CN101257420A - A point-to-point protocol access method, system and access node device - Google Patents

Abstract

The present invention relates to the field of access technology, and provides a point-to-point protocol access method, system and access node equipment. The access method includes: the access node equipment receives a point-to-point protocol access message from a user, and judges that the point-to-point protocol access Whether the message is a protocol message or a data message; when the point-to-point protocol access message is a protocol message, the protocol message is sent to the access controller, and the access controller The user performs access management. If the access controller allows the user to access, the access node device establishes and maintains a data forwarding table; when the point-to-point protocol access message is a data message, the access node device The data forwarding table forwards the data message. The technical solution provided by the invention realizes the separation of control and bearer in point-to-point protocol access, which is beneficial to network expansion and upgrade.

Description

A point-to-point protocol access method, system and access node device

technical field

The present invention relates to the technical field of broadband access networks, in particular to a point-to-point protocol (PPP, Point to Point Protocol) access method, system and access node equipment.

Background technique

The PPP protocol is a data link layer protocol in the TCP/IP protocol stack, providing a standard way to transmit datagrams of multiple network layer protocols on a point-to-point link. The PPP protocol supports network control protocols (NCP, Network Control Protocol) at different network levels, such as Internet Protocol Control Protocol (IPCP, Internet Protocol Control Protocol) and Internet Data Packet Exchange Control Protocol (IPXCP, Internet work Packet Exchange Control Protocol), Link Control Protocol (LCP, LinkControl Protocol) and authentication family protocols such as Challenge Handshake Authentication Protocol (CHAP, ChallengeHandshake Authentication Protocol), Password Authentication Protocol (PAP, PasswordAuthentication Protocol). Among them, NCP is mainly used to negotiate the format and type of data packets transmitted on the link. LCP is mainly used to establish, tear down and monitor PPP data links. PPP connection ensures network security. Figure 1 shows the frame format of the PPP protocol. Among them, the protocol field is used to identify the protocol type encapsulated in the information field field. At present, the main types of protocols used are LCP, NCP and ordinary IP protocols, and their corresponding protocol fields The fields are 0xC021, 0x8021, and 0x0021 respectively, and the following information contains different message contents according to different protocols.

With the development of network technology, broadband access has become a dominant user access method. Common broadband access methods include asymmetrical digital subscriber loop (ADSL, Asymmetrical Digital Subscriber Loop), very high-speed digital subscriber loop (VDSL, Very-high-bit-rate Digital Subscriber Loop), Ethernet, passive optical network (PON , Passive Optical Network). According to the operator's operation needs, these access methods require broadband dial-up and authentication processes. The current main ways of broadband dial-up and authentication include ATM (Asynchronous Transfer Mode) carrying PPP (PPPoA, PPP over ATM), and Ethernet carrying PPP (PPPoE, PPP over Ethernet). Among them, PPPoA is PPP based on ATM Adaptation Layer 5 (ATMAAL5, ATM Adaptation Layer 5), and PPPoA uses ATM Adaptation Layer 5 to assemble PPP-encapsulated packets. The PPP protocol requires the two parties to communicate to be in a point-to-point relationship, which cannot be directly applied to broadcast Ethernet, but PPPoE solves this problem. Through the PPPoE protocol, multiple hosts in a shared Ethernet can conduct multiple PPP sessions with the remote access server through one or more simple bridge access devices. PPPoE not only provides a broadband access method for users using bridged Ethernet access, but also provides convenient access control and billing. The workflow of the PPPoE protocol includes two stages: discovery and session. When a host wants to start a PPP session, it must first perform a discovery process to identify the other party's Medium Access Control (MAC, Medium Access Control) address, and then establish a unique PPP session ID (ID, Identification). After the PPPoE session phase starts, the host and the access server transmit PPP data according to the PPP protocol, and carry out various negotiations and data transmission of PPP. Both PPPoA and PPPoE provide a point-to-point connection. The difference is that PPPoA is carried on the ATM network, while PPPoE is carried on the Ethernet network, respectively adapting to the ATM standard and the Ethernet standard.

Since the PPP protocol is a standard point-to-point connection, and PPPoX (including PPPoA and PPPoE) also provides a point-to-point connection, protocol packets and user data packets are bundled together for control and bearing between two points of the protocol , during the creation process of the present invention, the inventor found that there are at least the following problems in the prior art: each technical update of the bearer network needs to support the PPP protocol, and the innovation of PPP access technology must also adapt to the bearer network, which will lead to The increase of network operation cost is not conducive to the expansion and upgrade of the network. With the evolution of the network, the separation of control and bearer becomes an inevitable requirement. Since PPPoX provides a point-to-point connection, the access server in the network, as one end of the network side in the point-to-point connection, needs to terminate a large number of PPP sessions and forward a large number of IP data packets. the bottleneck.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a PPP access authentication method, system and access node equipment to realize the separation of control and bearer in PPP access authentication.

In order to solve the above technical problems, the purpose of the embodiments of the present invention is achieved through the following technical solutions:

An embodiment of the present invention provides a point-to-point protocol access method, the method comprising:

The access node device receives the point-to-point protocol access message from the user, judges whether the point-to-point protocol access message is a protocol message or a data message, and if it is a protocol message, then sends the protocol message to the access point access controller, and the access controller performs access management for users. If the access controller allows users to access, the access node device establishes and maintains a data forwarding table; if it is a data packet, then The access node device forwards the data message according to the data forwarding table.

An embodiment of the present invention provides a point-to-point protocol access system, the system includes an access node device and an access controller, wherein:

An access node device, configured to receive a point-to-point protocol access packet from a user, determine whether the point-to-point protocol access packet is a protocol packet or a data packet, and determine whether the point-to-point protocol access packet is a protocol packet , send it to the access controller for processing, and create and maintain a data forwarding table when receiving the access permission message sent by the access controller; when the point-to-point protocol access message is a data message , forwarding it according to the data forwarding table;

The access controller is configured to perform access management on users according to the received protocol message.

The embodiment of the present invention also provides an access node device, the access node device includes a message receiving and identifying unit, a message sending unit, and a storage unit, wherein:

A message receiving identification unit, configured to receive a point-to-point protocol message and identify whether the received point-to-point protocol message is a protocol message or a data message;

The message sending unit forwards the protocol message received by the message receiving and identifying unit to the first destination address, and forwards the data message received by the message receiving and identifying unit to the second destination according to the data forwarding table stored in the storage unit address;

The storage unit is used for storing the data forwarding table.

As can be seen from the above technical solutions, the access node device judges the PPPoX access message from the user, separates the data message and the protocol message, and forwards the data message, and the access controller according to Access control and management are carried out by protocol packets, thereby completing the separation of control and bearer in PPP access, so that the innovation of PPP access control technology and the evolution of the bearer network do not affect each other, which is conducive to network expansion and upgrade, and saves network operating costs.

At the same time, the access controller is responsible for access control and management of users, while the access node device forwards data packets, and the network load is shared by the two, thereby improving the utilization efficiency of the device and avoiding the burden of a certain device on the network Too heavy will affect the operation of the entire network and reduce the performance requirements for network equipment.

Description of drawings

FIG. 1 is a schematic diagram of a PPP frame format in the prior art;

Fig. 2 is the access flowchart of the preferred embodiment of the PPP access method of the present invention;

FIG. 3 is a schematic structural diagram of a preferred embodiment of the PPP access system of the present invention;

Fig. 4 is a schematic structural diagram of a preferred embodiment of an access node device according to the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and examples.

First, an embodiment is given to illustrate the PPP access method provided by the present invention, referring to FIG. 2 .

Step 21: the access node device (AN, Access Node) receives the PPP access message from the user;

First, the user equipment sends a PPP access message to request the establishment of a PPP connection. The PPP connection can be initiated by the user host or by a Residential Gateway (RG, Residential Gateway). PPP access packets include PPPoA access packets and PPPoE access packets according to different bearer modes. Generally, PPPoA is used in routing mode, and the access authentication process is completed by RG, while PPPoE works in bridging mode. The host or RG initiates a PPPoE request. Therefore, the specific device on the user side may be a user host or an RG.

Step 22: AN judges whether the PPPoX access message is a protocol message or a data message, if it is a protocol message, then perform step 23; if it is a data message, then perform step 27;

The AN can judge the message type according to the protocol field of the PPP frame. If the protocol field field is 0x8021, it is an NCP protocol message; if the protocol field is 0x0021, it is an IP data message.

Step 23: Send the protocol message to the access controller (AC, Access Controller), and the AC performs access management on the user, including access link negotiation, user access address allocation, and access authentication authorization;

During the access management process, the AC performs corresponding processing according to different protocol types. If the received message is an LCP protocol message, it negotiates with the user to establish, maintain or terminate the data link. If the received authentication family protocol such as PAP or CHAP, forward the protocol message to the AAA, Authentication, Authorization and Accounting (AAA, Authentication, Authorization and Accounting) server to authenticate the user to prevent illegal users from PPP connection . If necessary, the message returned by the AAA server should be converted to PPPoX format first. When the AN receives the protocol packet sent by the AC to the user, it will directly forward it to the user.

The realization of AAA can adopt RADIUS (Remote Authentication Dial In User Service, remote user dial-up authentication system), RADIUS is a kind of authentication between NAS (Network Access Server, network access server) such as BRAS (Broadband Remote Access Server) and shared authentication server A protocol for transporting authentication, authorization, and configuration information. RADIUS uses UDP (UserDatagram Protocol, User Datagram Protocol) as its transmission protocol. In addition, RADIUS is also responsible for transmitting the accounting information between the network access server and the shared accounting server. In this embodiment, the AC can function as a NAS device such as a BRAS.

Step 24: AN judges whether the user is allowed to access, if not, execute step 25; if yes, execute step 26;

Whether the user is allowed to access can be judged by checking whether the user identity is passed.

Step 25: close and tear down the link, terminate the PPP session;

Step 26: AN establishes and maintains a data forwarding table;

The AN can obtain the PPP signaling information between the user and the AC through monitoring or detection, and then obtain the required information or parameters. The AN can also be controlled by the AC through additional control protocols such as SNMP (Simple Network Management Protocol, Simple Network Management Protocol), ANCP (Access Network Control Protocol, Access Network Control Protocol), etc. Thus, there is a management agent in the AN, which is used to request information and actions from the AC.

In PPP point-to-point communication, each stage has a certain timing relationship, so if the user is not allowed to access, if the user's identity authentication is not completed, the data message transmitted by the user cannot be delivered to the destination network, so It can be set that by default, the port on the user side of the AN can only transmit PPP protocol packets, and data packets can only be transmitted when the authentication is passed, similar to 802.1X.

AN establishes and maintains a data forwarding table according to the obtained PPP information.

For example, one of the data forwarding tables can be: (port [including logical port] identifier, user Mac, PPP session identifier) <-> (user MAC, user IP address, user gateway IP address), and AN bases the PPP datagram on this table The message is forwarded, including the conversion of the message format and sending the message to the destination address, such as: IPoE to PPPoE conversion or PPPoE to PPPoA conversion.

If it is the case of PPPoE mentioned above, and if the AN is a three-layer situation, the destination MAC address of the data message can be directly obtained locally. Analysis protocol) obtains the MAC address corresponding to the user gateway IP as the destination MAC, and uses the MAC address of the access user as the source MAC address.

Step 27: AN judges whether the user access is allowed, if yes, execute step 28; if not, execute step 29;

For example, the AN can judge by searching the data forwarding table established in step 26, if there is a corresponding session ID and destination address in the table, and if so, it means that the user is allowed to access. You can also set a port status in the table to indicate user access. By default, the port is closed, and when the user is allowed to access, the port is open, allowing the transmission of data packets.

Step 28: AN forwards the data message according to the established and maintained data forwarding table;

In PPP point-to-point communication, the negotiation is divided into five stages, namely: Dead stage, Establish stage, Authentication stage, Network control negotiation stage and Terminate stage. Negotiations of different agreements are carried out at different stages. After the results of the previous agreement negotiations are obtained, the next stage of agreement negotiation is transferred. Therefore, generally, the data packet sent by the user can be forwarded to the destination address by the AN only after the user is allowed to access, for example, the verification of the user identity is passed.

According to the destination address in the data forwarding table, it can be forwarded to the destination network such as the convergence network, or to other users.

In the data forwarding table, the corresponding data message can be converted from PPPoX format to IPoX format, that is, the decapsulation of PPPoX is completed, and the data message is sent to the corresponding destination IP address according to the table;

After the user is allowed to access, the other end of the PPP connection with the user can also send data packets to the user. After receiving these data packets, the AN sends the data packets to the user according to the established and maintained data forwarding table . If necessary, for example, the data packet received by the AN is in the IPoX format, or the bearer mode of the access side and the network is different, the AN needs to first convert the format of the received data packet into the PPPoX format recognized by the access side.

Step 29: Discard the data packet.

PPPoX provides a point-to-point connection. The above is the process of processing the PPP access message sent by the user. It can be seen from the above workflow that the PPP access message sent by the user is separated at the AN, and the AN sends the data packet The packet is forwarded, and the protocol packet is sent to the AC for processing. In this way, the control of PPP access and the bearer are separated, so that the innovation of the access control technology and the evolution of the bearer network do not affect each other, which is beneficial to the expansion and upgrade of the network.

A PPP access method is described through the above embodiments, and a PPP access system is described below through the embodiments, the system includes: an access node device and an access controller, wherein:

The access node device is configured to receive a PPP access packet from a user, determine whether the PPP access packet is a protocol packet or a data packet, and when the PPP access packet is a protocol packet, send It is sent to the access controller for processing, and when the message of allowing user access sent by the access controller is received, a session data forwarding table is created and maintained; when the PPP access message is a data message, according to The data forwarding table forwards it;

The access controller is configured to perform access management on the user according to the received protocol message, and send the protocol message to the user through the access node device.

The access node device can also be used to forward the data message sent to the user to the user; receive the PPPoX protocol message from the access controller and send it to the user;

As shown in Fig. 3, RG31, AN32, AC33 and aggregation network 35 form an access network, and AN is logically connected to AC.

RG31 is used to initiate a PPP call, request access to the network, and receive PPP protocol packets and PPP data packets.

AN32 is used to receive and judge whether the message sent by the user is a PPP data message or a PPP protocol message. When the message is a PPP protocol message, it is directly sent to AC33 to authenticate the user. If the message is PPPoX data The message is forwarded according to the data forwarding table, such as being sent to the Internet Service Provider (ISP, Internet Service Provider) network 36 through the aggregation network 35. The data message sent by the aggregation network 35 and sent to the RG31 is forwarded to the user, and the protocol message sent by the AC33 and sent to the RG31 is directly sent.

AC33 is used to control PPP connections and access management for users, such as sending authentication information to the AAA server for identity authentication, and maintaining the PPP state machine, that is, switching between different negotiation stages.

The AAA server 34 is used to authenticate, authorize and charge users.

The ISP network 36 interacts with users through the convergence network 35 and can provide access services, information services and value-added services.

An access node device is described below through an embodiment, the device includes: a message receiving and identifying unit, a message sending unit, and a storage unit, wherein:

A message receiving identification unit, configured to receive a PPP message and identify whether the received PPP message is a protocol message or a data message;

The message sending unit forwards the protocol message received by the message receiving and identifying unit to the first destination address, and forwards the data message received by the message receiving and identifying unit to the second destination according to the data forwarding table stored in the storage unit address;

The storage unit is used for storing the data forwarding table.

In order to adapt to different network bearer modes, the access node device also includes a format conversion unit for converting the format of the message sent by the message receiving identification unit according to the bearer mode of the destination network before sending it to the message sending unit. For example, the conversion between PPPoX and IPoX, and the mutual conversion between PPPoA and PPPoE can be carried out.

As shown in FIG. 4 , the node device includes: a message receiving and identifying unit 41, a message sending unit 42, a storage unit 43, and a format conversion unit 44, wherein:

A message receiving identification unit 41, configured to receive a PPP message and identify whether the received PPP message is a protocol message or a data message;

The message sending unit 42 forwards the protocol message received by the message receiving and identifying unit 41 to the first destination address, and forwards the data message received by the message receiving and identifying unit 41 according to the data forwarding table stored in the storage unit 43 to the second destination address;

A storage unit 43, configured to store a data forwarding table;

The format conversion unit 44 is configured to convert the format of the message sent by the message receiving identification unit 41 according to the bearer mode of the destination network before sending it to the message sending unit 42 .

As for the data forwarding table based on which the data message is forwarded, the parameters may include a PPP session identifier, an access user identifier, and a forwarding path identifier. As required, the access node device may also obtain other required PPP signaling information as parameters in the data forwarding table.

In each of the above embodiments, the access node device judges the PPPoX access message from the user side, separates the data message and the protocol message, and forwards the data message, and the access controller according to Protocol packets are used for access control and management, thereby completing the separation of PPP access control and bearer, so that the innovation of PPP access control technology and the evolution of the bearer network do not affect each other, which is conducive to network expansion and upgrade, and also saves Network operating costs.

At the same time, the access controller is responsible for access control and management of users, while the access node device forwards data packets, and the network load is shared by the two, thereby improving the utilization efficiency of the device and avoiding the burden of a certain device on the network Too heavy will affect the operation of the entire network and reduce the performance requirements for network equipment.

Above, a kind of PPP access method, system and access node equipment provided by the present invention have been introduced in detail through the embodiments, and the description of the above embodiments is only used to help understand the method and the idea of the present invention; at the same time, for the technical field Those of ordinary skill in the art will have changes in the specific implementation and scope of application according to the idea of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (10)

1. A point-to-point protocol access method, characterized in that, comprising: The access node device receives the point-to-point protocol access message from the user, and judges whether the point-to-point protocol access message is a protocol message or a data message; When the point-to-point protocol access message is a protocol message, the protocol message is sent to the access controller, and the access controller performs access management for the user, if the access controller If the user is allowed to access, the access node device establishes and maintains the data forwarding table; When the point-to-point protocol access message is a data message, the access node device forwards the data message according to the data forwarding table. 2. The point-to-point protocol access method according to claim 1, wherein the access node device obtains user access information by monitoring the point-to-point protocol signaling message between the user and the access controller or through an additional control protocol and Create the data forwarding table. 3. The point-to-point protocol access method according to claim 1 or 2, wherein the data forwarding table includes parameters: a point-to-point protocol session identifier, an access user identifier, and a forwarding path identifier. 4. The point-to-point protocol access method according to claim 1 or 2, wherein, before the access node device forwards the received data message, further comprising: The access node device converts the format of the received data message according to different network bearer modes. 5. The point-to-point protocol access method according to claim 1 or 2, wherein the point-to-point protocol access includes point-to-point protocol access carried by an asynchronous transfer mode network, and point-to-point protocol access carried by an Ethernet network. 6. A point-to-point protocol access system, characterized in that it includes an access node device and an access controller, wherein: An access node device, configured to receive a point-to-point protocol access packet from a user, determine whether the point-to-point protocol access packet is a protocol packet or a data packet, and determine whether the point-to-point protocol access packet is a protocol packet , send it to the access controller for processing, and create and maintain a data forwarding table when receiving the access permission message sent by the access controller; when the point-to-point protocol access message is a data message , forwarding it according to the data forwarding table; The access controller is configured to perform access management on users according to the received protocol message. 7. The point-to-point protocol access system as claimed in claim 6, wherein the access controller is a broadband remote access server. 8. An access node device, characterized in that it includes a message receiving identification unit, a message sending unit, and a storage unit, wherein: A message receiving identification unit, configured to receive a point-to-point protocol message and identify whether the received point-to-point protocol message is a protocol message or a data message; The message sending unit forwards the protocol message received by the message receiving and identifying unit to the first destination address, and forwards the data message received by the message receiving and identifying unit to the second destination according to the data forwarding table stored in the storage unit address; The storage unit is used for storing the data forwarding table. 9. The access node device according to claim 8, further comprising a format conversion unit configured to convert the format of the message sent by the message receiving identification unit according to the bearer mode of the destination network before sending it to the message Text sending unit. 10. The access node device according to claim 8 or 9, wherein the data forwarding table includes parameters: a point-to-point protocol session identifier, an access user identifier, and a forwarding path identifier.

Images