WO2020057585A1 - 接入认证 - Google Patents

接入认证 Download PDF

Info

Publication number
WO2020057585A1
WO2020057585A1 PCT/CN2019/106605 CN2019106605W WO2020057585A1 WO 2020057585 A1 WO2020057585 A1 WO 2020057585A1 CN 2019106605 W CN2019106605 W CN 2019106605W WO 2020057585 A1 WO2020057585 A1 WO 2020057585A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface
terminal
user
user terminal
information
Prior art date
Application number
PCT/CN2019/106605
Other languages
English (en)
French (fr)
Inventor
邱元香
Original Assignee
新华三技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三技术有限公司 filed Critical 新华三技术有限公司
Priority to JP2021512270A priority Critical patent/JP7135206B2/ja
Priority to EP19863952.8A priority patent/EP3855695B1/en
Priority to US17/276,387 priority patent/US11743258B2/en
Publication of WO2020057585A1 publication Critical patent/WO2020057585A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • Broadband Access Server (English: Broadband Remote Access Server, BRAS for short) emerges as the times require.
  • BRAS has flexible access authentication methods, effective address management functions, powerful user management functions, and can provide rich and flexible business and control functions.
  • a user terminal will not be fixed in one location. For example, when a user holds a mobile device to access the network, he often roams from one access point (English: Access Point, AP for short) to another access point. Due to the change of the access point, the access interface or the BRAS device corresponding to different access points may also be different. Therefore, when a user terminal roams from one access point to another, it may be from a certain station. One access interface of a BRAS device roamed to another access interface of the BRAS device, or roamed from one BRAS device to another BRAS device.
  • one access interface of a BRAS device roamed to another access interface of the BRAS device, or roamed from one BRAS device to another BRAS device.
  • FIG. 1 is a schematic diagram of BRAS networking in an exemplary embodiment of the present disclosure
  • FIG. 2 is a processing flowchart of an access authentication method in an exemplary embodiment of the present disclosure
  • FIG. 3 is a processing flowchart of an access authentication method in another exemplary embodiment of the present disclosure.
  • FIG. 4 is an interaction flowchart before roaming and after roaming to an interface of another BRAS device in an exemplary embodiment of the present disclosure
  • FIG. 5 is a logical structural diagram of an access authentication device in an exemplary embodiment of the present disclosure.
  • FIG. 6 is a logical structural diagram of an apparatus for access authentication in another exemplary embodiment of the present disclosure.
  • FIG. 7 is a hardware structural diagram of a network device in an exemplary embodiment of the present disclosure.
  • first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information, and similarly, the second information may also be referred to as first information.
  • word “if” as used herein can be interpreted as “at” or "when” or "in response to determination”.
  • FIG. 1 is a schematic diagram of networking of a BRAS device in an exemplary embodiment of the present disclosure, in which a user terminal (for example, a personal computer (English: Personal Computer, referred to as PC) 1) is accessed from a switching device (for example, a personal computer) , Switch 1) accesses the network, PC 2 accesses the network from Switch 2 through AP 2 and both PC 1 and PC 2 perform address allocation and access authentication through BRAS-A; PC 3 connects from Switch 3 through AP 3 Enter the network, PC4 accesses the network from Switch 4 through AP4, and both PC3 and PC4 perform address allocation and admission authentication through BRAS-B.
  • a user terminal for example, a personal computer (English: Personal Computer, referred to as PC) 1
  • Switch 1 accesses the network
  • PC 2 accesses the network from Switch 2 through AP 2 and both PC 1 and PC 2 perform address allocation and access authentication through BRAS-A
  • PC 3 connects from Switch 3 through AP 3 Enter the network
  • PC4
  • the BRAS device can record user information corresponding to the user terminal, including the access location of the user terminal and an Internet Protocol (English: Internet Protocol) address. .
  • an Internet Protocol English: Internet Protocol
  • the BRAS device modifies the recorded user information to migrate the user information to the second interface newly accessed by the user terminal when roaming.
  • the prior art uses the BRAS device to record authenticated user information, and the user information cannot be known to other BRAS devices. Therefore, the existing technology can only solve the roaming problem of user terminals accessing on different interfaces of the same BRAS device.
  • the user terminal is re-authenticated by the BRAS device corresponding to the location after roaming, so that the user terminal accesses the BRAS device.
  • PC1 is authenticated on the BRAS-A device, if PC1 roams to AP3 or AP4, since AP3 and AP4 correspond to the BRAS-B device, the BRAS device accessed by PC1 changes. Therefore, PC1 must re-access authentication, which affects the smoothness and convenience of users accessing the network.
  • the present disclosure provides a method and device for access authentication, which can make the first interface of the BRAS device to the authentication, authorization, and accounting server when the user entry corresponding to the user terminal is not found.
  • a method and device for access authentication which can make the first interface of the BRAS device to the authentication, authorization, and accounting server when the user entry corresponding to the user terminal is not found.
  • AAA server For short
  • the AAA server determines that the user terminal is an authenticated terminal and is a roaming terminal based on the terminal information of the user terminal.
  • the second interface the interface of the same BRAS device or the interface of another BRAS device
  • the AAA server sends an authentication pass message to the first interface, so that the first interface allows the user terminal to access, and records a user entry corresponding to the user terminal on the first interface. Therefore, the present disclosure records the terminal information of the authenticated user terminal through the AAA server, so that when the user terminal roams to a new location, the interface of the BRAS device corresponding to the new location sends an authentication request message including the terminal information to the AAA server.
  • the AAA server After confirming that the user terminal is an authenticated terminal and a roaming terminal, the AAA server allows the user terminal to access the network at a new location, preventing the user terminal from performing access authentication again after roaming, which improves the user experience.
  • FIG. 2 is a processing flowchart of an access authentication method according to an exemplary embodiment of the present disclosure.
  • the method is applied to an AAA server.
  • the method includes:
  • Step 201 The AAA server obtains an authentication request message sent by the first interface of the BRAS device when the user entry corresponding to the user terminal is not found, and the authentication request message includes terminal information of the user terminal.
  • the user terminal when the user terminal goes online from the first interface of the BRAS device, since the user terminal has not accessed the first interface before, the user corresponding to the user terminal is not recorded on the first interface of the BRAS device. Table entry.
  • the user terminal sends an IP packet to the first interface, and the IP packet includes terminal information, so the BRAS device obtains the user terminal by receiving the IP packet sent by the user terminal. Terminal information, which is used to distinguish different user terminals.
  • the foregoing terminal information may include a source IP address of a user terminal, a source Media Access Control (MAC) address, and access location information of the user terminal, where the access location information It may include information such as access to a BRAS device, an access interface, and a virtual local area network (Virtual Local Area Network, VLAN for short).
  • MAC Media Access Control
  • the first interface of the BRAS device sends an authentication request message including terminal information to the AAA server to authenticate the user terminal.
  • the AAA server obtains an authentication request message including terminal information sent by the first interface of the BRAS device.
  • Step 202 When it is determined that the user terminal is an authenticated terminal and a roaming terminal according to the terminal information, the AAA server notifies the second interface that has accessed the user terminal to delete the user entry corresponding to the user terminal.
  • the AAA server determines that the user terminal is an authenticated terminal and roams from the second interface to the first interface according to the terminal information, since the user entry of the user terminal is still recorded on the second interface, Therefore, the AAA server still continues to charge for the traffic of the user terminal, and part of the traffic of the user terminal may be incorrectly forwarded based on the user entries recorded on the second interface, so it is necessary to delete the user recorded on the second interface. User entry corresponding to the terminal.
  • the AAA server feedbacks an authentication failure message to the BRAS device, so that the BRAS device determines that the user terminal is an unauthenticated terminal, so that the BRAS device
  • the user terminal is authenticated according to the existing authentication method, and an authentication request message is sent to the AAA server after the authentication is passed.
  • Step 203 When it is confirmed that the second interface deletes the user entry corresponding to the user terminal, the AAA server sends an authentication pass message to the first interface, so that the first interface allows the user terminal to access, and A user entry corresponding to the user terminal is recorded on the first interface.
  • the AAA server when the AAA server confirms that the second interface deletes the user entry of the user terminal, it may feedback the authentication pass message for the authentication request message to the first interface of the BRAS device.
  • the first interface receives the authentication pass message, it can determine that the user terminal is an authenticated terminal, so the user terminal is allowed to access, and a user entry corresponding to the user terminal is recorded locally.
  • the present disclosure can improve the service processing flow of the AAA server and the BRAS device.
  • the AAA server recognizes that the user terminal is currently roaming based on the characteristics of the user terminal, and recognizes the user terminal's roaming status through a DM message.
  • the interface of the corresponding BRAS device accessed before roaming deletes the user entry recorded at the interface, and goes online at the new location without perceptual authentication, which prevents user terminals from re-access authentication, thereby improving the user access experience.
  • the AAA server may locally find the authentication user information corresponding to the user terminal according to the terminal information. If the authenticated user information is found, the user terminal is an authenticated terminal. Then, the AAA server further determines whether the access location information in the authentication user information and the access location information included in the terminal information are the same; if they are the same, it means that the user terminal is not a roaming terminal. At this time, the AAA server discards the authentication request message. If it is different, it means that the user terminal is a roaming terminal. At this time, the AAA server notifies the second interface that has accessed the user terminal to delete the user entry corresponding to the user terminal.
  • the AAA server can notify the The second interface on the BRAS device that has accessed the user terminal deletes the user entry corresponding to the user terminal; when the access location information in the terminal information indicates that the user terminal roams on a non-local BRAS device, the second The interface and the first interface are on different BRAS devices. Therefore, the AAA server may notify the second interface on the non-local BRAS device that has accessed the user terminal to delete the user entry corresponding to the user terminal.
  • the AAA server may send a disconnection notification message to the second interface, for example, a disconnection management (English: Disconnect Management (abbreviation: DM) request message).
  • the offline notification message includes terminal information of the user terminal.
  • the second interface receives the offline notification message sent by the AAA server, the second interface deletes the user entry corresponding to the user terminal.
  • the second interface feeds the offline confirmation message to the AAA server, for example, a DM confirmation message.
  • the AAA server receives the offline confirmation message sent by the second interface, it can confirm that the user entry corresponding to the user terminal recorded on the second interface has been deleted.
  • FIG. 3 is a processing flowchart of another method for access authentication in an exemplary embodiment of the present disclosure.
  • the method is applied to a BRAS device.
  • the method includes:
  • Step 301 If a user entry corresponding to a user terminal is not found on the first interface, the BRAS device obtains terminal information of the user terminal;
  • the BRAS device when the user terminal goes online from the first interface of the BRAS device, the BRAS device can find whether there is a user entry corresponding to the user terminal in the first interface according to the traffic characteristics. Because the user terminal has not accessed the first interface before, the user entry of the user terminal is not recorded on the first interface, so the first interface forwards the traffic sent by the user terminal to the central processor (Central) of the BRAS device. Processing Unit (abbreviation: CPU). The CPU analyzes the terminal information in the traffic, and the terminal information is used to distinguish different terminals.
  • CPU Processing Unit
  • the terminal information may include a source IP address, a source MAC address of the terminal, and access location information of the user terminal.
  • the access location information may include information such as access to a BRAS device, an access interface, and a VLAN.
  • Step 302 The first interface of the BRAS device sends an authentication request message including the terminal information to the AAA server, so that the AAA server notifies the user terminal as an authenticated terminal and a roaming terminal according to the terminal information.
  • the second interface that has accessed the user terminal deletes a user entry corresponding to the user terminal;
  • the first interface of the BRAS device may send an authentication request message to the AAA server, where the authentication request message includes the terminal information of the user terminal, so that the AAA server receives the terminal information. Then, when it is determined that the user terminal is an authenticated terminal and a roaming terminal, the second interface that has accessed the user terminal may be notified to delete the user entry corresponding to the user terminal that is locally saved.
  • Step 303 If an authentication pass message sent by the AAA server when it confirms that the second interface deletes the user entry corresponding to the user terminal is received, the first interface of the BRAS device allows the user terminal to access the The first interface is described, and a user entry corresponding to the user terminal is recorded on the first interface.
  • the AAA server When the AAA server confirms that the second interface deletes the user entry corresponding to the user terminal, it can feedback the authentication pass message with respect to the authentication request message sent by the first interface.
  • the first interface receives the authentication pass message sent by the AAA server, it can be determined that the user terminal is an authenticated terminal, so the user terminal is allowed to access, and a user entry corresponding to the user terminal is recorded locally.
  • the present disclosure enables the first interface of the BRAS device to send an authentication request message including the terminal information of the user terminal to the AAA server when the user entry corresponding to the user terminal is not found, and the AAA server determines that the user terminal is already
  • the second interface that has accessed the user terminal is notified to delete the user entry corresponding to the user terminal, and when the second interface confirms that the deletion is complete, it sends an authentication pass message to the first interface to Enable the first interface to allow the user terminal to access, and record a user entry corresponding to the user terminal on the first interface.
  • the present disclosure records the terminal information of the authenticated terminal through the AAA server, so that when the user terminal roams to a new location, the interface of the BRAS device corresponding to the new location sends an authentication request message including the terminal information to the AAA server, and the AAA server confirms the user terminal After the identity is authenticated, the user terminal is allowed to access the network at the new location, which prevents the user terminal from performing access authentication again after roaming, which improves the user experience.
  • the user terminal when the local BRAS device receives the offline notification message including the terminal information sent by the AAA server to the second interface of the local BRAS device, the user terminal may be considered as roaming from the second interface on the local BRAS device to the first interface. Therefore, the user entry corresponding to the user terminal stored in the second interface of the user terminal can be deleted, so that the terminal can access the first interface after roaming.
  • the second interface may feedback the offline confirmation message to the AAA server, so that when the AAA server receives the offline confirmation message, it confirms that the second interface has deleted the user corresponding to the user terminal. Table entry, so that the first interface of the user terminal after roaming can access the network.
  • cross-BRAS roaming is taken as an example below, and the solution of the present disclosure is further described in detail with reference to FIG. 4.
  • FIG. 4 is a flowchart of interaction between a user terminal before roaming and after roaming to an interface of another BRAS device according to an embodiment of the present disclosure, including:
  • the interaction process before the user terminal roams is:
  • the user terminal When the user terminal requests access to the network from the interface of BRAS-1, the user terminal sends an HTTP request to the interface of BRAS-1;
  • BRAS-1 Since the user entry of the user terminal is not recorded on the interface of BRAS-1, BRAS-1 redirects the HTTP request to the authentication page of the Web authentication server;
  • BRAS-1 accesses the authentication page of the Web authentication server
  • BRAS-1 pushes the Uniform Resource Locator (English: Uniform Resource Locator, URL: URL) corresponding to the authentication page of the Web authentication server to the user terminal;
  • Uniform Resource Locator English: Uniform Resource Locator, URL: URL
  • the user terminal When the user terminal receives the URL corresponding to the authentication page, it can request Web authentication from the Web authentication server according to the URL;
  • the web authentication server feeds back the web authentication page content to the user terminal;
  • the user terminal enters the web authentication user name and password according to the web authentication page content, and sends the web authentication user name and password to the web authentication server;
  • the web authentication server performs web authentication after receiving the user name and password, and sends web authentication information to BRAS-1;
  • BRAS-1 sends a user terminal's access authentication request to the AAA server, where the access authentication request includes the user name and password for web authentication, and terminal information (such as the user terminal's IP address, MAC address, and access location information) ;
  • the AAA server determines that the user terminal is authenticated according to the access authentication request, it sends an authentication response to BRAS-1;
  • the interface of the BRAS-1 device After the BRAS-1 receives the authentication response, the interface of the BRAS-1 device locally records the user entry of the user terminal, which includes the terminal information and the user name and password for Web authentication, and issues permissions to the user terminal to allow Its access to the network;
  • the interface of the BRAS-1 sends a start-accounting message to the AAA server.
  • the start-accounting message includes the terminal information of the user terminal, so that the AAA server starts to charge the user terminal.
  • the BRAS-2 interface After receiving the message sent by the user terminal, the BRAS-2 interface extracts the terminal information of the message (such as the terminal's IP address, MAC address, and access location information);
  • the authentication request message includes terminal information of the user terminal;
  • the AAA server After receiving the authentication request message sent by BRAS-2, the AAA server queries whether there is terminal information corresponding to the user terminal locally. Since the user terminal has previously completed access authentication on the interface of BRAS-1, The AAA server can find the terminal information corresponding to the user terminal, so as to determine that the user terminal has been authenticated.
  • the AAA server When the AAA server receives the DM confirmation message, it can change the access position of the user terminal recorded locally from the interface of BRAS-1 to the interface of BRAS-2;
  • the AAA server sends an authentication response message to the interface of BRAS-2;
  • the interface of (10 ') BRAS-2 determines that the user terminal is authenticated, so it can record the user entry of the user terminal, issue permissions for the user terminal, and allow it to access the network;
  • the interface of the BRAS-2 sends a start-accounting message to the AAA server, and the start-accounting message includes the terminal information of the user terminal, so that the AAA server starts to charge the user terminal.
  • the present disclosure can realize that when a user roams between different BRAS devices, the user is not required to re-enter the user name and password, which can realize the user's perceptual roaming and improve the user's online experience.
  • the present disclosure also provides a device for access authentication, which can be implemented by software, or by hardware or a combination of software and hardware.
  • the access authentication device of the present disclosure as a device in a logical sense, is obtained by reading a corresponding computer program instruction in a memory through a CPU of a device in which the device is located and running.
  • FIG. 5 is an apparatus 500 for access authentication according to an exemplary embodiment of the present disclosure.
  • the apparatus is applied to an AAA server.
  • the basic operating environment of the apparatus includes a CPU, a memory, and other hardware. See, the device 500 includes:
  • An obtaining unit 501 configured to obtain an authentication request message sent by a first interface of a BRAS device when a user entry corresponding to a user terminal is not found, where the authentication request message includes terminal information of the user terminal;
  • a notification unit 502 configured to, when it is determined according to the terminal information that the user terminal is an authenticated terminal and a roaming terminal, notify a second interface that has accessed the user terminal to delete a user entry corresponding to the user terminal;
  • a sending unit 503 configured to send an authentication pass message to the first interface when it is confirmed that the second interface deletes the user entry corresponding to the user terminal, so that the first interface allows the user terminal to access, A user entry corresponding to the user terminal is recorded on the first interface.
  • the apparatus further includes:
  • a determining unit 504 is configured to locally find whether there is authentication user information corresponding to the user terminal according to the terminal information; if the authentication user information is found, determine the access location information and the authentication user information in the authentication user information. Whether the access location information in the terminal information is the same; if they are the same, the authentication request message is discarded; if they are different, it is determined that the terminal is an authenticated terminal and a roaming terminal, and then the first The second interface deletes the user entry corresponding to the user terminal.
  • the notification unit 502 is specifically configured to notify the accessed location on the BRAS device when the access location information in the terminal information indicates that the user terminal roams on different interfaces on the BRAS device.
  • the second interface of the user terminal deletes a user entry corresponding to the user terminal; or, when the access location information in the terminal information indicates that the user terminal roams on a non-local BRAS device, it notifies the non-local BRAS A second interface on the device that has accessed the user terminal deletes a user entry corresponding to the user terminal.
  • the notification unit 502 is specifically configured to send a notification offline message including the terminal information to the second interface, so that when the second interface receives the notification offline message, delete the notification After the user entry corresponding to the terminal information saved by itself is fed back to the AAA server, an offline confirmation message;
  • the sending unit 503 is specifically configured to, if the offline confirmation message sent by the second interface is received, confirm that the second interface deletes the user entry corresponding to the user terminal.
  • FIG. 6 is an apparatus 600 for access authentication in an exemplary embodiment of the present disclosure.
  • the apparatus is applied to a BRAS device.
  • the basic operating environment of the apparatus includes a CPU, a memory, and other hardware. See, the device 600 includes:
  • An obtaining unit 601 configured to obtain terminal information of the user terminal if a user entry corresponding to the user terminal is not found on the first interface;
  • the sending unit 602 is configured to send an authentication request message including the terminal information to the AAA server, so that the AAA server notifies that the user terminal has been accessed when it determines that the user terminal is an authenticated terminal and is a roaming terminal according to the terminal information. Deleting, by the second interface of the user terminal, a user entry corresponding to the user terminal;
  • the recording unit 603 is configured to allow the user terminal to access the first pass if an authentication pass message is sent when the AAA server confirms that the second interface deletes a user entry corresponding to the user terminal. Interface, and record a user entry corresponding to the user terminal on the first interface.
  • the apparatus further includes:
  • a deleting unit 604 is configured to delete a user corresponding to the terminal information stored in the second interface of the BRAS device if the offline notification message including the terminal information is sent by the AAA server to the second interface of the local BRAS device. Entries; feedback an offline confirmation message to the AAA server, so that when the AAA server receives the offline confirmation message, it confirms that the second interface deletes the user entry corresponding to the terminal.
  • the present disclosure also provides an AAA server.
  • the AAA server includes a memory 71, a processor 72, a communication interface 73, and a communication bus 74.
  • the memory 71 and the processor 72 The communication interface 73 communicates with each other through the communication bus 74;
  • the memory 71 is configured to store a computer program
  • the processor 72 is configured to execute a computer program stored in the memory 71. When the processor 72 executes the computer program, the following operations are implemented:
  • the user terminal When it is determined that the user terminal is an authenticated terminal and a roaming terminal according to the terminal information, notify a second interface that has accessed the user terminal to delete a user entry corresponding to the user terminal;
  • the processor 72 sends an authentication pass message to the first interface through the communication interface 73, so that the first interface allows the user terminal Access, and record a user entry corresponding to the user terminal on the first interface.
  • the processor 72 executes the computer program to implement the following operations:
  • the user terminal is an authenticated terminal and a roaming terminal.
  • the processor 72 executes the computer program to implement the following operations:
  • the communication interface 73 is used to notify the second interface that has accessed the user terminal to delete the corresponding user terminal.
  • a user entry, the second interface is located in the BRAS device;
  • the communication interface 73 is used to notify the second interface that has accessed the user terminal to delete the user terminal.
  • a user entry corresponding to a user terminal, and the second interface is located in the second BRAS device.
  • the processor 72 executes the computer program to implement the following operations:
  • the processor 72 executes the computer program to implement the following operations:
  • the present disclosure also provides a BRAS device having the same structure as that shown in FIG. 7, so it is not shown.
  • the BRAS device includes a memory, a processor, a communication interface, and a communication bus.
  • the memory , The processor, and the communication interface communicate with each other through the communication bus;
  • the memory is used to store a computer program
  • the processor is configured to execute a computer program stored on the memory, and the processor executes the computer program to implement the following operations:
  • the user terminal If receiving an authentication pass message sent by the AAA server when it confirms that the second interface deletes the user entry corresponding to the user terminal, the user terminal is allowed to access the first interface, and A user entry corresponding to the user terminal is recorded on the first interface.
  • the processor also implements the following operations:
  • the offline confirmation message is fed back to the AAA server through the communication interface, so that when the AAA server receives the offline confirmation message, it confirms that the second interface deletes the user entry corresponding to the user terminal.
  • the present disclosure also provides a computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the access authentication method provided by the embodiment of the present disclosure is implemented. Either step.
  • the present disclosure enables the first interface of the BRAS device to send an authentication request message including the terminal information of the user terminal to the AAA server when the user interface corresponding to the user terminal is not found, and the AAA server determines that the user terminal is When the authenticated terminal is a roaming terminal, the second interface that has accessed the user terminal is notified to delete the user entry corresponding to the user terminal, and when it is confirmed that the deletion is completed, an authentication pass message is sent to the first interface so that the first An interface allows the user terminal to access, and records a user entry corresponding to the user terminal on a first interface.
  • the present disclosure records the terminal information of the authenticated terminal through the AAA server, so that when the user terminal roams to a new location, the interface of the BRAS device corresponding to the new location can send an authentication request message including the terminal information to the AAA server to confirm the user terminal's Authenticating the identity, thereby allowing the user terminal to access the network at the new location, preventing the user terminal from performing access authentication again after roaming, and improving the user experience.
  • the relevant part may refer to the description of the method embodiment.
  • the device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, may be located One place, or it can be distributed across multiple network elements. Some or all of these modules can be selected according to actual needs to achieve the purpose of the solution of this application. Those of ordinary skill in the art can understand and implement without creative efforts.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开提供一种接入认证的方法及装置，使BRAS设备的第一接口未查找到用户终端对应的用户表项时，向AAA服务器发送包括用户终端的终端信息的认证请求报文，AAA服务器确定该用户终端为已认证终端且是漫游终端时，通知已接入该用户终端的第二接口删除该用户终端对应的用户表项，并当确认删除完成时，向第一接口发送认证通过报文，以使第一接口允许该用户终端接入，并在第一接口上记录该用户终端对应的用户表项。

Description

接入认证
相关申请的交叉引用
本专利申请要求于2018年9月21日提交的、申请号为201811109298.4、发明名称为“一种接入认证的方法及装置”的中国专利申请的优先权，该申请的全文以引用的方式并入本文中。
背景技术
目前Internet市场的不断发展，接入到城域网的用户越来越多，用户的业务需求也日益膨胀，因此，宽带接入服务器(英文：Broadband Remote Access Server，简称：BRAS)应运而生。BRAS具有灵活的接入认证方式、有效的地址管理功能、强大的用户管理功能，并能提供丰富灵活的业务及控制功能。
然而，随着移动网络设备和无线业务的普及，用户终端不会固定在一个位置。例如，用户手持移动设备在访问网络的过程中，经常会从一个接入点(英文：Access Point，简称：AP)漫游到另一个接入点。由于接入点的改变，不同接入点对应连接的BRAS设备接入接口或BRAS设备也可能不同，因此，用户终端在从一个接入点漫游到另一个接入点时，可能是从某台BRAS设备的一个接入接口漫游到该BRAS设备另一个接入接口，或者是从一台BRAS设备漫游到了另一台BRAS设备。
附图说明
图1是本公开一种示例性实施方式中的BRAS组网示意图；
图2是本公开一种示例性实施方式中的一种接入认证的方法的处理流程图；
图3是本公开另一种示例性实施方式中的一种接入认证的方法的处理流程图；
图4是本公开一种示例性实施方式中的漫游前及漫游至另一BRAS设备的接口后的交互流程图；
图5是本公开一种示例性实施方式中的一种接入认证装置的逻辑结构图；
图6是本公开另一种示例性实施方式中的一种接入认证的装置的逻辑结构图；
图7是本公开一种示例性实施方式中的网络设备的硬件结构图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
在本申请使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。在本申请和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
请参考图1，是本公开一种示例性实施方式中的BRAS设备组网示意图，其中用户终端(例如，个人电脑(英文：Personal Computer，简称：PC)1)通过AP 1从交换设备(例如，交换机(Switch)1)接入网络，PC 2通过AP 2从Switch 2接入网络，PC 1和PC 2都通过BRAS-A进行地址分配和准入认证；PC 3通过AP 3从Switch 3接入网络，PC4通过AP4从Switch 4接入网络，PC 3和PC 4都通过BRAS-B进行地址分配和准入认证。
现有技术中，用户终端在BRAS设备的第一接口处上线后，BRAS设备可以记录用户终端对应的用户信息，包括用户终端的接入位置和互联网协议(英文：Internet Protocol，简称：IP)地址。在用户信息有效期间，如果BRAS设备的第二接口接收到携带该IP地址的IP报文，则认为用户终端处于漫游状态。此时，BRAS设备修改已记录的用户信息以将用户信息迁移至用户终端漫游时新接入的第二接口。
但是，现有技术是通过BRAS设备记录认证通过的用户信息，而该用户信息无法让其他BRAS设备获知，所以，现有技术只能解决用户终端在同一BRAS设备上不同接口接入的漫游问题。对于跨BRAS设备的漫游，则通过漫游后位置对应的BRAS设备对用户终端再次认证的方式，以使用户终端接入BRAS设备。例如，当PC 1在BRAS-A设 备上认证通过后，若PC 1漫游到AP 3或AP 4时，由于AP 3和AP 4对应于BRAS-B设备，PC 1接入的BRAS设备发生了变化，因此PC 1必须重新进行接入认证，从而影响用户访问网络的流畅性和便利性。
为了解决现有技术存在的问题，本公开提供一种接入认证的方法及装置，可以使BRAS设备的第一接口未查找到用户终端对应的用户表项时，向认证、授权、记账服务器(英文：Authentication,Authorization,Accounting server；简称：AAA server)发送包括用户终端的终端信息的认证请求报文，AAA服务器基于用户终端的终端信息确定该用户终端为已认证终端且是漫游终端时，通知已接入该用户终端的第二接口(同一BRAS设备的接口或者另一BRAS设备的接口)删除该用户终端对应的用户表项。当确认删除完成时，AAA服务器向第一接口发送认证通过报文，以使第一接口允许该用户终端接入，并在第一接口上记录该用户终端对应的用户表项。因此，本公开通过AAA服务器记录已认证的用户终端的终端信息，以使用户终端漫游到新位置时，新位置对应的BRAS设备的接口向AAA服务器发送包括终端信息的认证请求报文。AAA服务器在确认用户终端为已认证终端和漫游终端后，允许用户终端在新位置接入网络，避免用户终端漫游后再次进行接入认证，提升了用户体验。
请参考图2，是本公开一种示例性实施方式中的一种接入认证的方法的处理流程图，所述方法应用于AAA服务器，所述方法包括：
步骤201、AAA服务器获取BRAS设备的第一接口在未查到用户终端所对应的用户表项时发送的认证请求报文，所述认证请求报文包括所述用户终端的终端信息。
在本公开的实施例中，当用户终端从BRAS设备的第一接口上线时，由于用户终端之前未接入第一接口，因此，该BRAS设备的第一接口上未记录该用户终端对应的用户表项。用户终端接入第一接口的过程中，用户终端向第一接口发送IP报文，该IP报文包括终端信息，所以该BRAS设备会通过接收该用户终端发送的IP报文获取该用户终端的终端信息，该终端信息用于区分不同用户终端。
其中，作为示例而非限定，前述终端信息可以包括用户终端的源IP地址、源媒体访问控制(Media Access Control，简写：MAC)地址以及该用户终端的接入位置信息，其中，接入位置信息可以包括：接入BRAS设备、接入接口、虚拟局域网(Virtual Local Area Network，简称：VLAN)等信息。
BRAS设备的第一接口向AAA服务器发送包括终端信息的认证请求报文以对该用 户终端进行认证。
因此，AAA服务器会在BRAS设备的第一接口未查到用户终端所对应的用户表项时，获取到BRAS设备的第一接口发送的包括终端信息的认证请求报文。
步骤202、当根据所述终端信息确定所述用户终端为已认证终端且是漫游终端时，AAA服务器通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项。
在本公开的实施例中，当AAA服务器根据终端信息确定用户终端为已认证终端且是从第二接口漫游到第一接口时，由于第二接口上仍记录着该用户终端的用户表项，因此，AAA服务器仍会对用户终端的流量继续计费，并且该用户终端的部分流量可能会根据第二接口上记录的用户表项进行错误转发，所以需要删除第二接口上已记录的该用户终端对应的用户表项。
此外，若未查找到认证用户信息，则说明该用户终端之前未认证，此时，AAA服务器向BRAS设备反馈认证失败报文，以使BRAS设备确定该用户终端为未认证终端，从而使BRAS设备根据现有的认证方式对用户终端进行认证，并在认证通过后再向AAA服务器发送认证请求报文。
步骤203、当确认第二接口删除所述用户终端对应的用户表项时，AAA服务器向所述第一接口发送认证通过报文，以使所述第一接口允许所述用户终端接入，并在所述第一接口上记录所述用户终端对应的用户表项。
在本公开的实施例中，当AAA服务器确认第二接口删除该用户终端的用户表项时，可以向BRAS设备的第一接口反馈针对该认证请求报文的认证通过报文。第一接口接收到该认证通过报文时，可以确定该用户终端是已认证的终端，因此允许该用户终端接入，并在本地记录该用户终端对应的用户表项。
相比于现有技术，本公开可以改进AAA服务器和BRAS设备的业务处理流程，由AAA服务器基于用户终端的特征识别出用户终端当前处于漫游状态，识别出用户终端的漫游状态后通过DM消息通知漫游前接入的相应BRAS设备的接口删除该接口处记录的用户表项，并在新位置无感知认证上线，避免用户终端重新进行接入认证，从而提升用户访问体验。
可选的，AAA服务器获取终端信息后，可以根据该终端信息在本地查找与该用户终端对应的认证用户信息。若查找到该认证用户信息，说明该用户终端是已认证的终端。然后，AAA服务器进一步判断认证用户信息中的接入位置信息与终端信息包括的接入 位置信息是否相同；若相同，则说明该用户终端不是漫游终端，此时，AAA服务器丢弃该认证请求报文；若不同，则说明该用户终端是漫游终端，此时，AAA服务器通知已接入用户终端的第二接口删除用户终端对应的用户表项。
可选的，当该终端信息中的接入位置信息指示该用户终端在本BRAS设备上不同接口漫游时，说明第二接口和第一接口都在本BRAS设备上，因此，AAA服务器可以通知本BRAS设备上的已接入该用户终端的第二接口删除该用户终端对应的用户表项；当该终端信息中的接入位置信息指示该用户终端在非本BRAS设备上漫游时，说明第二接口和第一接口在不同BRAS设备上，因此，AAA服务器可以通知在非本BRAS设备上的已接入该用户终端的第二接口删除该用户终端对应的用户表项。
可选的，作为一个实施例，AAA服务器可以向第二接口发送通知下线消息，例如，断开管理(英文：Disconnect Management，简称：DM)请求消息。该通知下线消息包括该用户终端的终端信息，第二接口接收到AAA服务器发送的通知下线消息时，删除自身保存的该用户终端对应的用户表项。然后，第二接口向AAA服务器反馈下线确认消息，例如，DM确认消息。当AAA服务器接收到第二接口发送的下线确认消息时，可以确认第二接口上记录的该用户终端对应的用户表项已经删除完成。
请参考图3，是本公开一种示例性实施方式中的另一种接入认证的方法的处理流程图，所述方法应用于BRAS设备，所述方法包括：
步骤301、若在第一接口未查找到用户终端对应的用户表项，则BRAS设备获取所述用户终端的终端信息；
在本公开的实施例中，当用户终端从BRAS设备的第一接口上线时，BRAS设备可以根据流量特征查找第一接口中是否存在该用户终端对应的用户表项。由于用户终端之前未接入过第一接口，因此第一接口上未记录该用户终端的用户表项，所以第一接口会将该用户终端发送的流量转发至该BRAS设备的中央处理器(Central Processing Unit，简写：CPU)，由CPU分析该流量中的终端信息，该终端信息用于区分不同终端。
可选的，该终端信息可以包括终端的源IP地址、源MAC地址以及该用户终端的接入位置信息，其中接入位置信息可以包括：接入BRAS设备、接入接口、VLAN等信息。
步骤302、BRAS设备的第一接口向AAA服务器发送包括所述终端信息的认证请求报文，以使AAA服务器根据所述终端信息在确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
该BRAS设备的第一接口获取到该用户终端对应的终端信息后，可以发送认证请求报文到AAA服务器，其中该认证请求报文包括该用户终端的终端信息，以使AAA服务器收到终端信息后，可以在确定该用户终端是已认证终端且是漫游终端时，通知已接入该用户终端的第二接口删除其本地保存的该用户终端对应的用户表项。
步骤303、若接收到所述AAA服务器在确认所述第二接口删除所述用户终端对应的用户表项时发送的认证通过报文，则BRAS设备的第一接口允许所述用户终端接入所述第一接口，并在所述第一接口上记录所述用户终端对应的用户表项。
当AAA服务器确认第二接口删除该用户终端对应的用户表项时，可以针对第一接口发送的认证请求报文反馈认证通过报文。当第一接口收到AAA服务器发送的认证通过报文时，可以确定该用户终端是已认证的终端，因此允许该用户终端接入，并在本地记录该用户终端对应的用户表项。
由此可见，本公开可以使BRAS设备的第一接口未查找到用户终端对应的用户表项时，向AAA服务器发送包括用户终端的终端信息的认证请求报文，AAA服务器确定该用户终端为已认证终端且是漫游终端时，通知已接入该用户终端的第二接口删除该用户终端对应的用户表项，并当第二接口确认删除完成时，向第一接口发送认证通过报文，以使第一接口允许该用户终端接入，并在第一接口上记录该用户终端对应的用户表项。因此本公开通过AAA服务器记录已认证终端的终端信息，以使用户终端漫游到新位置时，新位置对应的BRAS设备的接口向AAA服务器发送包括终端信息的认证请求报文，AAA服务器确认用户终端的认证身份后，允许用户终端在新位置接入网络，避免用户终端漫游后再次进行接入认证，提升了用户体验。
可选的，当本BRAS设备接收到AAA服务器向本BRAS设备的第二接口发送的包括终端信息的通知下线消息时，可以认为用户终端从本BRAS设备上的第二接口漫游到第一接口，因此可删除自身第二接口保存的该用户终端对应的用户表项，以使该终端可以在漫游后的第一接口接入。第二接口确定删除该用户终端对应的用户表项后，可以反馈下线确认消息至AAA服务器，以使AAA服务器在收到下线确认消息时，确认第二接口已删除该用户终端对应的用户表项，从而可以使用户终端在漫游后的第一接口访问网络。
为使本公开的目的、技术方案及优点更加清楚明白，下面以跨BRAS漫游为例，结合图4对本公开的方案作进一步地详细说明。
请参见图4，是本公开实施例中的用户终端漫游前及漫游到另一BRAS设备的接口后的交互流程图，其中包括：
用户终端漫游前的交互流程为：
(1)当用户终端向BRAS-1的接口请求接入网络时，用户终端向BRAS-1的接口发送HTTP请求；
(2)由于BRAS-1的接口上未记录该用户终端的用户表项，因此，BRAS-1将该HTTP请求重定向到Web认证服务器的认证页面；
(3)BRAS-1访问Web认证服务器的认证页面；
(4)BRAS-1向用户终端推送Web认证服务器的认证页面对应的统一资源定位符(英文：Uniform Resource Locator，简写：URL)；
(5)用户终端接收到认证页面对应的URL时可以根据该URL向Web认证服务器请求Web认证；
(6)Web认证服务器向用户终端反馈Web认证页面内容；
(7)用户终端根据Web认证页面内容输入Web认证的用户名和密码并向Web认证服务器发送Web认证的用户名和密码；
(8)Web认证服务器接收到用户名和密码后进行web认证，向BRAS-1发送web认证信息；
(9)BRAS-1向AAA服务器发送用户终端的接入认证请求，其中该接入认证请求包括Web认证的用户名和密码、终端信息(例如用户终端的IP地址、MAC地址以及接入位置信息)；
(10)AAA服务器根据接入认证请求确定该用户终端认证通过时，向BRAS-1发送认证应答；
(11)BRAS-1收到认证应答后，BRAS-1设备的接口在本地记录用户终端的用户表项，其中包括终端信息和Web认证的用户名和密码，并向该用户终端下发权限以允许其访问网络；
(12)用户终端开始访问网络时，BRAS-1的接口向AAA服务器发送开始计费消息，该开始计费消息包括用户终端的终端信息，以使AAA服务器对该用户终端开始计费。
当用户终端从BRAS-1的接口漫游到BRAS-2的接口时，漫游后的交互流程为：
(1’)用户终端从BRAS-2的接口上线后发送(IP、地址解析协议(英文：Address Resolution Protocol，简写：ARP))报文到BRAS-2；
(2’)BRAS-2的接口收到用户终端发送的报文后，提取报文的终端信息(例如终端的IP地址、MAC地址以及接入位置信息)；
(3’)由于该用户终端首次接入BRAS-2的接口，因此BRAS-2的接口上未记录该用户终端的用户表项，所以BRAS-2的接口可以向AAA服务器发送认证请求报文，该认证请求报文中包括该用户终端的终端信息；
(4’)AAA服务器收到BRAS-2发送的认证请求报文后，查询本地是否存在该用户终端对应的终端信息，由于该用户终端之前在BRAS-1的接口上已经完成接入认证，因此AAA服务器可以查找到该用户终端对应的终端信息，从而确定该用户终端已经认证通过；
(5’)由于该用户终端已经在BRAS-2的接口上线，而AAA服务器检测到BRAS-1的接口还保存着该用户终端的用户表项，因此AAA服务器向BRAS-1的接口发送DM请求消息；
(6’)BRAS-1的接口收到DM请求消息时，将该接口上用户终端对应的用户表项删除，并且向AAA服务器发送停止计费消息；
(7’)BRAS-1的接口回复AAA服务器DM确认消息；
(8’)AAA服务器收到DM确认消息时可以将本地记录的用户终端的接入位置由BRAS-1的接口改为BRAS-2的接口；
(9’)AAA服务器向BRAS-2的接口发送认证应答报文；
(10’)BRAS-2的接口收到认证应答报文后，确定该用户终端已经认证，因此可以记录该用户终端的用户表项，为该用户终端下发权限，允许其访问网络；
(11’)用户终端开始访问网络时，BRAS-2的接口向AAA服务器发送开始计费消息，该开始计费消息包括用户终端的终端信息，以使AAA服务器对该用户终端开始计费。
因此，本公开可以实现用户在不同BRAS设备间漫游时，不需要用户重新输入用户名和密码，可实现用户无感知漫游，提升了用户上网体验。
基于相同的构思，本公开还提供一种接入认证的装置，该装置可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。以软件实现为例，本公开的接入认证的装置作为一个逻辑意义上的装置，是通过其所在装置的CPU将存储器中对应的计算机程序指令读取后运行而成。
请参考图5，是本公开一种示例性实施方式中的一种接入认证的装置500，所述装置应用于AAA服务器，该装置基本运行环境包括CPU、存储器以及其他硬件，从逻辑层面上来看，该装置500包括：
获取单元501，用于获取BRAS设备的第一接口在未查到用户终端所对应的用户表项时发送的认证请求报文，所述认证请求报文包括所述用户终端的终端信息；
通知单元502，用于当根据所述终端信息确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
发送单元503，用于当确认第二接口删除所述用户终端对应的用户表项时，向所述第一接口发送认证通过报文，以使所述第一接口允许所述用户终端接入，并在所述第一接口上记录所述用户终端对应的用户表项。
作为一个实施例，所述装置还包括：
确定单元504，用于根据所述终端信息在本地查找是否存在所述用户终端对应的认证用户信息；若查找到所述认证用户信息，则判断所述认证用户信息中的接入位置信息与所述终端信息中的接入位置信息是否相同；若相同，则丢弃所述认证请求报文；若不同，则确定所述终端为已认证终端且是漫游终端，然后通知已接入用户终端的第二接口删除用户终端对应的用户表项。
作为一个实施例，所述通知单元502，具体用于当所述终端信息中的接入位置信息指示所述用户终端在本BRAS设备上不同接口漫游时，通知本BRAS设备上的已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；或者，当所述终端信息中的接入位置信息指示所述用户终端在非本BRAS设备上漫游时，通知在非本BRAS设备上的已接入所述用户终端的第二接口删除所述用户终端对应的用户表项。
作为一个实施例，所述通知单元502，具体用于向所述第二接口发送包括所述终端信息的通知下线消息，以使所述第二接口收到所述通知下线消息时，删除自身保存的所述终端信息对应的用户表项之后向AAA服务器反馈下线确认消息；
所述发送单元503，具体用于若收到第二接口发送的所述下线确认消息，则确认所 述第二接口删除所述用户终端对应的用户表项。
请参考图6，是本公开一种示例性实施方式中的一种接入认证的装置600，所述装置应用于BRAS设备，该装置基本运行环境包括CPU、存储器以及其他硬件，从逻辑层面上来看，该装置600包括：
获取单元601，用于若在第一接口未查找到用户终端对应的用户表项，则获取所述用户终端的终端信息；
发送单元602，用于向AAA服务器发送包括所述终端信息的认证请求报文，以使AAA服务器根据所述终端信息在确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
记录单元603，用于若接收到所述AAA服务器在确认所述第二接口删除所述用户终端对应的用户表项时发送的认证通过报文，则允许所述用户终端接入所述第一接口，并在所述第一接口上记录所述用户终端对应的用户表项。
作为一个实施例，所述装置还包括：
删除单元604，用于若接收到所述AAA服务器向本BRAS设备的第二接口发送的包括所述终端信息的通知下线消息时，则删除自身第二接口保存的所述终端信息对应的用户表项；反馈下线确认消息至所述AAA服务器，以使所述AAA服务器在收到所述下线确认消息时，确认所述第二接口删除所述终端对应的用户表项。
基于相同的构思，本公开还提供一种AAA服务器，如图7所示，所述AAA服务器包括存储器71、处理器72、通信接口73以及通信总线74；其中，所述存储器71、处理器72、通信接口73通过所述通信总线74进行相互间的通信；
所述存储器71，用于存储计算机程序；
所述处理器72，用于执行所述存储器71上所存储的计算机程序，所述处理器72执行所述计算机程序时实现以下操作：
获取宽带接入服务器BRAS设备的第一接口在未查到用户终端所对应的用户表项时发送的认证请求报文，所述认证请求报文包括所述用户终端的终端信息；
当根据所述终端信息确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
当确认所述第二接口删除所述用户终端对应的用户表项时，处理器72通过通讯接口 73向所述第一接口发送认证通过报文，以使所述第一接口允许所述用户终端接入，并在所述第一接口上记录所述用户终端对应的用户表项。
可选的，在根据所述终端信息确定所述用户终端为已认证终端且是漫游终端时，所述处理器72执行所述计算机程序实现以下操作：
根据所述终端信息查找所述AAA服务器上是否存在所述用户终端对应的认证用户信息；
若查找到所述认证用户信息，则判断所述认证用户信息中的接入位置信息与所述终端信息中的接入位置信息是否相同；
若相同，则丢弃所述认证请求报文；
若不同，则确定所述用户终端为已认证终端且是漫游终端。
可选的，在通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项时，所述处理器72执行所述计算机程序实现以下操作：
当所述终端信息中的接入位置信息指示所述用户终端在所述BRAS设备包括的不同接口漫游时，通过通信接口73通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，所述第二接口位于所述BRAS设备；
当所述终端信息中的接入位置信息指示所述用户终端在非所述BRAS设备的第二BRAS设备上漫游时，通过通信接口73通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，所述第二接口位于所述第二BRAS设备。
可选的，在通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项时，所述处理器72执行所述计算机程序实现以下操作：
通过通信接口73向所述第二接口发送包括所述终端信息的通知下线消息，以使所述第二接口接收到所述通知下线消息时，删除保存的所述终端信息对应的用户表项之后向所述AAA服务器反馈下线确认消息；
在确认所述第二接口删除所述用户终端对应的用户表项时，所述处理器72执行所述计算机程序实现以下操作：
若接收到所述第二接口反馈的所述下线确认消息，则确认所述第二接口删除所述用户终端对应的用户表项。
基于相同的构思，本公开还提供一种BRAS设备，其结构与图7所示结构相同， 故未示出，所述BRAS设备包括存储器、处理器、通信接口以及通信总线；其中，所述存储器、处理器、通信接口通过所述通信总线进行相互间的通信；
所述存储器，用于存储计算机程序；
所述处理器，用于执行所述存储器上所存储的计算机程序，所述处理器执行所述计算机程序实现以下操作：
若在第一接口未查找到用户终端对应的用户表项，则获取所述用户终端的终端信息；
所述第一接口通过通信接口向AAA服务器发送包括所述终端信息的认证请求报文，以使所述AAA服务器根据所述终端信息在确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
若接收到所述AAA服务器在确认所述第二接口删除所述用户终端对应的用户表项时发送的认证通过报文，则允许所述用户终端接入所述第一接口，并在所述第一接口上记录所述用户终端对应的用户表项。
可选的，所述处理器还实现以下操作：
若接收到所述AAA服务器向所述BRAS设备的第二接口发送的包括所述终端信息的通知下线消息时，则删除所述BRAS设备的所述第二接口保存的所述用户终端对应的用户表项；
通过通信接口向所述AAA服务器反馈下线确认消息，以使所述AAA服务器在收到所述下线确认消息时，确认所述第二接口删除所述用户终端对应的用户表项。
本公开还提供一种计算机可读存储介质，其特征在于，所述计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现本公开实施例提供的接入认证方法的任一步骤。
本说明书中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于网络设备和计算机可读存储介质的实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
综上所述，本公开可以使BRAS设备的第一接口未查找到用户终端对应的用户表项时，向AAA服务器发送包括用户终端的终端信息的认证请求报文，AAA服务器确 定该用户终端为已认证终端且是漫游终端时，通知已接入该用户终端的第二接口删除该用户终端对应的用户表项，并当确认删除完成时，向第一接口发送认证通过报文，以使第一接口允许该用户终端接入，并在第一接口上记录该用户终端对应的用户表项。因此本公开通过AAA服务器记录已认证终端的终端信息，以使用户终端漫游到新位置时，新位置对应的BRAS设备的接口可以向AAA服务器发送包括终端信息的认证请求报文来确认用户终端的认证身份，从而允许用户终端在新位置接入网络，避免用户终端漫游后再次进行接入认证，提升了用户体验。
上述装置中各个单元的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本申请方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上对本公开实施例所提供的方法和装置进行了详细介绍，本文中应用了具体个例对本公开的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本公开的方法及其核心思想；同时，对于本领域的一般技术人员，依据本公开的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本公开的限制。

Claims (14)

  1. 一种接入认证的方法，应用于认证授权计费AAA服务器，所述方法包括：
    获取宽带接入服务器BRAS设备的第一接口在未查到用户终端所对应的用户表项时发送的认证请求报文，所述认证请求报文包括所述用户终端的终端信息；
    当根据所述终端信息确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
    当确认所述第二接口删除所述用户终端对应的用户表项时，向所述第一接口发送认证通过报文，以使所述第一接口允许所述用户终端接入，并在所述第一接口上记录所述用户终端对应的用户表项。
  2. 根据权利要求1所述的方法，其中，根据所述终端信息确定所述用户终端为已认证终端且是漫游终端，具体包括：
    根据所述终端信息查找所述AAA服务器上是否存在所述用户终端对应的认证用户信息；
    若查找到所述认证用户信息，则判断所述认证用户信息中的接入位置信息与所述终端信息中的接入位置信息是否相同；
    若相同，则丢弃所述认证请求报文；
    若不同，则确定所述用户终端为已认证终端且是漫游终端。
  3. 根据权利要求2所述的方法，其中，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，具体包括：
    当所述终端信息中的接入位置信息指示所述用户终端在所述BRAS设备包括的不同接口漫游时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，所述第二接口位于所述BRAS设备；
    当所述终端信息中的接入位置信息指示所述用户终端在非所述BRAS设备的第二BRAS设备上漫游时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，所述第二接口位于所述第二BRAS设备。
  4. 根据权利要求1所述的方法，其中，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，具体包括：
    向所述第二接口发送包括所述终端信息的通知下线消息，以使所述第二接口接收到所述通知下线消息时，删除保存的所述终端信息对应的用户表项之后向所述AAA服务器反馈下线确认消息；
    确认所述第二接口删除所述用户终端对应的用户表项，具体包括：
    若接收到所述第二接口反馈的所述下线确认消息，则确认所述第二接口删除所述用户终端对应的用户表项。
  5. 一种接入认证的方法，应用于BRAS设备，所述方法包括：
    若在第一接口未查找到用户终端对应的用户表项，则获取所述用户终端的终端信息；
    所述第一接口向AAA服务器发送包括所述终端信息的认证请求报文，以使所述AAA服务器根据所述终端信息在确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
    若接收到所述AAA服务器在确认所述第二接口删除所述用户终端对应的用户表项时发送的认证通过报文，则允许所述用户终端接入所述第一接口，并在所述第一接口上记录所述用户终端对应的用户表项。
  6. 根据权利要求5所述的方法，还包括：
    若接收到所述AAA服务器向所述BRAS设备的第二接口发送的包括所述终端信息的通知下线消息时，则删除所述BRAS设备的所述第二接口保存的所述用户终端对应的用户表项；
    向所述AAA服务器反馈下线确认消息，以使所述AAA服务器在收到所述下线确认消息时，确认所述第二接口删除所述用户终端对应的用户表项。
  7. 一种接入认证的装置，应用于AAA服务器，所述装置包括：
    获取单元，用于获取BRAS设备的第一接口在未查到用户终端所对应的用户表项时发送的认证请求报文，所述认证请求报文包括所述用户终端的终端信息；
    通知单元，用于当根据所述终端信息确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
    发送单元，用于当确认所述第二接口删除所述用户终端对应的用户表项时，向所述第一接口发送认证通过报文，以使所述第一接口允许所述用户终端接入，并在所述第一接口上记录所述用户终端对应的用户表项。
  8. 根据权利要求7所述的装置，其中，所述装置还包括：
    确定单元，用于根据所述终端信息查找所述AAA服务器上是否存在所述用户终端对应的认证用户信息；若查找到所述认证用户信息，则判断所述认证用户信息中的接入位置信息与所述终端信息中的接入位置信息是否相同；若相同，则丢弃所述认证请求报文；若不同，则确定所述用户终端为已认证终端且是漫游终端。
  9. 根据权利要求8所述的装置，其中，
    所述通知单元，具体用于当所述终端信息中的接入位置信息指示所述用户终端在所述BRAS设备包括的不同接口漫游时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，所述第二接口位于所述BRAS设备；或者，当所述终端信息中的接入位置信息指示所述终端在非所述BRAS设备的第二BRAS设备上漫游时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项，所述第二接口位于所述第二BRAS设备。
  10. 根据权利要求7所述的装置，其中，
    所述通知单元，具体用于向所述第二接口发送包括所述终端信息的通知下线消息，以使所述第二接口收到所述通知下线消息时，删除保存的所述终端信息对应的用户表项之后向所述AAA服务器反馈下线确认消息；
    所述发送单元，具体用于若接收到所述第二接口反馈的所述下线确认消息，则确认所述第二接口删除所述用户终端对应的用户表项。
  11. 一种接入认证的装置，应用于BRAS设备，所述装置包括：
    获取单元，用于若在第一接口未查找到用户终端对应的用户表项，则获取所述用户终端的终端信息；
    发送单元，用于向AAA服务器发送包括所述终端信息的认证请求报文，以使所述AAA服务器根据所述终端信息在确定所述用户终端为已认证终端且是漫游终端时，通知已接入所述用户终端的第二接口删除所述用户终端对应的用户表项；
    记录单元，用于若接收到所述AAA服务器在确认所述第二接口删除所述用户终端对应的用户表项时发送的认证通过报文，则允许所述用户终端接入所述第一接口，并在所述第一接口上记录所述用户终端对应的用户表项。
  12. 根据权利要求11所述的装置，其中，所述装置还包括：
    删除单元，用于若接收到所述AAA服务器向所述BRAS设备的第二接口发送的包括所述终端信息的通知下线消息时，则删除所述BRAS设备的所述第二接口保存的所述用户终端对应的用户表项；向所述AAA服务器反馈下线确认消息，以使所述AAA服务器在收到所述下线确认消息时，确认所述第二接口删除所述用户终端对应的用户表项。
  13. 一种AAA服务器，包括：
    处理器；以及
    存储有在所述处理器上运行的机器可执行指令的存储器，所述处理器执行所述指令时实现如权利要求1-4中任一项所述的方法。
  14. 一种BRAS设备，包括：
    处理器；以及
    存储有在所述处理器上运行的机器可执行指令的存储器，所述处理器执行所述指令时实现如权利要求5或6中任一项所述的方法。
PCT/CN2019/106605 2018-09-21 2019-09-19 接入认证 WO2020057585A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2021512270A JP7135206B2 (ja) 2018-09-21 2019-09-19 アクセス認証
EP19863952.8A EP3855695B1 (en) 2018-09-21 2019-09-19 Access authentication
US17/276,387 US11743258B2 (en) 2018-09-21 2019-09-19 Access authenticating

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811109298.4A CN109067788B (zh) 2018-09-21 2018-09-21 一种接入认证的方法及装置
CN201811109298.4 2018-09-21

Publications (1)

Publication Number Publication Date
WO2020057585A1 true WO2020057585A1 (zh) 2020-03-26

Family

ID=64763556

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/106605 WO2020057585A1 (zh) 2018-09-21 2019-09-19 接入认证

Country Status (5)

Country Link
US (1) US11743258B2 (zh)
EP (1) EP3855695B1 (zh)
JP (1) JP7135206B2 (zh)
CN (1) CN109067788B (zh)
WO (1) WO2020057585A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109067788B (zh) * 2018-09-21 2020-06-09 新华三技术有限公司 一种接入认证的方法及装置
CN109861892A (zh) * 2019-03-28 2019-06-07 新华三技术有限公司 一种终端漫游方法及装置
CN113824696B (zh) * 2021-08-27 2023-12-05 杭州迪普科技股份有限公司 portal认证方法及装置
CN118175545B (zh) * 2024-05-15 2024-07-23 中兴通讯股份有限公司 Fttr的无线终端认证方法及无线终端认证网络

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102075904A (zh) * 2010-12-24 2011-05-25 杭州华三通信技术有限公司 一种防止漫游用户再次认证的方法和装置
CN103634776A (zh) * 2012-08-24 2014-03-12 中兴通讯股份有限公司 一种获取终端的接入标识的方法及身份信息服务器
EP2768180A1 (en) * 2013-02-14 2014-08-20 Telefonica S.A. Method and system for fixed broadband access zero touch, self-provisioning, auto-configuration and auto-activation
CN108429773A (zh) * 2018-06-20 2018-08-21 中国联合网络通信集团有限公司 认证方法及认证系统
CN109067788A (zh) * 2018-09-21 2018-12-21 新华三技术有限公司 一种接入认证的方法及装置

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7434044B2 (en) * 2003-02-26 2008-10-07 Cisco Technology, Inc. Fast re-authentication with dynamic credentials
CN1277368C (zh) 2004-01-21 2006-09-27 华为技术有限公司 无线局域网用户终端重新选择运营网络的交互方法
CN100493247C (zh) * 2004-02-27 2009-05-27 北京三星通信技术研究有限公司 高速分组数据网中接入认证方法
US8190124B2 (en) * 2004-10-22 2012-05-29 Broadcom Inc. Authentication in a roaming environment
FR2943881A1 (fr) * 2009-03-31 2010-10-01 France Telecom Procede et dispositif de gestion d'une authentification d'un utilisateur.
CN101765114B (zh) * 2010-01-18 2012-11-28 杭州华三通信技术有限公司 一种控制无线用户接入的方法、系统及设备
US9167427B2 (en) * 2013-03-15 2015-10-20 Alcatel Lucent Method of providing user equipment with access to a network and a network configured to provide access to the user equipment
CN105101152B (zh) * 2014-05-15 2018-11-16 华为技术有限公司 无线终端在无线控制器之间的漫游方法及相关装置
CN104038917B (zh) * 2014-06-27 2017-11-24 北京星网锐捷网络技术有限公司 终端漫游认证的方法及装置
US9894520B2 (en) * 2014-09-24 2018-02-13 Fortinet, Inc. Cache-based wireless client authentication
CN105744579B (zh) * 2014-12-11 2019-06-18 华为技术有限公司 终端在ap间切换的方法、切换控制装置及接入装置
US10257162B2 (en) * 2015-02-16 2019-04-09 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for providing “anywhere access” for fixed broadband subscribers
CN106230668B (zh) 2016-07-14 2020-01-03 新华三技术有限公司 接入控制方法及装置
CN107820246B (zh) * 2016-09-14 2020-07-21 华为技术有限公司 用户认证的方法、装置和系统
CN107995070B (zh) * 2017-11-21 2020-12-08 新华三技术有限公司 基于ipoe的连网控制方法、装置和bras

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102075904A (zh) * 2010-12-24 2011-05-25 杭州华三通信技术有限公司 一种防止漫游用户再次认证的方法和装置
CN103634776A (zh) * 2012-08-24 2014-03-12 中兴通讯股份有限公司 一种获取终端的接入标识的方法及身份信息服务器
EP2768180A1 (en) * 2013-02-14 2014-08-20 Telefonica S.A. Method and system for fixed broadband access zero touch, self-provisioning, auto-configuration and auto-activation
CN108429773A (zh) * 2018-06-20 2018-08-21 中国联合网络通信集团有限公司 认证方法及认证系统
CN109067788A (zh) * 2018-09-21 2018-12-21 新华三技术有限公司 一种接入认证的方法及装置

Also Published As

Publication number Publication date
EP3855695A4 (en) 2021-09-29
US20210409407A1 (en) 2021-12-30
CN109067788A (zh) 2018-12-21
JP2022501879A (ja) 2022-01-06
EP3855695B1 (en) 2024-01-17
JP7135206B2 (ja) 2022-09-12
US11743258B2 (en) 2023-08-29
EP3855695A1 (en) 2021-07-28
CN109067788B (zh) 2020-06-09

Similar Documents

Publication Publication Date Title
WO2020057585A1 (zh) 接入认证
US11212678B2 (en) Cross access login controller
KR101971167B1 (ko) 이주자에 의해 야기된 코어 네트워크 트래픽의 감소
US20200169880A1 (en) Network service system and network service method
WO2013159576A1 (zh) 接入无线网络的方法、终端、wi-fi接入网节点和鉴权服务器
JP3845086B2 (ja) 制御されたマルチキャストのシステム及び実行方法
WO2017177767A1 (zh) 一种业务访问及其控制方法、装置
US8122485B2 (en) Authentication techniques
WO2019042378A1 (zh) 提供用户身份信息的方法、系统及存储介质
EP1713289A1 (en) A method for establishing security association between the roaming subscriber and the server of the visited network
WO2022068219A1 (zh) 虚拟专有拨号网络接入方法、网络侧系统、系统和存储介质
WO2007045170A1 (fr) Procede et systeme de partage de zone memoire de terminal mobile
WO2020094039A1 (zh) 接入认证
WO2010000185A1 (zh) 一种网络认证的方法、装置、系统及服务器
US7394800B2 (en) Reservation with access points
WO2012167500A1 (zh) 一种隧道数据安全通道的建立方法
US10601830B2 (en) Method, device and system for obtaining local domain name
WO2011026404A1 (zh) 一种认证授权计费会话更新方法、装置和系统
WO2011098660A9 (en) Method and apparatus for redirecting data traffic
WO2017080333A1 (zh) 上网认证方法、认证服务器及其所在认证系统
TWI516151B (zh) 通訊方法與通訊系統
WO2009000214A1 (fr) Procédé et dispositif pour configurer des données de configuration du réseau d'accès utilisateur
WO2019144719A1 (zh) 一种远端设备的动态接入方法及装置
WO2010000157A1 (zh) 接入设备的配置方法、装置及系统
WO2015196580A1 (zh) 一种无线设备的接入方法、网关设备和无线网络

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19863952

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021512270

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019863952

Country of ref document: EP

Effective date: 20210421