, and the RS message is sent to the BRAS entity for authentication, which can implement IPv6 stateless automatic configuration boot authentication, and solve the limitation of the stateless automatic configuration in the authentication, which not only provides A variety of ways to assign addresses, and convenient for configuration.

As shown in FIG. 4, optionally, in the IPv6 stateless automatic configuration authentication method of the embodiment of the present invention, the step of performing authentication by the BRAS entity includes:

Step 401: Receive the RS message, and parse out the access information option.

The access information may be the device name of the switch plus the interface name. If the user opens the access service, the operator enters the name and the access port of the switch accessed by the user terminal on the authentication server. When the authentication information received by the authentication server is entered on the authentication server, the authentication is passed. If the authentication information received by the authentication server is not entered, the authentication fails.

Step 402: Perform authentication on the access entity according to the access information option, and obtain authentication. result;

Step 403: When the authentication result is the authentication pass, allocate and encapsulate the network parameter and the access information option into the RA message, and send the RA message to the access entity.

For user terminal authentication, if the authentication information is stored locally, it can be authenticated locally. The authentication information can also be sent to a dedicated authentication server (such as RADIUS (Remote Authentication Dial In User Service), remote user dial-up authentication system). Certification.

When the authentication result is that the authentication fails, the silent process is not processed.

As shown in FIG. 5, the process of sending an authentication by the access entity to the BRAS entity in the embodiment of the present invention and passing the BRAS entity authentication is as follows.

Step 501: When the access entity is used as the terminal, the RS message is sent to initiate stateless automatic configuration to obtain the network parameter, the access information option is inserted in the RS, and the network parameter timeout timer is started; or the access entity is used as the access device to listen. Forwarded RS message, insert access information option.

Step 502: The BRAS entity receives the RS message, parses out the access information option, and performs authentication according to the access information option.

Step 503: The BRAS entity authenticates the user through the access information option, allocates an IPv6 address prefix and other network parameters, encapsulates the information into the RA message, and sends the RA message to the user.

In step 504, the access entity listens for the RA message. The access entity acts as the terminal, parses the IPv6 address prefix and other network parameters, applies the network parameters, and deletes the network parameter timeout timer. Alternatively, the access entity acts as the access device and deletes the access information option in the RA message. And forward the processed RA message.

Correspondingly, in order to solve the above technical problem, as shown in FIG. 6, the embodiment of the present invention provides an IPv6 stateless automatic configuration authentication apparatus, which is applied to an access entity, and includes:

The first obtaining module 601 is configured to obtain a router requesting an RS message with the option of inserting the access information;

The sending module 602 is configured to send the RS message to the broadband remote access server BRAS entity by using a neighbor discovery ND protocol;

The receiving module 603 is configured to receive a router advertisement RA message returned by the BRAS entity, where the RA message carries the access information option and a network parameter with an IPv6 address prefix allocated by the BRAS entity.

Sending, by the sending module 602, the RS message acquired by the first obtaining module 601 to the BRAS entity, the RSS entity authenticates the RS message, and then the receiving module 603 returns the RA message of the BRAS entity, so that The extended ND protocol option can support carrying information. IPv6 stateless auto-configuration can implement boot authentication, and solve the limitation of the stateless auto-configuration in authentication. It not only provides multiple ways to allocate addresses, but also facilitates. Configuration use.

In the IPv6 stateless automatic configuration authentication apparatus of the embodiment of the present invention, when the access entity is an access device of the user terminal, the first acquiring module 601 includes:

In an IPv6 stateless automatic configuration authentication apparatus according to still another embodiment of the present invention, the network parameter further includes: a domain name service DNS address, and the receiving module 603 includes:

The sending unit is configured to send the deleted RA message to the user terminal according to the allocated IPv6 address prefix and the DNS address.

In the IPv6 stateless automatic configuration authentication apparatus of the embodiment of the present invention, when the access entity is a user terminal, the first acquiring module includes:

a second processing unit configured to directly insert the pre-configured access information option into the RS interest.

The IPv6 stateless automatic configuration authentication apparatus of the embodiment of the present invention further includes:

The IPv6 stateless automatic configuration authentication apparatus of still another embodiment of the present invention further includes:

In an IPv6 stateless automatic configuration authentication apparatus according to still another embodiment of the present invention, the sending module 602 includes:

The second ND unit is configured to configure the access information option as an ND protocol option, and encapsulate the ND protocol option into the RS message, and send the RS message to the BRAS entity for authentication. As shown in FIG. 7, the first ND unit and the second ND unit in the embodiment of the present invention may be ND units of the same access entity, and the access entity 701 includes an authentication information management unit and an ND unit; and the BRAS entity 702 includes an authentication unit. And the ND unit of the BRAS entity.

The authentication information management unit is configured to manage the authentication information of the access entity 701, and the authentication information may be configured in the following manner, including but not limited to: manually configuring the authentication information and saving to the storage; Information (such as MAC (short for Media Access Control)) generates authentication information.

The authentication unit of the BRAS is configured to authenticate the user terminal. If the authentication information is stored locally, the authentication unit may perform the localization; the authentication information may also be sent to a dedicated authentication server (such as RADIUS (Remote Authentication Dial In User Service). , remote user dial-up authentication system) server) to authenticate.

As shown in FIG. 8, the interaction process between the access entity and the BRAS entity when the authentication is passed in the embodiment of the present invention is as follows.

Step 801: If the access entity 701 is an access device of the user terminal, the ND unit of the access entity listens to the forwarded RS message; if the access entity 701 is the user terminal, the ND unit of the access entity initiates stateless automatic configuration acquisition. Network parameters and start to get the network parameter timeout timer.

Step 802: The ND unit of the access entity requests authentication from the authentication information management unit.

Step 803: The authentication information management unit notifies the ND unit of the access entity to perform authentication information of the access entity 701.

Step 804: The ND unit of the access entity encapsulates the authentication information of the authentication information into an ND protocol packet into an RS message, and sends the RS message to the BRAS entity 702.

The authentication information management unit manages the access information of the access entity, and the authentication information may be configured in the following manner, including but not limited to: manually configuring the authentication information and saving the storage information; and authenticating the uniqueness information of the entity ( Such as MAC) to generate authentication information.

The ND protocol has good scalability by extending the option information of the ND protocol, and the authentication information option is implemented by extending the options of the ND protocol message.

Step 805: The ND unit of the BRAS entity receives the RS message, parses the authentication information, and notifies the authentication unit of the authentication information.

Step 806: The authentication unit user terminal of the BRAS entity 702 authenticates and notifies the ND unit of the BRAS entity.

Step 807: After the user terminal passes the authentication, the ND unit of the BRAS entity obtains the network parameter and encapsulates it into the response message RA message of the RS message, and sends it back to the user terminal.

The user terminal refers to a user terminal of an access device, an independent user terminal, or another user terminal connected to a device without an access function.

Step 808: The ND unit of the access entity receives the RA message. If the access entity 701 is an access device of the user terminal, it is checked whether the RA message contains an authentication information option, and if so, the authentication information option is deleted. If the access entity 701 is a user terminal, the RA message is obtained by parsing the RA message and applied, and the network parameter timeout timer is cancelled.

As shown in FIG. 9, the interaction process between the access entity and the BRAS entity when the authentication fails in the embodiment of the present invention is as follows.

Step 901: If the access entity 701 is an access device of the user terminal, the ND unit of the access entity listens to the forwarded RS message; if the access entity 701 is the user terminal, the ND unit of the access entity initiates stateless automatic configuration acquisition. Network parameters and start to get the network parameter timeout timer.

Step 902: The ND unit of the access entity requests authentication from the authentication information management unit.

Step 903: The authentication information management unit notifies the ND unit of the access entity to perform the access entity 701. Certification information.

Step 904: The ND unit of the access entity encapsulates the authentication information of the authentication information into an ND protocol message into an RS message, and sends the RS message to the BRAS entity 702.

Step 905: The ND unit of the BRAS entity receives the RS message, parses the authentication information, and notifies the authentication unit of the authentication information.

Step 906: The authentication unit user terminal of the BRAS entity 702 fails to authenticate and notifies the ND unit of the BRAS entity. The ND unit of the BRAS entity is silent and does not send a response RA message.

Step 907: If the access entity 701 is an access device of the user terminal, the ND unit of the access entity does not perform any processing. If the access entity 701 is a user terminal, when the network parameter timer expires, the application for the IPv6 address prefix and other network addresses fails, and the user terminal is restored to the pre-application state.

As shown in FIG. 10, the terminal is connected to the switch of the operator access network, and the terminal configures an IPv6 address prefix by using the ND protocol. The switch performs insertion and deletion of authentication information options for the access entity 701. The BRAS in the carrier network allocates an IPv6 address prefix to the terminal through the ND protocol, and authenticates to the operator's authentication server according to the authentication information option before the address is assigned.

It should be noted that, the apparatus provided by the embodiment of the present invention is a device that applies the foregoing IPv6 stateless automatic configuration authentication method, and all embodiments of the IPv6 stateless automatic configuration authentication method are applicable to the device, and both can be achieved. The same or similar benefits.

One of ordinary skill in the art will appreciate that all or part of the steps in the above methods may be passed through the program. The instruction related hardware is completed, and the program can be stored in a computer readable storage medium such as a read only memory, a magnetic disk or an optical disk. Optionally, all or part of the steps of the foregoing embodiments may also be implemented by using one or more integrated circuits. Accordingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented by using a software function module. Formal realization. The invention is not limited to any specific form of combination of hardware and software.

The above is a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It should be considered as the scope of protection of the present invention.

Industrial applicability

The IPv6 stateless automatic configuration authentication of the user terminal is implemented, and the limitation of the stateless automatic configuration in the authentication is solved.

Claims

An IPv6 stateless automatic configuration authentication method is applied to an access entity, including:

Obtaining a router requesting an RS message inserted with an access information option;

Transmitting the RS message to the broadband remote access server BRAS entity by using a neighbor discovery ND protocol;

Receiving a router advertisement RA message returned by the BRAS entity, where the RA message carries the access information option and a network parameter with an IPV6 address prefix allocated by the BRAS entity.
The authentication method according to claim 1, wherein

The access entity is an access device of a user terminal,

The step of obtaining a router requesting an RS message inserted with an access information option includes:

Acquiring and listening to the forwarded router request RS message of the user terminal;

And monitoring access information of the port corresponding to the user terminal and the access device;

The monitored access information is inserted into the RS message as an access information option.
The authentication method according to claim 2, wherein

The network parameter further includes: a domain name service DNS address,

The step of receiving the router advertisement RA message returned by the BRAS entity includes:

Receiving the RA message returned by the BRAS entity, and determining that the access information option is included in the RA message, deleting the access information option;

Sending the deleted RA message to the user terminal according to the allocated IPv6 address prefix and the DNS address.
The authentication method according to claim 1, wherein when the access entity is a user terminal, the step of acquiring a router requesting an RS message inserted with an access information option comprises:

Obtaining an RS message of the user terminal;

The pre-configured access information option is inserted directly into the RS message.
The authentication method according to claim 4, further comprising:

After obtaining the router requesting the RS message with the access information option inserted,

Obtaining a router advertisement RA message returned from the broadband remote access server BRAS entity Time-timed timeout timer.
The authentication method according to claim 5, further comprising:

If the returned RA message is not received within the preset timeout period, the state of the user terminal before applying for authentication is restored.
The authentication method according to any one of claims 1 to 6, wherein the step of transmitting the RS message to the broadband remote access server BRAS entity by using the neighbor discovery ND protocol comprises:

The access information option is configured as an ND protocol option, and the ND protocol option is encapsulated into the RS message, and the RS message is sent to the BRAS entity for authentication.
An IPv6 stateless automatic configuration authentication device is applied to an access entity, including:

a first obtaining module, configured to acquire a router requesting an RS message with an option of inserting an access information;

a sending module, configured to send the RS message to the broadband remote access server BRAS entity by using a neighbor discovery ND protocol;

The receiving module is configured to receive a router advertisement RA message returned by the BRAS entity, where the RA message carries the access information option and a network parameter with an IPv6 address prefix allocated by the BRAS entity.
The authentication device according to claim 8, wherein when the access entity is an access device of the user terminal, the first acquiring module includes:

a first obtaining unit, configured to acquire and listen to the forwarded router request RS message of the user terminal;

a second acquiring unit, configured to monitor access information of the user terminal and a port corresponding to the access device;

The first processing unit is configured to insert the monitored access information into the RS message as an access information option.
The authentication device according to claim 9, wherein

The network parameter further includes: a domain name service DNS address;

The receiving module includes:

The first neighbor discovery ND unit is configured to receive the RA message returned by the BRAS entity, and determine that the access information option is deleted when the RA message includes the access information option;

The sending unit is configured to send the deleted RA message to the user terminal according to the allocated IPv6 address prefix and the DNS address.
The authentication device of claim 8, wherein when the access entity is a user terminal, the first obtaining module comprises:

a third acquiring unit, configured to acquire an RS message of the user terminal;

A second processing unit is arranged to directly insert the pre-configured access information option into the RS message.
The authentication device of claim 11, further comprising:

The second obtaining module is configured to acquire a timeout timer for timing the time of returning the router advertisement RA message.
The authentication device of claim 12, further comprising:

The processing module is configured to restore the state of the user terminal before applying for authentication if the returned RA message is not received within the preset timeout period.
The authentication device according to any one of claims 8 to 13, wherein the transmitting module comprises:

The second ND unit is configured to configure the access information option as an ND protocol option, and encapsulate the ND protocol option into the RS message, and send the RS message to the BRAS entity for authentication.
A computer program comprising program instructions that, when executed, implement the method of any one of claims 1-7.
A carrier carrying the computer program of claim 15.