WO2017219856A1 - 电路认证处理方法、系统、控制器和计算机存储介质 - Google Patents

电路认证处理方法、系统、控制器和计算机存储介质 Download PDF

Info

Publication number
WO2017219856A1
WO2017219856A1 PCT/CN2017/087332 CN2017087332W WO2017219856A1 WO 2017219856 A1 WO2017219856 A1 WO 2017219856A1 CN 2017087332 W CN2017087332 W CN 2017087332W WO 2017219856 A1 WO2017219856 A1 WO 2017219856A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface
controller
authentication
circuit
access device
Prior art date
Application number
PCT/CN2017/087332
Other languages
English (en)
French (fr)
Inventor
刘仓明
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017219856A1 publication Critical patent/WO2017219856A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of the present invention relate to the field of network technologies, and in particular, to a circuit authentication processing method, system, controller, and computer storage medium.
  • BAS Broadband Access Server
  • BAS Broadband Access Server
  • IP network access can provide broadband IP users with physical interfaces for IP network access, and can complete data access for broadband IP users, and aggregate and forward broadband IP.
  • the user's Internet traffic and intelligently implement the user's authentication, authorization, billing and other services, and further, BAS can also conveniently provide a variety of IP value-added services according to the needs of users.
  • Method 1 the user PC (Personal Computer) is connected to an ADSL (Asymmetric Digital Subscriber Line) modem, and the ADSL is connected to the DSLAM through a twisted pair (Digital Subscriber Line Access Multiplexer).
  • the DSLAM assigns an internal VLAN (Virtual Local Area Network) ID to each connected user.
  • the DSLAM is connected to the Layer 2 Ethernet aggregation switch through the uplink Ethernet port.
  • the Layer 2 Ethernet aggregation switch allocates the outer VLAN ID for each connected DSLAM and connects to the BAS device through the uplink Ethernet port.
  • the user's PC is connected to the Layer 2 Ethernet switch.
  • the Layer 2 Ethernet switch assigns an internal VLAN ID to each connected user, and directly connects to the BAS device. After further aggregation, the Layer 2 Ethernet switch passes through the uplink Ethernet port. Connect to the Layer 2 Ethernet aggregation switch. The Layer 2 Ethernet aggregation switch allocates the outer VLAN ID for each connected Layer 2 Ethernet switch, and then connects to the BAS device through the uplink Ethernet port.
  • the third mode is that the user PC is connected to the ONU (Optical Network Unit), and the ONU allocates an inner VLAN ID to each connected user, and connects to the OLT (Optical Line Terminal) through an ODN (Optical Distribution Network).
  • the optical line terminal allocates an outer VLAN ID to each connected ONU by the OLT, and then connects to the BAS device through the uplink Ethernet port.
  • the circuit authentication function in the BAS is based on this principle.
  • the circuit authentication is an important authentication method used in the BAS.
  • the working principle is that the BAS carries the VLAN information carried in the request packet according to the user authentication and the physical of the received packet.
  • the interface information is used to find the circuit authentication policy.
  • the circuit authentication policy includes the user access type (such as Point to Point Protocol over Ethernet (PPPoE), IPoE, etc.).
  • the authentication type (such as local authentication, Radius (Remote Authentication).
  • Dial In User Service, authentication, etc. authorization information (IP address, gateway, QoS (Quality of Service), ACL (Access Control List), etc.) and billing information.
  • the BAS then processes the user authentication request message according to the circuit authentication policy, and generates an authentication response message and a broadband IP user interaction.
  • the circuit authentication policy for authenticating the broadband IP users is configured on the physical interface of each BAS. Therefore, when a broadband IP user needs to be added to a physical interface of a BAS, it is necessary to manually access the BAS. Added circuit authentication strategy corresponding to broadband IP user configuration. The update of the circuit authentication policy is also the same. When upgrading and updating each circuit authentication policy, it is necessary to separately update and maintain each BAS configured with each circuit authentication policy. According to the current network deployment, BAS is basically dispersed in a place close to broadband IP users. Although some BASs can support remote login, the operation and maintenance staff can remotely log in to each BAS through the network to configure the circuit authentication policies corresponding to each physical interface under each BAS.
  • the initial configuration of the circuit authentication strategy under different BASs or the update of the circuit authentication policy may result in inefficient configuration or update, so that the user cannot enjoy the broadband IP Internet service in the first time, which easily affects the user. Use, reducing the user experience.
  • the circuit authentication policies are respectively configured in the BASs, and the manner in which the BAS performs circuit authentication on the user equipment not only has the problems of large configuration and maintenance workload, difficulty in upgrading and deployment, but also may be due to The efficiency of configuring and maintaining circuit authentication policies is too low and affects the user experience.
  • a circuit authentication processing method, system, controller, and computer storage medium provided by an embodiment of the present invention are expected to solve the problem that the circuit authentication is performed by the BAS on the user equipment by configuring the circuit authentication policy in each BAS in the prior art.
  • the task of configuring and maintaining the circuit authentication strategy is large, and the upgrade and deployment are difficult.
  • the embodiment of the invention provides a circuit authentication processing method, including:
  • the controller receives the authentication request reported by the access device, where the authentication request includes the original message that is sent by the user equipment to the access device and includes the content to be authenticated, and is used to identify and receive the Interface identifier of the physical interface of the original packet;
  • the controller acquires a circuit authentication policy of the physical interface corresponding to the interface identifier, where the circuit authentication policy is configured by the controller according to the physical interface information reported by the access device for each physical interface;
  • the controller performs an authentication process on the original packet according to the obtained circuit authentication policy, and feeds the authentication processing result to the user equipment through the access device.
  • the embodiment of the invention further provides a controller, including:
  • the receiving module is configured to receive an authentication request reported by the access device, where the authentication request includes an original message that is sent by the user equipment to the access device, and includes a physical interface that is used to identify the physical interface that receives the original packet.
  • Interface identifier
  • a determining module configured to obtain a circuit authentication policy of the physical interface corresponding to the interface identifier, where the circuit authentication policy is configured by the controller according to the physical interface information reported by the access device for each physical interface;
  • the processing module is configured to perform the authentication process on the original packet according to the obtained circuit authentication policy, and feed the authentication processing result to the user equipment by using the access device.
  • An embodiment of the present invention further provides a circuit authentication processing system, including: at least one access device and a controller as described above;
  • the access device is configured to generate an authentication request according to the original packet that is sent by the user equipment, and the interface identifier of the physical interface that receives the original packet, and send the authentication request to the controller. ;
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the circuit authentication processing method of any of the foregoing.
  • the embodiment of the invention further provides a controller, including:
  • a communication interface configured to connect with an access device
  • a memory configured to store computer executable instructions
  • a processor coupled to the communication interface and the memory, respectively, configured to perform the circuit authentication processing method of any of the foregoing by executing the computer executable instructions.
  • the controller configures a corresponding circuit authentication policy for each physical interface according to the physical interface information.
  • the access device receives the original packet reported by the user equipment
  • the access device compares the original packet with the original packet.
  • the interface identifier of the physical interface that receives the original packet is reported to the controller, and the controller determines the circuit authentication policy corresponding to the user equipment according to the interface identifier, and authenticates the original packet of the user equipment, and finally authenticates.
  • the result is returned to the user equipment through the access device, and the authentication of the user equipment is completed.
  • the circuit authentication policy still corresponds to each user equipment, but it is centralized in the controller, and the controller performs unified management and operation and maintenance, avoiding the physics in the prior art because the circuit authentication policy is dispersedly deployed under each access device.
  • the configuration and maintenance of the circuit authentication strategy caused by the interface is large, and the problems of upgrading and deployment are difficult, thereby reducing the demand for human resources, reducing the pressure on the staff, and optimizing the resource allocation.
  • FIG. 1 is a flowchart of a circuit authentication processing method according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic structural diagram of a controller according to Embodiment 2 of the present invention.
  • FIG. 4 is another schematic structural diagram of a controller according to Embodiment 2 of the present invention.
  • FIG. 5 is a schematic structural diagram of a circuit authentication processing system according to Embodiment 2 of the present invention.
  • FIG. 6 is a schematic diagram of networking of a circuit authentication processing system according to Embodiment 2 of the present invention.
  • FIG. 7 is a schematic structural diagram of an access device according to Embodiment 2 of the present invention.
  • FIG. 8 is a schematic structural diagram of a server according to Embodiment 2 of the present invention.
  • FIG. 9 is a flowchart of a circuit authentication processing method according to Embodiment 3 of the present invention.
  • FIG. 10 is a flowchart of a circuit authentication processing method according to Embodiment 4 of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • the controller receives an authentication request reported by the access device.
  • the controller may be a physical device or an application running on a general purpose server.
  • Access devices include BRAS (Broadband Remote Access Server), BNG (Broadband Network Gateway), BSG (Broadband Service Gateway), SR (Service Router), BAS , OFLS (OpenFlow Logical Switch), OFS (OpenFlow Switch), AC (Access Controller, Radio Access Controller).
  • the authentication request includes at least an original message generated by the user equipment and an interface identifier of a physical interface used by the user equipment to send the original message to the access device.
  • the access device After receiving the original packet sent by the user equipment, the access device obtains the interface information of the physical interface that receives the original packet, and then uses the physical interface information and interface label delivered by the controller. The relationship table between the identities finds the interface identifier corresponding to the obtained physical interface information.
  • the access device encapsulates the interface identifier with the original packet to form an authentication request, and sends an authentication request to the controller, where the controller authenticates the user equipment according to the authentication request.
  • the original packet contains the content to be authenticated.
  • the original packet includes the following types: PPPoE authentication request packet, DHCP (Dynamic Host Configuration Protocol) authentication request packet, and ARP (Address Resolution Protocol). Protocol) authentication request packet, IGMP (Internet Group Management Protocol) authentication request packet, 802.1x authentication request packet, authentication request packet in web (global network) authentication mode, NDP (Neighbor Discovery Protocol) , neighbor discovery protocol) authentication request message.
  • the controller acquires a circuit authentication policy under the physical interface corresponding to the interface identifier.
  • the circuit authentication policy is configured by the controller for each physical interface according to the physical interface information reported by the access device. Therefore, before the controller receives the authentication request reported by the access device, the controller further includes:
  • the controller obtains physical interface information of each access device.
  • the controller configures at least one circuit authentication policy for the physical interface of each access device according to the physical interface information.
  • the process of obtaining the physical interface information and configuring the circuit authentication policy may be performed only when the user equipment accessed under the access device changes.
  • the manner in which the controller obtains the physical interface information of each access device includes the following two types:
  • the first type is that the controller actively obtains physical interface information of each access device.
  • the controller can send an interface information report to the access device.
  • the access device can report the physical interface information according to the interface information. For example, when a new BAS is set up in the network, when the controller detects that a new device is connected Upon entering, the physical interface information reporting instruction is sent to the newly accessed BAS, and after receiving the instruction, the BAS may send its own physical interface information to the controller. It can be understood that the controller can also send physical interface information reporting instructions to all access devices under its management in a timed manner.
  • the controller receives the physical interface information that is actively reported by each access device.
  • the access device may actively send physical interface information to a controller that manages the network after accessing the network.
  • the time when the physical interface information is actively reported may be after the access to the network, or after the physical interface information of the user is changed, or periodically reported, for example, the physical interface information is reported once a week.
  • the controller may configure a circuit authentication policy for each physical interface according to the physical interface information, where the circuit authentication policy is used for performing authentication management on the user equipment accessed from the corresponding physical interface.
  • the process of configuring the circuit authentication policy by the controller can refer to Figure 2:
  • the controller creates a virtual interface corresponding to the physical interface.
  • the controller may first assign an ID (identification) to each physical interface, and the ID is an interface identifier for uniquely identifying the physical interface. After the interface identifier is assigned to the physical interface, the controller can create a virtual interface corresponding to the interface identifier of the physical interface. Since the interface identifier and the physical interface are in one-to-one correspondence, and the virtual interface is also in one-to-one correspondence, the physical interface and the virtual interface are also unique. Corresponding relationship.
  • the controller can send the relationship between the physical interface information and the interface identifier to the access device.
  • the controller needs to save the relationship between the interface identifier and the virtual interface.
  • the controller configures a corresponding number of circuit authentication policies for the virtual interface according to the number of user equipments on the physical interface.
  • Configuring a circuit authentication policy for a virtual interface is actually configuring the circuit for the corresponding physical interface.
  • the authentication policy is only because the user equipment will not be authenticated on the access device in this embodiment. Therefore, the circuit authentication policy is not under the physical interface on the access device.
  • the controller In the first mode, when the number of user equipments on the physical interface is one, the controller directly configures a circuit authentication policy for the corresponding virtual interface, and the number of circuit authentication policies is one.
  • the controller can create a corresponding number of virtual sub-interfaces on the basis of the virtual interface. For example, if 10 user devices need to be accessed under one physical interface, the controller can Create 10 virtual sub-interfaces on the virtual interface corresponding to the physical interface. As with the creation of a virtual interface, the controller should assign a corresponding interface sub-identity to each virtual sub-interface to distinguish user devices accessed by different virtual sub-interfaces.
  • the two virtual sub-interfaces under the two different virtual interfaces A and B may have the same Virtual subinterface ID.
  • the interface identifiers of the two virtual sub-interfaces under virtual interfaces A and B are all 10, but for the controller, the two virtual sub-interfaces are A-10 and B-10, so they can be distinguished. .
  • the controller can configure a corresponding circuit authentication policy for each virtual sub-interface.
  • the circuit authentication policy has a one-to-one correspondence with the virtual sub-interfaces, and substantially corresponds to the user equipments under the physical interfaces.
  • the controller only focuses on the number of user equipments on the physical interface, and does not pay attention to whether the number of user equipments exceeds one, because no matter how many user equipments are in one physical interface, the controller A virtual sub-interface must be created on the virtual interface corresponding to the physical interface.
  • the number of user devices must also correspond to the number of virtual sub-interfaces created.
  • the virtual sub-interface is not created on the basis of the virtual interface.
  • mode 2 when there is only one user device, a virtual sub-interface is created correspondingly.
  • the controller can also It is assumed that each virtual sub-interface is configured with a corresponding circuit authentication policy.
  • the controller configures the circuit authentication policy for the physical interface according to the mode 1
  • the access device only needs to encapsulate the interface identifier corresponding to the physical interface in the authentication request, and the controller
  • the corresponding circuit authentication policy can be matched for the authentication request.
  • the control circuit configuration policy is controlled according to mode 2 if the authentication request only includes the interface. Identification, the controller has no way to directly determine the circuit authentication strategy for processing the authentication request.
  • the controller can still The circuit authentication policy corresponding to each user equipment is uniquely determined, and the content contained in the original message may be changed.
  • connection methods the user equipment and the access equipment pass through some intermediate equipment, for example, in the connection mode 1, ADSL, DSLAM, Layer 2 Ethernet aggregation switches are all intermediate devices.
  • the intermediate device performs some processing on the original packet sent by the user equipment.
  • the DSLAM and the Layer 2 Ethernet aggregation switch respectively allocate an inner VLAN ID and an outer VLAN ID to the user equipment. These VLAN IDs are added as new ones.
  • the access device After receiving the original packet sent by the Layer 2 Ethernet aggregation switch, the access device encapsulates the interface identifier with the original packet to form an authentication request, and then sends the authentication request to the controller.
  • the controller can first determine the interface identifier according to the authentication request.
  • the virtual interface and then determine a virtual virtual interface based on the VLAN ID in the original packet.
  • the sub-interface is configured to determine a circuit authentication policy corresponding to the user equipment that sends the original message.
  • the VLAN ID assigned by the intermediate device to the original message should be in one-to-one correspondence with the sub-interface ID assigned by the controller for each virtual sub-interface, or both can be the same.
  • the controller and the intermediate device may be prefixed or suffixed when the VLAN ID is set in the original packet according to a certain protocol. For example, in this embodiment, the intermediate device sets the VLAN ID in the first two fields of the original packet. If the controller finds that the original packet does not have the two fields after receiving the authentication request, it indicates that the original is received. There is only one user equipment under the physical interface of the packet, and the controller pre-sets the circuit authentication policy in the manner of one. At this time, the controller can directly match the circuit authentication policy according to the interface identifier parsed in the authentication request. .
  • S106 The controller performs an authentication process on the original packet according to the obtained circuit authentication policy, and feeds the authentication processing result to the user equipment through the access device.
  • the controller After the controller processes the original packet according to the determined circuit authentication policy, the response packet is generated, and the response packet is forwarded to the user equipment by the access device.
  • the response packet type includes the PPPoE authentication response packet, the DHCP authentication response packet, the ARP authentication response packet, the IGMP authentication response packet, the 802.1x authentication response packet, the authentication response packet in the web authentication mode, and the NDP authentication response. Message.
  • the controller performs preliminary processing on the response message: the response message and the physical interface that sends the response message.
  • the interface identifiers are encapsulated together to form an authentication result, and then the authentication result is sent to the access device.
  • the access device decapsulates the authentication result, obtains the interface identifier in the authentication result, and then finds the PHY of sending the response packet according to the relationship table between the saved physical interface information and the interface identifier.
  • the interface sends the response packet to the user equipment through the physical interface to implement response to the original user packet.
  • the user equipment mentioned in this embodiment may be an RG (Residential Gateway), a CPE (Customer Premise Equipment) device, a PC, a VoIP (Voice over Internet Protocol), and an IPTV (Internet Protocol). Television, Network TV), STB (Set Top Box), IAD (Integrated Access Device), etc.
  • RG Residential Gateway
  • CPE Customer Premise Equipment
  • PC PC
  • VoIP Voice over Internet Protocol
  • IPTV Internet Protocol
  • Television Network TV
  • STB Set Top Box
  • IAD Integrated Access Device
  • the circuit authentication processing method provided in this embodiment configures the circuit authentication policy on the controller side, and the controller uniformly manages the circuit authentication policy, thereby avoiding the configuration of the circuit authentication policy directly under the physical interface of the access device.
  • the management and maintenance of circuit authentication strategies is inconvenient and requires a lot of human resources.
  • the authentication request of the user equipment is also processed by the controller, which further releases the binding between the circuit authentication policy and the access device, so that the access device works only as a forwarding device, and the performance of the access device is reduced.
  • the requirements for example, may not require the access device to support remote login or the like.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • the embodiment provides a controller and a circuit authentication processing system including the controller.
  • this embodiment first describes the controller, see Figure 3:
  • FIG. 3 shows a controller 30.
  • the circuit authentication processing method provided in the first embodiment can be implemented on the controller 30 provided in this embodiment.
  • the controller 30 includes a receiving module 302, a determining module 304, and a processing module 306.
  • the receiving module 302 is configured to receive an authentication request reported by the access device.
  • the controller may be a physical device or an application running on a general purpose server.
  • Access devices include BRAS, BNG, BSG, SR, BAS, OFLS, OFS, AC.
  • the authentication request includes at least the original packet generated by the user equipment and the physical interface used by the user equipment to send the original packet to the access device. Interface identifier.
  • the access device After receiving the original packet sent by the user equipment, the access device obtains the interface information of the physical interface that receives the original packet, and then uses the relationship table between the physical interface information and the interface identifier sent by the controller to find and obtain the interface.
  • the interface identifier corresponding to the physical interface information.
  • the access device encapsulates the interface identifier with the original packet to form an authentication request, and sends the authentication request to the receiving module 302.
  • the controller 30 authenticates the user equipment according to the authentication request.
  • the original packet contains the content to be authenticated.
  • the original packet includes the following types: a PPPoE authentication request packet, a DHCP authentication request packet, an ARP authentication request packet, an IGMP authentication request packet, and an 802.1x authentication request packet.
  • Authentication request packet and NDP authentication request packet in web authentication mode are included in the original packet.
  • the determining module 304 is configured to obtain a circuit authentication policy under the physical interface corresponding to the interface identifier in the authentication request. Then, the processing module 306 performs an authentication process on the original packet according to the obtained circuit authentication policy, and feeds the authentication processing result to the user equipment through the access device.
  • the circuit authentication policy is configured by the controller according to the physical interface information reported by the access device for each physical interface. Therefore, before the controller receives the authentication request reported by the access device, the controller needs to obtain the physical interface information of the access device, and according to the physical interface. The information configures at least one circuit authentication policy for the physical interface of each access device. Based on this, the embodiment further provides another controller 30, as shown in FIG. 4:
  • the controller 30 includes a receiving module 302, a determining module 304, and a processing module 306, and an acquiring module 308 for acquiring user interface information of the access device and configuring at least one circuit for the physical interface of each access device according to the physical interface information.
  • Configuration module 310 of the authentication policy includes a receiving module 302, a determining module 304, and a processing module 306, and an acquiring module 308 for acquiring user interface information of the access device and configuring at least one circuit for the physical interface of each access device according to the physical interface information.
  • the obtaining module 308 is configured to obtain physical interface information of each access device.
  • the manner in which the obtaining module 308 obtains the physical interface information of each access device includes the following two types:
  • the obtaining module 308 is configured to actively obtain physical interface information of each access device.
  • the obtaining module 308 can actively send an interface information reporting instruction to each access device, when the access device After receiving the interface information reporting instruction sent by the obtaining module 308, the physical interface information of the interface can be reported according to the interface information reporting instruction. For example, when a new BAS is set in the network, when the acquiring module 308 detects that a new device is accessed, the physical interface information reporting instruction is sent to the newly accessed BAS. After receiving the instruction, the BAS may obtain the acquiring module. 308 sends its own physical interface information. It can be understood that the obtaining module 308 can also send physical interface information reporting instructions to all access devices under its management in a timed manner.
  • the obtaining module 308 is configured to receive physical interface information that is actively reported by each access device.
  • the access device may actively send physical interface information to a controller that manages the network after accessing the network.
  • the time when the physical interface information is actively reported may be after the access to the network, or after the physical interface information of the user is changed, or periodically reported, for example, the physical interface information is reported once a week.
  • the configuration module 310 is configured to configure at least one circuit authentication policy for the physical interface of each access device according to the physical interface information acquired by the obtaining module 308.
  • the configuration module 310 can be configured to first assign an ID to each physical interface, and the ID is an interface identifier for uniquely identifying the physical interface. After the interface identifier is assigned to the physical interface, the configuration module 310 can create a virtual interface corresponding to the interface identifier of the physical interface. The physical interface and the virtual interface also have a one-to-one correspondence between the interface identifier and the physical interface. The only corresponding relationship.
  • the configuration module 310 can be configured to send the relationship between the physical interface information and the interface identifier to the access device, and the controller 30 needs to save the interface identifier and the virtual interface. Relational tables.
  • the configuration module 310 is configured to configure a corresponding number of circuit authentication policies for the virtual interface according to the number of user devices on the physical interface.
  • Configuring a circuit authentication policy for a virtual interface is actually to configure a circuit authentication policy for the corresponding physical interface, except that in this embodiment, the user equipment will not be performed on the access device again. Authentication, therefore, the circuit authentication policy is not under the physical interface on the access device.
  • the manner in which the configuration module 310 is configured to configure a circuit authentication policy for the virtual interface includes the following two types:
  • the configuration module 310 directly configures a circuit authentication policy for the corresponding virtual interface, and the number of circuit authentication policies is one.
  • the configuration module 310 can be configured to create a corresponding number of virtual sub-interfaces on the basis of the virtual interface. For example, if 10 user devices need to be accessed under one physical interface, then The configuration module 310 can create another 10 virtual sub-interfaces on the virtual interface corresponding to the physical interface. The configuration module 310 is configured to allocate a corresponding interface sub-identity for each virtual sub-interface to distinguish user devices accessed by different virtual sub-interfaces.
  • the two virtual sub-interfaces under the two different virtual interfaces A and B may have the same Virtual subinterface ID.
  • the interface identifiers of the two virtual sub-interfaces under virtual interfaces A and B are all 10, but for the controller 30, the two virtual sub-interfaces are one A-10 and one is B-10, so it can be distinguished. of.
  • the configuration module 310 can be configured to configure a corresponding circuit authentication policy for each virtual sub-interface.
  • the circuit authentication policy has a one-to-one correspondence with the virtual sub-interfaces, and substantially corresponds to the user equipments under the physical interfaces.
  • the configuration module 310 is configured to only pay attention to the number of user equipments on the physical interface, and does not care whether the number of user equipments exceeds one, because there are no user equipments under one physical interface.
  • the configuration module 310 must create a virtual sub-interface on the virtual interface corresponding to the physical interface.
  • the number of user devices must also correspond to the number of virtual sub-interfaces created.
  • the configuration module 310 does not create a virtual sub-interface based on the virtual interface. But in the second way When there is only one user equipment, the configuration module 310 is configured to also create a virtual sub-interface correspondingly.
  • the receiving module 302 is configured to receive an authentication request reported by the access device. Although the role of the authentication request is to perform circuit authentication on the user equipment, the authentication request is not directly generated by the user equipment.
  • the authentication request includes at least an original message generated by the user equipment and an interface identifier of a physical interface used by the user equipment to send the original message to the access device.
  • the access device After receiving the original packet sent by the user equipment, the access device obtains the interface information of the physical interface that receives the original packet, and then uses the relationship table between the physical interface information and the interface identifier delivered by the configuration module 310 to find and The interface identifier corresponding to the obtained physical interface information.
  • the access device encapsulates the interface identifier with the original packet to form an authentication request, and sends the authentication request to the receiving module 302.
  • the controller 30 authenticates the user equipment according to the authentication request.
  • the determining module 304 is configured to obtain a circuit authentication policy corresponding to the interface identifier in the authentication request according to the authentication request received by the receiving module 302.
  • the access device only needs to encapsulate the interface identifier corresponding to the physical interface in the authentication request.
  • the determining module 304 can match the corresponding circuit authentication policy for the authentication request. However, if multiple user devices are connected to one physical interface, or only one user device is connected to one physical interface, but the control circuit configuration policy is controlled according to mode 2, if the authentication request only includes the interface.
  • the identification, determination module 304 has no way to directly determine the circuit authentication policy for processing the authentication request.
  • the determining module 304 can still uniquely determine the circuit authentication policy corresponding to each user equipment, and the content contained in the original message may have some changes.
  • connection methods the user equipment and the access equipment pass through some intermediate equipment, for example, in the connection mode 1, ADSL, DSLAM, Layer 2 Ethernet aggregation switches are all intermediate devices.
  • the intermediate device performs some processing on the original packet sent by the user equipment.
  • the DSLAM and the Layer 2 Ethernet aggregation switch respectively allocate an inner VLAN ID and an outer VLAN ID to the user equipment. These VLAN IDs are added as new ones.
  • the access device After receiving the original packet sent by the Layer 2 Ethernet aggregation switch, the access device encapsulates the interface identifier with the original packet to form an authentication request, and then sends the identifier to the receiving module 302.
  • the determining module 304 can firstly identify the interface according to the authentication request. The virtual interface is determined, and then a virtual sub-interface under the virtual interface is determined according to the VLAN ID in the original packet, so as to determine a circuit authentication policy corresponding to the user equipment that sends the original packet.
  • the VLAN ID assigned by the intermediate device to the original message should be in one-to-one correspondence with the sub-interface ID assigned by the controller for each virtual sub-interface, or both can be the same.
  • the determining module 304 and the intermediate device in the controller 30 may be in a prefix manner or a suffix manner when setting the VLAN ID in the original packet according to a certain same protocol. For example, in this embodiment, the intermediate device sets the VLAN ID in the first two fields of the original packet. If the receiving module 302 receives the authentication request, the determining module 304 finds that the original packet does not have the two fields.
  • the configuration module 310 pre-sets the circuit authentication policy in the manner of one.
  • the determining module 304 can directly parse the information according to the authentication request.
  • the interface identifier matches the circuit authentication policy.
  • the processing module 306 is configured to perform an authentication process on the original packet according to the circuit authentication policy determined by the determining module 304, and feed the authentication processing result to the user equipment through the access device.
  • the processing module 306 is configured to process the original packet according to the determined circuit authentication policy, and then generate a response message, where the response message is a response to the original message, and should be forwarded to the user equipment by using the access device.
  • the response packet type includes the PPPoE authentication response packet, the DHCP authentication response packet, the ARP authentication response packet, the IGMP authentication response packet, the 802.1x authentication response packet, the authentication response packet in the web authentication mode, and the NDP authentication response. Message.
  • the processing module 306 is configured to perform preliminary processing on the response message: the response message and the response message are sent.
  • the interface identifiers of the physical interfaces are encapsulated together to form an authentication result, and then the authentication result is sent to the access device.
  • the access device decapsulates the authentication result, obtains the interface identifier in the authentication result, and then finds the PHY of sending the response packet according to the relationship table between the saved physical interface information and the interface identifier.
  • the interface sends the response packet to the user equipment through the physical interface to implement response to the original user packet.
  • the user equipment mentioned in this embodiment may be RG, CPE, PC, VoIP, IPTV, STB, IAD, and the like.
  • the present embodiment also provides a circuit authentication processing system 5 including at least one access device 70 and the controller 30 shown in FIG. 3 or 4.
  • the circuit authentication processing system provided in this embodiment includes a controller 30 and a plurality of access devices 70. Under each access device, multiple user devices 100 can be accessed.
  • the user equipment 100 is connected to the access device 70 through an access network, and the circuit authentication processing system can provide circuit authentication services for the plurality of user equipments 100 under the plurality of access devices 70.
  • FIG. 7 is a schematic structural diagram of an access device 70, where the access device 70 includes an information reporting module.
  • Block 702 encapsulation transmitting module 704, and result forwarding module 706.
  • the information reporting module 702 is configured to report its physical interface information to the controller 30.
  • the encapsulation sending module 704 is configured to generate an authentication request according to the original packet that is to be authenticated by the user equipment and the interface identifier of the physical interface that receives the original packet, and send the authentication request to the controller.
  • the result forwarding module 706 is configured to receive the authentication result delivered by the controller, and send the authentication result to the user equipment.
  • the information reporting module 702 in the access device 70 does not need to report its physical interface information to the controller 30 before the encapsulating transmitting module sends the authentication request.
  • the access device 70 can report the physical interface information before the controller 30 configures the circuit authentication policy for each physical interface. After that, if the user equipment in the physical interface does not change, the device does not report.
  • the controller 30 can be deployed on a server.
  • a server structure Please refer to FIG. 8:
  • the server 80 includes an input/output (IO) bus 801, a processor 802, a memory, a communication device 803, and a memory 804.
  • IO input/output
  • the acquisition module 308 in the controller 30 may be implemented by the communication device 803, the input/output bus 801, and the processor 802, or may be implemented simply by the communication device 803 and the input/output bus 801, if the controller 30 acquires the access device.
  • the processor 802 may generate an information reporting command to be transmitted to the communication device 803 via the input/output bus 801, and the communication device 803 sends the information reporting command to the access device 70, and then The communication device 803 also receives the physical interface information reported by the access device 70 according to the information reporting instruction, and transmits the physical interface information to the processor 802 through the input/output bus 801.
  • the function of the obtaining module 308 can be implemented only by the communication device 803 and the input/output bus 801, and the communication device 803 receives The physical interface information reported by the device 70 is accessed, and the physical interface information is transmitted to the processor 802 through the input/output bus 801, and the processor 802 performs subsequent processing.
  • the function of the configuration module 310 should be implemented by the processor 802.
  • the processor 802 configures an interface identifier for each physical interface according to the physical interface information transmitted by the communication device 803, and creates a corresponding virtual interface, and the processor 802 can set the physical interface information.
  • the relationship between the interface and the interface identifier is sent to the access device 70 by the communication device 803, and the processor 802 may also configure a corresponding number of virtual sub-interfaces on the virtual interface according to the number of user devices under each physical interface, and Each virtual sub-interface configures a sub-interface identifier, and finally the processor 802 configures a circuit authentication policy under the virtual interface or the virtual sub-interface.
  • the receiving module 302 is implemented by the communication device 803.
  • the function of the determining module 304 can be implemented by the processor 802. After receiving the authentication request reported by the access device 70, the communication device 803 transmits the authentication request to the processor 802. Obtain the corresponding circuit authentication strategy. After the processor 802 processes the original circuit according to the circuit authentication policy, the processor 802 processes the original message in the authentication request to obtain an authentication process result, and then transmits the authentication process result to the communication device 803 through the input/output bus 801. 803 sends the authentication processing result to the access device. Therefore, the functions of the processing module 306 can be implemented by the processor 802, the input and output bus 801, and the communication device 803.
  • the server 80 further includes a memory 804 for storing program code for implementing the controller 30.
  • the controller 30 and the circuit authentication processing system 5 provided in this embodiment configure the circuit authentication policy on the controller side, and the controller authenticates the user equipment, thereby implementing centralized management and maintenance of the circuit authentication policy, thereby avoiding operation and maintenance.
  • the operation and maintenance staff need to configure the circuit authentication strategy for each BAS, which results in a large problem of policy configuration and policy maintenance, which reduces the demand for human resources, reduces the pressure on the staff, and optimizes the resource allocation.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • circuit authentication processing method proposed in the first embodiment and the controller and circuit authentication processing system in the second embodiment are described in detail by taking the access device as the BRAS as an example:
  • the hardware module part of the circuit authentication processing system includes: a general-purpose server, a BRAS, and a user equipment. Please refer to Figure 9 for a flowchart of the circuit authentication processing system execution circuit authentication method:
  • the S902, the BRAS, and the controller on the general purpose server establish an OpenFlow connection.
  • the BRAS Configure the IP address and port number of the controller on the BRAS, start the OpenFlow protocol instance, and establish the OpenFlow connection through the connection flow defined by the OpenFlow protocol standard.
  • the Datapath defined by the OpenFlow protocol standard is reported.
  • the (data channel) ID distinguishes between different BRASs.
  • the Datapath ID is generated based on the globally uniquely assigned MAC address. Therefore, each OpenFlow protocol instance can be uniquely distinguished by the Datapath ID in the controller. Further, the BRAS is distinguished by the Datapath ID.
  • the Expirmenter message body is used, and the BRAS reports all the physical interface names of the BRAS to the controller.
  • the controller allocates an interface ID for each physical interface, and generates a corresponding virtual interface.
  • the controller After receiving the physical interface name reported by the BRAS, the controller uniformly allocates an interface ID and generates a corresponding virtual interface according to the Datapath ID and each physical interface name. The controller uniformly manages the virtual interface and saves the virtual interface and the interface ID. Relationship table.
  • the controller sends a relationship table between the physical interface and the interface ID to the BRAS.
  • the experimenter the experimenter
  • the controller sends the interface ID corresponding to the physical interface name to the BRAS, and the BRAS saves the physical interface name and interface ID delivered by the controller. Relationship table.
  • the controller creates a virtual sub-interface and configures a VLAN ID.
  • the VLAN ID is the sub-interface ID of the virtual sub-interface.
  • the controller configures a circuit authentication policy on a virtual interface or a sub-interface.
  • the BRAS forwards the original packet sent by the user equipment to the controller.
  • the BRAS After receiving the original packet sent by the user equipment, the BRAS searches the relationship table between the interface ID and the physical interface according to the physical interface information of the received packet, and obtains the interface ID.
  • the BRAS first performs MAC-in-MAC encapsulation on the received original message.
  • the Ethernet type in the encapsulated outer MAC-in-MAC header is set to 0x88E7, and the interface ID is filled in the I-SID field.
  • the GRE (Generic Routing Encapsulation) encapsulation is performed.
  • the outer IP address of the GRE encapsulation is the IP address of the controller, and the protocol number is 47.
  • the protocol type in the GRE Header (Protocol Type) ) Fill in the field 0x6558.
  • the controller processes the authentication request and returns an authentication processing result.
  • the controller receives the authentication request sent by the BRAS and performs decapsulation.
  • the GRE header is decapsulated, the MAC-in-MAC packet is obtained, the interface ID is obtained from the I-SID field in the MAC-in-MAC header, and then the MAC-in-MAC header is stripped to obtain the original report sent by the broadband IP user. Text.
  • the interface ID the virtual interface is found in the controller. If the original packet carries the VLAN information, the virtual sub-interface is found according to the virtual interface plus the VLAN information. The circuit authentication policy configured under the virtual sub-interface is found according to the virtual sub-interface. If the original packet does not carry the VLAN information, the circuit authentication policy configured on the virtual interface is directly found according to the virtual interface.
  • the controller processes the original message according to the authentication policy.
  • the generated response message the controller encapsulates the authentication response into the MAC-in-MAC packet, fills in the interface ID in the I-SID field, and performs GRE encapsulation on the MAC-in-MAC packet, and the outer IP address header.
  • the destination address is set to the IP address of the BRAS network side interface, and then the route is checked, and the Ethernet frame header is encapsulated to form an authentication processing result and sent to the BRAS.
  • the BRAS sends an authentication response to the user equipment.
  • the device After receiving the authentication processing result sent by the controller, decapsulating the authentication processing result, first stripping the GRE encapsulation header, obtaining the interface ID from the I-SID field in the MAC-in-MAC header, and then stripping the MAC-in-MAC The device obtains the original authentication response packet sent by the controller, and finds the physical outbound interface of the BRAS in the relationship table between the physical interface name and the interface ID according to the interface ID, and sends an authentication response packet to the user equipment.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • circuit authentication processing method proposed in the first embodiment and the controller and circuit authentication processing system in the second embodiment are described in detail by taking the access device as the BNG as an example:
  • the hardware module part of the circuit authentication processing system includes: a general-purpose server, a BNG, and a user equipment. Please refer to Figure 10 for a flowchart of the circuit authentication processing system execution circuit authentication method:
  • the controller can distinguish the broadband access device as the client management IP address.
  • S1003 The controller acquires physical interface information of the BNG.
  • the controller obtains all physical interface names on the BNG by using a query operation (get) through the established NETCONF connection with the BNG.
  • S1004 The controller allocates an interface ID for each physical interface, and generates a corresponding virtual interface.
  • the controller After obtaining the physical interface name of the BNG, the controller uniformly allocates an interface ID and generates a corresponding virtual interface according to the management IP address of the BNG and each physical interface name. The controller manages the virtual interface and saves the virtual interface and interface. A table of relationships between IDs.
  • S1005 The controller sends a relationship table between the physical interface and the interface ID to the BNG.
  • the controller connects to the established NETCONF connection with the BNG.
  • the configuration operation allows the controller to send the interface ID corresponding to the physical interface name to the BNG.
  • the BNG saves the physical interface name and interface ID delivered by the controller. Relationship table.
  • the controller creates a virtual sub-interface and configures a VLAN ID.
  • the VLAN ID is the sub-interface ID of the virtual sub-interface.
  • the controller configures a circuit authentication policy on a virtual interface or a sub-interface.
  • S1008 The BNG forwards the original packet sent by the user equipment to the controller.
  • the BNG After receiving the original packet sent by the user equipment, the BNG searches the relationship table between the interface ID and the physical interface information according to the physical interface information of the original packet, and obtains the interface ID.
  • the BNG first encapsulates the received authentication request packet with the Network Service Header (NSH).
  • the Next Protocol field in the NSH header is set to 0x3.
  • the Context Header is defined in the NSH header. Fill in the interface ID in the metadata defined in the (Context Header).
  • the VXLAN-GPE Virtual eXtensible Local Area Network-Generic Protocol Extension
  • the Next Protocol field defined in the VXLAN-GPE is set to 0x4, and the outer layer is further added with a UDP header and an IP header.
  • the outer IP destination address is the IP address of the controller. After the outer IP header is encapsulated, the route is checked, and the Ethernet frame header is encapsulated to form an authentication request, which is sent to the controller.
  • the controller processes the authentication request and returns an authentication processing result.
  • the controller receives the encapsulation authentication request sent by the BNG and performs decapsulation.
  • the VXLAN-GPE header is decapsulated, and the interface ID of the NSH Metadata field is obtained, and then the NSH header is stripped to obtain the original packet sent by the user equipment.
  • the interface ID the virtual interface is found in the controller. If the original packet carries the VLAN information, the virtual sub-interface is found according to the virtual interface plus the VLAN information. The circuit authentication policy configured under the virtual sub-interface is found according to the virtual sub-interface. If the original packet does not carry the VLAN information, the circuit authentication policy configured on the virtual interface is directly found according to the virtual interface.
  • the controller processes the original message according to the circuit authentication policy.
  • the generated response message encapsulates the NSH header, the Metadata field fills in the interface ID, and then encapsulates the VXLAN-GPE header, and then encapsulates the UDP header and the outer IP header, and sets the destination address of the outer IP header.
  • the IP address of the BNG network-side interface is then checked.
  • the Ethernet frame header is encapsulated to form an authentication process and sent to the BNG.
  • the S1010 After receiving the authentication processing result sent by the controller, the S1010 decapsulates the authentication processing result by first stripping the outer IP and UDP encapsulation headers, decapsulating the VXLAN-GPE header, and obtaining the interface ID from the Metadata field in the NSH header. Then, the NSH header is stripped, and the response packet sent by the controller is obtained. According to the interface ID, the physical interface of the BNG is found in the relationship table between the physical interface name and the interface ID, and the response packet is sent to the user equipment.
  • the access devices of the third embodiment and the fourth embodiment can also be implemented by using BAS, BSG, SR, OFLS, OFS or AC.
  • An embodiment of the present invention provides a computer storage medium, where the computer storage medium stores computer executable instructions, and the computer executable instruction instructions are used to perform a circuit authentication processing method provided by any one or more of the foregoing technical solutions, for example, One or more of the methods shown in FIGS. 1, 2, 9, and 10.
  • the computer storage medium may be a variety of storage media such as a read-only storage medium, a random storage medium, a magnetic disk, an optical disk, a flash memory, or a USB flash drive.
  • the computer storage medium can be a non-transitory storage medium.
  • This embodiment provides a controller, including:
  • a communication interface configured to connect with an access device
  • a memory configured to store computer executable instructions
  • the processor is respectively connected to the communication interface and the memory, and is configured to execute the circuit authentication processing method provided by any one or more of the foregoing technical solutions by executing the computer executable instructions, for example, as shown in FIG. 1 2.
  • the processor is respectively connected to the communication interface and the memory, and is configured to execute the circuit authentication processing method provided by any one or more of the foregoing technical solutions by executing the computer executable instructions, for example, as shown in FIG. 1 2.
  • the processor may be an application processor (AP), a central processing unit (CPU), a digital signal processor (DSP), or a programmable gate array (FPGA, Field Programmable Gate). Array) and so on.
  • AP application processor
  • CPU central processing unit
  • DSP digital signal processor
  • FPGA Field Programmable Gate array
  • the memory can include a storage medium capable of storing computer-executable instructions, which can be optionally a non-transitory storage medium.
  • the communication interface can be various communication interfaces and can be connected to an access device, such as a cable interface or a fiber optic cable interface.
  • the processor may be connected to a communication interface, a memory, and a bus through a bus, for example, an integrated circuit bus, and one of the circuit authentication processing methods provided by any one or more of the above technical solutions may be implemented by a computer program in the memory. Multiple.
  • modules or steps of the above embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed among multiple computing devices.
  • they may be implemented by program code executable by the computing device, such that they may be stored in a computer storage medium (read only storage medium, random storage medium, disk, optical disk) by a computing device.
  • Execution, and in some cases, the steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or a plurality of The integrated circuit module is implemented. Therefore, the invention is not limited to any particular combination of hardware and software.
  • a controller connected to the access device is introduced in the network, and the controller uniformly or centrally manages and maintains the circuit authentication policy, so that if a new circuit authentication policy or an old circuit authentication policy is updated, It does not need to be processed by one physical interface, which simplifies the management and maintenance of the circuit authentication strategy. It has a positive industrial effect, and at the same time, it is easy to implement in the industry, so the industry is highly achievable.

Abstract

本发明实施例提供一种电路认证处理方法、系统及控制器，通过将电路认证策略预先配置在控制器侧，当接入设备接收到用户设备上报的原始报文时，接入设备将该原始报文和接收到该原始报文的物理接口的接口标识一起上报给控制器，由控制器根据接口标识确定与该用户设备对应的电路认证策略并对该用户设备的原始报文进行认证，然后将认证结果通过接入设备返回给用户设备，完成对用户设备的认证。本发明实施例还提供了一种计算机存储介质及控制器。

Description

电路认证处理方法、系统、控制器和计算机存储介质
本申请基于申请号为201610465477.6、申请日为2016年06月23日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本发明实施例涉及网络技术领域，尤其涉及一种电路认证处理方法、系统、控制器和计算机存储介质。
背景技术
随着宽带城域网和宽带IP(Internet Protocol，网络之间互连的协议)业务的发展，对于用户上网需要进行认证管理。BAS(Broadband Access Server，宽带接入服务器)作为一种宽带接入设备，其可以为宽带IP用户提供进行IP网络接入的物理接口，可以完成宽带IP用户的数据接入，汇聚、转发宽带IP用户的上网流量，同时智能化地实现用户的认证、授权、计费等服务，更进一步地，BAS还可以根据用户的需要，方便地提供多种IP增值业务。
宽带IP用户和BAS之间一般通过二层网络连接，根据场景的不同，可以以下几种典型的部署方式：
方式一、用户PC(Personal Computer，个人计算机)连接到ADSL(Asymmetric Digital Subscriber Line，非对称数字用户线路)调制解调器，ADSL通过双绞线连接到DSLAM(Digital Subscriber Line Access Multiplexer，数字用户线路接入复用器)，DSLAM为每个连接用户分配一个内层VLAN(Virtual Local Area Network，虚拟局域网)ID。DSLAM通过上联以太网口连接到二层以太汇聚交换机，二层以太汇聚交换机为每个连接的DSLAM分配外层VLAN ID，再通过上联以太网口连接到BAS设备。
方式二、用户PC连接到二层以太交换机，二层以太交换机为每个连接用户分配一个内层VLAN ID，直接连接到BAS设备，或者经过进一步汇聚，二层以太交换机再通过上联以太网口连接到二层以太汇聚交换机，由二层以太汇聚交换机为每个连接的二层以太交换机分配外层VLAN ID，再通过上联以太网口连接到BAS设备。
方式三、用户PC连接到ONU(Optical Network Unit，光网络单元)，ONU为每个连接用户分配一个内层VLAN ID，经过ODN(Optical Distribution Network，光分配网络)连接到OLT(Optical Line Terminal，光线路终端)，由OLT为每个连接的ONU分配外层VLAN ID，再通过上联以太网口连接到BAS设备。
宽带IP用户经过上述的二层网络连接到BAS后，BAS能够通过接收到报文的物理接口和报文中所携带的外层VLAN ID与内层VLAN ID唯一区分每个宽带IP用户。BAS中的电路认证功能就是基于这个原理工作的，电路认证是BAS中采用的一种重要的认证方式，其工作原理是BAS根据用户认证请求报文中携带的VLAN信息和收到报文的物理接口信息，查找到电路认证策略，电路认证策略包括用户接入类型(如PPPoE(Point to Point Protocol over Ethernet，以太网上的点对点协议)、IPoE等)，认证类型(如本地认证、Radius(Remote Authentication Dial In User Service，远程用户拨号认证)认证等)，授权信息(IP地址、网关、QoS(Quality of Service，服务质量)、ACL(Access Control List，访问控制列表)等)和计费信息。BAS再根据电路认证策略处理用户认证请求报文，通过产生认证应答报文和宽带IP用户交互。
由于对各宽带IP用户进行认证的电路认证策略被配置在各BAS的物理接口下，所以当需要在某一个BAS的一个物理接口下新增一个宽带IP用户时，需要人工到该BAS上为该新增宽带IP用户配置对应的电路认证策略。 对于电路认证策略的更新也一样，对各个电路认证策略进行升级更新的时候，需要单独到配置了各电路认证策略的各个BAS上进行更新维护。而依照目前的网络部署，BAS基本都被分散设置在距宽带IP用户较近的地方。虽然有的BAS能够支持远程登录，运维工作人员可以通过网络分别远程登录到各BAS上，对各BAS下各个物理接口对应的电路认证策略进行配置，但这种分别登录的方式很麻烦，特别是对大量的电路认证策略进行更新的时候，分别登录然后进行策略配置的方式工作量太大；而对于另外一些不支持远程登录的BAS，运维人员甚至需要到部署BAS的地方去进行专门的策略配置或策略更新，在这种情境下，运维工作人员需要承担的压力不言而喻。
另外一方面，由人工不同BAS下的电路认证策略进行初次配置或者是对电路认证策略进行更新会导致配置或更新效率不高，使得用户不能在第一时间享受到宽带IP上网服务，容易影响用户使用，降低了用户体验。
综上，现有技术中将电路认证策略分别配置在各BAS中，由BAS对用户设备进行电路认证的方式不仅存在着配置和维护工作量大，升级和部署困难的问题，而且还有可能因为配置、维护电路认证策略的效率过低而影响用户体验。
发明内容
本发明实施例提供的一种电路认证处理方法、系统、控制器和计算机存储介质，期望解决现有技术中因为将电路认证策略分别配置在各BAS中，由BAS对用户设备进行电路认证导致的对电路认证策略进行配置、维护的工作量大，升级和部署困难的问题。
本发明实施例提供一种电路认证处理方法，包括：
控制器接收接入设备上报的认证请求；所述认证请求包括用户设备向所述接入设备上报的包含待认证内容的原始报文，以及用于识别接收所述 原始报文的物理接口的接口标识；
所述控制器获取所述接口标识对应的物理接口的电路认证策略，所述电路认证策略为所述控制器根据所述接入设备上报的物理接口信息为各所述物理接口配置；
所述控制器根据获取的电路认证策略对所述原始报文进行认证处理，将认证处理结果通过所述接入设备反馈给所述用户设备。
本发明实施例还提供一种控制器，包括:
接收模块，配置为接收接入设备上报的认证请求；所述认证请求包括用户设备向接入设备上报的包含待认证内容的原始报文，以及用于识别接收所述原始报文的物理接口的接口标识；
确定模块，配置为获取所述接口标识对应的物理接口的电路认证策略，所述电路认证策略为所述控制器根据所述接入设备上报的物理接口信息为各所述物理接口配置；
处理模块，配置为根据获取的电路认证策略对所述原始报文进行认证处理，将认证处理结果通过所述接入设备反馈给所述用户设备。
本发明实施例还提供一种电路认证处理系统，包括：至少一个接入设备和如上所述的控制器；
所述接入设备，配置为根据用户设备上报的包含待认证内容的原始报文和接收所述原始报文的物理接口的接口标识生成认证请求，并将所述认证请求发送给所述控制器；
接收所述控制器下发的认证结果，并将所述认证结果发送给所述用户设备。
本发明实施例还提供一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行前述的任一项的电路认证处理方法。
本发明实施例还提供一种控制器，包括：
通信接口，配置为与接入设备连接；
存储器，配置为存储有计算机可执行指令；
处理器，分别与所述通信接口及所述存储器相连，配置为通过执行所述计算机可执行指令，能够执行前述的任一项的电路认证处理方法。
在本发明实施例中，通过控制器预先根据物理接口信息为各物理接口配置对应的电路认证策略，当接入设备接收到用户设备上报的原始报文时，接入设备将该原始报文和接收到该原始报文的物理接口的接口标识一起上报给控制器，由控制器统一根据接口标识确定与该用户设备对应的电路认证策略并对该用户设备的原始报文进行认证，最后将认证结果通过接入设备返回给用户设备，完成对用户设备的认证。
电路认证策略仍然和各用户设备对应，但却是集中在控制器中，由控制器进行统一管理和运维，避免了现有技术中因为将电路认证策略分散部署在各接入设备下的物理接口下而导致的电路认证策略的配置和维护工作量大，升级和部署困难的问题，从而减少了对人力资源的需求，降低了工作人员的压力，优化了资源配置。
附图说明
图1为本发明实施例一提供的电路认证处理方法的一种流程图；
图2为本发明实施例一中控制器配置电路认证策略的一种流程图；
图3为本发明实施例二提供的控制器的一种结构示意图；
图4为本发明实施例二提供的控制器的另一种结构示意图；
图5为本发明实施例二提供的电路认证处理系统的一种结构示意图；
图6为本发明实施例二提供的电路认证处理系统的一种组网示意图；
图7为本发明实施例二提供的接入设备的一种结构示意图；
图8为本发明实施例二提供的一种服务器的结构示意图；
图9为本发明实施例三提供的一种电路认证处理方法的一种流程图；
图10为本发明实施例四提供的一种电路认证处理方法的一种流程图。
具体实施方式
下面通过具体实施方式结合附图对本发明实施例作进一步详细说明，应当理解，以下所说明的优选实施例仅用于说明和解释本发明，并不用于限定本发明。
实施例一：
为了解决现有技术中因为将电路认证策略分别配置在各BAS中，由BAS对用户设备进行电路认证而导致的电路认证策略的配置和维护工作量大，升级和部署困难的问题。本实施例提供一种电路认证处理方法，请参考图1：
S102、控制器接收接入设备上报的认证请求。
在本实施例中，控制器可以是一种物理设备，或者是运行在通用服务器上的应用程序。接入设备包括BRAS(宽带远程接入服务器，Broadband Remote Access Server)，BNG(Broadband Network Gateway，宽带网络网关)，BSG(Broadband Service Gateway，宽带业务网关)，SR(Service Router，业务路由器)，BAS，OFLS(Openflow Logical Switch，开放流逻辑交换机)、OFS(Openflow Switch，开放流交换机)，AC(Access Controller，无线接入控制器)。
认证请求的作用虽然是对用户设备进行电路认证，但这个认证请求并不是由用户设备直接生成的。在认证请求当中，至少包括由用户设备直接生成的原始报文和用户设备向接入设备发送原始报文时所使用的物理接口的接口标识。
当接入设备接收到用户设备发送的原始报文之后，会获取接收原始报文的物理接口的接口信息，然后利用控制器下发的物理接口信息与接口标 识之间的关系表查找到与获取到的物理接口信息相对应的接口标识。接入设备将接口标识与原始报文一起封装，形成认证请求，并将认证请求发送给控制器，由控制器根据认证请求对用户设备进行认证。
原始报文当中包含待认证内容，通常，原始报文包括这样一些类型：PPPoE认证请求报文，DHCP(Dynamic Host Configuration Protocol，动态主机配置协议)认证请求报文，ARP(Address Resolution Protocol，地址解析协议)认证请求报文，IGMP(Internet Group Management Protocol，Internet组管理协议)认证请求报文，802.1x认证请求报文，web(全球网)认证方式下的认证请求报文，NDP(Neighbor Discovery Protocol，邻居发现协议)认证请求报文。
S104、控制器获取接口标识对应的物理接口下的电路认证策略。
电路认证策略为控制器根据接入设备上报的物理接口信息为各物理接口配置，因此，在控制器接收接入设备上报的认证请求之前还包括：
控制器获取各接入设备的物理接口信息；
控制器根据物理接口信息为各接入设备的物理接口配置至少一个电路认证策略。
可以理解的是，并不是每一次对用户设备进行电路认证都需要重新获取一次物理接口信息，并进行一次电路认证策略的配置。获取物理接口信息以及配置电路认证策略的过程可以仅在接入设备下接入的用户设备发生变化的情况下进行。
控制器获取各接入设备的物理接口信息的方式包括以下两种：
第一种，控制器主动获取各接入设备的物理接口信息。控制器可以主动向各接入设备下发接口信息上报指令，当接入设备接收到控制器下发的接口信息上报指令之后，可以根据接口信息上报指令上报自身的物理接口信息。例如，当网络中新设置了一台BAS，当控制器检测到有新的设备接 入时，向新接入的BAS发送物理接口信息上报指令，BAS在接收到指令之后，可以向控制器发送自己的物理接口信息。可以理解的是，控制器也可以通过定时的方式，向所有在其管理之下的接入设备发送物理接口信息上报指令。
第二种，控制器接收各接入设备主动上报的物理接口信息。如，接入设备可以在接入网络之后主动向对其进行管理的控制器发送物理接口信息。主动上报物理接口信息的时机可以是在接入网络之后，也可以是在其自身的物理接口信息发生变化之后，或者是定时上报，例如，一周主动上报一次物理接口信息。
当控制器获取到接入设备的物理接口信息之后，控制器可以根据物理接口信息为各个物理接口配置电路认证策略，电路认证策略用于对从对应的物理接口接入的用户设备进行认证管理。控制器配置电路认证策略的流程可以参考图2：
S202、控制器创建与物理接口对应的虚拟接口。
控制器可以先为每一个物理接口分配一个ID(identification，身份识别信息)，这个ID是一个用于唯一识别该物理接口的接口标识。为物理接口分配接口标识之后，控制器可以对应于该物理接口的接口标识创建虚拟接口，由于接口标识和物理接口一一对应，和虚拟接口也是一一对应，因此物理接口与虚拟接口同样具有唯一对应的关系。
控制器在为各个物理接口分配接口标识之后，可以将物理接口信息与接口标识之间的关系表下发给接入设备，同时控制器需要保存接口标识与虚拟接口之间的关系表。
S204、控制器根据物理接口下用户设备的数目为虚拟接口配置对应数目的电路认证策略。
为虚拟接口配置电路认证策略实际上就是为对应的物理接口配置电路 认证策略，只是由于在本实施例中将不会再在接入设备上对用户设备进行认证，因此，电路认证策略不是在接入设备上的物理接口下。
为虚拟接口配置电路认证策略的方式包括以下两种：
方式一，当物理接口下的用户设备数目为一个的时候，控制器直接为对应的虚拟接口配置电路认证策略，且电路认证策略的个数为一个。
当物理接口下的用户设备数目超过一个时，控制器可以在虚拟接口的基础上再创建对应数目的虚拟子接口，例如，在一个物理接口下有10个用户设备需要接入，那么控制器可以在该物理接口对应的虚拟接口上再创建10个虚拟子接口。和创建虚拟接口一样，控制器应当为每一个虚拟子接口分配对应的接口子标识，用于对各个不同的虚拟子接口接入的用户设备进行区分。由于虚拟子接口接入的用户设备是通过虚拟接口的接口标识与虚拟子接口的子接口标识来共同区分的，所以在两个不同的虚拟接口A和B下的两个虚拟子接口可以具有同样的虚拟子接口标识。例如虚拟接口A和B下的两个虚拟子接口的接口标识都是10，但对于控制器来说，这两个虚拟子接口一个A-10，一个是B-10，因此是可以被区分的。
创建虚拟子接口之后，控制器可以为每一个虚拟子接口配置对应的电路认证策略。电路认证策略与虚拟子接口一一对应，实质上也就是与物理接口下的用户设备一一对应。
方式二，在这种配置电路认证策略的方案当中，控制器仅关注物理接口下用户设备的数目，并不关注用户设备的数目是否超过一个，因为无论一个物理接口下有多少用户设备，控制器都一定会在该物理接口对应的虚拟接口的上创建虚拟子接口，用户设备数目也一定与创建虚拟子接口的数目对应。在方式一当中，当只有一个用户设备的时候，就不会在虚拟接口的基础上创建虚拟子接口。但在方式二当中，当仅有一个用户设备时，也会对应地创建一个虚拟子接口。虚拟子接口创建完成之后，控制器也会可 以为每一个虚拟子接口配置对应的电路认证策略。
如果物理接口下仅有一个用户设备，且控制器为物理接口配置电路认证策略的时候是根据方式一进行的，那么接入设备只需要将物理接口对应的接口标识封装在认证请求中，控制器就能为该认证请求匹配出对应的电路认证策略。但如果在一个物理接口下会接入多个用户设备，或者一个物理接口下仅接入一个用户设备，但控制配置电路认证策略的时候是按照方式二进行的，那么若认证请求中仅包含接口标识，控制器则没办法直接确定出对该认证请求进行处理的电路认证策略。
为了解决上面提出的问题，即，在按照方式二为物理接口配置电路认证策略，或者控制器按照方式一配置电路认证策略，且物理接口下的用户设备超过一个的情况下，使控制器依然能唯一确定出与各个用户设备对应的电路认证策略，原始报文中所包含的内容会有一些改变。
前面已经阐述过用户设备与接入设备之间三种典型的连接方式，在各连接方式当中，用户设备与接入设备之间都会经过一些中间设备，例如在连接方式一中，ADSL、DSLAM、二层以太汇聚交换机等都属于中间设备。中间设备会对用户设备发送的原始报文进行一些处理，例如，DSLAM和二层以太汇聚交换机会分别为用户设备分配一个内层VLAN ID和外层VLAN ID，这些VLAN ID会作为新增设的字段存在于原始报文中，例如，内层VLAN ID和外层VLAN ID分别为“3”和“5”，而原始报文为“12345”，那么二层以太汇聚交换机接收到的报文内容应当为“312345”，然后二层以太汇聚交换机又会对报文进行一些处理，当报文从二层以太汇聚交换机发出的时候，报文实际应当为“5312345”。接入设备接收到二层以太汇聚交换机发送的原始报文之后，会将接口标识和原始报文一起封装形成认证请求，然后发送给控制器，控制器首先能够根据认证请求中的接口标识确定出虚拟接口，然后再根据原始报文中的VLAN ID确定虚拟接口下的一个虚 拟子接口，从而确定出与发送原始报文的用户设备对应的电路认证策略。
可以理解的是，中间设备为原始报文分配的VLAN ID应当和控制器为各个虚拟子接口分配的子接口ID一一对应，或者这二者可以是相同的。控制器和中间设备可以是根据某一相同的协议约定好在原始报文中设置VLAN ID的时候是以前缀的方式还是以后缀的方式。例如在本实施例中，中间设备会将原始报文的前两个字段中设置VLAN ID，如果控制器接收到认证请求之后发现原始报文中不具备这两个字段，那就说明在接收原始报文的物理接口下仅有一个用户设备，而且控制器预先设置电路认证策略的时候是以方式一进行的，这时候，控制器可以直接根据认证请求中解析出来的接口标识匹配出电路认证策略。
S106、控制器根据获取的电路认证策略对原始报文进行认证处理，将认证处理结果通过接入设备反馈给用户设备。
控制器根据确定出来的电路认证策略对原始报文进行处理之后，会产生应答报文，该应答报文是针对原始报文的响应，应当经由接入设备转发给用户设备。
应答报文的类型包括PPPoE认证应答报文，DHCP认证应答报文，ARP认证应答报文，IGMP认证应答报文，802.1x认证应答报文，web认证方式下的认证应答报文，NDP认证应答报文。
为了让接入设备在接收到应答报文之后知道如何将应答报文发送给对应的用户设备，控制器会对应答报文进行初步处理：将应答报文和发送该应答报文的物理接口的接口标识一起封装，形成认证结果，然后将该认证结果发送给接入设备。接入设备接收到认证结果之后，会对认证结果进行解封装，获取到认证结果中的接口标识，然后根据其保存的物理接口信息与接口标识之间的关系表查找到发送应答报文的物理接口，并通过该物理接口将应答报文发送给用户设备，实现对用户原始报文的响应。
本实施例中所提及的用户设备可以为RG(Residential Gateway，住宅网关)、CPE(Customer Premise Equipment，用户侧设备)设备、PC，VoIP(Voice over Internet Protocol，网络电话)，IPTV(Internet Protocol Television，网络电视)，STB(Set Top Box，机顶盒)，IAD(Integrated Access Device，综合接入设备)等。
本实施例提供的电路认证处理方法通过将电路认证策略配置在控制器侧，由控制器统一对电路认证策略进行管理，避免了将电路认证策略直接配置在接入设备的物理接口下所造成的电路认证策略的管理和维护不方便，需要大量人力资源的问题。同时，用户设备的认证请求也由控制器进行处理，这进一步释放了电路认证策略与接入设备之间的绑定，使接入设备仅作为转发设备进行工作，降低了对接入设备性能等的要求，例如，可以不必要求接入设备支持远程登录等。
实施例二：
本实施例提供一种控制器和一种包含有该控制器的电路认证处理系统。为了方便理解，本实施例先对控制器进行阐述，请参见图3：
图3示出的是一种控制器30，实施例一提供的电路认证处理方法可以在本实施例提供的控制器30上实施，控制器30包括接收模块302、确定模块304和处理模块306。
接收模块302，配置为接收接入设备上报的认证请求。
在本实施例中，控制器可以是一种物理设备，或者是运行在通用服务器上的应用程序。接入设备包括BRAS，BNG，BSG，SR，BAS，OFLS、OFS，AC。
认证请求的作用虽然是对用户设备进行电路认证，但这个认证请求并不是由用户设备直接生成的。在认证请求当中，至少包括由用户设备直接生成的原始报文和用户设备向接入设备发送原始报文时所使用的物理接口 的接口标识。
当接入设备接收到用户设备发送的原始报文之后，会获取接收原始报文的物理接口的接口信息，然后利用控制器下发的物理接口信息与接口标识之间的关系表查找到与获取到的物理接口信息相对应的接口标识。接入设备将接口标识与原始报文一起封装，形成认证请求，并将认证请求发送给接收模块302，由控制器30根据认证请求对用户设备进行认证。
原始报文当中包含待认证内容，通常，原始报文包括这样一些类型：PPPoE认证请求报文，DHCP认证请求报文，ARP认证请求报文，IGMP认证请求报文，802.1x认证请求报文，web认证方式下的认证请求报文，NDP认证请求报文。
确定模块304配置为获取认证请求中的接口标识对应的物理接口下的电路认证策略。然后由处理模块306根据获取到的电路认证策略对原始报文进行认证处理，并将认证处理结果通过接入设备反馈给用户设备。电路认证策略为控制器根据接入设备上报的物理接口信息为各物理接口配置，因此，在控制器接收接入设备上报的认证请求之前还需要获取接入设备的物理接口信息，并根据物理接口信息为各接入设备的物理接口配置至少一个电路认证策略。基于此，本实施例还提供另外一种控制器30，如图4所示：
控制器30包括接收模块302、确定模块304和处理模块306以外，还包括用户获取接入设备物理接口信息的获取模块308和用于根据物理接口信息为各接入设备的物理接口配置至少一个电路认证策略的配置模块310。
获取模块308配置为获取各接入设备的物理接口信息。获取模块308获取各接入设备的物理接口信息的方式包括以下两种：
第一种，获取模块308配置为主动获取各接入设备的物理接口信息。获取模块308可以主动向各接入设备下发接口信息上报指令，当接入设备 接收到获取模块308下发的接口信息上报指令之后，可以根据接口信息上报指令上报自身的物理接口信息。例如，当网络中新设置了一台BAS，当获取模块308检测到有新的设备接入时，向新接入的BAS发送物理接口信息上报指令，BAS在接收到指令之后，可以向获取模块308发送自己的物理接口信息。可以理解的是，获取模块308也可以通过定时的方式，向所有在其管理之下的接入设备发送物理接口信息上报指令。
第二种，获取模块308配置为接收各接入设备主动上报的物理接口信息。如，接入设备可以在接入网络之后主动向对其进行管理的控制器发送物理接口信息。主动上报物理接口信息的时机可以是在接入网络之后，也可以是在其自身的物理接口信息发生变化之后，或者是定时上报，例如，一周主动上报一次物理接口信息。
配置模块310配置为可以根据获取模块308获取到的物理接口信息为各接入设备的物理接口配置至少一个电路认证策略。
配置模块310可以配置为先为每一个物理接口分配一个ID，这个ID是一个用于唯一识别该物理接口的接口标识。为物理接口分配接口标识之后，配置模块310可以对应于该物理接口的接口标识创建虚拟接口，由于接口标识和物理接口一一对应，和虚拟接口也是一一对应，因此物理接口与虚拟接口同样具有唯一对应的关系。
在为各个物理接口分配接口标识之后，配置模块310可以配置为将物理接口信息与接口标识之间的关系表下发给接入设备，同时控制器30侧需要保存接口标识与虚拟接口之间的关系表。
虚拟接口创建完成后，配置模块310配置为根据物理接口下用户设备的数目为虚拟接口配置对应数目的电路认证策略。
为虚拟接口配置电路认证策略实际上就是为对应的物理接口配置电路认证策略，只是由于在本实施例中将不会再在接入设备上对用户设备进行 认证，因此，电路认证策略不是在接入设备上的物理接口下。
配置模块310配置为给虚拟接口配置电路认证策略的方式包括以下两种：
方式一，当物理接口下的用户设备数目为一个的时候，配置模块310直接为对应的虚拟接口配置电路认证策略，且电路认证策略的个数为一个。
当物理接口下的用户设备数目超过一个时，配置模块310可以配置为在虚拟接口的基础上再创建对应数目的虚拟子接口，例如，在一个物理接口下有10个用户设备需要接入，那么配置模块310可以在该物理接口对应的虚拟接口上再创建10个虚拟子接口。和创建虚拟接口一样，配置模块310应当为每一个虚拟子接口分配对应的接口子标识，用于对各个不同的虚拟子接口接入的用户设备进行区分。由于虚拟子接口接入的用户设备是通过虚拟接口的接口标识与虚拟子接口的子接口标识来共同区分的，所以在两个不同的虚拟接口A和B下的两个虚拟子接口可以具有同样的虚拟子接口标识。例如虚拟接口A和B下的两个虚拟子接口的接口标识都是10，但对于控制器30来说，这两个虚拟子接口一个A-10，一个是B-10，因此是可以被区分的。
创建虚拟子接口之后，配置模块310可以配置为为每一个虚拟子接口配置对应的电路认证策略。电路认证策略与虚拟子接口一一对应，实质上也就是与物理接口下的用户设备一一对应。
方式二，在这种配置电路认证策略的方案当中，配置模块310配置为仅关注物理接口下用户设备的数目，并不关注用户设备的数目是否超过一个，因为无论一个物理接口下有多少用户设备，配置模块310都一定会在该物理接口对应的虚拟接口的上创建虚拟子接口，用户设备数目也一定与创建虚拟子接口的数目对应。在方式一当中，当只有一个用户设备的时候，配置模块310就不会在虚拟接口的基础上创建虚拟子接口。但在方式二当 中，当仅有一个用户设备时，配置模块310配置为也会对应地创建一个虚拟子接口。
接收模块302配置为接收接入设备上报的认证请求。认证请求的作用虽然是对用户设备进行电路认证，但这个认证请求并不是由用户设备直接生成的。在认证请求当中，至少包括由用户设备直接生成的原始报文和用户设备向接入设备发送原始报文时所使用的物理接口的接口标识。
当接入设备接收到用户设备发送的原始报文之后，会获取接收原始报文的物理接口的接口信息，然后利用配置模块310下发的物理接口信息与接口标识之间的关系表查找到与获取到的物理接口信息相对应的接口标识。接入设备将接口标识与原始报文一起封装，形成认证请求，并将认证请求发送给接收模块302，由控制器30根据认证请求对用户设备进行认证。
确定模块304配置为根据接收模块302接收到的认证请求获取到与认证请求中的接口标识对应的电路认证策略。
如果物理接口下仅有一个用户设备，且配置模块310配置为为物理接口配置电路认证策略的时候是根据方式一进行的，那么接入设备只需要将物理接口对应的接口标识封装在认证请求中，确定模块304就能为该认证请求匹配出对应的电路认证策略。但如果在一个物理接口下会接入多个用户设备，或者一个物理接口下仅接入一个用户设备，但控制配置电路认证策略的时候是按照方式二进行的，那么若认证请求中仅包含接口标识，确定模块304则没办法直接确定出对该认证请求进行处理的电路认证策略。
为了解决上面提出的问题，即，在配置模块310按照方式二为物理接口配置电路认证策略，或者配置模块310按照方式一配置电路认证策略，且物理接口下的用户设备超过一个的情况下，使确定模块304依然能唯一确定出与各个用户设备对应的电路认证策略，原始报文中所包含的内容会有一些改变。
前面已经阐述过用户设备与接入设备之间三种典型的连接方式，在各连接方式当中，用户设备与接入设备之间都会经过一些中间设备，例如在连接方式一中，ADSL、DSLAM、二层以太汇聚交换机等都属于中间设备。中间设备会对用户设备发送的原始报文进行一些处理，例如，DSLAM和二层以太汇聚交换机会分别为用户设备分配一个内层VLAN ID和外层VLAN ID，这些VLAN ID会作为新增设的字段存在于原始报文中，例如，内层VLAN ID和外层VLAN ID分别为“3”和“5”，而原始报文为“12345”，那么二层以太汇聚交换机接收到的报文内容应当为“312345”，然后二层以太汇聚交换机又会对报文进行一些处理，当报文从二层以太汇聚交换机发出的时候，报文实际应当为“5312345”。接入设备接收到二层以太汇聚交换机发送的原始报文之后，会将接口标识和原始报文一起封装形成认证请求，然后发送给接收模块302，确定模块304首先能够根据认证请求中的接口标识确定出虚拟接口，然后再根据原始报文中的VLAN ID确定虚拟接口下的一个虚拟子接口，从而确定出与发送原始报文的用户设备对应的电路认证策略。
可以理解的是，中间设备为原始报文分配的VLAN ID应当和控制器为各个虚拟子接口分配的子接口ID一一对应，或者这二者可以是相同的。控制器30中的确定模块304和中间设备可以是根据某一相同的协议约定好在原始报文中设置VLAN ID的时候是以前缀的方式还是以后缀的方式。例如在本实施例中，中间设备会将原始报文的前两个字段中设置VLAN ID，如果接收模块302接收到认证请求之后，确定模块304发现原始报文中不具备这两个字段，那就说明在接收原始报文的物理接口下仅有一个用户设备，而且配置模块310预先设置电路认证策略的时候是以方式一进行的，这时候，确定模块304可以直接根据认证请求中解析出来的接口标识匹配出电路认证策略。
处理模块306配置为根据确定模块304确定的电路认证策略对原始报文进行认证处理，并将认证处理结果通过接入设备反馈给用户设备。
处理模块306配置为根据确定出来的电路认证策略对原始报文进行处理之后，会产生应答报文，该应答报文是针对原始报文的响应，应当经由接入设备转发给用户设备。
应答报文的类型包括PPPoE认证应答报文，DHCP认证应答报文，ARP认证应答报文，IGMP认证应答报文，802.1x认证应答报文，web认证方式下的认证应答报文，NDP认证应答报文。
为了让接入设备在接收到应答报文之后知道如何将应答报文发送给对应的用户设备，处理模块306配置为会对应答报文进行初步处理：将应答报文和发送该应答报文的物理接口的接口标识一起封装，形成认证结果，然后将该认证结果发送给接入设备。接入设备接收到认证结果之后，会对认证结果进行解封装，获取到认证结果中的接口标识，然后根据其保存的物理接口信息与接口标识之间的关系表查找到发送应答报文的物理接口，并通过该物理接口将应答报文发送给用户设备，实现对用户原始报文的响应。
本实施例中所提及的用户设备可以为RG、CPE、PC，VoIP，IPTV，STB，IAD等。
如图5所示，本实施还提供一种电路认证处理系统5，该系统中包括至少一个接入设备70和图3或图4示出的控制器30。
请参考图6，本实施例提供的电路认证处理系统包括一个控制器30和多个接入设备70，在每一个接入设备下，可以接入多个用户设备100。用户设备100通过接入网络连接到接入设备70下，电路认证处理系统可以为多个接入设备70下的多个用户设备100提供电路认证服务。
图7是接入设备70的一种结构示意图，接入设备70包括信息上报模 块702、封装发送模块704和结果转发模块706。
信息上报模块702配置为向控制器30上报自身的物理接口信息。
封装发送模块704配置为根据用户设备上报的包含待认证内容的原始报文和接收原始报文的物理接口的接口标识生成认证请求，并将认证请求发送给控制器。
结果转发模块706配置为接收控制器下发的认证结果，并将认证结果发送给用户设备。
可以理解的是，接入设备70中的信息上报模块702并不需要在封装发送模块发送认证请求之前都向控制器30上报自身的物理接口信息。接入设备70可以在控制器30为各物理接口配置电路认证策略之前上报物理接口信息，此后，若其下的物理接口中的用户设备没有发生变动，就可以不上报。
在本实施例中，控制器30可以部署在服务器上，这里提供一种服务器的结构示意图，请参考图8：
服务器80中包括输入输出(IO)总线801、处理器802、存储器、通信装置803和内存804。
控制器30中的获取模块308可以由通信装置803、输入输出总线801和处理器802共同实现，也可以单纯地由通信装置803和输入输出总线801来实现，如果控制器30获取接入设备的物理接口信息的时候采用主动获取的方式，那么可能要处理器802生成信息上报指令经由输入输出总线801传输至通信装置803上，由通信装置803将信息上报指令下发至接入设备70，然后通信装置803还会接收接入设备70根据信息上报指令上报的物理接口信息，并将物理接口信息通过输入输出总线801传输至处理器802当中。如果是接入设备主动上报自身的物理接口信息，则获取模块308的功能可以仅由通信装置803和输入输出总线801来实现，通信装置803接收 接入设备70上报的物理接口信息，并将物理接口信息通过输入输出总线801传输给处理器802，由处理器802进行后续的处理。
配置模块310的功能应当由处理器802来实现，处理器802根据通信装置803传输过来的物理接口信息来为各个物理接口配置接口标识，并且创建对应的虚拟接口，处理器802可以将物理接口信息与接口标识之间的关系表通过通信装置803发送给接入设备70，同时处理器802还有可能会根据各物理接口下的用户设备数目在虚拟接口下配置对应数目的虚拟子接口，并为各个虚拟子接口配置子接口标识，最后处理器802会在虚拟接口或者虚拟子接口下配置电路认证策略。
接收模块302由通信装置803来实现，确定模块304的功能可以由处理器802来实现，通信装置803接收接入设备70上报的认证请求后会将其传输至处理器802中，由处理器802获取对应的电路认证策略。处理器802根据对应的电路认证策略之后，可以根据电路认证策略对认证请求中的原始报文进行处理得到认证处理结果，然后通过输入输出总线801将认证处理结果传输至通信装置803，由通信装置803将认证处理结果发送给接入设备。所以处理模块306的功能可以由处理器802、输入输出总线801以及通信装置803来实现。
由于本实施例中的控制器30可能是运行在服务器上的应用程序，所以服务器80中还包括内存804，内存804用于存储实现该控制器30的程序代码。
本实施例提供的控制器30和电路认证处理系统5通过将电路认证策略配置在控制器侧，由控制器对用户设备进行认证，能够实现对电路认证策略进行集中管理、维护，避免了运维过程中需要运维工作人员分别为各BAS配置电路认证策略而导致的策略配置、策略维护工作量大的问题，减少了对人力资源的需求，降低了工作人员的压力，优化了资源配置。
实施例三：
本实施例以接入设备为BRAS为例对实施例一提出的电路认证处理方法、实施例二提出的控制器及电路认证处理系统进行详细说明：
电路认证处理系统中的硬件模块部分包括：通用服务器，BRAS，用户设备。电路认证处理系统执行电路认证方法的流程图请参考图9：
S901、通用服务器上启动控制器程序。
S902、BRAS和通用服务器上的控制器建立OpenFlow连接。
BRAS上配置控制器的IP地址和端口号，启动OpenFlow协议实例，通过OpenFlow协议标准定义的连接流程，BRAS和控制器建立OpenFlow连接，控制器通过OpenFlow连接建立时，上报的OpenFlow协议标准定义的Datapath(数据通道)ID区分不同的BRAS。OpenFlow标准中定义，Datapath ID是根据全球唯一分配的MAC生成的，所以在控制器中能够通过Datapath ID唯一区分每个OpenFlow协议实例，进一步，通过Datapath ID区分BRAS。
S903、BRAS通过OpenFlow连接向控制器上报物理接口信息。
通过BRAS和控制器之间已建立的OpenFlow连接，采用Experimenter消息体，BRAS上报自身的所有物理接口名称给控制器。
S904、控制器为各物理接口分配接口ID，并生成对应的虚拟接口。
控制器收到BRAS上报的物理接口名称后，根据Datapath ID和每个物理接口名称，统一分配一个接口ID和生成对应的一个虚拟接口，控制器统一管理虚拟接口，保存虚拟接口和接口ID之间的关系表。
S905、控制器向BRAS下发物理接口与接口ID之间的关系表。
通过BRAS和控制器之间已建立的OpenFlow连接，采用Experimenter(实验者)消息体，控制器下发物理接口名称对应的接口ID给BRAS，BRAS保存控制器下发的物理接口名称和接口ID之间的关系表。
S906、控制器创建虚拟子接口并配置VLAN ID。
VLAN ID即为虚拟子接口的子接口标识。
S907、控制器在虚拟接口或子接口下配置电路认证策略。
S908、BRAS向控制器转发用户设备发送的原始报文。
BRAS接收到用户设备发送的原始报文后，根据接收报文的物理接口信息，查找接口ID和物理接口之间的关系表，获取接口ID。BRAS首先对接收到的原始报文进行MAC-in-MAC封装，封装的外层MAC-in-MAC头中的以太类型设置为0x88E7，I-SID字段中填写接口ID。然后再进行GRE(Generic Routing Encapsulation，通用路由封装)封装，GRE封装的外层IP目的地址是控制器的IP地址，协议号是47，GRE Header(通用路由封装头)中的Protocol Type(协议类型)字段填写0x6558。GRE Header和外层IP头封装完成后，查路由，封装以太帧头后形成认证请求，发送到控制器。
S909、控制器对认证请求进行处理并返回认证处理结果。
控制器接收到BRAS发送的认证请求，进行解封装。首先，解封装GRE头，获取MAC-in-MAC报文，从MAC-in-MAC头中I-SID字段中获取接口ID，然后剥离MAC-in-MAC头，获取宽带IP用户发送的原始报文。根据接口ID，在控制器中查找到虚拟接口，如果原始报文中携带VLAN信息，则根据虚拟接口加上VLAN信息查找到虚拟子接口。根据虚拟子接口查找到配置在虚拟子接口下的电路认证策略。如果原始报文中没有携带VLAN信息，则直接根据虚拟接口查找到配置在虚拟接口下的电路认证策略。控制器根据认证策略处理原始报文。产生的应答报文，控制器将认证应答封装到MAC-in-MAC报文中，在I-SID字段中填写接口ID，对MAC-in-MAC报文再进行GRE封装，外层IP地址头的目的地址设置为BRAS网络侧接口的IP地址，然后查路由，封装以太帧头后形成认证处理结果并发送到BRAS。
S910、BRAS向用户设备发送认证应答。
接收到控制器发送的认证处理结果后，对认证处理结果进行解封装处理，首先剥离GRE封装头，从MAC-in-MAC头中的I-SID字段获取接口ID，然后剥离MAC-in-MAC头，获取控制器发送的原始认证应答报文，根据接口ID，在物理接口名称和接口ID之间的关系表中查找到BRAS物理出接口，发送认证应答报文给用户设备。
实施例四：
本实施例以接入设备为BNG为例对实施例一提出的电路认证处理方法、实施例二提出的控制器及电路认证处理系统进行详细说明：
电路认证处理系统中的硬件模块部分包括：通用服务器，BNG，用户设备。电路认证处理系统执行电路认证方法的流程图请参考图10：
S1001、通用服务器启动控制器程序；
S1002、控制器和BNG建立NETCONF连接。
控制器可以作为客户端管理IP地址区分宽带接入设备。
S1003、控制器获取BNG的物理接口信息。
控制器通过和BNG之间已建立的NETCONF连接，利用查询操作(get)，获取BNG上所有物理接口名称。
S1004、控制器为各物理接口分配接口ID，并生成对应的虚拟接口。
控制器获取到BNG上所有物理接口名称后，根据BNG的管理IP地址和每个物理接口名称，统一分配一个接口ID和生成对应的一个虚拟接口，控制器统一管理虚拟接口，保存虚拟接口和接口ID之间的关系表。
S1005、控制器向BNG下发物理接口与接口ID之间的关系表。
控制器通过和BNG之间已建立的NETCONF连接，通过配置操作(edit-config)，控制器下发物理接口名称对应的接口ID给BNG，BNG保存控制器下发的物理接口名称和接口ID之间的关系表。
S1006、控制器创建虚拟子接口和配置VLAN ID。
VLAN ID即为虚拟子接口的子接口标识。
S1007、控制器在虚拟接口或子接口下配置电路认证策略。
S1008、BNG向控制器转发用户设备发送的原始报文。
BNG接收到用户设备发送的原始报文后，根据接收原始报文的物理接口信息，查找接口ID和物理接口信息之间的关系表，获取接口ID。BNG首先对接收到的认证请求报文进行NSH(Network Service Header，网络业务头)封装，NSH头中的Next Protocol(下一个协议)字段设置为0x3，NSH头中定义了Context Header，在Context Header(上下文头)中定义的metadata(元数据)中填写接口ID。然后再进行VXLAN-GPE(Virtual eXtensible Local Area Network-Generic Protocol Extension虚拟可扩展局域网-通用协议扩展)封装，VXLAN-GPE中定义的Next Protocol字段设置为0x4，外层再增加UDP头和IP头，外层IP目的地址是控制器的IP地址。外层IP头封装完成后，查路由，封装以太帧头后形成认证请求，发送到控制器。
S1009、控制器对认证请求进行处理并返回认证处理结果。
控制器接收到BNG发送的封装认证请求，进行解封装。首先，解封装VXLAN-GPE头，获取NSH Metadata字段的接口ID，然后剥离NSH头，获取用户设备发送的原始报文。根据接口ID，在控制器中查找到虚拟接口，如果原始报文中携带VLAN信息，则根据虚拟接口加上VLAN信息查找到虚拟子接口。根据虚拟子接口查找到配置在虚拟子接口下的电路认证策略。如果原始报文中没有携带VLAN信息，则直接根据虚拟接口查找到配置在虚拟接口下的电路认证策略。控制器根据电路认证策略处理原始报文。产生的应答报文并封装NSH头，Metadata字段填写接口ID，再封装VXLAN-GPE头，再封装UDP头和外层IP头，外层IP头的目的地址设置 为BNG网络侧接口的IP地址，然后查路由，封装以太帧头后形成认证处理结果，发送到BNG。
S1010、BNG接收到控制器发送的认证处理结果后，对认证处理结果进行解封装处理，首先剥离外层IP和UDP封装头，解封装VXLAN-GPE头，从NSH头中的Metadata字段获取接口ID，然后剥离NSH头，获取控制器发送的应答报文，根据接口ID，在物理接口名称和接口ID之间的关系表中查找到BNG物理出接口，发送应答报文给用户设备。
可以理解的是，实施例三和实施例四种的接入设备还可以通过BAS、BSG、SR、OFLS、OFS或AC来实现。
本发明实施例提供一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令指令用于执行前述任意一个或多个技术方案提供的电路认证处理方法，例如，如图1、图2、图9及图10所示方法中的一个或多个。
所述计算机存储介质可为只读存储介质、随机存储介质、磁碟、光盘、闪存或U盘等各种存储介质。所述计算机存储介质可为非瞬间存储介质。
本实施例提供一种控制器，包括：
通信接口，配置为与接入设备连接；
存储器，配置为存储有计算机可执行指令；
处理器，分别与所述通信接口及所述存储器相连，配置为通过执行所述计算机可执行指令，能够执行前述任意一个或多个技术方案提供的电路认证处理方法，例如，如图1、图2、图9及图10所示方法中的一个或多个。
所述处理器可为应用处理器AP(AP，Application Processor)、中央处理器(CPU，Central Processing Unit)、数字信号处理器(DSP，Digital Signal Processor)或可编程门阵列(FPGA，Field Programmable Gate Array)等。
所述存储器可包括能够存储计算机可执行指令的存储介质，这里的存储介质可选为非瞬间存储介质。
所述通信接口可为各种通信接口，能够与接入设备连接，例如，电缆接口或光缆接口等。
所述处理器可以通过总线，例如，集成电路总线，分别与通信接口、存储器及相连，可以通过存储器中的计算机程序，实现上述任意一个或多个技术方案提供的电路认证处理方法中的一个或多个。
显然，本领域的技术人员应该明白，上述本发明实施例的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在计算机存储介质(只读存储介质、随机存储介质、磁碟、光盘)中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。所以，本发明不限制于任何特定的硬件和软件结合。
以上内容是结合具体的实施方式对本发明实施例所作的进一步详细说明，凡按照本发明原理所作的修改，都应当理解为落入本发明的保护范围。
工业实用性
本发明实施例中在网络中引入了与接入设备连接的控制器，由控制器统一或集中对电路认证策略进行管理和维护，这样若出现新的电路认证策略或更新旧的电路认证策略，就不用一个个物理接口进行处理，简化了电路认证策略的管理和维护，具有积极的工业效果，同时实现简便在工业上的推广性强，故工业可实现性强。

Claims (19)

  1. 一种电路认证处理方法，包括：
    控制器接收接入设备上报的认证请求；所述认证请求包括：用户设备向所述接入设备上报的包含待认证内容的原始报文，以及用于识别接收所述原始报文的物理接口的接口标识；
    所述控制器获取所述接口标识对应的物理接口的电路认证策略，所述电路认证策略为所述控制器根据所述接入设备上报的物理接口信息为各所述物理接口配置；
    所述控制器根据获取的电路认证策略对所述原始报文进行认证处理，将认证处理结果通过所述接入设备反馈给所述用户设备。
  2. 如权利要求1所述的电路认证处理方法，其中，在控制器接收接入设备上报的认证请求之前还包括：
    所述控制器获取各接入设备的物理接口信息；
    所述控制器根据所述物理接口信息为：各所述接入设备的物理接口配置至少一个电路认证策略。
  3. 如权利要求2所述的电路认证处理方法，其中，所述控制器获取各接入设备的物理接口信息的方式包括：
    所述控制器向各所述接入设备下发接口信息上报指令，并接收各所述接入设备根据所述接口信息上报指令上报的物理接口信息；
    或，
    所述控制器接收各所述接入设备主动上报的物理接口信息。
  4. 如权利要求2或3所述的电路认证处理方法，其中，所述控制器根据所述物理接口信息为各所述接入设备的物理接口配置至少一个电路认证策略包括：
    所述控制器创建与所述物理接口对应的虚拟接口；
    所述控制器根据所述物理接口下用户设备的数目为所述虚拟接口配置对应数目的电路认证策略。
  5. 如权利要求4所述的电路认证处理方法，其中，所述控制器根据所述物理接口下用户设备的数目为所述虚拟接口配置对应数目的电路认证策略包括：
    当所述物理接口下用户设备的数目为一个时，在所述虚拟接口下配置电路认证策略；
    当所述物理接口下用户设备的数目超过一个时，所述控制器为各所述虚拟接口创建对应数目的虚拟子接口，并为各所述虚拟子接口配置对应的子接口标识；所述控制器在各所述虚拟子接口下配置与所述虚拟子接口对应的电路认证策略。
  6. 如权利要求5所述的电路认证处理方法，其中，所述控制器获取所述接口标识对应的物理接口下的电路认证策略包括：
    为各所述物理接口配置对应的电路认证策略时，判断所述认证请求中是否包含子接口标识信息；
    若是，则根据所述认证请求中的所述接口标识和所述子接口标识获取与所述认证请求对应的电路认证策略；
    若否，则根据所述认证请求中的所述接口标识获取与所述认证请求对应的电路认证策略。
  7. 如权利要求4所述的电路认证处理方法，其中，所述控制器根据所述物理接口下用户设备的数目为所述虚拟接口配置对应数目的电路认证策略包括：
    所述控制器根据各所述物理接口下用户设备的数目为各所述虚拟接口创建对应数目的虚拟子接口，并为各所述虚拟子接口配置对应的子接口标识；
    所述控制器在各所述虚拟子接口下配置与所述虚拟子接口对应的电路认证策略。
  8. 如权利要求7所述的电路认证处理方法，其中，所述控制器获取所述接口标识对应的物理接口下的电路认证策略包括：
    为各所述物理接口配置对应的电路认证策略时，根据所述认证请求中的所述接口标识和所述子接口标识获取与所述认证请求对应的电路认证策略。
  9. 一种控制器，包括：
    接收模块，配置为接收接入设备上报的认证请求；所述认证请求包括用户设备向接入设备上报的包含待认证内容的原始报文，以及用于识别接收所述原始报文的物理接口的接口标识；
    确定模块，配置为获取所述接口标识对应的物理接口的电路认证策略，所述电路认证策略为所述控制器根据所述接入设备上报的物理接口信息为各所述物理接口配置；
    处理模块，配置为根据获取的电路认证策略对所述原始报文进行认证处理，将认证处理结果通过所述接入设备反馈给所述用户设备。
  10. 如权利要求9所述的控制器，其中，还包括：
    获取模块，配置为在接收接入设备上报的认证请求之前获取各接入设备的物理接口信息；
    配置模块，配置为根据所述物理接口信息为各所述接入设备的物理接口配置至少一个电路认证策略。
  11. 如权利要求10所述的控制器，其中，所述配置模块，配置为创建与所述物理接口对应的虚拟接口；根据所述物理接口下用户设备的数目为所述虚拟接口配置对应数目的电路认证策略。
  12. 如权利要求11所述的控制器，其中，所述配置模块，配置为根据 所述物理接口下用户设备的数目为所述虚拟接口配置对应数目的电路认证策略包括：当所述物理接口下用户设备的数目为一个时，在所述虚拟接口下配置电路认证策略；当所述物理接口下用户设备的数目超过一个时，为各所述虚拟接口创建对应数目的虚拟子接口，并为各所述虚拟子接口配置对应的子接口标识；在各所述虚拟子接口下配置与所述虚拟子接口对应的电路认证策略。
  13. 如权利要求12所述的控制器，其中，所述确定模块，配置为为各所述物理接口配置对应的电路认证策略时，判断所述认证请求中是否包含子接口标识信息；
    若是，则根据所述认证请求中的所述接口标识和所述子接口标识获取与所述认证请求对应的电路认证策略；
    若否，则根据所述认证请求中的所述接口标识获取与所述认证请求对应的电路认证策略。
  14. 如权利要求11所述的控制器，其中，所述配置模块，配置为根据所述物理接口下用户设备的数目为所述虚拟接口配置对应数目的电路认证策略包括：
    根据各所述物理接口下用户设备的数目为各所述虚拟接口创建对应数目的虚拟子接口，并为各所述虚拟子接口配置对应的子接口标识；
    在各所述虚拟子接口下配置与所述虚拟子接口对应的电路认证策略。
  15. 如权利要求14所述的控制器，其中，所述确定模块，配置为为各所述物理接口配置对应的电路认证策略时，直接根据所述认证请求中的所述接口标识和所述子接口标识获取与所述认证请求对应的电路认证策略。
  16. 一种电路认证处理系统，包括：至少一个接入设备和如权利要求9至15任一项提供的控制器；
    所述接入设备，配置为根据用户设备上报的包含待认证内容的原始报 文和接收所述原始报文的物理接口的接口标识生成认证请求，并将所述认证请求发送给所述控制器；
    接收所述控制器下发的认证结果，并将所述认证结果发送给所述用户设备。
  17. 如权利要求16所述的电路认证处理系统，其中，所述接入设备还用于在生成所述认证请求之前向所述控制器上报自身的物理接口信息。
  18. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令指令用于执行权利要求1至8任一项所述电路认证处理方法。
  19. 一种控制器，包括：
    通信接口，配置为与接入设备连接；
    存储器，配置为存储有计算机可执行指令；
    处理器，分别与所述通信接口及所述存储器相连，配置为通过执行所述计算机可执行指令，能够执行权利要求1至8任一项所述电路认证处理方法。
PCT/CN2017/087332 2016-06-23 2017-06-06 电路认证处理方法、系统、控制器和计算机存储介质 WO2017219856A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610465477.6 2016-06-23
CN201610465477.6A CN107547467B (zh) 2016-06-23 2016-06-23 一种电路认证处理方法、系统及控制器

Publications (1)

Publication Number Publication Date
WO2017219856A1 true WO2017219856A1 (zh) 2017-12-28

Family

ID=60783185

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/087332 WO2017219856A1 (zh) 2016-06-23 2017-06-06 电路认证处理方法、系统、控制器和计算机存储介质

Country Status (2)

Country Link
CN (1) CN107547467B (zh)
WO (1) WO2017219856A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112131147A (zh) * 2020-09-21 2020-12-25 成都海光微电子技术有限公司 一种控制器验证方法、装置、系统、电子设备及存储介质
CN112291162A (zh) * 2020-10-02 2021-01-29 中盈优创资讯科技有限公司 一种业务动态资源分配方法

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114501445B (zh) * 2022-01-06 2024-02-09 新华三技术有限公司合肥分公司 一种接入控制方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1592220A (zh) * 2003-09-04 2005-03-09 华为技术有限公司 控制宽带网络用户接入网络的方法
US7606232B1 (en) * 2005-11-09 2009-10-20 Juniper Networks, Inc. Dynamic virtual local area network (VLAN) interface configuration
CN102307097A (zh) * 2011-09-02 2012-01-04 深圳中兴网信科技有限公司 一种用户身份认证方法及系统
CN102257790B (zh) * 2009-11-26 2014-12-10 华为技术有限公司 用户拨号认证方法、系统和设备

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7953539B2 (en) * 2007-04-04 2011-05-31 GM Global Technology Operations LLC Torque split strategy for a belt alternator starter (BAS) hybrid
CN101355489B (zh) * 2007-07-23 2011-08-10 中兴通讯股份有限公司 基于动态主机配置协议前缀代理的用户管理方法
CN101577915B (zh) * 2008-12-17 2011-05-11 中兴通讯股份有限公司 Dsl网络接入的认证方法以及系统
CN101808038B (zh) * 2010-03-29 2012-02-08 杭州华三通信技术有限公司 一种vpn实例的划分方法和设备
CN102045398B (zh) * 2010-12-24 2013-08-28 杭州华三通信技术有限公司 一种基于Portal的分布式控制方法和设备
CN104243496B (zh) * 2014-10-11 2018-06-12 北京邮电大学 一种软件定义网跨域安全代理方法和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1592220A (zh) * 2003-09-04 2005-03-09 华为技术有限公司 控制宽带网络用户接入网络的方法
US7606232B1 (en) * 2005-11-09 2009-10-20 Juniper Networks, Inc. Dynamic virtual local area network (VLAN) interface configuration
CN102257790B (zh) * 2009-11-26 2014-12-10 华为技术有限公司 用户拨号认证方法、系统和设备
CN102307097A (zh) * 2011-09-02 2012-01-04 深圳中兴网信科技有限公司 一种用户身份认证方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
CHEN, GUOPING ET AL.: "Research on the Principle and Implementation of IPoE Technology Based on BRAS", CHINA INTERNET, 31 March 2015 (2015-03-31), ISSN: 1672-5077 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112131147A (zh) * 2020-09-21 2020-12-25 成都海光微电子技术有限公司 一种控制器验证方法、装置、系统、电子设备及存储介质
CN112291162A (zh) * 2020-10-02 2021-01-29 中盈优创资讯科技有限公司 一种业务动态资源分配方法
CN112291162B (zh) * 2020-10-02 2022-12-06 中盈优创资讯科技有限公司 一种业务动态资源分配方法

Also Published As

Publication number Publication date
CN107547467A (zh) 2018-01-05
CN107547467B (zh) 2021-09-24

Similar Documents

Publication Publication Date Title
CN109660443B (zh) 基于sdn的物理设备与虚拟网络通信方法和系统
US9485147B2 (en) Method and device thereof for automatically finding and configuring virtual network
US8005083B1 (en) Applying differentiated services within a cable network using customer-aware network router
US20160285736A1 (en) Access method and system for virtual network
CN108965497B (zh) 接入网虚拟化的方法及代理节点
JP5876877B2 (ja) 電気通信ネットワーク及び電気通信ネットワークと顧客構内機器との間の接続の効率的な使用のための方法及びシステム
WO2012139453A1 (zh) 一种dpoe系统及基于该系统业务自动配置方法和网络
US10848244B2 (en) Data provisioning
JP5424007B2 (ja) 情報を提供するための方法、ホームゲートウェイおよびホームネットワークシステム
WO2012100716A1 (zh) 在无源光网络中实现家庭网关功能的方法及装置
WO2011150620A1 (zh) 家庭网关识别入网的方法及系统
WO2011153679A1 (zh) 业务配置方法、设备和系统
WO2018113591A1 (zh) 一种调度方法、系统、控制器和计算机存储介质
EP3148164B1 (en) Packet processing method and device
WO2017166936A1 (zh) 一种实现地址管理的方法、装置、aaa服务器及sdn控制器
JP5679343B2 (ja) クラウドシステム、ゲートウェイ装置、通信制御方法、及び通信制御プログラム
WO2015021595A1 (zh) 业务通道配置方法和光线路终端以及无源光网络
US9100206B1 (en) Seamless architecture for cable access networks
WO2016180020A1 (zh) 一种报文处理方法、设备和系统
WO2015018069A1 (zh) 网络终端获取业务的方法、设备、系统
WO2017219856A1 (zh) 电路认证处理方法、系统、控制器和计算机存储介质
JP5898189B2 (ja) 電気通信ネットワーク、該電気通信ネットワークと顧客構内機器との間の接続を効率的に使用するための方法及びシステム
WO2019047611A1 (zh) 一种数据传输方法、pnf sdn控制器、vnf sdn控制器及系统
WO2016082335A1 (zh) Ip地址分配方法、同轴电缆中间转换器及系统
WO2016169260A1 (zh) 光接入模块的认证注册方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17814594

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17814594

Country of ref document: EP

Kind code of ref document: A1