WO2017000565A1

WO2017000565A1 - User access control method and apparatus, relay device and server

Info

Publication number: WO2017000565A1
Application number: PCT/CN2016/074271
Authority: WO
Inventors: 张玉磊; 苏清
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-07-01
Filing date: 2016-02-22
Publication date: 2017-01-05
Also published as: CN106331203A; CN106331203B

Abstract

Provided are a user access control method and apparatus, a relay device and a server. The control method comprises: acquiring a media access control (MAC) address of the client and access information about the client; encapsulating the MAC address of the client and the access information about the client into a DHCP request packet, and forwarding the DHCP request packet to a DHCP server; receiving a DHCP response packet fed back by the DHCP server; and according to the DHCP response packet, acquiring the MAC address of the client, the access information about the client and network configuration information, updating the network configuration information recorded in a corresponding table entry matching the client in a pre-set table, and then forwarding the DHCP response packet to the client.

Description

User access control method, device, relay device and server

Technical field

The present application relates to a broadband access technology based on an Ethernet protocol of the Internet, for example, a control method, apparatus, relay device, and server for user access.

Background technique

DHCP (Dynamic Host Configuration Protocol) is a network configuration protocol that is optimized and extended based on the BOOTP (Bootstrap Protocol) protocol.

With the continuous development of Internet broadband services and the mobile Internet, DHCP is on the Internet Protocol Television (IPTV), NGN (Next Generation Network, Next Generation Network) 3G (the 3th Generation mobile communication technology) Technology), 4G (the 4th Generation mobile communication technology) and other applications in the business. At present, the management user on the DHCP device mainly distinguishes different users by using a User MAC (Medium/Media Access Control) address. Users on the same DHCP relay device/server (relay/server) use the MAC address carried in the DHCP packet to centrally manage users accessing from the same or different paths. However, as the service expands, there are more and more cases where the user MAC address is duplicated. Although in most cases, these same MAC users are distributed in different virtual local area networks, which causes the DHCP relay/server to distinguish between these different users. It is not possible to dynamically assign different addresses and configuration information to them and to effectively manage these users. In order to better carry out business and manage users, operators urgently need to find a way to solve user access and management of duplicate MAC addresses.

Summary of the invention

The embodiment of the invention provides a method, a device, a relay device and a server for controlling user access. By combining the access information and the MAC address of the client, the client with the same MAC address can be distinguished and the network configuration information can be allocated. , effectively manage it.

In order to solve the above technical problem, the embodiment of the present invention adopts the following technical solutions:

A user access control method is applied to a dynamic host configuration protocol DHCP relay device; the control method includes:

Receiving a DHCP request message sent by the client, acquiring a media access control MAC address of the client, and access information of the client;

Encapsulating the MAC address of the client and the access information of the client into a DHCP request message, and forwarding the DHCP request message to the DHCP server;

Receiving a DHCP response message fed back by the DHCP server, where the DHCP response message carries network configuration information allocated by the DHCP server to the client;

Acquiring, according to the DHCP response packet, the MAC address of the client, the access information of the client, and the network configuration information, and updating the network configuration information recorded in the corresponding entry in the preset table that matches the client, The DHCP response message is then forwarded to the client.

Optionally, after the receiving the DHCP request packet sent by the client, acquiring the MAC address of the client and the access information of the client, the control method further includes:

If there is no corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the MAC address of the client and the access by the client are used. The information creates a new entry for recording network configuration information allocated by the DHCP server for the client.

Optionally, the encapsulating the MAC address of the client and the access information of the client into a DHCP request message, and forwarding the DHCP request message to the DHCP server, includes:

Encapsulating the access information of the client as the content of the relay proxy option and the MAC address of the client into the DHCP request message;

Forwarding the DHCP request message to the DHCP server.

Optionally, the obtaining, according to the DHCP response packet, the MAC address of the client and the access information of the client, and updating the network configuration recorded in the corresponding entry in the preset table that matches the client And then forwarding the DHCP response message to the client, including:

Acquiring, according to the DHCP response packet, the MAC address of the client encapsulated in the DHCP response packet and the access information of the client included in the content of the relay proxy option;

Querying, according to the MAC address of the client and the access information of the client, a corresponding entry matching the client in the preset record table;

Assigning to the client according to the DHCP server carried in the DHCP response packet Network configuration information, updating network configuration information of the client recorded in the corresponding entry;

The relay agent option is stripped from the DHCP response message, and the stripped DHCP response message is forwarded to the client.

Optionally, obtaining the media access control MAC address of the client and the access information of the client, including:

Acquiring, according to the DHCP request message, a media access control MAC address of the client and access information of the client.

A method for controlling user access is applied to a DHCP server; the control method includes:

Receiving a DHCP request message, obtaining a media access control MAC address of the client and access information of the client;

Allocating network configuration information to the client, and encapsulating the network configuration information, the MAC address of the client, and the access information of the client into a DHCP response message.

Optionally, the acquiring the MAC address of the client and the access information of the client include:

Obtaining, according to the DHCP request packet forwarded by the DHCP relay device, the MAC address of the client encapsulated in the DHCP request message and the access information of the client included in the content of the relay agent option.

Optionally, the allocating network configuration information to the client, and the network configuration information, the MAC address of the client, and the access information of the client are encapsulated into a DHCP response message, including:

Allocating network configuration information to the client, and encapsulating the access information of the client as the content of the relay proxy option with the MAC address of the client and the network configuration information into the DHCP response packet, and Feedback to the DHCP relay device.

Optionally, receiving the DHCP request message, including receiving the DHCP request message sent by the client.

If there is a corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the record in the corresponding entry matching the client in the preset table is updated. Network configuration information, sending the DHCP response message to the client;

In the case that the MAC address of the client and the corresponding entry of the client's access information do not exist in the preset record table, a new table is created according to the MAC address of the client and the access information of the client. And recording network configuration information allocated by the DHCP server for the client.

A control device for user access is applied to a DHCP relay device; the control device includes:

The first obtaining module is configured to receive a DHCP request message sent by the client, and obtain a media access control MAC address of the client and access information of the client;

The forwarding module is configured to encapsulate the MAC address of the client and the access information of the client into a DHCP request message, and forward the DHCP request message to the DHCP server, and receive the DHCP response fed back by the DHCP server. a packet, the DHCP response packet carrying network configuration information allocated by the DHCP server to the client;

The first update module is configured to acquire the network configuration information, the MAC address of the client, and the access information of the client according to the DHCP response packet, and update the preset table to match the client. Corresponding to the network configuration information recorded in the entry, and then forwarding the DHCP response packet to the client.

Optionally, the control device further includes:

a first creating module, configured to: if there is no corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, according to the MAC address and location of the client The client access information is used to create a new entry, and the network configuration information allocated by the DHCP server to the client is recorded.

Optionally, the forwarding module includes:

The encapsulating unit is configured to encapsulate the access information of the client as the content of the relay proxy option and the MAC address of the client into the DHCP request message;

The forwarding unit is configured to forward the DHCP request message to the DHCP server, and the DHCP server allocates network configuration information to the client, and feeds back a DHCP response message.

Optionally, the first update module includes:

An obtaining unit, configured to obtain, according to the DHCP response message, the MAC address of the client encapsulated in the DHCP response message and the access information of the client included in the content of the relay agent option;

The querying unit is configured to query, according to the MAC address of the client and the access information of the client, the corresponding entry matching the client in the preset record table;

An update unit, configured to update network configuration information of the client recorded in the corresponding entry according to network configuration information that is allocated by the DHCP server to the client in the DHCP response packet;

The stripping unit is configured to strip the relay proxy option from the DHCP response packet, and forward the stripped DHCP response packet to the client.

Optionally, the first obtaining module is configured to obtain, according to the DHCP request packet sent by the client, the media access control MAC address of the client and the access information of the client.

A control device for user access is applied to a DHCP server; the control device includes:

The second obtaining module is configured to receive the DHCP request message, obtain the media access control MAC address of the client, and the access information of the client;

The encapsulating module is configured to allocate network configuration information to the client, and encapsulate the network configuration information, the MAC address of the client, and the access information of the client into a DHCP response message.

Optionally, the second obtaining module is configured to: obtain, according to the DHCP request packet forwarded by the DHCP relay device, the content of the MAC address of the client encapsulated in the DHCP request message and the content of the relay agent option. The access information of the client.

Optionally, the encapsulating module is configured to: allocate network configuration information to the client, use the access information of the client as the content of the relay proxy option, and the MAC address of the client and the network. The configuration information is encapsulated into the DHCP response message and fed back to the DHCP relay device.

Optionally, the second obtaining module is configured to: receive a DHCP request packet sent by the client, and obtain a media access control MAC address of the client and access information of the client;

The control device further includes:

The second update module is configured to: if there is a corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the update preset table matches the client The network configuration information recorded in the corresponding entry, and then sending the DHCP response message to the client;

a second creation module, configured to: if the MAC address of the client does not exist in the preset record table, and the corresponding entry of the client access information, according to the MAC address of the client and the client The access information creates a new entry, and records network configuration information allocated by the DHCP server for the client.

A computer readable storage medium storing computer executable instructions for performing the methods described above.

In the method for controlling user access provided by the embodiment of the present invention, by combining the access letter of the client The MAC address of the client and the client can distinguish between multiple users with the same MAC address, and then assign network configuration information to the access user. By matching in the preset table according to the MAC address of the client and its access information, The network configuration information allocated by the DHCP server is updated in the matched corresponding entry, and the management and control of users accessing from different access paths and having the same MAC address are implemented.

BRIEF abstract

1 is a flowchart of a method for controlling user access in an embodiment of the present invention;

2 is a flowchart of forwarding a DHCP request message in the embodiment of the present invention;

3 is a flow chart showing updating network configuration information in an embodiment of the present invention;

4 is a second flowchart of a method for controlling user access in an embodiment of the present invention;

FIG. 5 is a timing diagram showing a control method of user access in an embodiment of the present invention;

6 is a third flowchart of a method for controlling user access in an embodiment of the present invention;

FIG. 7 is a second timing diagram of a method for controlling user access in an embodiment of the present invention;

FIG. 8 is a block diagram showing the structure of a control device accessed by a user in an embodiment of the present invention;

FIG. 9 is a structural block diagram of a forwarding module according to an embodiment of the present invention;

10 is a structural block diagram of a first update module in an embodiment of the present invention;

Figure 11 is a block diagram showing the structure of a control device for user access in the embodiment of the present invention;

FIG. 12 is a third structural block diagram of a control device for user access in an embodiment of the present invention.

Embodiments of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

Embodiment 1

According to an aspect of the embodiments of the present invention, a method for controlling user access is provided, which is applied to a DHCP relay device in a dynamic host configuration protocol DHCP network including a client, a relay device, and a server that allocates network configuration information. As shown in FIG. 1, the control method includes:

Step S101: Receive a DHCP request packet sent by the client, and obtain a MAC address of the client and access information of the client; the MAC address may be obtained from a DHCP request message, and the access information may also be a DHCP request message. Obtained, if the DHCP request message does not carry the access information, Access information can also be obtained from other messages or configuration information.

Step S103: Encapsulate the MAC address of the client and the access information of the client into the DHCP request message, and forward the DHCP request message to the DHCP server, where the DHCP server allocates network configuration information (including information such as an IP address) to the client. And feeding back a DHCP response message to the DHCP relay device;

Step S105: Obtain a MAC address of the client according to the DHCP response message, the access information of the client, and the network configuration information allocated by the DHCP server to the client, and update the network configuration recorded in the corresponding entry in the preset table that matches the client. The information is processed and the DHCP response packet is processed and forwarded to the client.

In the embodiment of the present invention, the DHCP relay device receives the DHCP request packet sent by the client, obtains the MAC address and the access information of the client, and encapsulates the MAC address and the access information of the client into the DHCP request packet and forwards the packet to the DHCP request packet. When the DHCP server feeds back the response packet, the DHCP server also encapsulates the MAC address and access information of the client and the network configuration information allocated to the client into the DHCP response packet, which is based on the MAC address of the client in the preset table. The address and the access information are matched, and the network configuration information allocated by the DHCP server can be updated in the matching corresponding entry. Therefore, the control method in the embodiment of the present invention can distinguish between multiple clients with the same MAC address according to the MAC address and the access information of the client, and obtain the network configuration information allocated by the DHCP server for the client, thereby achieving the corresponding Users with different access paths accessing and the same MAC address are managed and controlled.

If there is no corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the new entry is created according to the MAC address of the client and the access information of the client, and the DHCP server is recorded. Network configuration information assigned by the client.

As shown in FIG. 2, in the embodiment of the present invention, the MAC address of the client and the access information of the client are encapsulated into a DHCP request message, and the DHCP request message is forwarded to the DHCP server, and the DHCP server allocates a network to the client. And configuring the information and feeding back the DHCP response message to the DHCP relay device (step S103), including:

Step S1031: The client access information is used as the content of the relay agent option, and the MAC address of the client is encapsulated into the DHCP request message;

Step S1033: Forward the DHCP request message to the DHCP server, and the DHCP server allocates network configuration information to the client, and feeds back the DHCP response message to the DHCP server.

Therefore, the access information of the client is encapsulated into the DHCP request message by using the relay agent option as a carrier, and the address information of the client is transmitted and recorded on the DHCP relay device and the DHCP server through the relay agent option.

As shown in FIG. 3, in the embodiment of the present invention, the MAC address of the client and the access information of the client are obtained according to the DHCP response message, and the network configuration information recorded in the corresponding entry matching the client in the preset table is updated. Then, the DHCP response packet is processed and forwarded to the client (step S105), including:

Step S1051: Obtain, according to the DHCP response packet, the MAC address of the client encapsulated in the DHCP response packet and the access information of the client included in the content of the relay proxy option.

Step S1053: Query, according to the MAC address of the client and the access information of the client, the corresponding entry matching the client in the preset record table;

Step S1055: Update the network configuration information of the client recorded in the corresponding entry according to the network configuration information allocated by the DHCP server carried in the DHCP response packet to the client.

Step S1057: The relay agent option is stripped from the DHCP response message, and the stripped DHCP response message is forwarded to the client.

After obtaining the response message fed back by the DHCP server, the relay agent obtains the access information of the client according to the MAC address and the relay agent option of the client in the response packet, and matches the MAC address of the client in the preset record table. Corresponding entries matching the address and the access information, and then updating the network configuration information of the client recorded therein, and then the relay agent option is stripped from the response packet and then forwarded to the client, thereby achieving different access Users with the same path access and the same MAC address are managed and controlled.

Embodiment 2

According to another aspect of the embodiments of the present invention, a method for controlling user access is also provided, which is applied to a DHCP server in a dynamic host configuration protocol DHCP network including a client, a relay device, and a server that allocates network configuration information. As shown in FIG. 4, the control method includes:

Step S401: Obtain a MAC address of the client and access information of the client according to the DHCP request packet forwarded by the DHCP relay device.

Step S403: Allocating network configuration information to the client, and encapsulating the network configuration information, the MAC address of the client, and the access information of the client into the DHCP response message.

The DHCP server will serve the client after receiving the request packet forwarded by the DHCP relay device. The terminal allocates the network configuration information, and encapsulates the MAC address of the client, the access information of the client, and the network configuration information allocated to the client into the response packet. Therefore, the control method in the embodiment of the present invention can be based on the MAC address of the client and The access information is differentiated among multiple clients with the same MAC address, and the network configuration information is allocated to the client, thereby achieving management and control for users accessing different access paths and having the same MAC address.

In the embodiment of the present invention, the MAC address of the client and the access information of the client are obtained according to the DHCP request packet forwarded by the DHCP relay device (step S401), which is:

According to the DHCP request packet forwarded by the DHCP relay device, the MAC address of the client encapsulated in the DHCP request message and the access information of the client included in the content of the relay agent information option are obtained.

The network configuration information is allocated to the client, and the network configuration information, the MAC address of the client, and the access information of the client are encapsulated into a DHCP response message (step S403), which is:

The network configuration information is allocated to the client, and the access information of the client is used as the content of the relay agent information option, and the MAC address of the client and the network configuration information are encapsulated into the DHCP response message, and fed back to the DHCP relay device.

In the embodiment of the present invention, the relay agent option is a DHCP option 82 option. It can be understood that, in the embodiment of the present invention, the option type of the relay agent option is not limited.

In a DHCP network that includes a client, a relay device, and a server that allocates network configuration information, a sequence diagram of the DHCP server assigning network configuration information to the client is shown in FIG. 5, wherein the DHCP client is a DHCP client, that is, the client. The DHCP relay is a DHCP relay device; the DHCP server is a DHCP server, and the timing sequence is as follows:

Step 501: The DHCP client sends a DHCP discovery (discover) message to the DHCP relay.

Step 502. The DHCP relay receives the DHCPdiscover message, obtains the user access side access information and the user MAC address, and uses the access information as the option 82 option, fills the DHCP discover message, and selects the DHCP server to continue to send the DHCP discover, the MAC. The address can be extracted from the DHCP request message, and the access information can also be extracted from the DHCP request message. If the DHCP request message does not carry the access information, the access information can be extracted from other messages or configuration information. information. ;

Step 503: After receiving the DHCP discover, the DHCP server allocates network configuration information to the user, and returns a DHCP offer (offer) message to the DHCP relay. The DHCP offer message carries the network configuration information, the user MAC address, and the DHCP discover message. Option82 information;

Step 504: The DHCP relay receives the DHCP offer message, obtains the user MAC address, and extracts the access information of the user access side from the option 82, and matches the existing entry in the preset record table according to the access information and the MAC address of the user. The network configuration information assigned by the DHCP server is saved. If there is no matching corresponding entry, a new user entry is created, and the network configuration information allocated by the DHCP server for the user is recorded; the option 82 information in the DHCP offer is stripped and sent to the DHCP client. DHCP offer message;

Step 505. The DHCP client returns a DHCP request message to the DHCP relay.

Step 506: The DHCP relay receives the DHCP Request message, and extracts the user access side access information and the user MAC address from the message, and matches the existing corresponding entry in the preset record table according to the access information and the MAC address of the user. And the access information is used as the option 82 option, filled in the DHCP request message, and sent to the DHCP server;

Step 507. After receiving the DHCP request, the DHCP server returns a DHCP acknowledgement (ack) packet to the DHCP relay, and the DHCP ack carries the option 82 information carried in the DHCP request packet.

Step 508. The DHCP relay receives the DHCP ack packet, obtains the user MAC address, and extracts the access information of the user access side from the option 82, and matches the existing correspondence table according to the access information and the MAC address of the user. The item saves the network configuration information assigned by the DHCP server, strips the option 82 information in the DHCP ack, and sends a DHCP ack message to the DHCP client. The process ends.

Embodiment 3

According to another aspect of the embodiments of the present invention, a method for controlling user access is also provided, which is applied to a DHCP server in a DHCP network including a client and a server that allocates an address, as shown in FIG. 6, the control method 600 includes:

Step S601: Receive a DHCP request message sent by the client, obtain a MAC address of the client, and access information of the client, and allocate network configuration information to the client, where the MAC address can be obtained from the DHCP request message, where the The incoming information can also be obtained from the DHCP request message. If the DHCP request message does not carry the access information, the access information can also be obtained from other messages or configuration information. ;

Step S603: If there is a corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the network configuration information recorded in the corresponding entry matching the client in the preset table is updated. Then sending a DHCP response message to the client;

Step S605: If the MAC address of the client and the corresponding entry of the client's access information do not exist in the preset record table, create a new entry according to the MAC address of the client and the access information of the client, and record the DHCP server as Network configuration information assigned by the client.

When the client is directly connected to the DHCP server, the DHCP server directly allocates network configuration information to the client according to the MAC address of the client and its access information, and can distinguish between multiple users with the same MAC address, and then access the network. The user allocates network configuration information to implement management and control of users accessing different access paths and having the same MAC address.

In the embodiment of the present invention, the access information of the client may be the virtual local area network (VLAN) VLAN information or the interface information. It is to be understood that, in the embodiment of the present invention, the access information of the client is not limited to the foregoing information.

In the DHCP network that includes the client and the server that allocates the address, the timing diagram of the DHCP server assigning network configuration information to the client is shown in Figure 7. The DHCP client is the DHCP client, that is, the client; the DHCP server is the DHCP server. The timing sequence is as follows:

Step 701: The DHCP client sends a DHCP discover message to the DHCP server.

Step 702: The DHCP server receives the DHCP discover message, and obtains the user access side access information and the user MAC address, and matches the existing entry in the preset record table according to the access information and the user MAC address, if there is no matching entry. The corresponding user entry is created, and the network configuration information assigned by the DHCP server to the user is recorded. If there is a matching corresponding entry, the network configuration information of the corresponding entry in the preset table is updated and allocated to the user. After the network configuration information is recorded, the network configuration information is recorded, and the DHCP offer message is returned.

Step 703: The DHCP client returns a DHCP request message to the DHCP server.

Step 704: The DHCP server receives the DHCP request packet, and obtains the user access information and the user MAC address. The access information and the MAC address of the user match the existing entries in the preset record table, and the network configuration information allocated by the DHCP server is saved, and The DHCP ack message is returned to the user and the process ends.

The DHCP server can obtain the MAC address and the access information from the DHCP request packet. If the DHCP request packet does not carry the access information, the DHCP server can obtain the access information from other packets or configuration information.

Embodiment 4

According to another aspect of the embodiments of the present invention, a control device for user access is also provided. For a DHCP relay device in a dynamic host configuration protocol DHCP network including a client, a relay device, and a server that allocates network configuration information, as shown in FIG. 8, the control device 800 includes:

The first obtaining module 801 is configured to receive a DHCP request packet sent by the client, and obtain the MAC address of the client and the access information of the client.

The forwarding module 803 is configured to encapsulate the MAC address of the client and the access information of the client into the DHCP request message, and forward the DHCP request message to the DHCP server, and receive the DHCP response message and the DHCP response message fed back by the DHCP server. Carrying a network configuration information assigned by the DHCP server to the client;

The first update module 805 is configured to obtain the MAC address of the client and the access information of the client according to the DHCP response message, and update the network configuration information recorded in the corresponding entry in the preset table that matches the client, and then the DHCP The response packet is processed and forwarded to the client.

In the embodiment of the present invention, the control device further includes:

The first creating module is configured to create a new entry according to the MAC address of the client and the access information of the client if the corresponding entry in the preset record table does not match the MAC address of the client and the access information of the client. , record the network configuration information that the DHCP server allocates for the client.

As shown in FIG. 9, in the embodiment of the present invention, the forwarding module 803 includes:

The encapsulating unit 8031 is configured to encapsulate the access information of the client as a content of the relay proxy option and the MAC address of the client into the DHCP request message;

The forwarding unit 8033 is configured to forward the DHCP request message to the DHCP server, and the DHCP server allocates network configuration information to the client, and feeds back the DHCP response message.

As shown in FIG. 10, in the embodiment of the present invention, the first update module 805 includes:

The obtaining unit 8051 is configured to obtain, according to the DHCP response packet, the MAC address of the client encapsulated in the DHCP response packet and the access information of the client included in the content of the relay proxy option;

The querying unit 8053 is configured to query, according to the MAC address of the client and the access information of the client, the corresponding entry matching the client in the preset record table;

The updating unit 8055 is configured to update the network configuration information of the client recorded in the corresponding entry according to the network configuration information allocated by the DHCP server carried in the DHCP response packet to the client;

The stripping unit 8057 is configured to strip the relay agent option from the DHCP response message and forward the stripped DHCP response message to the client.

The control device in the embodiment of the present invention can distinguish between multiple clients with the same MAC address according to the MAC address of the client and the access information thereof, and obtain the DHCP server to allocate network configuration information to the client, thereby achieving Manage and control users accessing different access paths and having the same MAC address.

Embodiment 5

According to another aspect of the embodiments of the present invention, there is also provided a DHCP relay device, comprising the above-mentioned control device for user access.

The DHCP relay device in the embodiment of the present invention can distinguish between multiple clients with the same MAC address according to the MAC address of the client and the access information thereof, and obtain the DHCP server to allocate network configuration information to the client, thereby achieving Manage and control users accessing different access paths and having the same MAC address.

Embodiment 6

According to another aspect of the embodiments of the present invention, a user access control apparatus is further applied to a DHCP server in a dynamic host configuration protocol DHCP network including a client, a relay device, and a server that allocates network configuration information. As shown in FIG. 11, the control device 1100 includes:

The second obtaining module 1101 is configured to obtain the MAC address of the client and the access information of the client according to the DHCP request packet forwarded by the DHCP relay device.

The encapsulating module 1103 is configured to allocate network configuration information to the client, and encapsulate the network configuration information, the MAC address of the client, and the access information of the client into the DHCP response packet.

The second obtaining module 1101 is configured to: according to the DHCP request message forwarded by the DHCP relay device, obtain the MAC address of the client encapsulated in the DHCP request message and the access information of the client included in the content of the relay agent option.

The encapsulation module 1103 is configured to: allocate network configuration information to the client, and encapsulate the client access information as the content of the relay proxy option with the client's MAC address and network configuration information into the DHCP response packet, and feed back to the DHCP relay. device.

In the embodiment of the present invention, after receiving the request packet forwarded by the DHCP relay device, the DHCP server allocates network configuration information to the client, and encapsulates the MAC address of the client and the access information of the client into the response packet. Therefore, the control device in the embodiment of the present invention can be based on the MAC of the client. The address and its access information are distinguished among multiple clients with the same MAC address, and network configuration information is allocated thereto, thereby achieving management and control for users accessing different access paths and having the same MAC address.

Example 7

According to another aspect of the embodiments of the present invention, there is also provided a DHCP server, including the above-mentioned control device for user access.

The DHCP server in the embodiment of the present invention can distinguish between multiple clients with the same MAC address according to the MAC address of the client and its access information, and allocate network configuration information to the access terminal to access the access path from different access paths. Users with the same MAC address are managed and controlled.

Example eight

According to another aspect of the embodiments of the present invention, there is also provided a user access control apparatus, which is applied to a DHCP server in a dynamic host configuration protocol DHCP network including a client and a server that allocates network configuration information, as shown in FIG. 12 . As shown, the control device 1200 includes:

The third obtaining module 1201 is configured to receive the DHCP request message, obtain the MAC address of the client, and the access information of the client, and allocate network configuration information to the client.

The second update module 1203 is configured to: if there is a corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, update the corresponding entry in the preset table that matches the client. Recording network configuration information, and then sending a DHCP response message to the client;

The second creating module 1205 is configured to create a new entry according to the MAC address of the client and the access information of the client if the MAC address of the client and the corresponding entry of the client's access information do not exist in the preset record table. And record the network configuration information that the DHCP server allocates for the client.

When the client directly connects to the DHCP server, the DHCP server allocates network configuration information to the client directly according to the MAC address of the client and its access information, and can distinguish multiple users with the same MAC address, and then access the user. The allocation of network configuration information enables management and control of users accessing different access paths and having the same MAC address.

In the embodiment of the present invention, the access information of the client is the VLAN information or the interface information of the virtual local area network. It is to be understood that, in the embodiment of the present invention, the access information of the client is not limited to the foregoing information.

Example nine

According to another aspect of the embodiments of the present invention, there is also provided a DHCP server, including the above User access control device.

The DHCP server in the embodiment of the present invention can directly allocate network configuration information to the client according to the MAC address of the client and the access information thereof, and can distinguish the users with the same MAC address, and then allocate the network configuration information to the access user. It realizes the management and control of users accessing from different access paths and having the same MAC address.

The above is an embodiment of the present invention, and it should be noted that those skilled in the art can also make improvements and retouching without departing from the principles described in the embodiments of the present invention. These improvements and retouchings are also in the present invention. Within the scope of protection.

The embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions for executing the method described in the foregoing embodiments.

The embodiment of the invention further provides a control device comprising a memory and at least one processor, wherein the memory stores instructions executable by the processor, the instructions being used to execute the method described in the above embodiments.

This document is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Industrial applicability

In the authentication method provided by the present application, by combining the access information and the MAC address of the client, multiple users with the same MAC address can be distinguished, and management of users with the same MAC address accessing from different access paths is realized. And control.

Claims

A user access control method is applied to a dynamic host configuration protocol DHCP relay device; the control method includes:

Receiving a DHCP request message sent by the client, acquiring a media access control MAC address of the client, and access information of the client;

Encapsulating the MAC address of the client and the access information of the client into a DHCP request message, and forwarding the DHCP request message to the DHCP server;

Receiving a DHCP response message fed back by the DHCP server, where the DHCP response message carries network configuration information allocated by the DHCP server to the client;

Acquiring, according to the DHCP response packet, the MAC address of the client, the access information of the client, and the network configuration information, and updating the network configuration information recorded in the corresponding entry in the preset table that matches the client, The DHCP response message is then forwarded to the client.
The control method according to claim 1, wherein after the receiving the DHCP request message sent by the client, obtaining the MAC address of the client and the access information of the client, the control method further includes:

If there is no corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the MAC address of the client and the access by the client are used. The information creates a new entry for recording network configuration information allocated by the DHCP server for the client.
The control method according to claim 1, wherein the encapsulating the MAC address of the client and the access information of the client into a DHCP request message, and forwarding the DHCP request message to a DHCP server, including :

Encapsulating the access information of the client as the content of the relay proxy option and the MAC address of the client into the DHCP request message;

Forwarding the DHCP request message to the DHCP server.
The control method according to claim 1, wherein the obtaining the MAC address of the client and the access information of the client according to the DHCP response message, and updating the preset table to match the client Corresponding to the network configuration information recorded in the entry, and then forwarding the DHCP response packet to the client, including:

Acquiring the client encapsulated in the DHCP response packet according to the DHCP response packet The MAC address of the end and the access information of the client included in the content of the relay agent option;

Querying, according to the MAC address of the client and the access information of the client, a corresponding entry matching the client in the preset record table;

Updating the network configuration information of the client recorded in the corresponding entry according to the network configuration information that is allocated by the DHCP server to the client in the DHCP response packet;

The relay agent option is stripped from the DHCP response message, and the stripped DHCP response message is forwarded to the client.
The method of any one of the preceding claims, wherein obtaining the media access control MAC address of the client and the access information of the client comprises:

Acquiring, according to the DHCP request message, a media access control MAC address of the client and access information of the client.
A method for controlling user access is applied to a DHCP server; the control method includes:

Receiving a DHCP request message, obtaining a media access control MAC address of the client and access information of the client;

Allocating network configuration information to the client, and encapsulating the network configuration information, the MAC address of the client, and the access information of the client into a DHCP response message.
The control method of claim 6, wherein the obtaining the MAC address of the client and the access information of the client comprises:

Obtaining, according to the DHCP request packet forwarded by the DHCP relay device, the MAC address of the client encapsulated in the DHCP request message and the access information of the client included in the content of the relay agent option.
The control method according to claim 6, wherein said allocating network configuration information to said client, and encapsulating said network configuration information, said client's MAC address and said client access information into a DHCP response message Text, including:

Allocating network configuration information to the client, and encapsulating the access information of the client as the content of the relay proxy option with the MAC address of the client and the network configuration information into the DHCP response packet, and Feedback to the DHCP relay device.
The control method of claim 6, wherein receiving the DHCP request message comprises:

Receive DHCP request packets sent by the client.
The control method according to claim 6, wherein said assigning a network configuration to said client The information, the network configuration information, the MAC address of the client, and the access information of the client are encapsulated into a DHCP response message, including:

If there is a corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the record in the corresponding entry matching the client in the preset table is updated. Network configuration information, sending the DHCP response message to the client;

In the case that the MAC address of the client and the corresponding entry of the client's access information do not exist in the preset record table, a new table is created according to the MAC address of the client and the access information of the client. And recording network configuration information allocated by the DHCP server for the client.
A control device for user access is applied to a DHCP relay device; the control device includes:

The first obtaining module is configured to receive a DHCP request message sent by the client, and obtain a media access control MAC address of the client and access information of the client;

The forwarding module is configured to encapsulate the MAC address of the client and the access information of the client into a DHCP request message, and forward the DHCP request message to the DHCP server, and receive the DHCP response fed back by the DHCP server. a packet, the DHCP response packet carrying network configuration information allocated by the DHCP server to the client;

The first update module is configured to acquire the network configuration information, the MAC address of the client, and the access information of the client according to the DHCP response packet, and update the preset table to match the client. Corresponding to the network configuration information recorded in the entry, and then forwarding the DHCP response packet to the client.
The control device according to claim 11, wherein the control device further comprises:

a first creating module, configured to: if there is no corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, according to the MAC address and location of the client The client access information is used to create a new entry, and the network configuration information allocated by the DHCP server to the client is recorded.
The control device of claim 11, wherein the forwarding module comprises:

The encapsulating unit is configured to encapsulate the access information of the client as the content of the relay proxy option and the MAC address of the client into the DHCP request message;

The forwarding unit is configured to forward the DHCP request message to the DHCP server, and the DHCP server allocates network configuration information to the client, and feeds back a DHCP response message.
The control device of claim 11, wherein the first update module comprises:

An obtaining unit, configured to obtain, according to the DHCP response message, the MAC address of the client encapsulated in the DHCP response message and the access information of the client included in the content of the relay agent option;

The querying unit is configured to query, according to the MAC address of the client and the access information of the client, the corresponding entry matching the client in the preset record table;

An update unit, configured to update network configuration information of the client recorded in the corresponding entry according to network configuration information that is allocated by the DHCP server to the client in the DHCP response packet;

The stripping unit is configured to strip the relay proxy option from the DHCP response packet, and forward the stripped DHCP response packet to the client.
The control device according to any one of claims 11 to 14, wherein the first obtaining module is configured to acquire a media access control MAC address of the client according to a DHCP request message sent by a client, and Client access information.
A control device for user access is applied to a DHCP server; the control device includes:

The second obtaining module is configured to receive the DHCP request message, obtain the media access control MAC address of the client, and the access information of the client;

The encapsulating module is configured to allocate network configuration information to the client, and encapsulate the network configuration information, the MAC address of the client, and the access information of the client into a DHCP response message.
The control device according to claim 16, wherein the second obtaining module is configured to: obtain, according to a DHCP request message forwarded by the DHCP relay device, a MAC address of the client encapsulated in the DHCP request message, and The access information of the client included in the content of the proxy option.
The control device according to claim 16, wherein the encapsulation module is configured to: assign network configuration information to the client, and use the access information of the client as the content of the relay agent option and the The MAC address of the client and the network configuration information are encapsulated into the DHCP response message and fed back to the DHCP relay device.
The control device according to claim 16, wherein the second obtaining module is configured to: receive a DHCP request message sent by the client, acquire a media access control MAC address of the client, and access information of the client. ;

The control device further includes:

The second update module is configured to: if there is a corresponding entry in the preset record table that matches the MAC address of the client and the access information of the client, the update preset table matches the client The network configuration information recorded in the corresponding entry, and then sending the DHCP response message to the client;

a second creation module, configured to: if the MAC address of the client does not exist in the preset record table, and the corresponding entry of the client access information, according to the MAC address of the client and the client The access information creates a new entry, and records network configuration information allocated by the DHCP server for the client.
A computer readable storage medium storing computer executable instructions for performing the method of any of claims 1-10.