WO2015196755A1

WO2015196755A1 - Address allocation method in subscriber identifier and locator separation network, and access service router

Info

Publication number: WO2015196755A1
Application number: PCT/CN2014/094131
Authority: WO
Inventors: 芮通; 郝振武; 孙默; 骆文
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-06-27
Filing date: 2014-12-17
Publication date: 2015-12-30
Also published as: CN105323325A

Abstract

An address allocation method in a subscriber identifier and locator separation network, and an access service router. The method comprises: an ASR receives a DHCP discovery message sent by a first terminal, the DHCP discovery message carrying a first MAC address of the first terminal; the ASR determines whether the first MAC address exits in a correspondence table; when the first MAC address exits in the correspondence table, the ASR determines a first user name corresponding to the first MAC address according to the correspondence table, and sends, to an identification and locator register (ILR), an identification request message carrying the first user name; and the ASR receives a first IP address returned by the ILR, and allocates the first IP address to the first terminal.

Description

Address allocation method and access service node in identity location separation network

Technical field

The present invention relates to the field of data communication technologies, and in particular, to an address allocation method in an identity location separation network and an access service node (ASR).

Background technique

The IP address in the TCP/IP protocol widely used by the Internet has a dual function, which serves as both the location identifier of the communication terminal host network interface of the network layer in the network topology and the identity of the transport layer host network interface. With the development of mobile networks, when the movement of hosts/terminals becomes more and more common, the defects of the dual functions of such IP addresses become increasingly obvious, directly affecting the route scalability of the Internet and the continuity of communication services.

The purpose of the identity and location separation technology is to solve the semantic ambiguity of the IP address. Figure 1 shows a network architecture of the identity and location separation technology system. For the convenience of description, this user identity and location. The Separation Network (SILSN, Subscriber Identifier & Locator Separation Network) is simply referred to as an identity location separation network.

In FIG. 1, the SILSN includes an Access Service Router (ASR), a User Equipment (UE), and an Identity and Location Register (ILR, Identification & Locater Register). The UE accesses the ASR through the access network (not shown in FIG. 1), and the ASR is responsible for accessing the UE to the Internet, and assumes functions such as charging and switching, and the ILR assumes functions such as location registration and query of the user.

In the SILSN, an access identifier (AID, Access IDentification) is used as the identity of the UE, and a route identifier (RID, Route IDentification) is used as the location identifier of the UE. The location identifier here is usually the identifier of the ASR accessed by the UE, so each UE accessing the SILSN has its own AID and RID.

When the UE accesses the SILSN, it first registers its location with the ILR through the ASR, that is, which ASR the UE is located under. After the UE registers, the ILR establishes a correspondence (AID, RID) of the identifier AID of the UE and the RID of the accessed ASR. After that, if UE1 needs to communicate with UE2, UE1 takes its own The ID of the ID2 is the source address, and the identity of the UE2 is the destination address. After the data packet is constructed and sent, the ASR1 queries the ILR for the location of the UE2, that is, the ASR (in the ASR 9 in Figure 1) where the UE2 is located. Then, ASR 1 sends the packet to the corresponding ASR 9, and ASR 9 processes the packet and sends it to UE2.

The foregoing network well implements the separation of the identity identifier and the location identifier of the UE. When the user moves and roams, the identity identifier does not need to be changed, the continuity of the service in the mobile process is guaranteed, and the route in the network is based on the address of the ASR. When the RID is routed, the number of ASRs is greatly reduced relative to the original IP address prefix, which improves network routing scalability.

Summary of the invention

The technical problem to be solved by the embodiments of the present invention is to provide an address allocation method and an ASR in an identity location separation network, and implement user address based address allocation under a portal authentication network architecture.

To solve the above technical problem, the address allocation method in the identity location separation network provided by the embodiment of the present invention includes:

An address allocation method in an identity identification and location separation network, comprising:

The access service node ASR receives the dynamic host configuration protocol DHCP discovery message sent by the first terminal, where the DHCP discovery message carries the first media access control MAC address of the first terminal;

Determining, by the ASR, whether the first MAC address exists in a correspondence relationship table, where the correspondence relationship table records a correspondence between a user name and a MAC address of the terminal that has passed the identity authentication;

When the first MAC address exists in the correspondence table, the ASR determines, according to the correspondence table, a first user name corresponding to the first MAC address, and sends the first user name to the identity identifier and the location registration register ILR. Carrying an identity request message carrying the first username;

Receiving, by the ASR, a first IP address returned by the ILR, and assigning the first IP address to the first terminal, where the first IP address is the ILR based on the first user name The identity identifier assigned by the first terminal.

Optionally, the method further includes:

The ASR receives an identity authentication request forwarded by an ingress server, where the identity authentication request carries a MAC address, a username, and a password of a terminal;

And the ASR forwards the authentication request to the identity authentication server, and records the correspondence between the user name and the MAC of the terminal in the correspondence relationship table after the terminal is authenticated by the identity authentication server.

Optionally, when the first MAC address does not exist in the correspondence table, the method further includes: the ASR forwarding the DHCP discovery message to the DHCP server, and the DHCP server is The temporary IP address selected in the temporary IP address pool is allocated to the first terminal.

Optionally, the allocating the temporary IP address selected by the DHCP server from the temporary IP address pool to the first terminal includes:

The ASR allocates a temporary IP address selected by the DHCP server to the first terminal by forwarding a DHCP Offer message and a DHCP ACK message from the DHCP server, and sets the lease date of the temporary IP address to a preset value. The preset value is not greater than a predetermined maximum allowable duration between the terminal's identity authentication and the IP address assigned by the ILR.

Optionally, the method further includes:

The ASR receives the DHCP renewing message sent by the second terminal, where the DHCP renewing message carries the second MAC address of the second terminal and the second IP address currently used;

Determining, by the ASR, whether the second IP address is a temporary IP address;

When the second IP address is a temporary IP address, the ASR determines whether the second MAC address exists in the correspondence table;

When the second MAC address exists in the correspondence table, the ASR returns a DHCP NAK message that refuses to renew the lease to the second terminal;

When the second MAC address does not exist in the correspondence table, the ASR returns a DHCP ACK message allowing the lease to be renewed to the second terminal.

Optionally, when the second IP address is not a temporary IP address, the ASR returns a DHCP ACK message for allowing the lease to be renewed to the second terminal.

An access service node ASR includes:

a first receiving unit, configured to: receive a dynamic host configuration protocol DHCP discovery message sent by the first terminal, where the DHCP discovery message carries a first media access control MAC address of the first terminal;

a first determining unit, configured to: determine whether the first MAC address exists in a corresponding In the relationship table, the correspondence between the user name and the MAC address of the terminal that has passed the identity authentication is recorded in the correspondence relationship table;

a first processing unit, configured to: determine, according to the correspondence relationship table, a first user name corresponding to the first MAC address, and to identify an identity when the first MAC address exists in the corresponding relationship table And the location registration register ILR sends an identity identification request message carrying the first username; and receives the first IP address returned by the ILR, and allocates the first IP address to the first terminal, where The first IP address is an identity identifier that is allocated by the ILR based on the first user name.

Optionally, the ASR further includes:

a second receiving unit, configured to: receive an identity authentication request forwarded by the portal server, where the identity authentication request carries a MAC address, a username, and a password of the terminal;

a recording unit, configured to forward the authentication request to the identity authentication server, and after the terminal authenticates by the identity authentication server, record the username and the MAC between the terminal in the correspondence table Correspondence.

Optionally, the ASR further includes:

a second processing unit, configured to: when the first MAC address does not exist in the correspondence table, forward the DHCP discovery message to a DHCP server, and pass between the DHCP server and the first terminal Forwarding the DHCP address allocation message, and assigning the temporary IP address selected by the DHCP server from the temporary IP address pool to the first terminal.

Optionally, the second processing unit is configured to: assign a temporary IP address selected by the DHCP server to the first terminal by forwarding a DHCP Offer message and a DHCP ACK message from the DHCP server, and assign the temporary The lease of the IP address is set to a preset value that is not greater than the maximum tolerable duration between the terminal's identity authentication and the IP address assigned by the ILR.

Optionally, the ASR further includes:

a third receiving unit, configured to: receive a DHCP renewing message sent by the second terminal, where the DHCP renewing message carries a second MAC address of the second terminal and a second IP address currently used;

a second determining unit, configured to: determine whether the second IP address is a temporary IP address;

a third determining unit, configured to: when the second IP address is a temporary IP address, further determining whether the second MAC address exists in the correspondence relationship table;

a third processing unit, configured to: when the second MAC address exists in the correspondence relationship table, return a DHCP NAK message that refuses to renew the lease to the second terminal;

And a fourth processing unit, configured to: when the second MAC address does not exist in the correspondence relationship table, return a DHCP ACK message that allows renewal of the lease to the second terminal.

Optionally, the ASR further includes:

And a fifth processing unit, configured to: when the second IP address is not a temporary IP address, return a DHCP ACK message allowing the lease renewal to the second terminal.

Embodiments of the present invention also provide a computer program including program instructions that, when executed by an ASR, cause the ASR to perform the method described above.

Embodiments of the present invention also provide a computer readable storage medium carrying the computer program. The address allocation method and the ASR of the embodiment of the present invention re-assign an IP address to the terminal based on the identity of the user after the terminal is authenticated by the portal identity, thereby realizing the identity identity assignment based on the user identity in the portal authentication network architecture. The application identity separation technology in the authentication network architecture provides technical support. At the same time, the above solution does not need to install the client in the terminal, nor does it need to change the user's existing usage habits, and is convenient and has good ease of use.

DRAWINGS

1 is a schematic diagram of a network architecture of an identity identification and location separation technology system according to related art;

2 is a schematic diagram of a network architecture of a portal authentication according to related art;

FIG. 3 is a schematic flowchart of an address allocation method according to an embodiment of the present disclosure;

4 is a schematic diagram of functional modules of an ASR according to an embodiment of the present invention;

FIG. 5 is a flowchart of a specific example of an address allocation method provided by the present invention.

Preferred embodiment of the invention

With the development of the network, the above-mentioned identity location separation technology has also been applied in the government-enterprise network. By assigning a fixed identity to each employee, network security management is enhanced and operation and maintenance consumption is reduced. However, due to the current network, many government and enterprise network authentication systems adopt the portal authentication method, as shown in Figure 2. The portal user is an office user, and the portal server is an authentication server. The Broadband Access Server (BAS) is a router device that sends the user's username and password to the Radius authentication server (not shown in Figure 2), and the Radius authentication server verifies the user identity.

Portal authentication is also commonly referred to as Web authentication. A typical example is as follows: When an unauthenticated user logs in to the government intranet, the device forces the user to log in to a specific site (such as an IT hotline), and the user can access the service of the site for free. When users need to access other information resources of the intranet (such as accessing servers, office operations, etc.), they must be authenticated on the portal. Only after the authentication is passed can the resources be used.

The portal service can provide convenient management functions for the government and enterprise network, which makes the management of the government and enterprise network operation and maintenance personnel simple. Since the portal authentication does not require the installation of the software client in the terminal, the office users are convenient to operate and widely used in the market. However, the characteristics of the portal authentication method determine that the user needs to first assign an IP address (for example, DHCP automatically obtains an IP address), and then the user logs in to the portal for identity authentication. The core idea of the identity location separation network is to assign addresses based on user identity. It can be seen that the IP address obtained by the user before the portal authentication is passed cannot be used as the identity of the identity separation network. Therefore, after the authentication, the old address of the user is released, and the address is reassigned as the identity.

In order to achieve the above address redistribution, the embodiment of the present invention provides an address allocation method in an identity location separation network, which implements address allocation under the portal authentication architecture under the identity location separation technology, and does not need to be changed without installing a client. The user is assigned an identity (IP address) based on the user's identity on the premise of the user's usage habits.

The address allocation method provided by the embodiment of the present invention is applied to an identity identification and location separation network, where the network includes an ASR, an ILR, and multiple terminals, and also includes a Portal server, a DHCP server, and an authentication server (such as a radius authentication server). And the device, wherein the terminal accesses the network through the corresponding ASR, and the DHCP server can be set in the ASR as a function module of the ASR, or can be independent of the ASR setting, and the ASR can act as a DHCP relay. The specific networking mode can be constructed according to the time network requirements and referring to the existing DHCP architecture. Similarly, ILR can be integrated in ASR or set independently of ASR. Referring to FIG. 3, an address allocation method according to an embodiment of the present invention includes the following steps:

Step 31: The ASR receives a DHCP Discover message sent by the first terminal, where the DHCP Discover message carries the first MAC address of the first terminal.

Here, a terminal (referred to as a first terminal for convenience of reference later) transmits a DHCP discovery message according to an existing DHCP standard. For example, when a terminal powers up or an IP address lease expires, the terminal broadcasts. A DHCP discovery message, which usually carries the MAC address of the terminal itself (for convenience of reference later, the MAC address is referred to as the first MAC address), so that the ASR accessed by the first terminal receives the message. DHCP discovery message sent by a terminal

Step 32: The ASR determines whether the first MAC address exists in a correspondence relationship table, where the correspondence between the user name and the MAC address of the terminal that has passed the identity authentication is recorded in the correspondence relationship table.

In the embodiment of the present invention, the user terminal can perform Portal identity authentication through the Portal site according to the access requirement, so as to obtain the permission to access more network resources. In order to distinguish the terminal that has passed the identity authentication, the embodiment of the present invention sets a correspondence relationship table in the ASR, where the MAC address of the terminal that has passed the Portal identity authentication and the user name used by the terminal for Portal authentication are recorded in the table. Correspondence relationship. Here, the username used for Portal authentication represents the user identity of the terminal.

The corresponding relationship table may be maintained in the Portal authentication process of the terminal. The specific maintenance mode may be: after the ASR receives the identity authentication request for any terminal forwarded by the Portal server, the identity authentication request carries the any terminal. The MAC address, the user name, and the password are forwarded to the identity authentication server (such as the radius server) for identity authentication, and after the identity of the terminal is authenticated by the identity authentication server, in the corresponding relationship table. Record the correspondence between the username of the terminal and the MAC.

In this way, in the foregoing step 32, it is determined whether the first terminal has passed the portal identity authentication according to whether the first MAC address exists in the correspondence relationship table.

Step 33: When the first MAC address exists in the correspondence relationship table, the ASR determines, according to the correspondence relationship table, a first user name corresponding to the first MAC address, and registers with the identity identifier and the location. The register ILR sends an identity request message carrying the first username.

Here, if the first terminal has already passed the portal identity authentication, the corresponding relationship between the MAC address of the first terminal and the user name will exist in the correspondence table, so the user name of the first terminal can be determined, so that the first terminal can be determined in the above step 33. The username is carried in the identity request and sent to the ILR.

Step 34: The ASR receives a first IP address returned by the ILR, and allocates the first IP address to the first terminal, where the first IP address is the ILR based on the first The user name is an identity identifier assigned by the first terminal.

Here, the correspondence between the username and the identity of the legal user may be pre-stored in the ILR. The identity may be an IP address, which is different from the temporary IP address assigned by the DHCP server. The IP address here is called an official IP address. After receiving the identity request message sent by the ASR in step 33, the ILR determines the identity (ie, the first IP address) corresponding to the first user name according to the first user name carried in the request message, and then, The first IP address is sent to the ASR. After receiving the first IP address returned by the ILR, the ASR allocates the first IP address to the first terminal.

Through the above steps, after the terminal passes the authentication, the embodiment of the present invention allocates an identity identifier (ie, an IP address) to the terminal based on the user name (ie, the user identity), thereby implementing identity identity assignment based on the user identity in the network architecture of the portal authentication. It is consistent with the core idea of the identity location separation network, and provides support for the application of identity location separation technology in the government-enterprise network. Moreover, the foregoing allocation method of the embodiment of the present invention does not need to install the client in the terminal, and does not need to change the user usage habit, which is convenient to implement and has good ease of use.

In the embodiment of the present invention, when the first terminal sends the DHCP discovery message, the portal terminal may not be authenticated. For example, the first terminal may be just powered on, and the DHCP discovery message is sent after the power is turned on. Of course, it is also possible that the first terminal does not pass the identity authentication of the authentication server although it performs Portal authentication. In these cases, the first MAC address of the first terminal does not exist in the above correspondence table. As another result of the foregoing step 32, the first MAC address may not exist in the corresponding relationship table. In this case, the foregoing method of the embodiment of the present invention further includes the following steps:

When the first MAC address does not exist in the correspondence table, the ASR forwards the DHCP discovery message to a DHCP server, and allocates a temporary IP address selected by the DHCP server from the temporary IP address pool to the The first terminal.

That is, if the first terminal has not passed Portal authentication, it is used by the DHCP server. Assign a temporary IP address. The DHCP server can maintain a temporary IP address pool, which includes a preset temporary IP address. For example, some IP addresses can be used as temporary IP addresses according to the network segment to which the address belongs. Of course, some specific IP addresses can also be used as temporary IP addresses. In the embodiment of the present invention, the ASR can identify the temporary IP address, for example, according to the network segment to which the IP address belongs, or whether the IP address is a temporary IP address according to whether the IP address is the specific IP address.

For the manner in which the DHCP server allocates a temporary IP address, refer to the prior art DHCP address allocation process. In the process, the ASR allocates a temporary IP address selected by the DHCP server to the first terminal by forwarding a DHCP Offer message and a DHCP ACK message from the DHCP server, and sets the lease of the temporary IP address to A preset value. Here, the preset value should generally be set smaller, so as to quickly discover the terminals that are authenticated in the timeout process and pass the Portal authentication through frequent lease timeouts, and re-assign the user-identified IP addresses to the terminals.

Usually, the network will have a lot of performance parameters, and there will be an expected or required value for these network performance parameters. As an implementation manner, the period from the time when a terminal passes the portal identity authentication to the IP address that the terminal obtains the ILR based on the user identity may be used as a performance indicator of the network. Obviously, the shorter the period, the higher the sensitivity of the network, and the easier it is to discover the terminals that have recently passed the Portal authentication and reassign the IP addresses based on the user's identity. Therefore, the network administrator can set the identity of the ILR from the terminal through the identity authentication to the terminal according to the requirements of the network sensitivity and considering the processing capabilities of the ASR and the DHCP server, and the number of terminals in the network. The maximum tolerable time. Then, the preset value of the above rental period is set to a value not greater than the maximum allowable duration, for example, set to 10s.

During the lease of the temporary IP address, the terminal determines when to initiate the renewal request based on the remaining duration of the lease of the current IP address. For example, when the lease period is still half the time, the DHCP renewal message is sent. The second terminal is taken as an example to describe how to perform the lease renewal process in the embodiment of the present invention. The second terminal here is any terminal in the network, for example, may be the first terminal in the above, or may be other terminals in the network.

The second terminal sends a DHCP renewal message, where the DHCP renewal message carries the second terminal The second MAC address and the second IP address currently in use. After receiving the DHCP renewing message sent by the second terminal, the ASR determines whether the second IP address is a temporary IP address:

When the second IP address is not a temporary IP address, the ASR returns a DHCP ACK message allowing the lease renewal to the second terminal;

When the second IP address is a temporary IP address, the ASR further determines whether the second MAC address exists in the correspondence table: if yes, returns a DHCP NAK that refuses to renew the lease to the second terminal. a message; if not, returning a DHCP ACK message allowing the renewal of the lease to the second terminal.

Through the above steps, when receiving the renewal request message of the terminal, if the IP address currently used by the terminal is a temporary IP address, and the terminal has already passed the portal identity authentication, the ASR rejects the renewal request of the terminal. In this way, when the lease timeout (or the remaining lease period is less than a preset threshold), the terminal will send a DHCP discovery message, and the ASR and ILR will assign the terminal identity based on the user identity (ie, the official IP). The address is such that the terminal does not use the temporary IP address after passing the Portal authentication, but uses the official IP address to access the corresponding network resource.

Based on the address allocation method provided by the foregoing embodiment, the embodiment of the present invention further provides an ASR for implementing the foregoing method. Referring to FIG. 4, the ASR includes:

The first receiving unit 41 is configured to receive a DHCP discovery message sent by the first terminal, where the DHCP discovery message carries the first MAC address of the first terminal;

The first determining unit 42 is configured to determine whether the first MAC address exists in a correspondence relationship table, where the correspondence relationship between the user name and the MAC address of the terminal that has passed the identity authentication is recorded in the correspondence relationship table;

The first processing unit 43 is configured to: when the first MAC address exists in the correspondence relationship table, determine, according to the correspondence relationship table, a first user name corresponding to the first MAC address, and The location registration register ILR sends an identity identification request message carrying the first username; and receives a first IP address returned by the ILR, and allocates the first IP address to the first terminal, where The first IP address is an identity identifier that is allocated by the ILR based on the first user name.

In the embodiment of the present invention, the foregoing ASR may maintain the foregoing correspondence table according to the information obtained in the authentication process of the terminal, where the ASR may further include:

a second processing unit, configured to: when the first MAC address does not exist in the correspondence table, forward the DHCP discovery message to a DHCP server, and forward DHCP between the DHCP server and the first terminal The address allocation message allocates the temporary IP address selected by the DHCP server from the temporary IP address pool to the first terminal.

The second receiving unit is configured to receive an identity authentication request forwarded by the Portal server for any terminal, where the identity authentication request carries a MAC address, a username, and a password of the any terminal.

a recording unit, configured to forward the authentication request to the identity authentication server, and after the identity of the terminal is authenticated by the identity authentication server, record the username and MAC address of the terminal in the corresponding relationship table. Correspondence between them.

Here, the second processing unit is further configured to allocate a temporary IP address selected by the DHCP server to the first terminal by forwarding a DHCP Offer message and a DHCP ACK message from the DHCP server, and rent the temporary IP address. The period is set to a preset value that is not greater than the maximum tolerable duration between the terminal's identity authentication and the IP address assigned by the ILR. Preferably, the preset value may be any value from 5 s to 15 s.

In the embodiment of the present invention, when receiving the renewal request sent by the terminal, the ASR may further determine whether to refuse or allow the renewal of the lease according to the IP address used by the terminal and whether the terminal has passed the Portal identity authentication. Also includes:

a third receiving unit, configured to receive a DHCP renewing message sent by the second terminal, where the DHCP renewing message carries a second MAC address of the second terminal and a second IP address currently used;

The second determining unit is configured to determine whether the second IP address is a temporary IP address.

The third determining unit is configured to further determine whether the second MAC address exists in the correspondence relationship table when the second IP address is a temporary IP address.

The third processing unit is configured to return, when the second MAC address exists in the correspondence table, a DHCP NAK message that refuses to renew the lease to the second terminal.

And a fourth processing unit, configured to return, to the second terminal, a DHCP ACK message that allows for renewal when the second MAC address does not exist in the correspondence table.

The fifth processing unit is configured to return, to the second terminal, a DHCP ACK message allowing the lease renewal when the second IP address is not a temporary IP address.

The address allocation method of the embodiment of the present invention will be described below through an application example. In this example, after the user terminal accesses the network, a DHCP address request is initiated. Since the user terminal does not perform Portal identity authentication at this time, the network allocates a temporary IP address with limited permissions to the user. After the user initiates and authenticates through the portal identity, the network rejects the user terminal's request for renewal of the temporary IP address. Therefore, the user terminal waits for the lease of the temporary IP address to expire, and then re-initiates the DHCP address request. The authenticated user identity is assigned to the user terminal as the official IP address of the identity. The specific process is shown in Figure 5, including:

Step 501: The UE is powered on (or plugged in to the Internet), initiates a DHCP Discover process, and sends a DHCP Discover message to request an address.

Step 502: The network allocates a temporary IP address to the user, for example, 10.255.255.1, because the UE does not pass the Portal identity authentication. The ASR allocates a temporary address. The ASR can act as a DHCP server to assign a temporary IP address. It can also act as a DHCP relay device to relay the address allocation request (DHCP Discover message) to the DHCP server. The specific relay process can refer to the current relay process. There are technical implementations, which are not repeated here;

Step 503: The ASR returns a DHCP Offer message to the UE, where the message carries the temporary IP address allocated by the network, and the address cannot be used as the identity identifier of the UE.

Step 504: After receiving the temporary IP address, the UE sends a DHCP Request message to request a lease for the temporary IP address.

Step 505: After the ASR confirms, return a DHCP ACK message to the UE, and carry the lease term of the temporary address. Among them, the lease term needs to be set shorter, for example: 10 seconds;

Thus, through the above steps, the UE obtains a temporary IP address and can use the temporary IP address to access the restricted network resources. If the UE does not initiate portal authentication during this process, when the temporary IP address lease expires, the UE initiates a request to renew the lease, and the network allows the lease to be renewed. The renewal process can be implemented by referring to the prior art, and is not described here;

Step 506: The UE initiates portal authentication, and inputs a username and password. The ASR forwards the user name and password to the identity authentication server (for example, AAA Server), and the identity authentication server authenticates the user identity. The ASR and the identity authentication server may be combined and set. Can be set independently, depending on the actual networking decision;

Step 507: If the UE passes the authentication, the ASR records the user identity of the UE (for example, the username). Binding relationship with the MAC address;

After that, if the ASR receives the renewing request (DHCP Request message) for the temporary IP address of the UE, the ASR returns a DHCP NAK and refuses to renew the lease;

Step 508, the UE waits for the temporary IP address lease timer to expire. At this time, the UE still does not obtain the renewal success response of the temporary IP address, so the UE will re-initiate DHCP Discover, request the address;

Step 509: After receiving the DHCP Discover message of the UE, the ASR extracts the MAC address of the UE carried in the message. Since the user identity of the UE and the MAC address are bound, the ASR determines the UE by querying the binding relationship. The user has been authenticated, so the user is not assigned a temporary address, and the user needs to be assigned an identity-based address. The ASR can determine the username corresponding to the MAC address of the UE according to the binding relationship.

Step 510: The ASR sends an address request to the ILR, where the request message carries user identity information, such as a username;

Step 511: The ILR assigns an identity to the UE based on the user identity information, and then returns the identity of the user to the ASR (eg, address 10.2.6.1).

In the above steps 510 and 511, if the ILR is deployed in the ASR (ILR and ASR merge settings), the address allocation process in step 511 can be implemented in the ASR;

In step 512, the ASR returns a DHCP Offer message to the user, and carries the identity identifier assigned by the ILR. In this way, the UE obtains an IP address based on the identity of the user. Subsequently, the UE may also send a DHCP Request message according to the DHCP process of the prior art, and request a lease for the IP address. The ASR returns a DHCP ACK message to the UE, carrying the lease term of the IP address, and the lease term here can be set longer. In this way, the UE can use the IP address to access the corresponding network resource.

After the UE obtains the IP address based on the user identity, if the UE initiates a renewal request for the IP address, the ASR will allow the UE to continue using the IP address.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented using an integrated circuit. The steps may be separately fabricated into individual integrated circuit modules, or a plurality of modules or steps may be fabricated into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

The address allocation method and the ASR of the embodiment of the present invention re-assign an IP address to the terminal based on the identity of the user after the terminal is authenticated by the portal identity, thereby realizing the identity identity assignment based on the user identity in the portal authentication network architecture. The application identity separation technology in the authentication network architecture provides technical support. At the same time, the above solution does not need to install the client in the terminal, nor does it need to change the user's existing usage habits, and is convenient and has good ease of use.

Claims

An address allocation method in an identity identification and location separation network, comprising:

The access service node ASR receives the dynamic host configuration protocol DHCP discovery message sent by the first terminal, where the DHCP discovery message carries the first media access control MAC address of the first terminal;

Determining, by the ASR, whether the first MAC address exists in a correspondence relationship table, where the correspondence relationship table records a correspondence between a user name and a MAC address of the terminal that has passed the identity authentication;

When the first MAC address exists in the correspondence table, the ASR determines, according to the correspondence table, a first user name corresponding to the first MAC address, and sends the first user name to the identity identifier and the location registration register ILR. Carrying an identity request message carrying the first username;

Receiving, by the ASR, a first IP address returned by the ILR, and assigning the first IP address to the first terminal, where the first IP address is the ILR based on the first user name The identity identifier assigned by the first terminal.
The method of claim 1 further comprising:

The ASR receives an identity authentication request forwarded by an ingress server, where the identity authentication request carries a MAC address, a username, and a password of a terminal;

And the ASR forwards the authentication request to the identity authentication server, and records the correspondence between the user name and the MAC of the terminal in the correspondence relationship table after the terminal is authenticated by the identity authentication server.
The method of claim 1 or 2, wherein

When the first MAC address does not exist in the correspondence table, the method further includes: the ASR forwarding the DHCP discovery message to the DHCP server, and the DHCP server from the temporary IP address pool The temporary IP address selected in is assigned to the first terminal.
The method of claim 3, wherein

The assigning the temporary IP address selected by the DHCP server from the temporary IP address pool to the first terminal includes:

The ASR allocates a temporary IP address selected by the DHCP server to the first terminal by forwarding a DHCP Offer message and a DHCP ACK message from the DHCP server, and The lease of the IP address is set to a preset value that is not greater than a predetermined maximum allowable duration between the terminal's identity authentication and the IP address assigned by the ILR.
The method of claim 3 further comprising:

The ASR receives the DHCP renewing message sent by the second terminal, where the DHCP renewing message carries the second MAC address of the second terminal and the second IP address currently used;

Determining, by the ASR, whether the second IP address is a temporary IP address;

When the second IP address is a temporary IP address, the ASR determines whether the second MAC address exists in the correspondence table;

When the second MAC address exists in the correspondence table, the ASR returns a DHCP NAK message that refuses to renew the lease to the second terminal;

When the second MAC address does not exist in the correspondence table, the ASR returns a DHCP ACK message allowing the lease to be renewed to the second terminal.
The method of claim 5, wherein

When the second IP address is not a temporary IP address, the ASR returns a DHCP ACK message allowing the lease renewal to the second terminal.
An access service node ASR includes:

a first receiving unit, configured to: receive a dynamic host configuration protocol DHCP discovery message sent by the first terminal, where the DHCP discovery message carries a first media access control MAC address of the first terminal;

a first determining unit, configured to: determine whether the first MAC address exists in a correspondence relationship table, where the correspondence between the user name and the MAC address of the terminal that has passed the identity authentication is recorded in the correspondence relationship table ;

a first processing unit, configured to: determine, according to the correspondence relationship table, a first user name corresponding to the first MAC address, and to identify an identity when the first MAC address exists in the corresponding relationship table And the location registration register ILR sends an identity identification request message carrying the first username; and receives the first IP address returned by the ILR, and allocates the first IP address to the first terminal, where The first IP address is an identity identifier that is allocated by the ILR based on the first user name.
The ASR of claim 7 further comprising:

a second receiving unit, configured to: receive an identity authentication request forwarded by the portal server, where the identity authentication request carries a MAC address, a username, and a password of the terminal;

a recording unit, configured to forward the authentication request to the identity authentication server, and after the terminal authenticates by the identity authentication server, record the username and the MAC between the terminal in the correspondence table Correspondence.
The ASR of claim 7 or 8, further comprising:

a second processing unit, configured to: when the first MAC address does not exist in the correspondence table, forward the DHCP discovery message to a DHCP server, and pass between the DHCP server and the first terminal Forwarding the DHCP address allocation message, and assigning the temporary IP address selected by the DHCP server from the temporary IP address pool to the first terminal.
The ASR of claim 9 wherein

The second processing unit is configured to: assign a temporary IP address selected by the DHCP server to the first terminal by forwarding a DHCP Offer message and a DHCP ACK message from the DHCP server, and rent the temporary IP address The period is set to a preset value that is not greater than the maximum tolerable duration between the terminal's identity authentication and the IP address assigned by the ILR.
The ASR of claim 10, further comprising:

a third receiving unit, configured to: receive a DHCP renewing message sent by the second terminal, where the DHCP renewing message carries a second MAC address of the second terminal and a second IP address currently used;

a second determining unit, configured to: determine whether the second IP address is a temporary IP address;

a third determining unit, configured to: when the second IP address is a temporary IP address, further determining whether the second MAC address exists in the correspondence relationship table;

a third processing unit, configured to: when the second MAC address exists in the correspondence relationship table, return a DHCP NAK message that refuses to renew the lease to the second terminal;

And a fourth processing unit, configured to: when the second MAC address does not exist in the correspondence relationship table, return a DHCP ACK message that allows renewal of the lease to the second terminal.
The ASR of claim 10, further comprising:

And a fifth processing unit, configured to: when the second IP address is not a temporary IP address, return a DHCP ACK message allowing the lease renewal to the second terminal.
A computer program comprising program instructions that, when executed by an ASR, cause the ASR to perform the method of any of claims 1-6.
A computer readable storage medium carrying the computer program of claim 13.