WO2017016473A1 - Procédé, appareil et système de détection de tunnel - Google Patents

Procédé, appareil et système de détection de tunnel Download PDF

Info

Publication number
WO2017016473A1
WO2017016473A1 PCT/CN2016/091781 CN2016091781W WO2017016473A1 WO 2017016473 A1 WO2017016473 A1 WO 2017016473A1 CN 2016091781 W CN2016091781 W CN 2016091781W WO 2017016473 A1 WO2017016473 A1 WO 2017016473A1
Authority
WO
WIPO (PCT)
Prior art keywords
tunnel
user
packet
side device
gateway device
Prior art date
Application number
PCT/CN2016/091781
Other languages
English (en)
Chinese (zh)
Inventor
徐卫平
牛乐宏
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2017016473A1 publication Critical patent/WO2017016473A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks

Definitions

  • the present invention relates to communication technologies, and in particular, to a method for performing tunnel detection, a gateway device, a control device, and a system for performing tunnel detection.
  • the gateway device can perform access control such as authentication, authorization, and charging on the user side device.
  • the gateway device can also allocate network resources to the user-side device, such as an Internet Protocol (IP).
  • IP Internet Protocol
  • the access control of the gateway device to the user side device is usually based on the user session.
  • the user session can be based on the way the user accesses the network.
  • the mode of accessing the network can be Ethernet bearer IP protocol (English name is Internet Protocol over Ethernet, IPoE for short) and Ethernet bearer PPP protocol. Point-to-Point Protocol over Ethernet (PPPoE), 802.1x, and so on.
  • the gateway device may be a broadband network gateway (Broadband network gateway, referred to as BNG in English), a broadband remote access server (referred to as a broadband remote access server in English, BRAS for short), and a broadband access server (English full name is a broadband access server). , referred to as BAS), system architecture evolution gateway (English full name system architecture evolution gateway, referred to as SAE GW).
  • BAS broadband network gateway
  • SAE GW system architecture evolution gateway
  • the user-side device can be a customer premises equipment (English name is called customer premises equipment, referred to as CPE), an optical network terminal (English called optical network terminal, referred to as ONT), a home router, a personal computer, and a user equipment. Equipment) and so on.
  • the user side device may also be a device between the gateway device and the CPE, such as a switch.
  • the user side device can establish a tunnel with the network side device.
  • the user side device encapsulates the data that needs to be sent to the network side device in the tunnel report. In the text.
  • the user equipment can send a tunnel message to the gateway device and forward it to the network side device through the gateway device.
  • the normal gateway device cannot detect the tunnel used by the user-side device, and there is a security risk.
  • the embodiments of the present invention provide a method for performing tunnel detection, which can detect a tunnel carrying data of a user, and helps improve security.
  • the embodiment of the invention further provides a gateway device, a control device and a system for performing tunnel detection.
  • a method for tunnel detection comprising:
  • the gateway device obtains an authentication request according to the identifier information of the user, where the user is a user requesting access to the network, and the authentication request includes the identifier information of the user;
  • the gateway device receives an authentication response from the control device, where the authentication response includes a parameter of the tunnel and identifier information of the user that is authenticated by the control device, and the tunnel uses the transmission adopted by the gateway device. a tunnel of the user's message;
  • the gateway device generates a tunnel table according to the parameter of the tunnel and the identifier information of the user that is authenticated by the control device, and the tunnel table is used for tunnel encapsulation of a packet from a legal user.
  • the parameter of the tunnel includes a source address of the tunnel and a destination address of the tunnel, where a source address of the tunnel is an address of the gateway device, The destination address of the tunnel is the address of the network side device, and the network side device is the device at the termination point of the tunnel.
  • a second possible implementation manner of the first aspect is further provided, where the parameter of the tunnel includes identifier information of the tunnel,
  • the identification information of the user, and the generated tunnel table includes:
  • the gateway device queries the source address of the tunnel and the destination address of the tunnel according to the identifier information of the tunnel, where the source address of the tunnel and the destination address of the tunnel respectively correspond to the identifier information of the tunnel
  • the source address of the tunnel is an address of the gateway device
  • the destination address of the tunnel is an address of a network side device
  • the network side device is a device at a termination point of the tunnel
  • the gateway device generates the tunnel table according to the source address of the tunnel, the destination address of the tunnel, and the identification information of the user that is authenticated by the control device.
  • the parameters of the tunnel include a label allocated to a network side device, where the network side device is a device at a termination point of the tunnel .
  • a fourth possible implementation manner of the first aspect is further provided, where the parameter of the tunnel includes identifier information of the tunnel,
  • the generating, by the gateway device, the tunnel table according to the parameter of the tunnel and the identifier information of the user that is authenticated by the control device includes:
  • the gateway device queries, according to the identifier information of the tunnel, a label that is allocated to the network side device, where the network side device is a device that is at a termination point of the tunnel;
  • the gateway device generates the tunnel table according to the identifier information of the user that is authenticated by the control device and the label that is allocated to the network side device.
  • the gateway device obtains the authentication request according to the identifier information of the user, including:
  • the gateway device receives an access request from the user side device, where the access request includes the identification information of the user, and the user side device is a device used by the user to access the network;
  • the gateway device generates the authentication request according to the identifier information of the user included in the access request.
  • the method further includes:
  • the gateway device receives the first packet from the user-side device, where the first packet includes the identifier information of the first user, and the user-side device is the device used by the first user to access the network;
  • the gateway device determines that the tunnel table includes the identifier information of the first user, the gateway device according to the first packet, the source address of the tunnel included in the tunnel table, and the tunnel And obtaining, by the destination address, a second packet, where the second packet is a packet obtained by tunneling the first packet by using a source address of the tunnel and a destination address of the tunnel;
  • the gateway device forwards the second packet according to the destination address of the tunnel included in the second packet.
  • the seventh possible implementation of the first aspect is further provided, the method further includes:
  • the gateway device receives the first packet from the user side device, where the first packet includes the identifier information of the second user, and the user side device is the device used by the second user to access the network;
  • the gateway device determines that the tunnel table includes the identifier information of the second user, the gateway device allocates the label that is allocated to the network side device according to the first packet and the tunnel table. Obtaining a second packet, where the second packet is a packet obtained by tunneling the first packet by using the label allocated to the network side device;
  • the gateway device forwards the second packet according to the label that is allocated to the network side device that is included in the second packet.
  • an eighth possible implementation manner of the first aspect is further provided, where the authentication response further includes the tunnel Corresponding flow information, the flow information is used to identify the data flow of the user,
  • the gateway device After the generating, by the gateway device, the tunnel table according to the parameter of the tunnel and the identifier information of the user that is verified by the control device to be legal: the gateway device according to the flow information, the tunnel And generating, by the control device, the identification information of the user that is legal, and generating the tunnel table;
  • the method further includes:
  • the gateway device receives the first packet from the user side device, where the first packet includes the first stream information and the identifier information of the third user, where the user side device accesses the network for the third user Equipment used;
  • the gateway device determines that the tunnel table includes the first flow information and the identifier information of the third user, the gateway device according to the first packet, the source of the tunnel included in the tunnel table The address and the destination address of the tunnel obtain a second packet, and the second packet is a packet obtained by tunnel encapsulating the first packet by using a source address of the tunnel and a destination address of the tunnel.
  • the gateway device forwards the second packet according to the destination address of the tunnel included in the second packet.
  • the ninth possible implementation manner of the first aspect is further provided, where the authentication response further includes the tunnel Corresponding flow information, the flow information is used to identify the data flow of the user,
  • the gateway device After the generating, by the gateway device, the tunnel table according to the parameter of the tunnel and the identifier information of the user that is verified by the control device to be legal: the gateway device according to the flow information, the parameter of the tunnel, and the control The device is authenticated as the legal identification information of the user, and the tunnel table is generated;
  • the method further includes:
  • the gateway device receives the first packet from the user side device, where the first packet includes the second stream information and the identifier information of the fourth user, where the user side device accesses the network for the fourth user Equipment used;
  • the gateway device determines that the tunnel table includes the second flow information and the identification information of the fourth user, the gateway device allocates the information according to the first packet and the tunnel table And the second packet is a packet obtained by tunneling the first packet by using the label allocated to the network side device;
  • the gateway device allocates the label allocated to the network side device according to the second packet Signing and forwarding the second message.
  • a method for tunnel detection including:
  • the gateway device obtains an authentication request according to the identifier information of the user, where the user is a user requesting access to the network, and the authentication request includes the identifier information of the user;
  • the gateway device receives an authentication response from the control device, where the authentication response includes a tunnel parameter, and the tunnel is a tunnel for transmitting a message adopted by the user authenticated by the control device;
  • the gateway device generates a tunnel table according to the parameters of the tunnel, where the tunnel table is used to check the validity of the tunnel.
  • the parameter of the tunnel includes a source address of the tunnel and a destination address of the tunnel, where a source address of the tunnel is an address of a user side device, where the user The side device is a device used by the user to access the network, the destination address of the tunnel is an address of the network side device, and the network side device is a device at a termination point of the tunnel.
  • the second possible implementation manner of the second aspect is further provided, where the parameter of the tunnel includes the identifier information of the tunnel,
  • the generating, by the gateway device, the tunnel table according to the parameters of the tunnel includes:
  • the gateway device queries the source address of the tunnel and the destination address of the tunnel according to the identifier information of the tunnel, where the source address of the tunnel and the destination address of the tunnel respectively correspond to the identifier information of the tunnel
  • the source address of the tunnel is the address of the user-side device
  • the user-side device is the device used by the user to access the network
  • the destination address of the tunnel is the address of the network-side device
  • the device is a device at the termination point of the tunnel;
  • the gateway device generates the tunnel table according to the source address of the tunnel and the destination address of the tunnel.
  • the parameters of the tunnel include a label allocated to a network side device, where the network side device is a device at a termination point of the tunnel .
  • a fourth possible implementation manner of the second aspect is further provided, where the parameter of the tunnel includes the identifier information of the tunnel,
  • the generating, by the gateway device, the tunnel table according to the parameters of the tunnel includes:
  • the gateway device queries, according to the identifier information of the tunnel, a label that is allocated to the network side device, where the network side device is a device that is at a termination point of the tunnel;
  • the gateway device generates the tunnel table according to the label allocated to the network side device.
  • the gateway device obtains the authentication request according to the identifier information of the user, including:
  • the gateway device receives an access request from the user side device, where the access request includes the identification information of the user, and the user side device is a device used by the user to access the network;
  • the gateway device generates the authentication request according to the identifier information of the user included in the access request.
  • the method further includes:
  • the gateway device receives a packet from the user side device, where the packet includes a source address of the first tunnel and a destination address of the first tunnel;
  • the gateway device determines that the tunnel table includes a source address of the first tunnel and a destination address of the first tunnel in the packet, the gateway device is configured according to the packet in the packet The destination address of a tunnel forwards the packet.
  • the seventh possible implementation of the second aspect is further provided, where the method further includes:
  • the gateway device determines that the tunnel table includes the first label allocated to the network side device in the packet, the gateway device allocates to the network side device according to the A label that forwards the message.
  • a method for tunnel detection including:
  • the control device receives an authentication request sent by the gateway device, where the authentication request includes the identifier information of the user, where the user is a user requesting to access the network;
  • the control device determines that the user is a valid user according to the information of the legal user and the identification information of the user that is included in the authentication request, and the information of the legal user includes the identifier of the user whose authentication device is authenticated as a legitimate user.
  • the control device sends an authentication response to the gateway device, where the authentication response includes the identification information of the user that is authenticated by the control device and the parameter of the tunnel that is assigned to the user whose authentication device is authenticated.
  • the parameter of the tunnel includes the identifier information of the tunnel, the identifier information of the tunnel is used to identify the tunnel, and the tunnel is the gateway device and the network. a tunnel between side devices, the network side device being a device at a termination point of the tunnel; or
  • the parameters of the tunnel include the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is the address of the gateway device, and the destination address of the tunnel is the address of the network side device, the network The side device is a device at the termination point of the tunnel; or
  • the parameters of the tunnel include a label assigned to a network side device, and the network side device is a device at a termination point of the tunnel.
  • the second possible implementation manner of the third aspect is further provided, where the authentication response further includes flow information corresponding to the tunnel, where the flow The information is used to identify the data stream of the user.
  • a method for performing tunnel detection including:
  • the control device receives an authentication request sent by the gateway device, where the authentication request includes the identifier information of the user, where the user is a user requesting to access the network;
  • the control device determines that the user is a legitimate user according to the information of the legal user and the identification information of the user that is included in the authentication request, and the information of the legal user includes the control device.
  • the authentication information of the legal user and the parameters of the tunnel assigned to the user authenticated by the control device are legal;
  • the control device sends an authentication response to the gateway device, where the authentication response includes a parameter assigned to a tunnel of a user authenticated by the control device as a legitimate user.
  • the parameter of the tunnel includes the identifier information of the tunnel, and the identifier information of the tunnel is used to identify the tunnel, where the tunnel is a user side device and a network side. a tunnel between devices, where the user side device is a device used by the user to access the network, and the network side device is a device at a termination point of the tunnel; or
  • the parameter of the tunnel includes the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is the address of the user-side device, and the destination address of the tunnel is the address of the network-side device,
  • the network side device is a device at a termination point of the tunnel;
  • the parameters of the tunnel include a label assigned to a network side device, and the network side device is a device at a termination point of the tunnel.
  • a gateway device including:
  • An obtaining unit configured to obtain an authentication request according to the identification information of the user, where the user is a user requesting access to the network, and the authentication request includes the identification information of the user;
  • a sending unit configured to send the authentication request to the control device
  • a receiving unit configured to receive an authentication response from the control device, where the authentication response includes a parameter of the tunnel and identifier information of the user that is authenticated by the control device, and the tunnel is used by the gateway device a tunnel of messages from the user;
  • a generating unit configured to generate a tunnel table according to the parameter of the tunnel and the identifier information of the user that is authenticated by the control device, where the tunnel table is used for tunnel encapsulation of a packet from a legal user.
  • the parameter of the tunnel includes a source address of the tunnel and a destination address of the tunnel, where a source address of the tunnel is The address of the gateway device, the destination address of the tunnel is the address of the network side device, and the network side device is the device at the termination point of the tunnel.
  • the parameter of the tunnel includes the identifier information of the tunnel
  • the generating unit is specifically configured to:
  • the source address is the address of the gateway device
  • the destination address of the tunnel is the address of the network side device
  • the network side device is the device at the termination point of the tunnel
  • the parameters of the tunnel include a label allocated to a network side device, where the network side device is a device at a termination point of the tunnel .
  • the parameter of the tunnel includes the identifier information of the tunnel
  • the generating unit is specifically configured to:
  • the obtaining unit is specifically configured to:
  • the user side device Receiving an access request from the user side device, where the access request includes the identification information of the user, and the user side device is a device used by the user to access the network;
  • the gateway device further includes the first determining Unit and first processing unit;
  • the receiving unit is further configured to receive a first packet from the user side device, where the first packet is The identification information of the first user, where the user side device is a device used by the first user to access the network;
  • the first determining unit is configured to determine whether the tunnel table includes the identifier information of the first user
  • the first processing unit is configured to determine, in the first determining unit, that the tunnel table includes the identifier information of the first user, and according to the first packet, a source address of the tunnel included in the tunnel table And obtaining, by the destination address of the tunnel, a second packet, where the second packet is a packet obtained by tunnel encapsulating the first packet by using a source address of the tunnel and a destination address of the tunnel ;
  • the sending unit is further configured to forward the second packet according to the destination address of the tunnel included in the second packet.
  • the gateway device further includes the first determining Unit and first processing unit;
  • the receiving unit is further configured to receive the first packet from the user side device, where the first packet includes the identifier information of the second user, where the user side device is used by the second user to access the network. device of;
  • the first determining unit is configured to determine whether the tunnel table includes identifier information of the second user
  • the first processing unit is configured to determine, in the first determining unit, that the tunnel table includes the identifier information of the second user, and according to the first packet, the path included in the tunnel table is allocated to the a packet of the network side device, where the second packet is obtained, and the second packet is a packet obtained by tunneling the first packet by using the label allocated to the network side device;
  • the sending unit is further configured to forward the second packet according to the label that is allocated to the network side device that is included in the second packet.
  • an eighth possible implementation manner of the fifth aspect is further provided, where the authentication response further includes the tunnel Corresponding flow information, the flow information is used to identify the data flow of the user,
  • the generating unit is configured to generate the tunnel table according to the flow information, the parameter of the tunnel, and the identifier information of the user that is authenticated by the control device;
  • the gateway device further includes a second determining unit and a second processing unit;
  • the receiving unit is configured to receive the first packet from the user side device, where the first packet includes the first stream information and the identifier information of the third user, where the user side device accesses the third user Equipment used by the network;
  • the second determining unit is configured to determine whether the tunnel table includes the first flow information and the identifier information of the third user;
  • the second processing unit is configured to determine, in the second determining unit, that the tunnel table includes the first flow information and the identifier information of the third user, and according to the first packet, the tunnel table includes Obtaining a second packet by using a source address of the tunnel and a destination address of the tunnel, where the second packet is used to tunnel the first packet by using a source address of the tunnel and a destination address of the tunnel a message obtained after encapsulation;
  • the sending unit is further configured to forward the second packet according to the destination address of the tunnel included in the second packet.
  • the ninth possible implementation manner of the fifth aspect is further provided, where the authentication response further includes the tunnel Corresponding flow information, the flow information is used to identify the data flow of the user,
  • the generating unit is configured to generate the tunnel table according to the flow information, the parameter of the tunnel, and the identifier information of the user that is authenticated by the control device;
  • the gateway device further includes a second determining unit and a second processing unit;
  • the receiving unit is further configured to receive the first packet from the user side device, where the first packet includes the second stream information and the identifier information of the fourth user, where the user side device is the fourth user
  • the equipment used to access the network
  • the second determining unit is configured to determine whether the tunnel table includes the second stream information and the identifier information of the fourth user;
  • the second processing unit determines, at the second determining unit, that the tunnel table includes the second stream
  • the information and the identifier information of the fourth user according to the first packet and the label that is included in the tunnel table that is allocated to the network side device, obtain a second packet, where the second packet is And obtaining, by using the label allocated to the network side device, a packet obtained by tunnel encapsulating the first packet;
  • the sending unit is further configured to forward the second packet according to the label that is allocated to the network side device that is included in the second packet.
  • a gateway device including:
  • An obtaining unit configured to obtain an authentication request according to the identification information of the user, where the user is a user requesting access to the network, and the authentication request includes the identification information of the user;
  • a sending unit configured to send the authentication request to the control device
  • a receiving unit configured to receive an authentication response from the control device, where the authentication response includes a parameter of a tunnel, where the tunnel is a tunnel for transmitting a message adopted by a user authenticated by the control device;
  • a generating unit configured to generate a tunnel table according to the parameter of the tunnel, where the tunnel table is used to perform legality detection on the tunnel.
  • the parameter of the tunnel includes a source address of the tunnel and a destination address of the tunnel, where a source address of the tunnel is an address of a user side device, where the user The side device is a device used by the user to access the network, the destination address of the tunnel is an address of the network side device, and the network side device is a device at a termination point of the tunnel.
  • the second possible implementation manner of the sixth aspect is further provided, where the parameter of the tunnel includes the identifier information of the tunnel,
  • the generating unit is specifically configured to:
  • the source address is the address of the user-side device
  • the user-side device is the device used by the user to access the network
  • the destination address of the tunnel is the address of the network-side device
  • the network-side device is in the a device that describes the termination point of the tunnel
  • the parameters of the tunnel include a label allocated to a network side device, where the network side device is a device at a termination point of the tunnel .
  • the fourth possible implementation manner of the sixth aspect is further provided, where the parameter of the tunnel includes the identifier information of the tunnel,
  • the generating unit is specifically configured to:
  • the obtaining unit is specifically configured to:
  • the user side device Receiving an access request from the user side device, where the access request includes the identification information of the user, and the user side device is a device used by the user to access the network;
  • the sixth possible implementation manner of the sixth aspect is further provided, where the packet further includes a determining unit;
  • the receiving unit is further configured to receive a packet from the user side device, where the packet includes a source address of the first tunnel and a destination address of the first tunnel;
  • the determining unit is configured to determine whether the tunnel table includes a source address of the first tunnel and a destination address of the first tunnel in the packet;
  • the sending unit is further configured to determine, in the determining unit, that the tunnel table includes a source address of the first tunnel and a destination address of the first tunnel in the packet, according to the information in the packet The destination address of the first tunnel forwards the packet.
  • the receiving unit is further configured to receive a packet from the user side device, where the packet includes a first label allocated to the network side device;
  • the determining unit is further configured to determine whether the tunnel table includes the first label allocated to the network side device in the packet;
  • the sending unit is further configured to: determine, by the determining unit, that the tunnel table includes the first label allocated to the network side device in the packet, and assign the network label to the network side device according to the The first tag forwards the message.
  • a control device including:
  • a receiving unit configured to receive an authentication request sent by the gateway device, where the authentication request includes identifier information of the user, where the user is a user requesting access to the network;
  • a determining unit configured to determine, according to the information of the legal user and the identifier information of the user that the authentication request includes, that the user is a legitimate user, where the information of the legal user includes the user whose authentication device is authenticated as a legitimate user. Identification information and parameters of a tunnel assigned to a user authenticated by the control device as a legitimate user;
  • a sending unit configured to send an authentication response to the gateway device after the determining unit determines that the user is the legal user, where the authentication response includes identifier information and allocation of the user that is authenticated by the control device A parameter of a tunnel that authenticates the control device as a legitimate user.
  • the parameter of the tunnel includes the identifier information of the tunnel, the identifier information of the tunnel is used to identify the tunnel, and the tunnel is the gateway device and the network. a tunnel between side devices, the network side device being a device at a termination point of the tunnel; or
  • the parameters of the tunnel include the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is the address of the gateway device, and the destination address of the tunnel is the address of the network side device, the network The side device is a device at the termination point of the tunnel; or
  • the parameters of the tunnel include a label assigned to a network side device, and the network side device is a device at a termination point of the tunnel.
  • the second possible implementation manner of the seventh aspect is further provided, where the authentication response further includes flow information corresponding to the tunnel, where the flow The information is used to identify the data stream of the user.
  • a control device including:
  • a receiving unit configured to receive an authentication request sent by the gateway device, where the authentication request includes identifier information of the user, where the user is a user requesting access to the network;
  • a determining unit configured to determine, according to the information of the legal user and the identifier information of the user that the authentication request includes, that the user is a legitimate user, where the information of the legal user includes the user whose authentication device is authenticated as a legitimate user. Identification information and parameters of a tunnel assigned to a user authenticated by the control device as a legitimate user;
  • a sending unit configured to: after the determining unit determines that the user is the legal user, send an authentication response to the gateway device, where the authentication response includes a tunnel allocated to a user authenticated by the control device as a legitimate user parameter.
  • the parameter of the tunnel includes the identifier information of the tunnel, and the identifier information of the tunnel is used to identify the tunnel, where the tunnel is a user side device and a network side. a tunnel between devices, where the user side device is a device used by the user to access the network, and the network side device is a device at a termination point of the tunnel; or
  • the parameter of the tunnel includes the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is the address of the user-side device, and the destination address of the tunnel is the address of the network-side device,
  • the network side device is a device at a termination point of the tunnel;
  • the parameters of the tunnel include a label assigned to a network side device, and the network side device is a device at a termination point of the tunnel.
  • the ninth aspect provides a system for performing tunnel detection, wherein the system includes: the gateway device provided by any one of the fifth aspect or the fifth aspect, and the sixth aspect or the foregoing a control device provided by any one of the six aspects; or
  • the system includes the gateway device provided by any one of the foregoing seventh aspect or the seventh aspect, and the control device provided by any one of the foregoing eighth or eighth aspects.
  • the method for the tunnel detection, the gateway device, the control device, and the system for performing tunnel detection provided by the embodiment of the present invention, the parameters and the control of the tunnel included by the gateway device according to the authentication response delivered by the control device are controlled.
  • the device authenticates the identification information of the legitimate user and generates a tunnel table.
  • the gateway device may receive the first packet from the first user from the user side device, where the first packet is not encapsulated by the tunnel. After the gateway device determines that the tunnel table includes the identifier information of the first user, the tunnel table may be used to encapsulate the first packet to obtain a second packet. The gateway device sends the second packet to the network side device.
  • the gateway device can encapsulate the packet of the first user and forward the packet by using the tunnel table after detecting that the first user is a user authenticated by the controller, which helps to improve security.
  • the gateway device may generate a tunnel table according to a parameter of the tunnel that is included in the authentication response that is sent by the control device, where the tunnel is a tunnel through which the user authenticated by the control device is a legitimate user.
  • the gateway device may receive a packet from the user, where the packet is a packet encapsulated by the first tunnel, and the first tunnel is a tunnel between the user-side device and the network-side device. After the gateway device determines that the tunnel table includes parameters of the first tunnel in the packet, the gateway device sends the packet to the network side device. In this way, the gateway device can forward the packet to the network side device after detecting the validity of the tunnel used by the user, which helps improve security.
  • FIG. 1 is a schematic diagram of a network scenario according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a method for performing tunnel detection according to Embodiment 1 of the present invention.
  • FIG. 3 is a flowchart of a method for performing tunnel detection according to Embodiment 1 of the present invention.
  • FIG. 4 is a schematic diagram of another network scenario according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for performing tunnel detection according to Embodiment 2 of the present invention.
  • FIG. 6 is a flowchart of a method for performing tunnel detection according to Embodiment 2 of the present invention.
  • FIG. 7 is a schematic structural diagram of a gateway device according to Embodiment 3 of the present invention.
  • FIG. 8 is a schematic structural diagram of a control device according to Embodiment 3 of the present invention.
  • FIG. 9 is a schematic structural diagram of a gateway device according to Embodiment 4 of the present invention.
  • FIG. 10 is a schematic structural diagram of a control device according to Embodiment 4 of the present invention.
  • FIG. 11 is a schematic structural diagram of a gateway device according to Embodiment 5 of the present invention.
  • FIG. 12 is a schematic structural diagram of a control device according to Embodiment 5 of the present invention.
  • FIG. 13 is a schematic structural diagram of a gateway device according to Embodiment 6 of the present invention.
  • FIG. 14 is a schematic structural diagram of a control device according to Embodiment 6 of the present invention.
  • An embodiment of the present invention provides a method for performing tunnel detection, where the method includes: the gateway device obtains an authentication request according to the identification information of the user, where the user is a user requesting to access the network, and the authentication request includes the Decoding information of the user; the gateway device sends the authentication request to the control device; the gateway device receives an authentication response from the control device, where the authentication response includes a parameter of the tunnel and the control device is authenticated as legal
  • the identification information of the user, the tunnel is a tunnel used by the gateway device to transmit a packet from the user; and the gateway device is authenticated according to the parameter of the tunnel and the control device.
  • the identifier information is used to generate a tunnel table, and the tunnel table is used for tunnel encapsulation of packets from legitimate users. In this way, after determining that the user is the legal user, the gateway device encapsulates the packet from the legal user by using the parameter in the tunnel table and transmits the packet.
  • the embodiment of the present invention further provides another method for performing tunnel detection, where the method includes: the gateway device obtains an authentication request according to the identification information of the user, where the user is a user requesting access to the network, and the authentication request Including the identification information of the user; the gateway device sends the authentication request to the control device; the gateway device receives an authentication response from the control device, the authentication response includes a parameter of the tunnel, and the tunnel is the
  • the control device is authenticated as a tunnel for transmitting packets used by the legal user.
  • the gateway device generates a tunnel table according to the parameters of the tunnel, where the tunnel table is used for authenticity detection of the tunnel. In this way, the gateway device determines the number adopted by the user. After the validity of a tunnel, the first tunnel is used to send a packet from the user to the network side device.
  • the gateway device provided by the embodiment of the present invention may be a BNG, a BRAS, a BAS, an SAE GW, or a device capable of implementing the functions of the foregoing devices, and is not illustrated by way of example.
  • the user-side device provided by the embodiment of the present invention may be a CPE, an ONT, a home router, a personal computer, a user equipment, a terminal, or a device between the gateway device and the CPE, and is not illustrated herein.
  • FIG. 1 is a schematic diagram of a network scenario according to an embodiment of the present invention.
  • C1 is the control device
  • G1 is the gateway device
  • D1, D2, and D3 belong to the network side device
  • R1, R2, and R3 belong to the network side device.
  • D1 is a first user terminal
  • D2 is a second user terminal
  • D3 is a third user terminal
  • R1 is the first router
  • R2 is the second router
  • R3 is the third router
  • T1 is the tunnel between D1 and R1
  • T2 is the tunnel between D2 and R2
  • T3 is the tunnel between D3 and R3.
  • T1, T2 and T3 are both tunnels through G1, and G1 can detect T1, T2 and T3.
  • FIG. 2 is a flowchart of a method for performing tunnel detection according to Embodiment 1 of the present invention.
  • the first embodiment corresponding to FIG. 2 is a description of the method provided by the implementation of the present invention from the perspective of the gateway device.
  • the gateway device may detect the first tunnel between the user side device and the network side device, that is, the packet mentioned in the first embodiment of FIG.
  • the packet obtained after the parameters of the tunnel are encapsulated.
  • the first tunnel is a tunnel between the user side device and the network side device, and the first tunnel passes through the gateway device.
  • the user side device is a device used by the user to access the network.
  • the gateway device obtains an authentication request according to the identifier information of the user, where the user is a user requesting access to the network, and the authentication request includes the identifier information of the user.
  • the gateway device obtains the authentication request according to the identifier information of the user, where the gateway device receives the access request sent by the user side device, where the access request includes the identifier information of the user, and the gateway device And generating the authentication request according to the identifier information of the user included in the access request.
  • the access request may be an IPoE, PPPoE, or 802.1x-based access request, and the access request is not described herein.
  • the identification information of the user may be The address of the media access control (referred to as the MAC address) of the user-side device, the IP address of the user-side device, and the virtual local area network to which the user-side device belongs (English name is virtual local area network, or VLAN for short).
  • the account information of the user can be used to identify the information of the user.
  • the user side device is a device used by the user to access an operator's network.
  • the account information of the user may be information such as a user name and/or password required for the user to access the network of the operator.
  • the line-ID is used to indicate an identifier of a link accessed by the user.
  • the gateway device may generate the authentication request according to a protocol between it and the control device.
  • the authentication request is a packet based on a dial-up user remote authentication service (referred to as a Remote Authentication Dial In User Service, RADIUS for short) protocol.
  • the authentication request based on the RADIUS protocol includes an attribute (the English name is attribute).
  • One or more attributes in the RADIUS protocol-based authentication request may be used to carry the identification information of the user.
  • the authentication request is a packet based on a charging authentication (English name: Diameter) protocol, and the Diameter header of the authentication request based on the Diameter protocol includes an attribute value pair (in English, an attribute-value pair, abbreviated as AVP).
  • AVP attribute value pair
  • One or more AVPs in the Diameter header are used to carry the identification information of the user.
  • the manner in which the gateway device obtains the authentication request according to the identifier information of the user may be: the gateway device sends the identifier information of the user to the device for generating the authentication request, where the gateway device The device for generating the authentication request obtains the authentication request, and the authentication request includes identifier information of the user.
  • the device for generating the authentication request may generate the authentication request according to the identification information of the user from the gateway device.
  • the method for generating the authentication request by the device for generating the authentication request is the same as the method for the gateway device to generate the authentication request, and details are not described herein again.
  • the gateway device may acquire the identification information of the user from the control device, or the control device may periodically send the identification information of the user to the gateway device.
  • the period in which the control device sends the identifier information of the user may be set according to the performance and needs of the device, and details are not described herein.
  • T1 is a tunnel between D1 and R1, and T1 belongs to an Internet Protocol (Internet Protocol, IP for short) tunnel.
  • G1 may receive a first access request from D1, which may be a request to access R1.
  • the first access request includes identification information of D1.
  • G1 obtains the identification information of D1 from the first access request.
  • G1 generates a first authentication request according to the identification information of D1.
  • the first authentication request includes identification information of D1.
  • T2 is a tunnel between D2 and R2, and T2 is a multi-protocol label switching (referred to as Multiprotocol Label Switching, MPLS for short) tunnel.
  • G1 may receive a second access request from D2, which may be a request to access R2.
  • the second access request includes identification information of D2.
  • G1 obtains the identification information of D2 from the second access request.
  • G1 generates a second authentication request according to the identification information of D2.
  • the second authentication request includes identification information of D2.
  • T3 is the tunnel between D3 and R3, and T3 belongs to the IP tunnel.
  • G1 can receive a third access request from D3.
  • the third access request may be a request to access R3.
  • the third access request includes identification information of D3.
  • G1 obtains the identification information of D3 from the third access request.
  • G1 generates a third authentication request according to the identification information of D3, where the third authentication request includes the identification information of D3.
  • the gateway device sends the authentication request to a control device.
  • the gateway device may be configured with an identifier or an address of a control device to which it belongs.
  • the control device to which the gateway device belongs is a device for sending an authentication response to the gateway device.
  • the gateway device may send the authentication request to the control device according to an identifier of the control device or an address of the control device.
  • the source IP address of the authentication request is an IP address of the gateway device
  • the destination IP address of the authentication request is an IP address of the control device.
  • the gateway device may send the authentication request to the control device according to the destination IP address of the authentication request.
  • control device may be a software defined network (English full name software definition network, referred to as SND) controller, dial-up user remote authentication service (English full name is Remote) Authentication Dial In User Service (RADIUS) server, authentication, authorization, and accounting (Authentication, Authorization and Accounting, AAA) server, etc., which can implement the functions that the control device can implement in the embodiment of the present invention. This is no longer an example.
  • SND software defined network
  • RADIUS Authentication Dial In User Service
  • AAA Authentication, Authorization and Accounting
  • G1 sends the first authentication request, the second authentication request, and the third authentication request to C1.
  • FIG. 1 is an example in which G1 sends the first authentication request, the second authentication request, and the third authentication request to C1 as an example. In other scenarios, G1 may send the first to C1 simultaneously or sequentially.
  • One or more of the authentication request, the second authentication request, and the third authentication request are not illustrated one by one.
  • the first, second, and third of the first authentication request, the second authentication request, and the third authentication request are used to distinguish different authentication requests, and do not indicate a sending order, for example, G1 may sequentially C1 sends the second authentication request, the first authentication request, and the third authentication request.
  • the gateway device receives an authentication response from the control device, where the authentication response includes a parameter of a tunnel, and the tunnel is a tunnel for transmitting a message adopted by a user authenticated by the control device.
  • the parameters of the tunnel include the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is the address of the user-side device, and the user-side device authenticates the control device as legal.
  • the device used by the user to access the network is the address of the network side device, and the network side device is the device at the termination point of the tunnel.
  • the parameter of the tunnel includes identifier information of the tunnel.
  • the parameter of the tunnel includes a label allocated to the network side device.
  • the source address of the tunnel is the source IP address of the tunnel, such as the IP address of the user side device.
  • the destination address of the tunnel is the destination IP address of the tunnel, such as the IP address of the network side device.
  • the protocol used by the authentication response may be the same as the protocol used by the authentication request.
  • the authentication response is a packet based on a RADIUS protocol.
  • the RADIUS protocol-based authentication response includes an attribute, and one or more attributes in the RADIUS-based authentication response are used to carry parameters of the tunnel.
  • the authentication response is a message based on a Diameter protocol.
  • the Diameter header of the authentication response based on the Diameter protocol includes an AVP, and one or more AVPs in the Diameter header are used to carry parameters of the tunnel.
  • G1 receives a first authentication response from C1, the first authentication response including a source address of a tunnel allocated to D1 and a destination address of a tunnel allocated to D1.
  • G1 receives a second authentication response from C1, the second authentication response including a label assigned to R2.
  • G1 receives a third authentication response from C1, the third authentication response including identification information of a tunnel assigned to D3.
  • the D1, the R2, and the D3 are all user-side devices used by the user whose authentication device is authenticated.
  • the gateway device generates a tunnel table according to the parameters of the tunnel, where the tunnel table is used to perform legality detection on the tunnel.
  • the gateway device if the parameter of the tunnel includes the source address of the tunnel and the destination address of the tunnel, the gateway device generates a tunnel table according to the parameters of the tunnel, including The gateway device generates the tunnel table according to the source address of the tunnel and the destination address of the tunnel.
  • G1 generates a first tunnel table according to the source address of the tunnel allocated to D1 and the destination address of the tunnel allocated to D1 in the first authentication response.
  • the first tunnel table includes a source address of the tunnel allocated to D1 and a destination address of the tunnel allocated to D1.
  • the gateway device if the parameter of the tunnel includes the identifier information of the tunnel, the gateway device generates a tunnel table according to the parameter of the tunnel, including: the gateway device according to the The source information of the tunnel and the destination address of the tunnel are obtained by the tunnel, and the source address of the tunnel and the destination address of the tunnel respectively correspond to the identifier information of the tunnel, and the source of the tunnel
  • the address is the address of the user-side device, and the user-side device is the device used by the user to access the network, the destination address of the tunnel is the address of the network-side device, and the network-side device is in the tunnel.
  • the device of the termination point; the gateway device generates the tunnel table according to the source address of the tunnel and the destination address of the tunnel.
  • the first corresponding relationship may be pre-stored on the gateway device, where the first correspondence includes the identifier information of the tunnel, a source address of the tunnel, and a destination address of the tunnel.
  • the gateway device may query and obtain the tunnel according to the identifier information of the tunnel and the first corresponding relationship that is stored in advance.
  • the source address and the destination address of the tunnel In the scenario shown in FIG. 1 , G1 obtains a source address of a tunnel allocated to D3 and allocates to D3 according to the identification information of the tunnel allocated to D3 in the third authentication response and the first corresponding relationship stored in advance.
  • the destination address of the tunnel G1 generates a third tunnel table according to the source address of the tunnel allocated to D3 and the destination address of the tunnel allocated to D3.
  • the third tunnel table includes a source address of the tunnel allocated to D3 and a destination address of the tunnel allocated to D3.
  • the gateway device Generating a tunnel table according to the parameters of the tunnel includes: the gateway device generating the tunnel table according to the label allocated to the network side device.
  • the label assigned to the network side device belongs to a global label, that is, the forwarding device that the tunnel passes through can learn the device at the termination point of the tunnel according to the label allocated to the network side device.
  • G1 generates a second tunnel table according to the label allocated to R2 in the second authentication response.
  • the second tunnel table includes the label assigned to R2.
  • the generating, by the gateway device, the tunnel table according to the parameter of the tunnel includes: the gateway device according to the The identifier information of the tunnel is obtained by querying the label of the network side device, where the network side device is a device at a termination point of the tunnel; and the gateway device generates a label according to the label allocated to the network side device.
  • the second corresponding relationship may be pre-stored on the gateway device, where the second correspondence includes the identifier information of the tunnel and the label allocated to the network side device.
  • the gateway device may query, according to the identifier information of the tunnel and the second corresponding relationship that is stored in advance, the label that is allocated to the network side device.
  • the identification information of the tunnel in the embodiment of the present invention may be the identifier of the tunnel (in English, the identifier is the ID), and may be the index of the tunnel (the English name is index), and is no longer
  • the possible forms of the identification information of the tunnel are illustrated one by one.
  • the method provided by the embodiment of the present invention further includes:
  • the gateway device receives a packet from the user side device, where the packet includes a source address of the first tunnel and a destination address of the first tunnel.
  • the packet is a packet obtained by using the source address of the first tunnel and the destination address of the first tunnel, and the packet is used by the user equipment.
  • the packet obtained after the source address of the tunnel and the destination address of the first tunnel are encapsulated.
  • the gateway device may parse the packet from the user side device, and obtain a source address of the first tunnel and a destination address of the first tunnel in the packet.
  • the first tunnel is a tunnel between the user equipment and the network side device, and the first tunnel is a tunnel that needs to be checked by the gateway device for legality detection.
  • G1 receives a message from D1, and the message from D1 includes the source address of T1 and the destination address of T1.
  • the source address of T1 is the address of D1.
  • the destination address of T1 is the address of R1.
  • G1 may also receive a message from D3, the message from D3 including the source address of T3 and the destination address of T3.
  • the source address of T3 is the address of D3.
  • the destination address of T3 is the address of R3.
  • the gateway device determines whether the tunnel table includes a source address of the first tunnel and a destination address of the first tunnel in the packet, if the tunnel table includes a location in the packet S207, if the source address of the first tunnel and the destination address of the first tunnel are performed, perform S207, if the tunnel table does not include the source address of the first tunnel or the destination of the first tunnel in the packet Address, then execute S208.
  • G1 generates a first tunnel table and a third tunnel table.
  • the first tunnel table includes a source address of the tunnel allocated to D1 and a destination address of the tunnel allocated to D1.
  • the third tunnel table includes a source address of a tunnel allocated to D3 and a destination address of the tunnel allocated to D3.
  • G1 may query the first tunnel table and the third tunnel table to determine whether the first tunnel table or the third tunnel table includes the packet from D1.
  • G1 may query the first tunnel table and the third tunnel table to determine whether the first tunnel table or the third tunnel table is The source address of T3 and the destination address of T3 in the message from D3 are included. If the third tunnel table includes the source address of T3 and the destination address of T3, that is, the tunnel allocated to D3 is T3, G1 may determine that T3 is a valid tunnel, and perform S207. If the third tunnel does not include the source address of T3 or the destination address of T3, that is, the tunnel allocated to D3 is not T3, G1 may determine that T3 is an illegal tunnel, and perform S208.
  • the gateway device forwards the packet according to the destination address of the first tunnel in the packet.
  • a third correspondence relationship may be pre-stored on the gateway device.
  • the third correspondence is a correspondence between a first port of the gateway device and a destination address of the first tunnel.
  • the gateway device may determine the first port of the gateway device according to the third correspondence and the destination address of the first tunnel in the packet.
  • the gateway device sends the packet by using the first port, so that the packet is forwarded to the network side device.
  • G1 determines that the first tunnel table includes the source address of T1 and the destination address of T1, G1 forwards the packet from D1 to R1. If G1 determines that the third tunnel table includes the source address of T3 and the destination address of T3, G1 forwards the message from D3 to R3.
  • S207 may be: the gateway device may forward the packet according to a destination address of the first tunnel in the tunnel table. After the gateway device determines that the tunnel table includes the destination address of the first tunnel in the packet, the gateway device may forward the location according to the destination address of the first tunnel included in the tunnel table. Said message.
  • the gateway device discards the packet or caches the packet.
  • the gateway device determines that the tunnel table does not include the source address of the first tunnel or the destination address of the first tunnel in the packet, and determines that the first tunnel that transmits the packet is not Legal tunnel.
  • the gateway device may process the packet according to a preset policy.
  • the preset The policy is to discard the message or cache the message.
  • the preset policy may also be other processing policies for the packet, and details are not described herein again.
  • G1 determines that the first tunnel table does not include the source address of T1 or the destination address of T1
  • G1 discards the message from D1 or caches the message from D1.
  • G1 determines that the third tunnel table does not include the source address of T3 or the destination address of T3, G1 discards the message from D3 or caches the message from D3.
  • the method provided by the embodiment of the present invention further includes:
  • the gateway device receives a packet from the user side device, where the packet includes a first label allocated to the network side device.
  • the packet is a packet obtained by using the first label allocated to the network side device, for example, the packet is the first that the user side device uses the network side device to allocate.
  • the packet obtained after the label is encapsulated.
  • the gateway device may parse the received packet from the user side device to obtain the first label allocated to the network side device.
  • the tunnel corresponding to the first label allocated to the network side device is a tunnel that needs to be checked by the gateway device for legality detection.
  • G1 receives a message from D2, and the message from D2 includes a tag assigned to R2.
  • the gateway device determines whether the tunnel table includes the first label allocated to the network side device in the packet, if the tunnel table includes the allocation in the packet to the network side If the first label of the device is performed, S207' is performed. If the tunnel table does not include the first label allocated to the network side device in the packet, S208' is performed.
  • G1 generates a second tunnel table.
  • the second tunnel table includes a label assigned to R2.
  • the G1 may query the second tunnel table to determine whether the second tunnel table includes the label allocated to the R2 in the packet from the D2. If the second tunnel table includes the label assigned to R2 in the message from D2, G1 may determine that T2 is a legitimate tunnel, and execute S207'. If the second tunnel table does not include the label assigned to R2 in the message from D2, G1 may determine that T2 is an illegal tunnel, and execute S208'.
  • the gateway device forwards the packet according to the first label allocated to the network side device in the packet.
  • the fourth correspondence relationship may be pre-stored on the gateway device.
  • the fourth correspondence is a correspondence between the second port of the gateway device and the first label allocated to the network side device.
  • the gateway device may determine the second port of the gateway device according to the fourth correspondence and the first label allocated to the network side device in the packet.
  • the gateway device sends the packet by using the second port, so that the packet is forwarded to the network side device.
  • G1 determines that the second tunnel table includes a label assigned to R2, G1 forwards the message from D2 to R2 through T2.
  • S207' may be: the gateway device may forward the packet according to the first label allocated to the network side device in the tunnel table. That is, the gateway device determines that the tunnel table includes the first label that is allocated to the network side device in the packet, and the gateway device may be first allocated to the network side device according to the information included in the tunnel table. A label that forwards the message.
  • the gateway device discards the packet or caches the packet.
  • the gateway device determines that the tunnel table does not include the first label allocated to the network side device in the packet, and the gateway device determines that the tunnel for transmitting the packet is not a legal tunnel.
  • the tunnel for transmitting the packet is a tunnel corresponding to the first label allocated to the network side device.
  • the gateway device may process the packet according to a preset policy.
  • the preset policy is to discard the message or cache the message.
  • the preset policy may also be other processing strategies for the message, and will not be described here.
  • G1 determines that the second tunnel table does not include the label allocated to R2, G1 discards the message from D2 or caches the message from D2.
  • the authentication response from the control device that is received by the gateway device further includes a forwarding policy, where the forwarding policy is used to indicate, by the gateway device, the processing used by the user to send the packet the way.
  • the gateway device may process the packet according to the forwarding policy, such as Discard the message or cache the message.
  • the parameters of the tunnel may further include a type of the tunnel.
  • the gateway device may determine, according to the value of the protocol (English name is protocol) field included in the IP header of the packet from the user, or the destination data number of the User Datagram Protocol (UDP).
  • the type of the tunnel can be determined as the general routing encapsulation protocol (Generic Routing Encapsulation, GRE for short), virtual extended local area network (VXLAN), and network virtualization overlay. (English full name is Network Virtualization over Layer 3, UDP for short), Internet Protocol Security Protocol (English full name is Internet Protocol Security, IPsec for short), etc., and will not be illustrated one by one.
  • the tunnel table obtained by the gateway device further includes a type of the tunnel.
  • the gateway device may detect a tunnel for transmitting the packet according to a tunnel table including a type of the tunnel, and details are not described herein.
  • the authentication response received by the gateway device from the control device further includes a quality of service (referred to as quality of service, QoS for short) parameter.
  • QoS quality of service
  • the gateway device may control the transmission quality of the packet according to the QoS parameter, for example, the gateway device forwards the packet according to the QoS parameter.
  • the authentication response received by the gateway device from the control device further includes an alert indication.
  • the alarm indication is used to prompt the control device to receive the message sent by the user side device.
  • the gateway device In the method provided in the first embodiment of the present invention, the gateway device generates a tunnel table according to the authentication response from the control device.
  • the gateway device is capable of detecting a tunnel for transmitting the packet by using a tunnel table. If the tunnel table includes parameters of the first tunnel in the packet, the gateway device forwards the packet to the network side device. In this way, the gateway device can verify the validity of the tunnel corresponding to the user, which helps to improve security.
  • FIG. 3 is a flowchart of a method for performing tunnel detection according to Embodiment 1 of the present invention.
  • the first embodiment of FIG. 3 is a description of the method provided by the embodiment of the present invention from the perspective of the control device.
  • the gateway device may be applicable to the user side device and the network side device.
  • the first tunnel is detected, that is, the packet mentioned in the first embodiment of FIG. 3 is a packet obtained by encapsulating the parameters of the first tunnel.
  • the first tunnel is a tunnel between the user side device and the network side device, and the first tunnel passes through the gateway device.
  • the user side device is a device used by the user to access the network.
  • the control device receives an authentication request from a gateway device, where the authentication request includes identifier information of the user, where the user is a user requesting access to the network.
  • the authentication request, the gateway device, the user's identification information, and the control device in the embodiment of the present invention may be the same as the corresponding content in the embodiment corresponding to FIG. 2, and details are not described herein again.
  • the authentication request may also carry the identifier of the gateway device or the address of the gateway device, for example, the source IP address of the authentication request is the source IP address of the gateway device.
  • the authentication request in this embodiment may be the same as the authentication request in the embodiment corresponding to FIG. 2, and details are not described herein again.
  • C1 is the control device
  • G1 is the gateway device
  • D1, D2, and D3 belong to the network side device
  • R1, R2, and R3 belong to the network side device.
  • D1 is a first user terminal
  • D2 is a second user terminal
  • D3 is a third user terminal
  • R1 is the first router
  • R2 is the second router
  • R3 is the third router
  • T1 is the tunnel between D1 and R1
  • T2 is the tunnel between D2 and R2
  • T3 is the tunnel between D3 and R3.
  • T1, T2 and T3 are both tunnels through G1, and G1 can detect T1, T2 and T3.
  • C1 receives the first authentication request, the second authentication request, and the third authentication request from G1.
  • the first authentication request includes identification information of D1.
  • the second authentication request includes identification information of D2.
  • the third authentication request includes identification information of D3.
  • the control device determines, according to the information of the legal user, the identification information of the user that is included in the authentication request, whether the user is a legitimate user, and the information of the legal user includes the control device being authenticated as legal.
  • control device saves information of the legitimate user.
  • the control device may search for information of the legal user according to the identification information of the user included in the authentication request. If the information of the legal user includes the identification information of the user, the user is authenticated as a legitimate user by the control device.
  • C1 stores the information of the legal user, and the information of the legal user includes the identification information of the user that is authenticated by the control device and the user that is authenticated to the control device.
  • the C1 determines whether the information of the legal user includes the identification information of the D1. If the information of the legal user includes the identification information of the D1, C1 executes S303; if the information of the legal user does not include the identification information of the D1, the C1 ends or C1 A message that D1 failed the authentication is fed back to G1.
  • the information of the legal user includes the identification information of D2, C1 performs S303; if the information of the legal user does not include the identification information of D2, the end or C1 feeds back to G1 a message that D2 fails the authentication. If the information of the legal user includes the identification information of D3, C1 performs S303; if the information of the legal user does not include the identification information of D3, the end or C1 feeds back to G1 a message that D3 fails the authentication.
  • the control device obtains the user that is authorized to be authenticated by the control device according to the identification information of the user and the information of the legal user.
  • the parameters of the tunnel may generate the authentication response according to the parameter of the tunnel allocated to the user whose device is authenticated by the control device.
  • the parameter of the tunnel allocated to the user that is authenticated by the control device may be a source address of a tunnel allocated to a user authenticated by the control device and a tunnel assigned to a user authenticated by the control device as a legitimate user.
  • the destination address, or the parameter of the tunnel allocated to the user authenticated by the control device may be the identification information of the tunnel assigned to the user whose authentication device is authenticated, or the authentication device is assigned to the control device.
  • the parameter of the tunnel of the legitimate user may be a label assigned to the network side device.
  • the network side device is the same as the network side device in the embodiment corresponding to FIG. 2, and details are not described herein again.
  • the authentication response in the embodiment corresponding to FIG. 3 may be the same as the authentication response in the embodiment corresponding to FIG. 2, and details are not described herein again.
  • control device may send the authentication response to the gateway device according to the identifier of the gateway device or the address of the gateway device that is carried in the authentication request.
  • the control device may send the authentication response to the gateway device by using a communication port between the control device and the gateway device, and the specific sending process is not described herein again.
  • C1 determines that D1 is a legitimate user, C1 can obtain the source address of the tunnel allocated for D1 and the destination address of the tunnel allocated for D1. C1 generates a first authentication response according to the source address of the tunnel allocated for D1 and the destination address of the tunnel allocated for D1. The first authentication response includes a source address of a tunnel allocated for D1 and a destination address of a tunnel allocated for D1. C1 sends the first authentication response to G1.
  • C1 determines that D2 is a legitimate user, C1 can obtain the label assigned to R2.
  • C1 generates a second authentication response according to the label assigned to R2.
  • the second authentication response includes the label assigned to R2.
  • C1 sends the second authentication response to G1.
  • C1 determines that D3 is a legitimate user, C1 can obtain identification information of the tunnel allocated for D3.
  • C1 generates a third authentication response according to the identification information of the tunnel allocated for D3.
  • the third authentication response includes identification information of a tunnel allocated for D3.
  • C1 sends the third authentication response to G1.
  • the parameter of the tunnel allocated to the user whose device is authenticated as a legitimate device further includes a type of a tunnel allocated to a user whose device is authenticated as a legitimate device.
  • the type of the tunnel is the same as that of the tunnel in the first embodiment corresponding to FIG. 2, and details are not described herein again.
  • the tunnel table generated by the gateway device may further include the type of the tunnel, that is, the type of the tunnel may be used as an additional match when verifying the legitimacy of the tunnel.
  • the authentication response may further include an alert indication and/or a forwarding policy.
  • the alarm indication is used to prompt the control device to receive the message sent by the user side device.
  • the packet includes a parameter of the first tunnel, that is, the packet is a packet obtained by encapsulating the parameter of the first tunnel.
  • the forwarding policy is used to indicate a processing manner adopted by the gateway device for the packet sent by the user.
  • the authentication response may further include identification information of the user.
  • the net The tunnel table obtained by the device may further include the identification information of the user, that is, the identifier information of the user may be used as an additional item when verifying the legitimacy of the tunnel.
  • the control device can verify the validity of the user according to the identification information of the user carried in the authentication request from the gateway device. After the control device verifies that the user is a legitimate user, the control device may send an authentication response to the gateway device. In this way, the gateway device can perform legality verification on the tunnel corresponding to the user, which helps improve security.
  • FIG. 4 is a schematic diagram of another network scenario according to an embodiment of the present invention.
  • C2 is a control device
  • G2 is a gateway device
  • D1, D2, and D3 belong to a network side device
  • R1, R2, and R3 belong to a network side device.
  • D1 is a first user terminal
  • D2 is a second user terminal
  • D3 is a third user terminal
  • R1 is the first router
  • R2 is the second router
  • R3 is the third router
  • T1 is the tunnel between G2 and R1
  • T2 is the tunnel between G1 and R2
  • T3 is the tunnel between G1 and R3.
  • FIG. 5 is a flowchart of a method for performing tunnel detection according to Embodiment 2 of the present invention.
  • the second embodiment corresponding to FIG. 5 is a description of the method provided by the implementation of the present invention from the perspective of the gateway device.
  • the gateway device establishes a tunnel with the network side device after detecting the legality of the user side device, where the tunnel is a tunnel between the gateway device and the network side device.
  • the network side device is a device at the termination point of the tunnel, that is, the network side device is a network side device that the user side device needs to access.
  • the user side device is a device used by the user to access the network.
  • the first packet mentioned in the second embodiment of FIG. 5 is a packet that is not encapsulated by the tunnel, and the second packet is a packet encapsulated by the tunnel.
  • the method provided in the second embodiment of the present invention will be specifically described below with reference to FIG. 4 and FIG. 5.
  • the gateway device obtains an authentication request according to the identifier information of the user, where the user is a user requesting access to the network, and the authentication request includes identifier information of the user.
  • S501 in the second embodiment of FIG. 5 is the same as S201 in the first embodiment corresponding to FIG. 2, and details are not described herein again.
  • G2 may receive a first access request from D1, which may be a request to access R1.
  • the first access request includes identification information of D1.
  • G2 obtains the identification information of D1 from the first access request.
  • G2 generates the first recognition based on the identification information of D1. Certificate request.
  • the first authentication request includes identification information of D1.
  • G2 may receive a second access request from D2, which may be a request to access R2.
  • the second access request includes identification information of D2.
  • G2 obtains the identification information of D2 from the second access request.
  • G2 generates a second authentication request according to the identification information of D2.
  • the second authentication request includes identification information of D2.
  • G2 can receive a third access request from D3.
  • the third access request may be a request to access R3.
  • the third access request includes identification information of D3.
  • G2 obtains the identification information of D3 from the third access request.
  • G2 generates a third authentication request according to the identification information of D3, where the third authentication request includes
  • the gateway device sends the authentication request to a control device.
  • S502 in the second embodiment of FIG. 5 is the same as S202 in the first embodiment of FIG. 2, and details are not described herein again.
  • G2 sends the first authentication request, the second authentication request, and the third authentication request to C2.
  • 4 is an example of sending the first authentication request, the second authentication request, and the third authentication request to the C2 as an example.
  • G2 may send the first to C2 simultaneously or sequentially.
  • One or more of the authentication request, the second authentication request, and the third authentication request are not illustrated one by one.
  • the first, second, and third of the first authentication request, the second authentication request, and the third authentication request are used to distinguish different authentication requests, and do not indicate a sending order, for example, G2 may sequentially C2 sends the second authentication request, the first authentication request, and the third authentication request.
  • the gateway device receives an authentication response from the control device, where the authentication response includes a parameter of the tunnel and the identifier information of the user that is authenticated by the control device, where the tunnel is used by the gateway device.
  • the parameters of the tunnel include the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is the address of the gateway device, and the destination address of the tunnel is the address of the network side device.
  • the network side device is a device at a termination point of the tunnel.
  • the parameter of the tunnel includes the identifier information of the tunnel, where the tunnel is a tunnel between the gateway device and the network side device.
  • the parameter of the tunnel includes a label allocated to the network side device.
  • the source address of the tunnel is a source IP address of the tunnel, such as an IP address of the gateway device.
  • the destination address of the tunnel is the destination IP address of the tunnel, such as the IP address of the network side device.
  • the protocol used by the authentication response may be the same as the protocol used by the authentication request.
  • the authentication response is a packet based on a RADIUS protocol.
  • the RADIUS protocol-based authentication response includes an attribute, and one or more attributes in the RADIUS-based authentication response are used to carry the parameters of the tunnel and the identification information of the user that is authenticated by the control device.
  • the authentication response is a message based on a Diameter protocol.
  • the Diameter header of the authentication response based on the Diameter protocol includes an AVP, and one or more AVPs in the Diameter header are used to carry the parameters of the tunnel and the identification information of the user that is authenticated by the control device.
  • G2 receives a first authentication response from C2, the first authentication response including a source address of the first tunnel and a destination address of the first tunnel.
  • the first tunnel may be used to transmit a message sent by D1 to R1.
  • G2 receives a second authentication response from C2, the second authentication response including a label assigned to R2.
  • the tag assigned to R2 can be used to establish a second tunnel.
  • the second tunnel may be used to transmit a message sent by D2 to R2.
  • G2 receives a third authentication response from C2, the third authentication response including identification information of the third tunnel.
  • the third tunnel may be used to transmit a message sent by D3 to R3.
  • the gateway device generates a tunnel table according to the parameter of the tunnel and the identifier information of the user that is authenticated by the control device, where the tunnel table is used for tunnel encapsulation of a packet from a legal user.
  • the gateway device performs the parameter according to the tunnel and the control.
  • the device is authenticated as the legal identifier of the user
  • the generating the tunnel table includes: the gateway device according to the source address of the tunnel, the destination address of the tunnel, and the identifier information of the user that is authenticated by the control device. , generating the tunnel table.
  • G2 generates a first tunnel table according to the identification information of D1 in the first authentication response, the source address of the first tunnel, and the destination address of the first tunnel.
  • the first tunnel table includes an identification letter of D1
  • the source address of the first tunnel is an address of G2, and the destination address of the first tunnel is an address of R1.
  • the gateway is And generating, by the device, the tunnel table according to the parameter of the tunnel and the identifier information of the user that is authenticated by the control device, the gateway device querying, according to the identifier information of the tunnel, the source address and the location of the tunnel.
  • the destination address of the tunnel, the source address of the tunnel and the destination address of the tunnel respectively correspond to the identifier information of the tunnel; the gateway device according to the identifier information of the user, the source address of the tunnel, and the The tunnel address is generated by the destination address of the tunnel.
  • the first corresponding relationship may be pre-stored on the gateway device, where the first correspondence includes the identifier information of the tunnel, a source address of the tunnel, and a destination address of the tunnel.
  • the gateway device may query the source address of the tunnel and the destination address of the tunnel according to the identifier information of the tunnel and the first corresponding relationship that is pre-stored.
  • G2 obtains a source address and a third tunnel for allocating the third tunnel according to the identifier information of the third tunnel in the third authentication response and the first corresponding relationship stored in advance. Destination address.
  • the source address of the third tunnel is the address of G2, and the destination address of the third tunnel is the address of R3.
  • G2 generates a third tunnel table according to the identification information of D3, the source address of the third tunnel, and the destination address of the third tunnel.
  • the third tunnel table includes identification information of D3, a source address of the third tunnel, and a destination address of the third tunnel.
  • the gateway device if the parameters of the tunnel include a label allocated to a network side device, where the network side device is a device at a termination point of the tunnel, the gateway device And generating a tunnel table according to the parameter of the tunnel and the identifier information of the user that is verified by the control device to be valid: the gateway device generates, according to the identifier information of the user and the label allocated to the network side device, The tunnel table.
  • the label assigned to the network side device belongs to a global label, that is, the forwarding device that the tunnel passes through can learn the device at the termination point of the tunnel according to the label allocated to the network side device.
  • G2 generates, according to the identification information of D2 in the second authentication response and the label allocated to R2.
  • Second tunnel table includes identification information of D2 and the label assigned to R2.
  • the gateway device if the tunnel parameter includes the identifier information of the tunnel, and the tunnel is a tunnel between the gateway device and the network side device, the gateway device And generating a tunnel table according to the parameter of the tunnel and the identifier information of the user that is verified by the control device to be valid: the gateway device queries the label allocated to the network side device according to the identifier information of the tunnel. The gateway device generates the tunnel table according to the identifier information of the user and the label allocated to the network side device. The second corresponding relationship may be pre-stored on the gateway device, where the second correspondence includes the identifier information of the tunnel and the label allocated to the network side device. The gateway device may query, according to the identifier information of the tunnel and the second corresponding relationship that is stored in advance, the label that is allocated to the network side device.
  • the identification information of the tunnel in the embodiment of the present invention may be an ID of the tunnel, and may also be an index of the tunnel.
  • the possible forms of the identification information of the tunnel are not illustrated one by one.
  • the method provided by the embodiment of the present invention further includes:
  • the gateway device receives the first packet from the user-side device, where the first packet includes the identifier information of the first user, where the user-side device is used by the first user to access the network. device.
  • the first packet is a packet that is not encapsulated by the tunnel and needs to be sent to the network side device.
  • the gateway device may parse the first packet from the user side device, and obtain the identifier information of the first user included in the first packet.
  • G2 receives the first message from D1, and the first message from D1 includes the identification information of D1.
  • the first packet from D1 is a packet that is not tunnel encapsulated and needs to be sent to R1.
  • G2 may also receive a first message from D2, the first message from D2 including identification information of D2.
  • the first packet from D2 is a packet that is not tunnel encapsulated and needs to be sent to R2.
  • G2 may also receive a first message from D3, the first message from D3 including identification information of D3.
  • the first packet from D3 is a packet that is not tunnel encapsulated and needs to be sent to R3.
  • the gateway device determines whether the tunnel table includes the identifier information of the first user in the first packet, if the tunnel table includes the first user in the first packet If the identification information is not generated, the S507 is performed. If the tunnel table does not include the identifier information of the first user in the first packet, S508 is performed.
  • G2 determines whether the first tunnel table includes the identification information of D1 in the first packet from D1. If the first tunnel table includes the identification information of D1, G2 may execute S507. . If the first tunnel table does not include the identification information of D1, G2 may perform S508. G2 determines whether the third tunnel table includes the identification information of D3 in the first packet from D3. If the third tunnel table includes the identification information of D3, G2 may execute S507. If the third tunnel table does not include the identification information of D3, G2 may perform S508.
  • the gateway device obtains a second packet according to the first packet, a source address of the tunnel, and a destination address of the tunnel, where the second packet is The packet obtained after the first packet is encapsulated by the source address of the tunnel and the destination address of the tunnel, and then S509 is performed.
  • the gateway device determines that the tunnel table includes the identifier information of the first user in the first packet, that is, the first user is a user whose authentication device is authenticated as a legitimate user.
  • the gateway device may establish, according to the tunnel table, a tunnel for transmitting the first packet with the network side device, that is, the gateway device encapsulates the first packet by using parameters of the tunnel .
  • the G2 determines that the first tunnel table includes the identification information of the D1
  • the G2 is based on the source address of the first tunnel and the destination address of the first tunnel included in the first tunnel table.
  • the first packet from D1 is encapsulated to obtain a second packet that needs to be sent to R1.
  • the source address of the first tunnel is the address of G2.
  • the destination address of the first tunnel is the address of R1.
  • G2 determines that the third tunnel table includes the identification information of D3
  • G2 compares the first packet from D3 according to the source address of the third tunnel included in the third tunnel table and the destination address of the third tunnel. Encapsulation is performed to obtain a second message that needs to be sent to R3.
  • the source address of the third tunnel is the address of G2.
  • the destination address of the third tunnel is the address of R3.
  • the gateway device discards the first packet or caches the first packet, and may end the process.
  • the gateway device determines that the tunnel table does not include the identifier information of the first user in the first packet, and determines that the first user is not a user whose authentication device is authenticated as a legitimate user.
  • the gateway device may process the first packet according to a preset policy.
  • the preset policy is to discard the first packet or cache the first packet.
  • G2 may process the first packet from D1 according to a preset policy. If G2 determines that the third tunnel table does not include the identification information of D3, G2 processes the first packet from D3 according to a preset policy.
  • the gateway device forwards the second packet according to the destination address of the tunnel that is included in the second packet.
  • a third correspondence relationship may be pre-stored on the gateway device.
  • the third correspondence is a correspondence between a first port of the gateway device and a destination address of the tunnel.
  • the gateway device may determine the first port of the gateway device according to the third correspondence and the destination address of the tunnel in the packet.
  • the gateway device sends the second packet by using the first port, so that the second packet is forwarded to the network side device.
  • G2 forwards the second packet that needs to be sent to R1 to R1.
  • G2 sends the second message that needs to be sent to R3 to R3.
  • the authentication response further includes flow information corresponding to the tunnel, where the flow information is used to identify a data flow of the user, where the flow information corresponds to the identification information of the user included in the tunnel table.
  • the control device authenticates the legal identification information of the user, and generates the tunnel table.
  • the first message in S505 further includes first flow information.
  • the first flow information is used to identify a data flow of a third user.
  • the first packet is from a user side device used by the third user to access the network.
  • the S506 determines, by the gateway device, whether the tunnel table includes the first flow information and the identifier information of the third user, if the tunnel table S506 is performed, where the first flow information and the identification information of the third user are included, and if the tunnel table does not include the first flow information or the identification information of the third user, S508 is performed.
  • the first stream information and the identifier information of the third user may be used to identify a certain data stream of the third user, that is, the legal data stream is transmitted to the network side through a tunnel. device.
  • the third user is a user who needs the gateway device to perform legality detection.
  • the method provided by the embodiment of the present invention further includes:
  • the gateway device receives the first packet from the user-side device, where the first packet includes the identifier information of the second user, where the user-side device is used by the second user to access the network. device of.
  • the first packet is a packet that is not encapsulated by the tunnel.
  • the gateway device may parse the received first packet from the user side device, and obtain the identifier information of the second user included in the first packet.
  • the second user is a user who needs the gateway device to perform legality detection.
  • G2 receives the first message from D2, and the first message from D2 includes the identification information of D2.
  • the first packet from D2 is a packet that is not tunnel encapsulated and needs to be sent to R2.
  • the gateway device determines whether the tunnel table includes the identifier information of the second user in the first packet, if the tunnel table includes the second user in the first packet S508' is performed, and if the tunnel table does not include the identification information of the second user in the first packet, then S508' is performed.
  • G2 determines whether the second tunnel table includes the identification information of D2 in the first packet from D2. If the second tunnel table includes the identification information of D2, G2 may execute S507. '. If the second tunnel table does not include the identification information of D2, G2 may execute S508'.
  • the gateway device obtains a second packet according to the first packet and the label that is included in the tunnel table and is allocated to the network side device, where the second packet is allocated to the network side device by using the The label is obtained by tunneling the packet obtained by the first packet, and then executing S509'.
  • the gateway device determines that the tunnel table includes the first part in the first packet And determining, by the second user, the second user that the user is authenticated as a legitimate user.
  • the gateway device may tunnel encapsulate the first packet to obtain a second packet by using the label that is allocated to the network side device that is included in the tunnel table.
  • G2 may encapsulate the first packet from D2 according to the label allocated to R2 included in the second tunnel table, and obtain a second packet that needs to be sent to R2.
  • the gateway device discards the first packet or caches the first packet, and may end Process.
  • the gateway device determines that the tunnel table does not include the identifier information of the second user in the first packet, and determines that the second user is not a user whose authentication device is authenticated as a legitimate user.
  • the gateway device may process the first packet according to a preset policy.
  • the preset policy is to discard the first packet or cache the first packet.
  • G2 may process the first packet from D2 according to a preset policy.
  • the gateway device forwards the second packet according to the label that is allocated to the network side device that is included in the second packet.
  • the fourth correspondence relationship may be pre-stored on the gateway device.
  • the fourth correspondence is a correspondence between the second port of the gateway device and the label allocated to the network side device.
  • the gateway device may determine the second port of the gateway device according to the fourth correspondence and the label allocated to the network side device in the tunnel table.
  • the gateway device sends the second packet by using the second port, so that the second packet is forwarded to the network side device.
  • G2 forwards the second packet that needs to be sent to R2 to R2.
  • the authentication response from the control device that is received by the gateway device further includes a forwarding policy, where the forwarding policy is used to indicate a processing manner adopted by the gateway device for the first packet.
  • the gateway device may process the first packet according to the forwarding policy, such as discarding the first packet or buffering the first packet.
  • the parameters of the tunnel may further include a type of the tunnel.
  • the type of the tunnel can be It is the same as the type of the tunnel mentioned in the first embodiment, and details are not described herein again.
  • the authentication response received by the gateway device from the control device further includes a QoS parameter.
  • the gateway device may control the transmission quality of the second packet according to the QoS parameter, for example, the gateway device forwards the second packet according to the QoS parameter.
  • the authentication response further includes flow information corresponding to the tunnel, where the flow information is used to identify a data flow of the user, and the flow information corresponds to a parameter of the tunnel.
  • the first message in S505' further includes second stream information. The second stream information is used to identify a data stream of the fourth user.
  • the first packet is from a user side device used by the fourth user to access the network.
  • S506 determining, by the gateway device, whether the tunnel table includes the identifier information of the fourth user and the second stream information, and if the tunnel table includes the identifier information of the fourth user and the second stream information, executing S507', if the tunnel table does not include the identifier information of the fourth user or the second stream information, then S508' is performed.
  • the flow information and the identification information of the user may be used to identify a certain data flow of the fourth user, that is, the legal data flow is transmitted to the network side device through the tunnel.
  • the gateway device In the method provided by the second embodiment of the present invention, the gateway device generates a tunnel table according to the authentication response from the control device. And if the tunnel table includes the identifier information of the user in the first packet, the gateway device generates a second packet according to the tunnel table and the first packet. The gateway device forwards the second packet to the network side device. The gateway device can perform the legality verification on the user, and after the legality is verified, the gateway device establishes a legal tunnel with the network side device, which helps improve security.
  • FIG. 6 is a flowchart of a method for performing tunnel detection according to Embodiment 2 of the present invention.
  • the second embodiment of FIG. 6 is a description of the method provided by the embodiment of the present invention from the perspective of the control device.
  • the gateway device may establish a tunnel for transmitting the first packet of the user with the network side device.
  • Figure 6 corresponds to the second embodiment
  • the first packet mentioned is a packet that is not encapsulated by the tunnel
  • the second packet is a packet encapsulated by the tunnel.
  • the tunnel is a tunnel between the gateway device and the network side device.
  • the control device receives an authentication request sent by the gateway device, where the authentication request includes identifier information of the user, where the user is a user requesting access to the network.
  • the authentication request, the gateway device, the user's identification information, and the control device in the embodiment of the present invention may be the same as the corresponding content in the embodiment corresponding to FIG. 5, and details are not described herein again.
  • the authentication request may also carry the identifier of the gateway device or the address of the gateway device, for example, the source IP address of the authentication request is the source IP address of the gateway device.
  • the authentication request in this embodiment may be the same as the authentication request in the embodiment corresponding to FIG. 5, and details are not described herein again.
  • C2 is the control device
  • G2 is the gateway device
  • D1, D2, and D3 belong to the network side device
  • R1, R2, and R3 belong to the network side device.
  • D1 is a first user terminal
  • D2 is a second user terminal
  • D3 is a third user terminal
  • R1 is the first router
  • R2 is the second router
  • R3 is the third router
  • T1 is the tunnel between G2 and R1
  • T2 is the tunnel between G2 and R2
  • T3 is the tunnel between G2 and R3.
  • C2 receives the first authentication request, the second authentication request, and the third authentication request from G2.
  • the first authentication request includes identification information of D1.
  • the second authentication request includes identification information of D2.
  • the third authentication request includes identification information of D3.
  • the control device determines, according to the information of the legal user, the identification information of the user that is included in the authentication request, whether the user is a legitimate user, and the information of the legal user includes the control device being authenticated as legal.
  • C2 stores the information of the legal user, and the information of the legal user includes the identification information of the user whose authentication device is authenticated as a legitimate user and the user that is authenticated to the control device.
  • the C2 determines whether the information of the legal user includes the identification information of the D1. If the information of the legal user includes the identification information of the D1, C2 executes S603; if the information of the legal user does not include the identification information of the D1, the end or C2 Feedback D1 to G2 Uncertified message.
  • the information of the legal user includes the identification information of D2, C2 performs S603; if the information of the legal user does not include the identification information of D2, the end or C2 feeds back to G2 a message that D2 fails the authentication. If the information of the legal user includes the identification information of the D3, C2 performs S603; if the information of the legal user does not include the identification information of the D3, the end or C2 feeds back to the G2 a message that the D3 fails the authentication.
  • the control device determines that the user is the legal user, sends an authentication response to the gateway device, where the authentication response includes identifier information of the user that is authenticated by the control device and is allocated to the control.
  • the device is authenticated as a parameter of the tunnel of the legitimate user.
  • the control device may determine that the user is the legal user, and obtain a tunnel assigned to the user whose authentication device is authenticated according to the identification information of the user and the information of the legal user. parameter.
  • the control device may generate the authentication response according to the parameter of the tunnel allocated to the user whose device is authenticated by the control device.
  • the parameter of the tunnel may be the source address of the tunnel and the destination address of the tunnel, or the parameter of the tunnel may be the identifier information of the tunnel, or the parameter of the tunnel may be a label allocated to the network side device.
  • the tunnel is a tunnel between the gateway device and the network side device.
  • the authentication response in the embodiment corresponding to FIG. 6 may be the same as the authentication response in the embodiment corresponding to FIG. 5, and details are not described herein again.
  • control device may send the authentication response to the gateway device according to the identifier of the gateway device or the address of the gateway device that is carried in the authentication request.
  • the control device may send the authentication response to the gateway device by using a communication port between the control device and the gateway device, and the specific sending process is not described herein again.
  • C2 can obtain the source address of the first tunnel and the destination address of the first tunnel.
  • the first tunnel is a tunnel between G2 and R1.
  • the C2 generates a first authentication response according to the source address of the first tunnel and the destination address of the first tunnel.
  • the first authentication response includes a source address of the first tunnel and a destination address of the first tunnel.
  • C2 sends the first authentication response to G2.
  • C2 determines that D2 is a legitimate user, C2 can obtain the label assigned to R2.
  • C2 generates a second authentication response according to the label assigned to R2.
  • the allocation for R2 The label can be used to forward the message from D2 through the second tunnel.
  • the second authentication response includes the label assigned to R2.
  • C2 sends the second authentication response to G2.
  • C2 determines that D3 is a legitimate user, C2 can obtain the identification information of the third tunnel.
  • C2 generates a third authentication response according to the identification information of the third tunnel.
  • the third authentication response includes identification information of the third tunnel.
  • C2 sends the third authentication response to G2.
  • the parameters of the tunnel further include a type of the tunnel.
  • the tunnel type is the same as the tunnel parameter in the embodiment corresponding to FIG. 5, and details are not described herein again.
  • the authentication response may further include a forwarding policy and/or flow information corresponding to the tunnel.
  • the forwarding policy is used to indicate a processing manner used by the gateway device to send the first packet sent by the user.
  • the flow information is used to identify a data flow of the user.
  • the control device may verify the validity of the user according to the identification information of the user carried in the authentication request from the gateway device. After the control device verifies that the user is a valid user, the control device may send the identifier information of the user whose control device is authenticated to the gateway device and the parameters of the tunnel that is allocated to the user whose device is authenticated by the control device. . In this way, the gateway device can perform legality verification on the user and establish a legal tunnel with the network side device, which helps improve security.
  • FIG. 7 is a schematic structural diagram of a gateway device according to Embodiment 3 of the present invention.
  • the gateway device provided in Embodiment 3 corresponding to FIG. 7 can perform the method provided in Embodiment 1 corresponding to FIG. 2.
  • the gateway device can detect the tunnel between the user side device and the network side device, that is, the packet mentioned in the third embodiment of the present invention is obtained by using the parameters of the tunnel for encapsulation. Text.
  • the gateway device provided in Embodiment 3 of the present invention includes: an obtaining unit 701, a sending unit 702, a receiving unit 703, and a generating unit 704.
  • the obtaining unit 701 is configured to obtain an authentication request according to the identification information of the user, where the user is a user requesting access to the network, and the authentication request includes the identification information of the user.
  • the obtaining unit 701 is specifically configured to receive an access request sent by the user side device, and generate the authentication request according to the identifier information of the user included in the access request.
  • the obtaining unit 701 is specifically configured to receive an access request sent by the user side device, and send the identifier information of the user included in the access request to a device for generating the authentication request, from the The device for generating the authentication request obtains the authentication request.
  • the user side device in the third embodiment may be the user side device in the first embodiment
  • the network side device in the third embodiment may be the network side device in the first embodiment, and details are not described herein again.
  • the sending unit 702 is configured to send the authentication request to a control device.
  • the authentication request and the method for sending the authentication request are the same as those in the first embodiment, and details are not described herein again.
  • the receiving unit 703 is configured to receive an authentication response from the control device, where the authentication response includes a parameter of a tunnel, and the tunnel is a tunnel for transmitting a message adopted by a user authenticated by the control device.
  • the parameters of the tunnel are the same as those of the tunnel in the first embodiment, and are not described here.
  • the parameters of the tunnel may also include a type of tunnel.
  • the type of the tunnel is the same as that of the tunnel provided in the first embodiment, and details are not described herein again.
  • the generating unit 704 is configured to generate a tunnel table according to a parameter of the tunnel, where the tunnel table is used to perform legality detection on the tunnel, and the tunnel table includes parameters of the tunnel.
  • the parameters of the tunnel include the source address of the tunnel and the destination address of the tunnel
  • the source address of the tunnel is the address of the user-side device
  • the user-side device accesses the network for the user.
  • the device used, the destination address of the tunnel is the address of the network side device, and the network side device is the device at the termination point of the tunnel.
  • the generating unit 704 is configured to generate a tunnel table according to the source address of the tunnel and the destination address of the tunnel.
  • the tunnel table includes a source address of the tunnel and a destination address of the tunnel.
  • the parameters of the tunnel include the identifier information of the tunnel
  • the tunnel is a tunnel between the user side device and the network side device
  • the user side device is a device used by the user to access the network.
  • the network side device is a device at a termination point of the tunnel
  • the generating unit 704 is specifically configured to: according to the identifier information of the tunnel, obtain a source address of the tunnel and a destination address of the tunnel, where The source address of the tunnel and the destination address of the tunnel respectively correspond to the identification information of the tunnel; and generate according to the source address of the tunnel and the destination address of the tunnel.
  • a tunnel table the tunnel table including a source address of the tunnel and a destination address of the tunnel.
  • the parameters of the tunnel include a label allocated to a network side device, and the network side device is a device at a termination point of the tunnel.
  • the generating unit 704 is specifically configured to generate a tunnel table according to the label allocated to the network side device.
  • the tunnel table includes a label of the network side device.
  • the parameters of the tunnel include the identifier information of the tunnel, the tunnel is a tunnel between the user side device and the network side device, and the user side device is a device used by the user to access the network.
  • the network-side device is a device that is in the termination point of the tunnel, and the generating unit 704 is configured to: query, according to the identifier information of the tunnel, a label that is allocated to the network-side device; The label of the network side device generates a tunnel table, where the tunnel table includes the label allocated to the network side device.
  • the gateway device further includes the determining unit 705.
  • the receiving unit 703 is further configured to receive a packet from the user side device, where the packet includes the first The source address of the tunnel and the destination address of the first tunnel.
  • the determining unit 705 is configured to determine whether the tunnel table includes a source address of the first tunnel and a destination address of the first tunnel in the packet.
  • the sending unit 702 is further configured to determine, in the determining unit 705, that the tunnel table includes a source address of the first tunnel and a destination address of the first tunnel in the packet, according to the packet The destination address of the first tunnel forwards the packet.
  • the sending unit 702 is further configured to: at the determining unit 705, that the tunnel table includes a source address of the first tunnel and a destination address of the first tunnel in the packet, according to the tunnel The destination address of the first tunnel of the table forwards the packet.
  • the receiving unit 703 is further configured to receive a packet from the user side device, where the packet includes a first label that is allocated to the network side device.
  • the user side device is a device used by a user who needs to detect legality to access the network.
  • the determining unit 705 is further configured to determine whether the tunnel table includes the first label allocated to the network side device in the packet.
  • the sending unit 702 is further configured to use the The element 705 determines that the tunnel table includes the first label allocated to the network side device in the packet, and forwards the packet according to the first label allocated to the network side device in the packet.
  • the sending unit 702 is further configured to determine, by the determining unit 705, that the tunnel table includes the first label allocated to the network side device in the packet, according to the allocation in the tunnel table. And forwarding the packet to the first label of the network side device.
  • the gateway device further includes a processing unit 706. If the tunnel table includes the source address of the tunnel and the destination address of the tunnel, the packet from the user side device includes a source address of the first tunnel and a destination address of the first tunnel, and the determining unit 705 determines the The processing unit 706 discards the packet from the user side device, if the tunnel table does not include the source address of the first tunnel in the packet or the destination address of the first tunnel in the packet. Or buffering the message from the user side device.
  • the authentication response further includes a forwarding policy, and the forwarding policy is the same as the forwarding policy in the first embodiment, and details are not described herein again.
  • the processing unit 706 can process the packet from the user side device according to the forwarding policy.
  • the packet from the user side device includes a first label allocated to the network side device, and the determining unit 705 determines that the tunnel table does not include the packet.
  • the processing unit 706 discards the packet from the user side device or caches the message from the user side device.
  • the authentication response further includes a QoS parameter.
  • the sending unit 702 may further forward the packet according to the QoS parameter, that is, control the transmission quality of the packet.
  • the parameters of the tunnel may further include a type of the tunnel.
  • the content of the type of the tunnel is the same as that of the tunnel in the first embodiment of the present invention, and details are not described herein again.
  • the authentication response further includes an alert indication and/or a forwarding policy.
  • the alarm indication is used to prompt the control device to receive the message sent by the user side device.
  • the forwarding policy is used to indicate a processing manner adopted by the gateway device for the packet sent by the user.
  • the generating unit 704 may generate a tunnel table according to the authentication response received by the receiving unit.
  • the determining unit 705 can receive according to the tunnel table and the receiving unit The packet determines the legitimacy of the tunnel used to forward the packet. After the determining unit 705 determines that the tunnel for forwarding the packet is a valid tunnel, the sending unit 702 can forward the packet to the network side device by using the tunnel. In this way, the gateway device can verify the validity of the tunnel corresponding to the user, which helps to improve security.
  • FIG. 8 is a schematic structural diagram of a control device according to Embodiment 3 of the present invention.
  • the control device provided in Embodiment 3 corresponding to FIG. 8 can perform the method provided in Embodiment 1 corresponding to FIG. 3.
  • the control device provided in Embodiment 3 includes: a receiving unit 801, a determining unit 802, and a transmitting unit 803.
  • the receiving unit 801 is configured to receive an authentication request sent by the gateway device, where the authentication request includes identifier information of the user, where the user is a user requesting access to the network.
  • the authentication request in the embodiment of the present invention is the same as the authentication request in the embodiment corresponding to FIG. 7, and details are not described herein again.
  • the determining unit 802 is configured to determine, according to the information of the legal user, the identification information of the user that is included in the authentication request, whether the user is a legitimate user, and the information of the legal user includes the control device being authenticated as legal.
  • the sending unit 803 is configured to send an authentication response to the gateway device after the determining unit 802 determines that the user is the legal user, where the authentication response includes a user assigned to the control device to be authenticated as a legitimate user.
  • the parameters of the tunnel are configured to send an authentication response to the gateway device after the determining unit 802 determines that the user is the legal user, where the authentication response includes a user assigned to the control device to be authenticated as a legitimate user.
  • the parameter of the tunnel includes the identifier information of the tunnel, and the identifier information of the tunnel is used to identify the tunnel, where the tunnel is a tunnel between the user side device and the network side device, and the user side device is The device used by the user to access the network, where the network side device is a device at a termination point of the tunnel.
  • the source address of the tunnel and the destination address of the tunnel the source address of the tunnel is an address of the user equipment, and the destination address of the tunnel is an address of the network side device.
  • the network side device is a device at a termination point of the tunnel.
  • the parameter of the tunnel includes a label allocated to a network side device, where the network side device is a device at a termination point of the tunnel.
  • control device may further include a generating unit.
  • the generating unit is configured to: after the determining unit 802 determines that the user is the legal user, according to the use The identification information of the user and the information of the legal user obtain the parameters of the tunnel of the user that is authenticated to the control device as being legal.
  • the generating unit may generate the authentication response according to the parameter of the tunnel allocated to the user that is authenticated by the control device.
  • the authentication response may further include any one or any combination of the identification information, the QoS parameter, the alarm indication, and the forwarding policy of the user, and is not illustrated herein.
  • the authentication response in the embodiment of the present invention is the same as the authentication response in the embodiment corresponding to FIG. 7, and details are not described herein again.
  • the tunnel parameter may also include a type of tunnel.
  • the parameters of the tunnel in the embodiment of the present invention are the same as those of the tunnel in the embodiment corresponding to FIG. 7, and details are not described herein again.
  • the determining unit 802 may send an authentication response carrying the parameters of the tunnel to the gateway device by using the sending unit 803 after determining that the user is a valid user. In this way, the gateway device can verify the validity of the tunnel corresponding to the user, which helps to improve security.
  • FIG. 9 is a schematic structural diagram of a gateway device according to Embodiment 4 of the present invention.
  • the gateway device provided in Embodiment 4 corresponding to FIG. 9 can perform the method provided in Embodiment 1.
  • the gateway device corresponding to FIG. 7 and the gateway device corresponding to FIG. 9 are the same gateway device.
  • Figure 9 shows the content included in the gateway device from a physical perspective
  • Figure 7 shows the content included in the gateway device from a logical perspective.
  • the gateway device provided in Embodiment 4 of the present invention includes: a processor 901, a memory 902, a communication interface 903, and a communication bus 904.
  • Processor 901, memory 902, and communication interface 903 can communicate over communication bus 904.
  • the memory 902 is used to store program code.
  • processor 901 After the processor 901 is configured to read the program code stored in the memory 902, the following content is executed:
  • the tunnel is a tunnel for transmitting a message used by a user authenticated by the control device.
  • the parameter of the tunnel may be a source address of the tunnel and a destination address of the tunnel, or
  • the parameter of the tunnel may be the identification information of the tunnel, or the parameter of the tunnel may be a label allocated to the network side device.
  • the network side device is a device that the user needs to communicate;
  • the processor 901 receives, by using the communication interface 903, an access request sent by the user equipment, where the access request includes the identifier information of the user, and the processor 901 includes, according to the access request, The identification information of the user is generated, and the authentication request is generated.
  • the processor 901 is further configured to: after reading the program code stored in the memory 902, perform the following:
  • the destination address, or the parameter of the first tunnel is a first label assigned to the network side device.
  • the packet is forwarded through the communication interface 903 according to the parameter of the first tunnel in the packet.
  • the processor 901 is configured according to the first tunnel in the tunnel table.
  • the parameter is forwarded by the communication interface 903.
  • the parameters of the tunnel provided by the embodiment of the present invention are the same as those of the tunnel in the embodiment corresponding to FIG. 7, and details are not described herein again.
  • the authentication response may further include any one or any combination of the user's identification information, QoS parameters, an alarm indication, and a forwarding policy.
  • the content of the QoS parameters, the alarm indication, and the forwarding policy provided by the embodiment of the present invention are the same as the corresponding content in the embodiment corresponding to FIG. 2, and details are not described herein again.
  • the processor 901 may generate a tunnel table according to the authentication response received by the communication interface 903.
  • the processor 901 can determine the validity of the tunnel used to forward the packet according to the tunnel table and the packet received through the communication interface 903.
  • the processor After determining that the tunnel used to forward the packet is a valid tunnel, the 901 forwards the packet to the network side device through the communication interface 903. In this way, the gateway device can verify the validity of the tunnel corresponding to the user, which helps to improve security.
  • FIG. 10 is a schematic structural diagram of a control device according to Embodiment 4 of the present invention.
  • the control device provided in Embodiment 4 corresponding to FIG. 10 can perform the method provided in Embodiment 1 corresponding to FIG. 3.
  • the control device corresponding to FIG. 10 and the control device corresponding to FIG. 8 may be the same control device.
  • Figure 10 shows the contents of the control device from a physical point of view
  • Figure 8 shows the contents of the control device from a logical point of view.
  • the control device provided in Embodiment 4 includes a processor 1001, a memory 1002, a communication interface 1003, and a communication bus 1004.
  • the processor 1001, the memory 1002, and the communication interface 1003 can communicate via the communication bus 1004.
  • the memory 1002 is for storing program code.
  • processor 1001 After the processor 1001 is configured to read the program code stored in the memory 1002, the following is performed:
  • the authentication response is sent to the gateway device through the communication interface 1003, and the authentication response includes a parameter assigned to the tunnel of the user whose control device is authenticated as a legitimate user.
  • the parameters of the tunnel in the embodiment of the present invention may be the same as the parameters of the tunnel in the embodiment corresponding to FIG. 9 , and details are not described herein again.
  • the authentication response may further include any one or any combination of a QoS parameter, an alarm indication, a forwarding policy, and identification information of the user that the control device authenticates as legitimate.
  • the content of the QoS parameters, the alarm indication, and the forwarding policy provided by the embodiment of the present invention are the same as the corresponding content in the embodiment corresponding to FIG. 2, and details are not described herein again.
  • the processor 1001 may send an authentication response carrying the parameters of the tunnel to the gateway device through the communication interface.
  • the gateway device can verify the validity of the tunnel corresponding to the user, which helps to improve security.
  • FIG. 11 is a schematic structural diagram of a gateway device according to Embodiment 5 of the present invention.
  • the gateway device corresponding to FIG. 11 can perform the method provided in Embodiment 2 corresponding to FIG. 5.
  • the gateway device may establish a tunnel for transmitting the first packet of the user with the network side device.
  • the first packet mentioned in the fifth embodiment of FIG. 11 is a packet that is not encapsulated by the tunnel.
  • the gateway device provided in Embodiment 5 of the present invention includes: an obtaining unit 1101, a sending unit 1102, a receiving unit 1103, and a generating unit 1104.
  • the obtaining unit 1101 is configured to obtain an authentication request according to the identifier information of the user, where the user is a user requesting access to the network, and the authentication request includes the identifier information of the user.
  • the obtaining unit 1101 is specifically configured to receive an access request sent by the user side device, and generate the authentication request according to the identifier information of the user included in the access request.
  • the obtaining unit 1101 is specifically configured to receive an access request sent by the user side device, and send the identifier information of the user included in the access request to the device for generating the authentication request, from the The device for generating the authentication request obtains the authentication request.
  • the user side device in the fifth embodiment may be the user side device in the second embodiment, and the network side device in the fifth embodiment may be the network side device in the second embodiment, and details are not described herein again.
  • the sending unit 1102 is configured to send the authentication request to a control device.
  • the method for the authentication request and the method for sending the authentication request is the same as that of the second embodiment, and details are not described herein again.
  • the receiving unit 1103 is configured to receive an authentication response sent by the control device, where the authentication response includes a parameter of the tunnel and identifier information of the user that is authenticated by the control device, where the tunnel is used by the gateway device.
  • the transmission of the tunnel from the user's message is the same as the authentication response in the second embodiment, and details are not described herein again.
  • the parameters of the tunnel provided by the embodiment of the present invention are the same as those of the second embodiment, and are not described here.
  • the generating unit 1104 is configured to generate a tunnel table according to the parameter of the tunnel and the identifier information of the user that is authenticated by the control device, where the tunnel table is used for tunnel encapsulation of a packet from a legal user. .
  • the parameter of the tunnel corresponds to the identification information of the user that is authenticated by the control device.
  • the gateway device may use the tunnel table to identify the validity of the user, and use the tunnel table to tunnel encapsulate the packet sent by the user identified as legal.
  • the parameters of the tunnel include the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is the address of the gateway device, and the destination address of the tunnel is the address of the network side device.
  • the network side device is a device at a termination point of the tunnel.
  • the generating unit 1104 is specifically configured to generate a tunnel table by using a source address of the tunnel, a destination address of the tunnel, and identifier information of the user that is authenticated by the control device.
  • the tunnel table includes a source address of the tunnel, a destination address of the tunnel, and identifier information of the user that is authenticated by the control device.
  • the parameters of the tunnel include the identification information of the tunnel, the tunnel is a tunnel between the gateway device and the network side device, and the network side device is a device at a termination point of the tunnel,
  • the generating unit 1104 is specifically configured to: according to the identifier information of the tunnel, obtain a source address of the tunnel and a destination address of the tunnel, where a source address of the tunnel and a destination address of the tunnel are respectively related to the tunnel
  • the tunnel table is generated according to the source address of the tunnel, the destination address of the tunnel, and the identification information of the user that is authenticated by the control device.
  • the tunnel table includes a source address of the tunnel, a destination address of the tunnel, and identifier information of the user that is authenticated by the control device.
  • the parameters of the tunnel include a label allocated to a network side device, and the network side device is a device at a termination point of the tunnel.
  • the generating unit 1104 is specifically configured to generate a tunnel table according to the label allocated to the network side device and the identification information of the user that is authenticated by the control device.
  • the parameters of the tunnel include the identification information of the tunnel, the tunnel is a tunnel between the gateway device and the network side device, and the network side device is a device at a termination point of the tunnel,
  • the generating unit 1104 is specifically configured to: according to the identification information of the tunnel, query a label assigned to the network side device; a tunnel table is generated according to the identification information of the user that is authenticated by the control device and the label allocated to the network side device.
  • the tunnel table includes the identification information of the user that is authenticated by the control device and the label that is allocated to the network side device.
  • the authentication response may further include a QoS parameter and/or a forwarding policy.
  • the content of the QoS parameter and the forwarding policy are the same as the corresponding content in the second embodiment of the present invention, and details are not described herein again.
  • the parameters of the tunnel may also include a type of tunnel.
  • the parameters of the authentication request and the tunnel mentioned in the fifth embodiment of the present invention are the same as those in the second embodiment, and are not described herein again.
  • the gateway device further includes a first determining unit 1105 and a first processing unit 1106.
  • the receiving unit 1103 is further configured to receive a first packet from the user side device, where the first packet includes identifier information of the first user.
  • the first packet in the embodiment of the present invention is the same as the first packet in the second embodiment, and details are not described herein again.
  • the first determining unit 1105 is configured to determine whether the tunnel table includes the identifier information of the first user.
  • the first processing unit 1106 is configured to use the tunnel included in the first packet and the tunnel table according to the first packet
  • the source address and the destination address of the tunnel obtain a second packet
  • the second packet is encapsulated after the first packet is encapsulated according to the source address of the tunnel and the destination address of the tunnel. Obtained message.
  • the sending unit 1102 is further configured to forward the second packet according to the destination address of the tunnel that is included in the second packet.
  • the sending unit 1102 is further configured to forward the second packet according to the destination address of the tunnel included in the tunnel table.
  • the gateway device further includes a first determining unit 1105 and a first processing unit 1106.
  • the receiving unit 1103 is further configured to receive a first packet from the user side device, where the first packet includes identifier information of the second user.
  • the first determining unit 1105 is configured to determine whether the tunnel table includes the identifier information of the second user.
  • the first processing unit 1106 is configured to determine, at the first determining unit 1105, that the tunnel table includes identification information of the second user, and allocates the information according to the first packet and the tunnel table
  • the label of the network side device obtains a second packet, where the second packet is used to tunnel the first packet by using the label allocated to the network side device.
  • the sending unit 1102 is further configured to forward the second packet according to the label that is allocated to the network side device that is included in the second packet.
  • the first The processing unit 1106 is further configured to discard the first packet or cache the first packet.
  • the authentication response further includes flow information corresponding to the tunnel, where the flow information is used to identify a data flow of the user, and the generating unit 1104 is configured to use, according to the flow information, parameters of the tunnel. And generating, by the control device, the identification information of the user that is legal, and generating the tunnel table.
  • the gateway device further includes a second determining unit 1107 and a second processing unit 1108.
  • the receiving unit 1103 is further configured to receive the first packet from the user side device, where the first packet includes the first stream information and the identifier information of the third user, where the user side device is the third user accessing The equipment used by the network.
  • the second determining unit 1107 is configured to determine whether the tunnel table includes the first stream information and the identifier information of the third user.
  • the second processing unit 1108 is configured to use the first message and the Obtaining a second packet, where the second packet is based on a source address of the tunnel and a destination address of the tunnel, where the source address of the tunnel and the destination address of the tunnel are obtained, The packet obtained after the tunnel is encapsulated in the first packet.
  • the sending unit 1102 is further configured to forward the second packet according to the destination address of the tunnel that is included in the second packet. Or the sending unit 1102 is further configured to forward the second packet according to the destination address of the tunnel included in the tunnel table.
  • the authentication response further includes flow information corresponding to the tunnel, where the flow information is used to identify a data flow of the user, and the generating unit 1104 is configured to use, according to the flow information, parameters of the tunnel. And generating, by the control device, the identification information of the user that is legal, and generating the tunnel table.
  • the gateway device further includes a second determining unit 1107 and a second processing unit 1108.
  • the receiving unit 1103 is further configured to receive the first packet from the user side device, where the first packet includes the second stream information and the identifier information of the fourth user, where the user side device is the fourth user The equipment used to enter the network.
  • the second determining unit 1107 is configured to determine whether the tunnel table includes the second stream Information and identification information of the fourth user.
  • the second processing unit 1108 is configured to use the first packet and
  • the tunnel table includes a label that is allocated to the network side device, and obtains a second packet, where the second packet is obtained by tunnel encapsulating the first packet according to the label allocated to the network side device.
  • the sending unit 1102 is further configured to forward the second packet according to the label that is allocated to the network side device that is included in the second packet.
  • the sending unit 1102 is further configured to forward the second packet according to the label allocated to the network side device included in the tunnel table.
  • the second processing unit 1108 is further configured to discard The first packet or the first packet is buffered.
  • the generating unit 1104 generates a tunnel table according to the authentication response from the control device.
  • the judging unit 1105 can detect the legitimacy of the user using the tunnel table. If the tunnel table includes the identifier information of the user in the first packet, the sending unit 1102 forwards the second packet generated according to the first packet to the network side device.
  • the gateway device can establish a legal tunnel with the network side device after the user passes the legality verification, which helps improve security.
  • FIG. 12 is a schematic structural diagram of a control device according to Embodiment 5 of the present invention.
  • the control device corresponding to FIG. 12 can perform the method provided in Embodiment 2 corresponding to FIG. 6.
  • the control device provided in Embodiment 5 includes: a receiving unit 1201, a determining unit 1202, and a transmitting unit 1203.
  • the receiving unit 1201 is configured to receive an authentication request from a gateway device, where the authentication request includes identifier information of the user, where the user is a user requesting access to the network.
  • the authentication request in the embodiment of the present invention is the same as the authentication request in the embodiment corresponding to FIG. 11, and details are not described herein again.
  • the determining unit 1202 is configured to determine, according to the information of the legal user, the identification information of the user that is included in the authentication request, whether the user is a legitimate user, and the information of the legal user includes that the control device is authenticated as legal.
  • the sending unit 1203 is configured to: after the determining unit 1202 determines that the user is the legal user, send an authentication response to the gateway device, where the authentication response includes an identifier of a user that is authenticated by the control device. Information and parameters assigned to the tunnel of the user authenticated by the control device as legitimate.
  • the parameter of the tunnel includes the identifier information of the tunnel, and the identifier information of the tunnel is used to identify the tunnel, where the tunnel is a tunnel between the gateway device and a network side device, and the network side device Is the device at the termination point of the tunnel.
  • the parameter of the tunnel includes the source address of the tunnel and the destination address of the tunnel, the source address of the tunnel is an address of the gateway device, and the destination address of the tunnel is an address of the network side device.
  • the network side device is a device at the termination point of the tunnel.
  • the parameter of the tunnel includes a label allocated to a network side device, where the network side device is a device at a termination point of the tunnel.
  • control device may further include a generating unit.
  • the generating unit is configured to: after the determining unit 1202 determines that the user is the legal user, obtain the authentication that is assigned to the control device according to the identification information of the user and the information of the legal user. The parameters of the user's tunnel.
  • the generating unit may generate the authentication response according to the identification information of the user that is authenticated by the control device and the parameter of the tunnel that is allocated to the user that is authenticated by the control device.
  • the authentication response may further include a QoS parameter and/or a forwarding policy.
  • the content of the QoS parameter and the forwarding policy are the same as the corresponding content in the second embodiment of the present invention, and details are not described herein again.
  • the parameters of the tunnel may also include a type of tunnel.
  • the parameters of the authentication request and the tunnel mentioned in the fifth embodiment of the present invention are the same as those in the second embodiment, and are not described herein again.
  • the authentication response further includes flow information corresponding to the tunnel.
  • the flow information corresponding to the tunnel is the same as that of the second embodiment, and details are not described herein again.
  • the determining unit 1202 may send, by using the sending unit 1203, the identifier information of the user carrying the control device to be authenticated by the sending device 1203, and An authentication response assigned to a parameter of a tunnel of the user whose control device is authenticated as a legitimate user.
  • the gateway device can determine that the user is legitimate. Establishing a tunnel with the network-side device after the user helps improve security.
  • FIG. 13 is a schematic structural diagram of a gateway device according to Embodiment 6 of the present invention.
  • the gateway device provided in Embodiment 6 corresponding to FIG. 13 can perform the method provided in Embodiment 2 corresponding to FIG. 5.
  • the gateway device corresponding to FIG. 13 and the gateway device corresponding to FIG. 11 are the same gateway device.
  • Figure 13 shows the content of the gateway device from a physical perspective
  • Figure 11 shows the content included by the gateway device from a logical perspective.
  • the gateway device provided in Embodiment 6 includes: a processor 1301, a memory 1302, a communication interface 1303, and a communication bus 1304.
  • the processor 1301, the memory 1302, and the communication interface 1303 can communicate via the communication bus 1304.
  • the memory 1302 is for storing program code.
  • the processor 1301 is configured to read the program code stored in the memory 1302 and execute the following content:
  • an authentication response from the control device where the authentication response includes a parameter of the tunnel and the identifier information of the user that is authenticated by the control device, and the tunnel is a transmission adopted by the gateway device. a tunnel of messages from the user;
  • a tunnel table is generated according to the parameter of the tunnel and the identifier information of the user that is authenticated by the control device, and the tunnel table is used for tunnel encapsulation of a packet from a legal user.
  • the processor 1301 is further configured to: after reading the program code stored in the memory 1302, perform the following:
  • the tunnel table After determining that the tunnel table includes the identifier information of the first user, obtaining a second packet according to the parameter of the tunnel and the first packet included in the tunnel table, where the second packet is a packet obtained by tunneling the first packet according to the parameter of the tunnel;
  • the parameters of the tunnel included in the tunnel table include a source address of the tunnel and a destination address of the tunnel.
  • the parameter of the tunnel included in the tunnel table is a label allocated to a network side device.
  • the network side device is a device that the user needs to interact with.
  • the processor 1301 is specifically configured to receive an access request sent by the user side device, where the access request includes identifier information of the user, where the user is a user requesting access to the network; And obtaining an authentication request according to the identifier information of the user included in the access request, where the authentication request includes identifier information of the user.
  • the authentication response may further include a QoS parameter and/or a forwarding policy.
  • the content of the QoS parameter and the forwarding policy are the same as the corresponding content in the second embodiment of the present invention, and details are not described herein again.
  • the parameters of the tunnel may also include a type of tunnel.
  • the parameters of the authentication request and the tunnel mentioned in the fifth embodiment of the present invention are the same as those in the second embodiment, and are not described herein again.
  • the authentication response further includes flow information corresponding to the tunnel, where the flow information is used to identify a data flow of the user, the tunnel table further includes the flow information, and the processor 1301 further uses To perform the following:
  • the tunnel table includes the first flow information and the identifier information of the third user, and obtaining a second packet according to the first packet and the parameter of the tunnel included in the tunnel table, where The second packet is a packet obtained by tunnel encapsulating the first packet according to the parameter of the tunnel;
  • the processor In the gateway device provided in Embodiment 6 of the present invention, the processor generates a tunnel table according to the authentication response from the control device.
  • the processor can detect the legitimacy of the user by using a tunnel table. And if the tunnel table includes the identifier information of the user in the first packet, the processor forwards the second packet generated according to the first packet to the network side device by using the communication interface.
  • the gateway device can After the user passes the legality verification, a legal tunnel is established with the network side device, which helps improve security.
  • FIG. 14 is a schematic structural diagram of a control device according to Embodiment 6 of the present invention.
  • the control device provided in Embodiment 6 corresponding to FIG. 14 can perform the method provided in Embodiment 2 corresponding to FIG. 6.
  • the control device corresponding to FIG. 14 and the control device corresponding to FIG. 12 are the same control device.
  • Figure 14 shows the content included in the control device from a physical point of view
  • Figure 12 shows the content included in the control device from a logical point of view.
  • the control device provided in Embodiment 6 includes a processor 1401, a memory 1402, a communication interface 1403, and a communication bus 1404.
  • the processor 1401, the memory 1402, and the communication interface 1403 can communicate over the communication bus 1404.
  • the memory 1402 is for storing program code.
  • processor 1401 After the processor 1401 is configured to read the program code stored in the memory 1402, the following is performed:
  • the authentication request in the embodiment of the present invention is the same as the authentication request in the embodiment corresponding to FIG. 13, and details are not described herein again.
  • the authentication response is sent to the gateway device by using the communication interface 1403, and the authentication response includes the identification information of the user authenticated by the control device and the authentication device.
  • the parameters of the tunnel include a source address of the tunnel and a destination address of the tunnel.
  • the tunnel parameter is identifier information of the tunnel.
  • the tunnel parameter is a label assigned to the network side device.
  • the authentication response may further include a QoS parameter and/or a forwarding policy.
  • the content of the QoS parameter and the forwarding policy are the same as the corresponding content in the second embodiment of the present invention, and details are not described herein again.
  • the parameters of the tunnel may also include a type of tunnel.
  • the parameters of the authentication request and the tunnel mentioned in the sixth embodiment of the present invention are the same as those in the second embodiment, and details are not described herein again.
  • the authentication response further includes flow information corresponding to the tunnel.
  • the flow information corresponding to the tunnel is the same as that in the second embodiment, and details are not described herein again.
  • the processor 1401 may send, by using the communication interface 1403, the identifier of the user who carries the control device to be authenticated by the communication device. Information and an authentication response assigned to a parameter of a tunnel of the user authenticated by the control device as a legitimate user.
  • the gateway device can establish a tunnel with the network side device after determining that the user is a legitimate user, which helps improve security.
  • the embodiment of the present invention further provides a system for performing tunnel detection, and the system includes the gateway device provided by the embodiment corresponding to FIG. 7 and the control device provided by the embodiment corresponding to FIG. 8, or the system includes FIG.
  • the gateway device provided by the corresponding embodiment and the control device provided by the embodiment corresponding to FIG. 10 or the system includes the gateway device provided by the embodiment corresponding to FIG. 11 and the control device provided by the embodiment corresponding to FIG. 12, or FIG.
  • the gateway device provided by the corresponding embodiment and the control device provided by the embodiment corresponding to FIG. 14 For details, refer to the content provided in the foregoing embodiment, and details are not described herein again.
  • first and second in the first packet and the second packet in the foregoing embodiment of the present invention are only for distinguishing different packets, and do not indicate an order relationship.
  • Embodiments of the present invention also provide a system for performing tunnel detection.
  • the system includes the gateway device provided in Embodiment 3 of the present invention and the control device provided in Embodiment 3 of the present invention.
  • the system includes the gateway device provided in Embodiment 4 of the present invention and the control device provided in Embodiment 4 of the present invention.
  • the system includes the gateway device provided in Embodiment 5 of the present invention and the control device provided in Embodiment 5 of the present invention.
  • the system includes the gateway device provided in Embodiment 6 of the present invention and the control device provided in Embodiment 6 of the present invention.
  • the above general purpose processor may be a microprocessor or the processor or any conventional processor.
  • the steps of the method disclosed in the embodiment of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the code implementing the above functions may be stored in a computer readable medium.
  • Computer readable media includes computer storage media.
  • a storage medium may be any available media that can be accessed by a computer.
  • the computer readable medium may be a random access memory (English full name is random access memory, abbreviated as RAM), read only memory (English full name is read-only memory, English abbreviation for ROM), electricity Erasable programmable read-only memory (English full name electrically programmable programmable read-only memory, abbreviated as EEPROM), read-only optical disc (English full name compact disc read-only memory, English abbreviation for CD-ROM) or other optical disc storage
  • RAM random access memory
  • read only memory English full name is read-only memory, English abbreviation for ROM
  • electricity Erasable programmable read-only memory English full name electrically programmable programmable read-only memory, abbreviated as EEPROM
  • read-only optical disc English full name compact disc read-only memory, English abbreviation for CD-ROM
  • CD-ROM compact disc read-only memory
  • the computer readable medium may be a compact disc (English full name compact disc, abbreviated as CD), a laser disc, a digital video disc (English full name digital video disc, abbreviated as DVD), a floppy disk or a Blu-ray disc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé de détection de tunnel, capable de détecter des données de support de tunnel d'un utilisateur, et de contribuer à l'amélioration de la sécurité. Dans le procédé, un dispositif de passerelle obtient une demande d'authentification en fonction d'informations d'identification concernant un utilisateur, l'utilisateur étant un utilisateur demandant l'accès à un réseau, la demande d'authentification comportant les informations d'identification concernant l'utilisateur; le dispositif de passerelle envoie la demande d'authentification à un dispositif de commande; le dispositif de passerelle reçoit une réponse d'authentification en provenance du dispositif de commande, la réponse d'authentification comportant des paramètres d'un tunnel et des informations d'identification concernant l'utilisateur authentifié, par le dispositif de commande, en tant qu'utilisateur légitime, le tunnel étant un tunnel adopté par le dispositif de passerelle et utilisé pour transmettre un message émanant de l'utilisateur; et le dispositif de passerelle génère une table de tunnel en fonction des paramètres du tunnel et des informations d'identification concernant l'utilisateur authentifié, par le dispositif de commande, en tant qu'utilisateur légitime, la table de tunnel étant utilisée pour effectuer une encapsulation de tunnel sur le message émanant de l'utilisateur légitime.
PCT/CN2016/091781 2015-07-30 2016-07-26 Procédé, appareil et système de détection de tunnel WO2017016473A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510460170.2A CN106713057B (zh) 2015-07-30 2015-07-30 用于进行隧道检测的方法、装置及系统
CN201510460170.2 2015-07-30

Publications (1)

Publication Number Publication Date
WO2017016473A1 true WO2017016473A1 (fr) 2017-02-02

Family

ID=57885112

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/091781 WO2017016473A1 (fr) 2015-07-30 2016-07-26 Procédé, appareil et système de détection de tunnel

Country Status (2)

Country Link
CN (1) CN106713057B (fr)
WO (1) WO2017016473A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4037278A4 (fr) * 2019-09-24 2022-11-16 PRIBIT Technology, Inc. Système de commande d'accès au réseau d'un noeud sur la base d'un tunnel et d'un flux de données, et procédé associé
EP4037277A4 (fr) * 2019-09-24 2022-11-30 PRIBIT Technology, Inc. Système d'authentification et de contrôle d'accès au réseau d'un terminal, et procédé associé
US11652801B2 (en) 2019-09-24 2023-05-16 Pribit Technology, Inc. Network access control system and method therefor

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109936515B (zh) * 2017-12-18 2021-06-04 华为技术有限公司 接入配置方法、信息提供方法及装置
CN110838963B (zh) * 2018-08-15 2021-11-19 上海诺基亚贝尔股份有限公司 用于通信的设备、方法和装置以及计算机可读存储介质
CN111131496A (zh) * 2019-12-31 2020-05-08 易票联支付有限公司 一种基于标识信息的通讯中转方法、系统、装置及介质
CN114257543B (zh) * 2022-03-01 2022-07-01 北京翼辉信息技术有限公司 报文转发方法、装置、存储介质及计算设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1612539A (zh) * 2003-10-29 2005-05-04 华为技术有限公司 无线局域网中业务连接建立的方法
CN1642076A (zh) * 2004-01-14 2005-07-20 华为技术有限公司 一种无线局域网中分组数据关口获取用户身份标识的方法
CN101572645A (zh) * 2009-06-12 2009-11-04 杭州华三通信技术有限公司 隧道建立的方法及装置
CN101621433A (zh) * 2008-07-02 2010-01-06 上海华为技术有限公司 接入设备的配置方法、装置及系统
US20150058938A1 (en) * 2013-08-23 2015-02-26 Cisco Technology, Inc. Integrated IP Tunnel and Authentication Protocol based on Expanded Proxy Mobile IP

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101815106B (zh) * 2010-04-16 2013-03-20 杭州华三通信技术有限公司 动态gre隧道建立的方法和设备
CN103259736A (zh) * 2013-05-24 2013-08-21 杭州华三通信技术有限公司 一种隧道建立方法和网络设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1612539A (zh) * 2003-10-29 2005-05-04 华为技术有限公司 无线局域网中业务连接建立的方法
CN1642076A (zh) * 2004-01-14 2005-07-20 华为技术有限公司 一种无线局域网中分组数据关口获取用户身份标识的方法
CN101621433A (zh) * 2008-07-02 2010-01-06 上海华为技术有限公司 接入设备的配置方法、装置及系统
CN101572645A (zh) * 2009-06-12 2009-11-04 杭州华三通信技术有限公司 隧道建立的方法及装置
US20150058938A1 (en) * 2013-08-23 2015-02-26 Cisco Technology, Inc. Integrated IP Tunnel and Authentication Protocol based on Expanded Proxy Mobile IP

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4037278A4 (fr) * 2019-09-24 2022-11-16 PRIBIT Technology, Inc. Système de commande d'accès au réseau d'un noeud sur la base d'un tunnel et d'un flux de données, et procédé associé
EP4037277A4 (fr) * 2019-09-24 2022-11-30 PRIBIT Technology, Inc. Système d'authentification et de contrôle d'accès au réseau d'un terminal, et procédé associé
US11652801B2 (en) 2019-09-24 2023-05-16 Pribit Technology, Inc. Network access control system and method therefor

Also Published As

Publication number Publication date
CN106713057B (zh) 2019-11-29
CN106713057A (zh) 2017-05-24

Similar Documents

Publication Publication Date Title
US11095478B2 (en) Access control method, apparatus, and system
WO2017016473A1 (fr) Procédé, appareil et système de détection de tunnel
US7624181B2 (en) Techniques for authenticating a subscriber for an access network using DHCP
US9621372B2 (en) Title-enabled networking
US7062566B2 (en) System and method for using virtual local area network tags with a virtual private network
CN103188351B (zh) IPv6环境下IPSec VPN通信业务处理方法与系统
WO2018041152A1 (fr) Séparation d'une fonction de plan de commande et d'une fonction de plan de réacheminement d'un serveur d'accès distant à large bande
US8561140B2 (en) Method and system for including network security information in a frame
US10091247B2 (en) Apparatus and method for using certificate data to route data
US11302451B2 (en) Internet of things connectivity device and method
US7861076B2 (en) Using authentication server accounting to create a common security database
CN103067337B (zh) 一种身份联合的方法、IdP、SP及系统
WO2014071605A1 (fr) Procédé, appareil de plan d'acheminement, et dispositif de réseau pour le traitement d'un paquet
US20230090837A1 (en) Securing access to network devices utilizing authentication and dynamically generated temporary firewall rules
US10348687B2 (en) Method and apparatus for using software defined networking and network function virtualization to secure residential networks
US9497179B2 (en) Provisioning layer three access for agentless devices
WO2017185978A1 (fr) Procédé et dispositif d'analyse d'un paquet
CN105207778A (zh) 一种在接入网关设备上实现包身份标识及数字签名的方法
CN110166474B (zh) 一种报文处理方法及装置
CN114884667A (zh) 一种通信鉴权方法、设备及存储介质
WO2023246501A1 (fr) Procédé et appareil de vérification de message, et dispositif associé et support de stockage
CN117040817A (zh) 认证方法及装置
CN117040965A (zh) 通信方法及装置
WO2019020114A1 (fr) Procédé et système de partage de charge, et support de stockage lisible par ordinateur
KR20170140051A (ko) 동적 터널엔드 방식의 가상 사설 네트워크 시스템과 그를 위한 가상 라우터 및 매니저 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16829838

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16829838

Country of ref document: EP

Kind code of ref document: A1