CN101188614A - A method, system and device for user access security control - Google Patents

Abstract

The invention discloses a method, system and equipment for user access security control, belonging to the communication field. The method includes receiving an access request message, where the access request message carries a user link identifier; analyzing the access request message to obtain the user link identifier; judging whether the access request message satisfies the preset access condition according to the user link identifier ; If yes, allow the user corresponding to the user link identifier to access. The system includes user nodes, access equipment and control equipment. The access device includes a receiving module, an identification insertion module, and a sending module; the control device includes a receiving module, an analysis module, and a processing module. The present invention can uniquely identify the user link in the multi-service mode by configuring the logical interface on the BNG device, so that according to the security control policy of the pre-configured logical interface, the identification information of the user link can be used to realize the security of a single user link. Implement security control strategies such as access control, bandwidth control, and multicast control.

Description

A method, system and device for user access security control

technical field

The present invention relates to the communication field, in particular to a method, system and equipment for user access security control.

Background technique

With the development of broadband access technology, great changes have taken place in network access methods and access technologies. The network has also developed from a traditional network that only provides Internet access services to a network that bears multiple services. Referring to Fig. 1 , it is a schematic diagram of a network of broadband access technology provided by the prior art, wherein, users such as TV set-top boxes, VoIP (Voice over Internet Protocol, network telephone) terminals, PCs connected to the Internet, mobile phone terminals, and handheld multimedia terminals Complete unified access through RG (Residential Gateway, home gateway equipment), RG through telephone twisted pair or through ADSL (Asymmetric Digital Subscriber Line, asynchronous digital subscriber line) / VDSL (Very-high-data-rate Digital Subscriber Line, High-speed digital subscriber line) and other technologies are connected to DSLAM (Digital Subscriber Line Access Multiplexer, digital subscriber line access equipment), in which DSLAM is a layer 2 device, used to complete the aggregation of user access links and realize xDSL (ADSL /VDSL) and uplink Ethernet link conversion; then the DSLAM is connected to BNG (Broadband Network Gateway, broadband network gateway) through the access network, where BNG can be BRAS (Broadband Remote Access Server, broadband remote access service equipment) , or it can be a router dedicated to providing services. In the network, BNG is used to realize the access of PPPoE (PPP over Ethernet, the PPP protocol carried on Ethernet), usually to realize the business of PC accessing the Internet; it is used to realize DHCP ( Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol) access, usually to realize the access management of TV set-top boxes, VoIP terminals, etc.; Internet access service provider) provides different service data traffic distribution to corresponding users, and the services provided by ASP/ISP include IPTV, Internet access, VoIP, etc. The network also includes policy servers, gateway servers, etc. that implement user/service management by delivering control policies to each gateway device in the network.

It can be seen that the BNG is the core node in the network that handles functions such as user access management, service distribution, and service policy implementation.

Referring to FIG. 2 , it is a schematic diagram of user service access mapping provided in the prior art. After different user services are accessed through the RG, they are connected to the DSLAM through different VCs (Virtual Circuits). Among them, TV set-top box services are accessed through VC1, VoIP services are accessed through VC2, and PC services are accessed through VC3. When the DSLAM completes the mapping from VC to VLAN, the prior art provides two mapping models:

1) N∶1 model: the same service type is mapped to the same S-VLAN, that is, on one DSLAM, when the traffic of the same service type of all users reaches the BNG, the BNG passes through the same S-VLAN. identified.

2) 1:1 model: DSLAM assigns a unique combination of S-VLAN+C-VLAN for each service type. Generally, S-VLAN is used to identify services, and C-VLAN is used to identify users. That is, on one DSLAM, the user’s When the data packets of each service type arrive at the BNG, the BNG is uniquely determined through the combination of S-VLAN+C-VLAN.

The inventor finds in the process of realizing the present invention that there are at least the following disadvantages and deficiencies in the prior art:

The user link identified by the BNG is implemented through VLAN/QinQ, and security control is also performed at the granularity of VLAN/QinQ. In multi-service mode, the BNG cannot uniquely identify the user link through VLAN/QinQ, and thus It is impossible to implement security control on individual user links.

Contents of the invention

In order to enable the BNG to implement security control on a single user link, embodiments of the present invention provide a method, system and device for user access security control. Described technical scheme is as follows:

An embodiment of the present invention provides a method for user access security control, the method comprising:

receiving an access request message, where the access request message carries a user link identifier;

Analyzing the access request message to obtain the user link identifier;

judging whether the access request message satisfies a preset access condition according to the user link identifier;

If yes, allow the user corresponding to the user link identifier to access.

The embodiment of the present invention also provides a system for user access security control, the system includes:

A user node, configured to send an access request message;

The access device is configured to receive the access request message sent by the user node, insert the user link identifier into the access request message sent by the user node, and send the access request message inserted with the user link identifier ;

The control device is configured to analyze and obtain the user link identifier after receiving the access request message inserted into the user link identifier sent by the access device; judge the access request according to the user link identifier Whether the packet satisfies the preset access condition, and if so, allowing the user node corresponding to the user link identifier to access.

The embodiment of the present invention also provides an access device, and the device includes:

A receiving module, configured to receive an access request message sent by a user node;

An identification inserting module, configured to insert a user link identification into the access request message received by the receiving module;

A sending module, configured to send the access request message after the user link identifier is inserted by the identifier inserting module.

The embodiment of the present invention also provides a control device, the device includes:

A receiving module, configured to receive an access request message sent by an access device, where the access request message carries a user link identifier;

A parsing module, configured to parse the access request message received by the receiving module to obtain the user link identifier;

A processing module, configured to judge whether the access request message satisfies a preset access condition according to the user link identifier parsed by the parsing module, and if so, allow the user corresponding to the user link identifier to access.

The beneficial effects of the technical solution provided by the embodiments of the present invention are:

By configuring the logical interface on the BNG device, the user link can be uniquely identified in the multi-service mode, thereby implementing security control on a single user link based on the user link identification information on the pre-configured logical interface.

Description of drawings

FIG. 1 is a schematic diagram of a broadband access technology provided by the prior art;

FIG. 2 is a schematic diagram of user service access mapping provided by the prior art;

FIG. 3 is a flowchart of a method for user access security control provided by Embodiment 1 of the present invention;

FIG. 4 is a flowchart of a method for user access security control provided by Embodiment 2 of the present invention;

FIG. 5 is a flowchart of a method for user access security control provided by Embodiment 3 of the present invention;

FIG. 6 is a schematic diagram of a system for user access security control provided by Embodiment 4 of the present invention;

FIG. 7 is a schematic diagram of an access device provided in Embodiment 5 of the present invention;

Fig. 8 is a schematic diagram of a control device provided by Embodiment 6 of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the implementation manner of the present invention will be further described in detail below in conjunction with the accompanying drawings.

In the technical solution provided by the embodiment of the present invention, the BNG can uniquely identify user link identification information in a multi-service mode, and then implement security control on a single user link. Wherein, the method includes receiving an access request message, where the access request message carries a user link identifier; parsing the access request message to obtain the user link identifier; judging whether the access request message satisfies the preset connection identifier according to the user link identifier The entry condition; if yes, allow the user corresponding to the user link identifier to access.

The technical solution provided by the embodiment of the present invention will be described in detail below according to the configured specific security control strategy:

Example 1

Referring to Fig. 3, an embodiment of the present invention provides a method for user access security control, the steps are as follows:

Step 101: the BNG obtains the user link identifier.

When BNG obtains user link identification information, it can implement the following two methods:

1) Use the administrator to manually configure the device information of the DSLAM on the BNG through the command line. The device information of the DSLAM specifically includes: the frame number, slot number and port number of the device, wherein the DSLAM can uniquely determine a user link to access the DSLAM through the frame number + slot number + port number. The reference command line format is as follows:

access-loop-circuit-identifier dslaml-atm-frame-slot/port:[vpi.vci].

Among them, access-loop-circuit-identifier is a command word, indicating that a user link identifier needs to be configured on the BNG, followed by a string corresponding to each identifier, among which, the dslaml identifier indicates the name of a certain DSLAM node, and atm indicates the RG and DSLAM chain The road layer is ATM, frame is the frame number of DSLAM, slot is the slot number in DSLAM, port is the port number of DSLAM, vpi.vci is optional PVC (Permanent Virtual Circuit, permanent virtual circuit) information.

2) Realized by using the link information reporting function provided by the ANCP protocol. The ANCP protocol uses TCP as the transport layer protocol to provide a channel for the transmission of control information between the BNG and DSLAM. When the user starts the RG and activates the user link, the DSLAM will report the user link information of the user to the BNG, wherein the user link information includes user link status, user link identifier, and related user link parameters. The ANCP protocol is defined as follows:

Type(Access-Loop-Circuit-ID=Ox01), the maximum length is 64, and the default format of the protocol is:

access-Node-Identifier atm slot/port[:vlan-id]

Step 102: The BNG creates a corresponding logical link identifier for the user link identifier according to the acquired user link identifier.

Wherein, the logical link identifier may specifically be a user link identifier, or may be a logical interface created according to the user link identifier. The embodiment of the present invention uses the logical link identifier as a logical interface as an example for illustration. The logical interface created by the BNG corresponds uniquely to the user link ID. When creating an interface, refer to the command line as follows:

interface user-line dslaml-atm-frame-slot/port:[vpi.vci]

After the logical interface is created by BNG, the security control policy can be implemented on the created logical interface.

Step 103: User X initiates an access request through DHCP, that is, sends a DHCP access request message.

Among them, the user usually initiates an access request through the DHCP protocol or the PPPoE protocol according to the different types of services. When a user requests to access the IPTV service or a VoIP phone terminal user requests to access the VoIP service, an access request will be initiated through the DHCP protocol. In this embodiment, user X initiates an access request through DHCP as an example for illustration, but the type of the access request is not limited.

Step 104: the DSLAM receives the DHCP access request message sent by user X, inserts the user link identifier in the received DHCP access request message, and forwards the DHCP access request message inserted into the user link identifier to BNG.

Wherein, due to the characteristics of the DHCP protocol itself, there is an Agent-Circuit-ID option in the message, which is used to indicate the identifier of the circuit accessed by the user. When receiving the DHCP access request message sent by user X, the DSLAM knows which frame, notch and port of the access request message is received by itself, and accordingly inserts the corresponding user link identifier, where The format of the user link ID must be consistent with the format of the user link ID preset by the BNG.

Step 105: BNG receives the DHCP access request message carrying the user link identifier sent by the DSLAM, and judges whether the corresponding logical interface can be found according to the user link identifier carried in the DHCP access request message. Step 106, otherwise, go to step 107.

Step 106: BNG creates a user access entry bound to the logical interface, saves the information of user X, and executes step 108.

Wherein, the information of user X and the corresponding logical interface identifier can be stored in the user access table, and the information of user X includes MAC (Media Access Control, media access control) address, IP address, authentication, billing, etc. of user X information.

Step 107: BNG discards the received access request message, prohibits user X from accessing, and ends.

Step 108: The BNG returns a DHCP response message to the DSLAM, and the DHCP response message carries user link identification information.

Step 109: DSLAM receives the DHCP response message returned by the BNG, deletes the user link identification information carried in the DHCP response message, and forwards the DHCP response message with the user link identification information deleted to user X.

Step 110: After the DCHP negotiation is completed, user X successfully accesses the BNG, and ends.

After the user accesses the BNG device, further security control can be performed on the user. For example:

1) When it is necessary to implement bandwidth control on user X, the BNG can also configure bandwidth parameters for the created logical interface, where the bandwidth parameters specifically include bandwidth parameters in the uplink direction and bandwidth parameters in the downlink direction.

When user X successfully accesses BNG, user X sends a data message, which carries information such as the user's MAC address and IP address, and BNG searches for the user according to the user's MAC address and IP address carried in the received data message. Access the table, find the corresponding logical interface, and control the bandwidth of the data packet according to the uplink bandwidth parameters configured on the logical interface; When sending a message, search the user access table according to the user MAC address carried in the data message, find the corresponding logical interface, and perform the data message sent to user X according to the bandwidth parameters in the downlink direction configured on the logical interface. Bandwidth control.

2) When access control needs to be implemented for user X, that is, traffic control is performed, and the traffic-policy command can also be used to configure access control policies on the BNG logical interface.

When user X successfully accesses BNG, user X sends a data message, which carries information such as the user's MAC address and IP address, and BNG searches for the user according to the user's MAC address and IP address carried in the received data message. Access the table, find the logical interface corresponding to user X, and control the flow of data packets sent by user X according to the access control policy configured on the logical interface; When X sends a data packet, it searches the user access table according to the MAC address of user X carried in the data packet, finds the logical interface corresponding to user X, and the next hop address of the data packet is the corresponding According to the access control policy configured on the logical interface, flow control is performed on the data packets sent to user X through the BNG.

3) When user X requests IGMP (Internet Group Management Protocol, Internet Group Management Protocol) order and wants to join the multicast group, further, BNG can also configure the multicast control policy on the logical interface, that is, configure the multicast control list.

When user X successfully accesses BNG, user X sends an IGMP packet request, which carries the user MAC address; after receiving the IGMP packet request sent by user X, BNG searches the user access table according to the MAC address, and finds The logical interface corresponding to user X judges whether user X is allowed to join the multicast group according to the multicast control list configured on the logical interface. Send multicast data traffic; otherwise, discard user X's request to send IGMP packets.

The method provided by the embodiment of the present invention can uniquely identify the user link in the multi-service mode by configuring the logical interface on the BNG device, so as to implement the security control strategy configured on the logical interface, according to the identification information of the user link. A single user link implements security controls such as access control, bandwidth control, flow control, and multicast control.

Example 2

Referring to Figure 4, an embodiment of the present invention provides a method for user access security control, the steps are as follows:

Step 201: the BNG obtains the user link identifier.

Step 202: The BNG creates a corresponding logical link identifier for the user link identifier information according to the obtained user link identifier.

Wherein, the embodiment of the present invention is described by taking a logical link identifier as a logical interface as an example.

Step 203: BNG limits the number of IP Sessions of users on the logical interface, that is, the upper limit of IP Sessions of preset users.

Step 204: User X initiates an access request through DHCP, that is, sends a DHCP access request message.

Step 205: DSLAM receives the DHCP access request message sent by user X, inserts the user link identifier into the received DHCP access request message, and forwards the DHCP access request message inserted after the user link identifier to the BNG .

Step 206: BNG receives the DHCP access request message carrying the user link identifier sent by the DSLAM, and judges whether the corresponding logical interface can be found according to the user link identifier carried in the access request message. 207, otherwise, go to step 208.

Step 207: judge whether the number of IP Sessions of user X is less than the upper limit of the IPSessions of preset users found on the logical interface, if yes, then execute step 209, otherwise execute step 208.

Step 208: BNG discards the received access request message, prohibits user X from accessing, and ends.

Step 209: The BNG creates a user access entry bound to the logical interface, saves the information of user X; and returns a response message to the DSLAM, the response message carrying the user link identifier.

Step 210: The DSLAM receives the DHCP response message returned by the BNG, deletes the user link identifier carried in the message, and forwards the DHCP response message with the user link identifier deleted to user X.

Step 211: After the DHCP negotiation is completed, user X successfully accesses the BNG; the BNG device adds 1 to the recorded number of IP sessions of the user, and ends.

After the user accesses the BNG device, further security control can be performed on the accessing user. For example:

1) When it is necessary to implement bandwidth control on user X, the BNG can also configure bandwidth parameters for the created logical interface, where the bandwidth parameters specifically include bandwidth parameters in the uplink direction and bandwidth parameters in the downlink direction.

When user X successfully accesses BNG, user X sends a data message, which carries information such as the user's MAC address and IP address, and BNG searches for the user according to the user's MAC address and IP address carried in the received data message. Access the table, find the corresponding logical interface, and control the bandwidth of the data packet according to the uplink bandwidth parameters configured on the logical interface; When sending a message, search the user access table according to the user MAC address carried in the data message, find the corresponding logical interface, and perform the data message sent to user X according to the bandwidth parameters in the downlink direction configured on the logical interface. Bandwidth control.

2) When access control needs to be implemented for user X, that is, traffic control is performed, and access control policies can also be configured on the BNG logical interface by using commands such as traffic-policy.

When user X successfully accesses BNG, user X sends a data message, which carries information such as the user's MAC address and IP address, and BNG searches for the user according to the user's MAC address and IP address carried in the received data message. Access the table, find the logical interface corresponding to user X, and control the flow of data packets sent by user X according to the access control policy configured on the logical interface; When X sends a data packet, it searches the user access table according to the MAC address of user X carried in the data packet, finds the logical interface corresponding to user X, and the next hop address of the data packet is the corresponding According to the access control policy configured on the logical interface, flow control is performed on the data packets sent to user X through the BNG.

3) When user X requests IGMP (Internet Group Management Protocol, Internet Group Management Protocol) order and wants to join the multicast group, further, BNG can also configure the multicast control policy on the logical interface, that is, configure the multicast control list.

When user X successfully accesses BNG, user X sends an IGMP packet request, which carries the user MAC address; after receiving the IGMP packet request sent by user X, BNG searches the user access table according to the MAC address, and finds The logical interface corresponding to user X judges whether user X is allowed to join the multicast group according to the multicast control list configured on the logical interface. Send multicast data traffic; otherwise, discard user X's request to send IGMP packets.

The method provided by the embodiment of the present invention can uniquely identify the user link in the multi-service mode by configuring the logical interface on the BNG device, so as to implement the security control strategy configured on the logical interface, according to the identification information of the user link. A single user link implements security controls such as access control, bandwidth control, flow control, and multicast control.

Example 3

Referring to Figure 5, an embodiment of the present invention provides a method for user access security control, the steps are as follows:

Step 301: the BNG obtains the user link identifier.

Step 302: The BNG creates a corresponding logical link identifier for the user link identifier according to the acquired user link identifier.

Wherein, the embodiment of the present invention is described by taking a logical link identifier as a logical interface as an example.

Step 303: BNG configures different user types on the logical interface through different keywords. The reference command line is as follows:

[BNG]terminal-type voip dhcp-option-60 include VoIP

Step 304: User X initiates an access request through DHCP, that is, sends a DHCP access request message.

Wherein, user X initiates an access request through DHCP, for example, the keyword carried in the DHCP access request is VoIP-ISP-1, indicating that user X is a VoIP terminal of ISP-1.

Through steps 302 and 303, users and BNG simultaneously define keywords of different types of users.

Step 305: The DSLAM receives the DHCP access request message sent by user X, inserts the user link identifier into the received DHCP access request message, and forwards the DHCP access request message inserted into the user link identifier to the BNG .

Step 306: BNG receives the DHCP access request message carrying the user link identification information sent by the DSLAM, and judges whether the corresponding logical interface can be found according to the user link identification carried in the DHCP access request message, if yes Execute step 307, otherwise, execute step 308.

Step 307: The BNG judges whether the keyword carried in the DHCP access request message of user X matches the keyword configured on the logical interface, if yes, execute step 309, otherwise execute step 308.

Step 308: BNG discards the received access request message, prohibits user X from accessing, and ends.

Step 309: BNG creates a user access entry bound to the logical interface, saves the information of user X; and returns a DHCP response message to the DSLAM, and the DHCP response message carries the user link identifier.

Step 310: The DSLAM receives the DHCP response message returned by the BNG, deletes the user link identifier carried in the message, and forwards the response message with the user link identifier deleted to user X.

Step 311: After the DHCP negotiation is completed, user X successfully accesses the BNG, and ends.

After the user accesses the BNG device, further security control can be performed on the accessing user. For example:

1) When it is necessary to implement bandwidth control on user X, the BNG can also configure bandwidth parameters for the created logical interface, where the bandwidth parameters specifically include bandwidth parameters in the uplink direction and bandwidth parameters in the downlink direction.

When user X successfully accesses BNG, user X sends a data message, which carries information such as the user's MAC address and IP address, and BNG searches for the user according to the user's MAC address and IP address carried in the received data message. Access the table, find the corresponding logical interface, and control the bandwidth of the data packet according to the uplink bandwidth parameters configured on the logical interface; When sending a message, search the user access table according to the user MAC address carried in the data message, find the corresponding logical interface, and perform the data message sent to user X according to the bandwidth parameters in the downlink direction configured on the logical interface. Bandwidth control.

2) When access control needs to be implemented for user X, that is, traffic control is performed, and access control policies can also be configured on the BNG logical interface by using commands such as traffic-policy.

When user X successfully accesses BNG, user X sends a data message, which carries information such as the user's MAC address and IP address, and BNG searches for the user according to the user's MAC address and IP address carried in the received data message. Access the table, find the logical interface corresponding to user X, and control the flow of data packets sent by user X according to the access control policy configured on the logical interface; When X sends a data packet, it searches the user access table according to the MAC address of user X carried in the data packet, finds the logical interface corresponding to user X, and the next hop address of the data packet is the corresponding According to the access control policy configured on the logical interface, flow control is performed on the data packets sent to user X through the BNG.

3) When user X requests IGMP (Internet Group Management Protocol, Internet Group Management Protocol) order and wants to join the multicast group, further, BNG can also configure the multicast control policy on the logical interface, that is, configure the multicast control list.

When user X successfully accesses BNG, user X sends an IGMP packet request, which carries the user MAC address; after receiving the IGMP packet request sent by user X, BNG searches the user access table according to the MAC address, and finds The logical interface corresponding to user X judges whether user X is allowed to join the multicast group according to the multicast control list configured on the logical interface. Send multicast data traffic; otherwise, discard user X's request to send IGMP packets.

The method provided by the embodiment of the present invention can uniquely identify the user link in the multi-service mode by configuring the logical interface on the BNG device, so as to implement the security control strategy configured on the logical interface, according to the identification information of the user link. A single user link implements security controls such as access control, bandwidth control, flow control, and multicast control.

Creating a logical interface in the above-mentioned embodiments of the present invention is only one way of implementation. Any security control such as access control, flow control, bandwidth control, and multicast control implemented on a BNG or similar device based on a logical link identifier is all Within the protection scope of the present invention.

Example 4

Referring to Figure 6, an embodiment of the present invention provides a system for user access security control, the system includes:

A user node, configured to send an access request message;

The access device is configured to receive the access request message sent by the user node, insert the user link identifier into the access request message sent by the user node, and send the access request message inserted with the user link identifier;

The control device is configured to analyze and obtain the user link identifier after receiving the access request message inserted into the user link identifier sent by the access device; judge whether the access request message meets the preset access requirements according to the user link identifier The condition, if yes, allows the user node corresponding to the user link identifier to access.

Among them, the control equipment includes:

A receiving module, configured to receive an access request message sent by the access device;

The parsing module is used to parse the access request message received by the receiving module to obtain the user link identifier;

A judging module, configured to judge whether the logical link identifier corresponding to the user link identifier can be found according to the user link identifier parsed by the parsing module;

The processing module allows the user node corresponding to the user link identifier to access when the judging result of the judging module is that the logical link identifier corresponding to the user link identifier can be found.

Among them, the control equipment includes:

A receiving module, configured to receive an access request message sent by the access device;

The parsing module is used to parse the access request message received by the receiving module to obtain the user link identifier;

The search module is used to search for the logical link identifier corresponding to the user link identifier according to the analysis module to obtain the user link identifier;

A judging module, configured to judge whether the number of user sessions accessed by the logical link identifier found by the searching module reaches a preset threshold;

The processing module is used to allow the user node corresponding to the user link identifier to access when the judging result of the judging module is that the number of user sessions that have been accessed does not reach the preset threshold, and add the number of user sessions that have been accessed to 1.

Among them, the control equipment includes:

A receiving module, configured to receive an access request message sent by the access device;

The parsing module is used to parse the access request message received by the receiving module to obtain the user link identifier;

The search module is used to search for the logical link identifier corresponding to the user link identifier according to the analysis module to obtain the user link identifier;

A judgment module, configured to judge whether the user type carried in the access request message is consistent with the preset user type on the logical link identifier found by the search module;

The processing module is configured to allow the user node corresponding to the user link identifier when the judgment result of the judgment module is that the user type carried in the access request message is consistent with the preset user type on the logical link identifier found by the search module access.

The system provided by the embodiment of the present invention can uniquely identify the user link in the multi-service mode by configuring the logical link identifier on the control device, so as to realize the security control strategy corresponding to the pre-configured logical link identifier, according to User link identification information implements security control strategies such as access control, bandwidth control, flow control, and multicast control for a single user link.

Example 5

Referring to Figure 7, an embodiment of the present invention provides an access device, which includes:

A receiving module, configured to receive an access request message sent by a user node;

An identification inserting module, configured to insert the user link identification into the access request message received by the receiving module;

The sending module is configured to send the access request message after the user link identifier is inserted by the identifier inserting module.

The access device provided by the embodiment of the present invention can receive the access request message sent by the user node, insert the user link identifier into the received access request message, and send the access device with the user link identifier inserted. request message. Wherein, the device may also insert other information, such as user type, into the received access request message.

Example 6

Referring to Figure 8, an embodiment of the present invention provides a control device, which includes:

The receiving module is used to receive the access request message sent by the access device, and the access request message carries the user link identifier;

The parsing module is used to parse the access request message received by the receiving module to obtain the user link identifier;

The processing module is configured to judge whether the access request message satisfies the preset access condition according to the user link identifier parsed by the parsing module, and if so, allow the user corresponding to the user link identifier to access.

Among them, the processing module includes:

A judging unit, configured to judge whether the logical link identifier corresponding to the user link identifier can be found according to the user link identifier parsed by the parsing module;

The processing unit is configured to allow the user corresponding to the user link identifier to access when the judgment result of the judging unit is that the logical link identifier corresponding to the user link identifier can be found.

Among them, the processing module includes:

A search unit, configured to search for a logical link identifier corresponding to the user link identifier according to the user link identifier analyzed by the parsing module;

A judging unit, configured to judge whether the number of user sessions accessed by the logical link identifier found by the searching unit reaches a preset threshold;

A processing unit, configured to allow the user corresponding to the user link identifier to access when the judgment result of the judging unit is that the number of user sessions that have been accessed does not reach the preset threshold, and add 1 to the number of user sessions that have been accessed .

Among them, the processing module includes:

A search unit, configured to search for a logical link identifier corresponding to the user link identifier according to the user link identifier analyzed by the parsing module;

A judging unit, configured to judge whether the user type carried in the access request message is consistent with the preset user type on the logical link identifier found by the search unit;

A processing unit, configured to allow the user corresponding to the user link identifier to access when the judgment result of the judging unit is that the user type carried in the access request message is consistent with the user type preset on the logical link identifier found by the search unit. enter.

After the user accesses the control device, it can further perform security control on the accessed user. At this time, the control device also includes:

A recording module, configured to record the user's media access control address, IP address, user link identifier, and logical link identifier on the user interface according to the access request message when the processing module allows the user corresponding to the user link identifier to access into the table;

The configuration module is configured to configure a control strategy for the logical link ID according to the logical link ID recorded in the user access table by the recording module.

The first control module is configured to search for the corresponding logical link identifier in the user access table of the recording module according to the media access control address and IP address carried in the data message when receiving the data message sent by the user, according to The control strategy corresponding to the found logical link identifier controls the data message;

The second control module is configured to search for the corresponding logical link identifier in the recording module according to the media access control address carried in the data message sent to the user when receiving the data message sent to the user, and according to the found The control strategy corresponding to the logical link identifier controls the data packets sent to the user.

The control strategy configured by the above configuration module may be an access control strategy or/and a bandwidth control strategy, and accordingly, flow control or/bandwidth control of data packets may be performed. The embodiment of the present invention does not limit the type of control strategy configured by the configuration module.

When user X requests IGMP VOD and wants to join a multicast group, the control device also includes:

A recording module, configured to record the user's media access control address, IP address, user link identifier, and logical link identifier on the user interface according to the access request message when the processing module allows the user corresponding to the user link identifier to access into the table;

The configuration module is configured to configure a multicast control strategy for the logical link identifier according to the logical link identifier recorded by the recording module.

The multicast control module is configured to record the media access control address in the user access table of the recording module according to the media access control address carried in the network group management protocol message when receiving the network group management protocol message sent by the user to request to join the multicast group Find the corresponding logical link ID, and judge whether to allow the user to join the multicast group according to the multicast control strategy corresponding to the found logical link ID, and if so, allow the user to join the multicast group.

According to the embodiment of the present invention, by configuring the logical link identifier on the control device, the user link can be uniquely identified in the multi-service mode, so as to realize the corresponding security control strategy through the pre-configured logical link identifier, according to the user Link identification information implements security control strategies such as access control, bandwidth control, flow control, and multicast control for a single user link.

The technical solution provided by the above-mentioned embodiments of the present invention can uniquely identify the user link in the multi-service mode by configuring the logical link identifier on the BNG and other similar control devices, so as to realize the pre-configured logical link identifier corresponding to the The security control strategy implements security control strategies such as access control, bandwidth control, flow control, and multicast control for a single user link according to the user link identification information.

Part of the steps in the embodiments of the present invention can be realized by software, and the corresponding software program can be stored in a readable storage medium, such as an optical disk or a hard disk.

The above are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (18)

1. the method for user's access security control is characterized in that described method comprises:

Receive and insert request message, described access request message carries the user link sign;

Resolve described access request message and obtain described user link sign;

Judge according to described user link sign whether described access request message satisfies default access conditions;

If allow the corresponding user of described user link sign to insert.

2. the method for user's access security as claimed in claim 1 control is characterized in that, describedly judges according to described user link sign whether described access request message satisfies the step of presetting access conditions and comprise:

Judge whether to find the corresponding LLID of described user link sign;

If satisfy default access conditions.

3. the method for user's access security as claimed in claim 1 control is characterized in that, describedly judges according to described user link sign whether described access request message satisfies the step of presetting access conditions and comprise:

Search the corresponding LLID of described user link sign;

Check whether the number of user sessions that described LLID has inserted reaches default thresholding,, then satisfy default access conditions if do not reach described default thresholding;

Correspondingly, also comprise after the step that the corresponding user of the described user link sign of described permission inserts:

The described number of user sessions that has inserted is added 1.

4. the method for user's access security control as claimed in claim 1 is characterized in that, also carries user type in the described access request message;

Correspondingly, describedly judge according to described user link sign whether described access request message satisfies the step of presetting access conditions and comprise:

Search the corresponding LLID of described user link sign;

Judge that the user type of carrying in the described access request message is whether consistent with the default user type of described LLID, if satisfy default access conditions.

5. the method for user's access security control as claimed in claim 1 is characterized in that, also comprises after the step that the corresponding user of the described user link sign of described permission inserts:

According to described access request message user's media access control address, IP address, user link sign and LLID are recorded in user's access table, for the user of described LLID correspondence disposes control strategy;

When receiving the data message of user's transmission, in described user's access table, search corresponding LLID according to media access control address that carries in the described data message and IP address, according to the control strategy of the LLID correspondence that finds, described data message is controlled;

When receiving to when mailing to described user's data message, in described user's access table, search corresponding LLID according to the described media access control address that carries in the described user's data message that mails to, according to the control strategy of the LLID correspondence that finds, mail to described user's data message and control described.

6. the method for user's access security control as claimed in claim 5 is characterized in that described control strategy is specially:

Access control policy is or/and the bandwidth control strategy.

7. the method for user's access security control as claimed in claim 1 is characterized in that, also comprises after the step that the corresponding user of the described user link sign of described permission inserts:

According to described access request message user's media access control address, IP address, user link sign and LLID are recorded in user's access table, for the user of described LLID correspondence disposes the multicast control strategy;

When the request that receives user's transmission adds the group of networks management agreement message of multicast group, in described user's access table, search corresponding LLID according to the media access control address that carries in the described group of networks management agreement message, multicast control strategy according to the LLID correspondence that finds, judge whether to allow described user to add multicast group, if allow described user to add multicast group.

8. the system of user's access security control is characterized in that described system comprises:

User node is used for sending the access request message;

Access device is used to receive the access request message that described user node sends, and inserts the user link sign in the access request message that described user node sends, and sends the access request message that inserts the user link sign;

Control appliance, be used to receive the access request message of the insertion user link sign that described access device sends after, resolve and obtain described user link sign; Judge according to described user link sign whether described access request message satisfies default access conditions, if allow the corresponding described user node of described user link sign to insert.

9. the system of user's access security control as claimed in claim 8 is characterized in that described control appliance comprises:

Receiver module is used to receive the access request message that described access device sends;

Parsing module is used to resolve the access request message that described receiver module receives and obtains described user link sign;

Judge module is used for resolving the user link sign that obtains according to described parsing module and judges whether to find the corresponding LLID of described user link sign;

Processing module, the result who judges when described judge module is in the time of can finding the LLID of described user link sign correspondence, allows the corresponding user node of described user link sign to insert.

10. the system of user's access security control as claimed in claim 8 is characterized in that described control appliance comprises:

Receiver module is used to receive the access request message that described access device sends;

Parsing module is used to resolve the access request message that described receiver module receives and obtains described user link sign;

Search module, be used for obtaining the user link sign and search the corresponding LLID of described user link sign according to described parsing module parsing;

Judge module, be used to judge described search module searches to the number of user sessions that inserted of LLID whether reach default thresholding;

Processing module, be used for when result that described judge module is judged be that the described number of user sessions that has inserted is not when reaching described default thresholding, allow the corresponding described user node of described user link sign to insert, and the described number of user sessions that has inserted is added 1.

11. the system of user's access security control as claimed in claim 8 is characterized in that described control appliance comprises:

Receiver module is used to receive the access request message that described access device sends;

Parsing module is used to resolve the access request message that described receiver module receives and obtains described user link sign;

Search module, be used for obtaining the user link sign and search the corresponding LLID of described user link sign according to described parsing module parsing;

Judge module, be used for judging user type that described access request message carries whether with described search module searches to LLID on default user type consistent;

Processing module, be used for when result that described judge module is judged be the described access request message user type of carrying with described search module searches to LLID on default user type when consistent, allow the corresponding described user node access of described user link sign.

12. an access device is characterized in that, described equipment comprises:

Receiver module is used to receive the access request message that user node sends;

The sign insert module, the access request message that is used for receiving at described receiver module inserts the user link sign;

Sending module is used to send the access request message after described sign insert module is inserted the user link sign.

13. a control appliance is characterized in that, described equipment comprises:

Receiver module is used to receive the access request message that access device sends, and carries the user link sign in the described access request message;

Parsing module is used to resolve the access request message that described receiver module receives and obtains described user link sign;

Processing module is used for resolving the user link sign that obtains according to described parsing module and judges whether described access request message satisfies default access conditions, if allow the corresponding user of described user link sign to insert.

14. control appliance as claimed in claim 13 is characterized in that, described processing module comprises:

Judging unit is used for resolving the user link sign that obtains according to described parsing module and judges whether to find the corresponding LLID of described user link sign;

Processing unit, the result who is used for when described judgment unit judges is in the time of can finding the LLID of described user link sign correspondence, allows the corresponding user of described user link sign to insert.

15. control appliance as claimed in claim 13 is characterized in that, described processing module comprises:

Search the unit, be used for obtaining the user link sign and search the corresponding LLID of described user link sign according to described parsing module parsing;

Judging unit is used to judge and describedly searches the number of user sessions that LLID that the unit finds inserted and whether reach default thresholding;

Processing unit when being used for result when described judgment unit judges and being the described number of user sessions that has inserted and not reaching described default thresholding, allows the corresponding user of described user link sign to insert, and the described number of user sessions that has inserted is added 1.

16. control appliance as claimed in claim 13 is characterized in that, described processing module comprises:

Search the unit, be used for obtaining the user link sign and search the corresponding LLID of described user link sign according to described parsing module parsing;

Judging unit is used for judging that user type that described access request message carries is whether consistent with described default user type of searching on the LLID that the unit finds;

Processing unit, be used for result when described judgment unit judges and be user type that described access request message carries and search user type default on the LLID that the unit finds when consistent, allow the corresponding user's access of described user link sign with described.

17. control appliance as claimed in claim 13 is characterized in that, described equipment also comprises:

Logging modle, be used for when described processing module allows the corresponding user of described user link sign to insert, be recorded in user's access table according to media access control address, IP address, user link sign and the LLID of described access request message with the user;

Configuration module, being used for according to the LLID that described logging modle writes down at described user's access table is described LLID configuration control strategy.

First control module, be used for when receiving the data message of user's transmission, in user's access table of described logging modle, search corresponding LLID according to media access control address that carries in the described data message and IP address, according to the control strategy of the LLID correspondence that finds, described data message is controlled;

Second control module, be used for when receiving when mailing to described user's data message, according in described logging modle, searching corresponding LLID to the described media access control address that carries in the described user's data message that mails to, according to the control strategy of the LLID correspondence that finds, mail to described user's data message and control described.

18. control appliance as claimed in claim 13 is characterized in that, described equipment also comprises:

Logging modle, be used for when described processing module allows the corresponding user of described user link sign to insert, be recorded in user's access table according to media access control address, IP address, user link sign and the LLID of described access request message with the user;

Configuration module, the LLID that is used for according to described logging modle record is described LLID configuration multicast control strategy.

The multicast control module, be used for when the request that receives user's transmission adds the group of networks management agreement message of multicast group, in user's access table of described logging modle, search corresponding LLID according to the media access control address that carries in the described group of networks management agreement message, multicast control strategy according to the LLID correspondence that finds, judge whether to allow described user to add multicast group, if allow described user to add multicast group.

Images