CN1553741A - Method and system for providing users with network roaming - Google Patents

Abstract

A method for providing network roaming service to users and its system set roaming retransmit equipment at each operator network, the roaming retransmit equipment comprises the high layer AAA server of same operator in HCS, the central AAA server star-like network, the boarder AAA gateways of different operator, the boarder AAA gateway among multi operators and the AAA gateway of roaming union. It can configure the connection relationship at several limited equipments.

Description

Method and system for providing users with network roaming

field of invention

The invention relates to a data communication network, in particular to a method and a system for providing users with network roaming services.

Background technique

Modern society has entered the information society, and communication network, as the carrier of information, has been applied to all aspects of the whole society. Commonly used communication technologies include Ethernet, Token Ring, FR (Frame Relay), IP (Internet Protocol), ATM (Asynchronous Transfer Mode), etc. Commonly used communication networks include LAN composed of Ethernet and TCP/IP. WAN and INTERNET (Internet) and so on.

In the actual network, PC (personal computer) can be connected to the network in many ways, such as through LAN Switch (Ethernet switch), AP (wireless access point), VDSL (Very High Speed Digital Subscriber Line), ADSL (not Symmetrical Digital Subscriber Line) and other means to access the network.

In the network that needs to be managed, AAA (Authentication, Authorization, and Accounting) servers such as RADIUS (Authenticating Remote Incoming User Service) authentication servers need to be placed to verify the legitimacy of user identities. In addition, in practical applications, in order to ensure network security and management needs, it is generally required to authenticate, authorize, and bill customers to ensure that customers can reasonably enjoy the network services provided by operators. There are many common user authentication methods, such as PPPoE (Point-to-Point Protocol over Ethernet) authentication, WEB authentication, and 802.1X authentication.

In practical applications, a user's information is generally stored in the AAA server where the user opens an account, which is called the "home" AAA server, and the network where the user opens an account is called the "home" network. After the user obtains the account opening information (including but not limited to user name/password, smart card, etc.), the user can use it within the entire network provided by the network provider NSP/ISP. Therefore, geographically, users can access the Internet from anywhere on the NSP/ISP (Network Service Provider/Internet Access Service Provider) network. When the user is not in the home network (that is, roaming), the network the user accesses is called the "roaming" network, and the place where the user accesses is also authenticated, authorized, and billed through the AAA server. This AAA server is called "roaming". ground" AAA server.

Take an ISP (Internet Access Service Provider) providing access in Beijing and Nanjing as an example. User A is a Beijing user, that is, its home AAA server is in Beijing. When user A is in Nanjing and needs to use network services from the same ISP network in Nanjing, such as accessing WWW websites, etc., network roaming services need to be provided for him.

At this time, for user A, Nanjing is a "roaming location", and the AAA server connected to Nanjing is a "roaming location" AAA server. Since the information of user A is in Beijing, the "roaming" AAA server in Nanjing must obtain the information of user A from the home AAA server in Beijing.

Now, enterprises and operators have roaming service functions, but their scale is relatively small. The current networking of authentication and accounting servers is a mesh network. Either there is no interconnection between different operators, or there is a mesh network between a limited number of AAA servers). From the perspective of physical device connection, each AAA server is connected through the telecommunication network/Internet, as shown in Figure 1(a). From the perspective of logical connection, the actual AAA servers are a mesh network, and each AAA server is connected to all other AAA servers. As shown in Figure 1(b).

User name is used for user authentication and billing, and the user account name is composed of "user name@domain name". Currently, the identification between the roaming location and the home location is through the domain name in "user name@domain name". For example, "chinatelecom.sh.com" in "user@chinatelecom.sh.com" to identify. For example, if the domain name is chinalecom.sh.com, it means that the AAA server for this user's account opening is the AAA server of Shanghai Telecom. And "163.com" in "user@163.com" indicates that the AAA server where the user opened an account is the home AAA server in Guangdong Telecom.

There is following problem in above-mentioned prior art:

1. Since all AAA servers are connected in a mesh, all AAA servers must know all other AAA servers that have connection relationships, and configuration needs to be performed on each AAA server. Therefore, the addition, deletion and change of domain names often affect the entire network. All the AAA servers on the Internet require a lot of maintenance and are also very difficult to maintain.

2. If different operators and enterprises adopt mesh connection, they must know each other's AAA configuration, so the security is very poor. Moreover, due to management problems between operators, it is difficult to synchronize, and maintenance is very difficult.

3. Due to the mesh connection between AAA servers, all authentication and billing information are distributed, and the same operator in different regions and different operators cannot be uniformly settled.

4. When each operator or enterprise communicates with each other, a bilateral agreement is negotiated. Therefore, when an operator or enterprise wants to communicate with multiple operators or enterprises, bilateral agreements must be negotiated multiple times. Not only is there a difference between the protocols, which is very inconvenient, but it is also technically difficult.

5. Since the access server or similar access devices also need to be configured with the corresponding relationship of all AAA servers, often an access device can only be configured with limited domain name relationships, so the scalability is poor and the maintenance amount is large.

Contents of the invention

Therefore, the object of the present invention is to overcome the above-mentioned defects in the prior art in realizing the user roaming service function.

According to the first aspect of the present invention, there is provided a method for providing roaming service for users in the above system, the method includes:

(1) The roaming access device obtains user information according to the access request sent by the client terminal device of the roaming user;

(2) The roaming access device sends user information to the roaming AAA server for authentication;

(3) The AAA server in the roaming place identifies the user information, and when it is determined to be a roaming user, sends the user's authentication information to the roaming forwarding device, and sends it to the AAA server in the user's home place through the roaming forwarding device for authentication;

(4) The AAA server at the user's home location judges whether the user is legal according to the user information, and then sends the authentication success/failure message to the AAA server at the roaming place through the roaming forwarding device;

(5) If the AAA server at the user's home location sends an authentication success message, the roaming AAA server will notify the roaming access device to authorize the user; if the authentication failure message is sent, refuse to provide access services to the user;

(6) After the user is successfully authenticated, the roaming access device sends an accounting start request to the roaming AAA server;

(7) The roaming AAA server forwards the charging message to the user's home AAA server through the roaming forwarding device for charging.

The authentication and accounting methods described in the present invention can adopt conventional methods such as PPPoE, 802.1X, and WEB authentication. Those skilled in the art can understand that although there are slight differences between the access device and the AAA server in the process of various authentication methods, there is no substantial difference in the above methods of the present invention.

According to the second aspect of the present invention, there is provided a system for providing roaming services for users, the system includes: a client terminal, an access device and an AAA server, wherein the access device is used to provide access services for the client terminal, and the AAA The server is used to authenticate the authentication message of the client terminal forwarded by the access device and to charge for the successfully accessed client terminal. It is characterized in that the system also includes a roaming forwarding device for The authentication and accounting information of the roaming user is forwarded between the AAA server and the home AAA server.

In the above system of the present invention, the roaming forwarding device may include a high-level AAA server in the same operator network in a hierarchical network, a central AAA server in a star network, and an AAA gateway at the operator's border.

In the above system of the present invention, a roaming domain module can be set in the access device or the AAA server, which is used to configure path information, so as to configure the authentication and charging information of the roaming user to the roaming domain where the user's home AAA server can be found. on the forwarding device.

The present invention has the following advantages:

1. For the same operator or enterprise, only a few AAA servers need to configure roaming connection relationships, and the maintenance amount is small.

2. Different operators and enterprises transmit user authentication information and billing information through the AAA server gateway, so that they are interconnected through the network interface, which has high security, easy operation, and less maintenance. In addition, through the interconnection of AAA gateways, all authentication and billing information are unified, and unified settlement and statistics can be made between different regions of the same operator and different operators.

3. When an operator or enterprise wants to communicate with multiple operators or enterprises, it can communicate with all operators or enterprises only by negotiating an agreement once. The agreement is completely consistent, the technical difficulty is low, and the negotiation time is short.

4. Access devices or similar access devices do not need to configure all the corresponding relationships of AAA servers, as long as the core relationship and a roaming relationship are configured, the scalability is good, and zero maintenance can be realized for the access devices.

Description of drawings

Through the detailed text description and in conjunction with the following drawings, the above-mentioned purpose, features and advantages of the present invention will become easier to understand, wherein:

Fig. 1 (a) and (b) are the schematic diagrams illustrating the existing AAA server mesh networking mode;

Fig. 2 is a schematic diagram illustrating the AAA server networking mode of the same operator in the preferred embodiment of the present invention, wherein Fig. 2 (a) is a hierarchical networking mode; Fig. 2 (b) is a star networking mode;

Fig. 3 is a flow chart of configuring the high-level AAA server in the layered networking mode;

Fig. 4 is a schematic diagram illustrating a networking mode between two different operators according to a preferred embodiment of the present invention;

Fig. 5 is a schematic diagram illustrating a networking mode among a plurality of different operators according to a preferred embodiment of the present invention;

Fig. 6 is a flowchart illustrating user roaming authentication and billing procedures according to a preferred embodiment of the present invention;

7 is a sequence diagram illustrating a protocol adaptation process according to a preferred embodiment of the present invention, wherein FIG. 7(a) represents an adaptation process between the same protocols, and FIG. 7(b) represents an adaptation process between different protocols.

Detailed ways

The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings.

In the present invention, the method for user authentication and charging can adopt methods such as conventional PPPoE authentication and charging, WEB authentication and charging, and 802.1X authentication and charging as mentioned above. In this manual, PPPoE authentication and accounting are taken as examples.

Example 1: Roaming in different areas in the same operator/enterprise

The main problem of the same operator/enterprise is the mesh connection problem, which is often called the N2 problem. Therefore, other networking methods, including but not limited to hierarchical networks and star networks, can be used to solve this problem.

In one embodiment of the present invention, the layered network is shown in Figure 2 (a), the underlying AAA servers are not interconnected, and the entire network connection is configured between the high-level AAA servers to form a mesh network or a semi-mesh network , thus greatly reducing the maintenance workload, generally by an order of magnitude.

Among them, the typical configuration between high-level AAA servers is, for example:

[User data section]

Username = lisi@local.com

attribute = common user

Next authentication master server =

Next Authentication Standby Server =

Next billing master server =

Next billing standby server =

It needs to be explained here that the empty space after the equal sign in the above configuration indicates that the user is a local AAA authentication user (the domain name is local.com), and there is no next server.

Username＝zhangsan@beijing.com

attribute = proxy user

next authentication master = 10.1.1.1:1812

Next authentication standby server = 10.1.1.2:1812

next billing master = 10.1.1.3:1813

Next accounting standby server=10.1.1.4:1813

Shared Key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[domain name part]

domain name = roaming

attribute = proxy

next authentication master = 10.1.1.1:1812

Next authentication standby server = 10.1.1.2:1812

next billing master = 10.1.1.3:1813

Next accounting standby server=10.1.1.4:1813

Shared Key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[default (default)]

attribute = proxy ! Or discard (discard), etc.

next authentication master = 10.1.1.1:1812

Next authentication standby server = 10.1.1.2:1812

next billing master = 10.1.1.3:1813

Next accounting standby server=10.1.1.4:1813

Shared Key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

A simple exemplary configuration file is given above to illustrate the method for configuring the high-level AAA server in the layered network. In practice, it can generally be stored in the form of text files, binary files and databases, and the above configuration can be performed through manual editing and configuration interfaces such as command lines or GUI (graphical user interface). The specific processing flow is shown in Figure 3.

Below in conjunction with Fig. 3, illustrate the process that the high-level AAA server determines the processing strategy for the authentication message of the roaming user according to the above configuration:

1) When the high-level AAA server receives the user RADIUS message, it parses out the RADIUS message attributes;

2) According to various conventional policies and exception handling (such as fixed special data policies in the code, system administrator data policies, etc.), it is judged whether it is necessary to search for configuration data. If yes, go to step 3); if no, go to step 8).

3) Judging according to the content of the user data part, if the corresponding data can be found from the user data part, then use the strategy configured in the data to judge whether the subsequent processing is to perform authentication and accounting, or to perform RADIUS Proxy (that is, the remote user dials Incoming authentication service proxy), and other methods such as discarding, forcing failure, etc. At the same time, it is also necessary to judge some auxiliary parameters, such as the address of the next authentication and accounting server of RADIUS Proxy, port number, shared key and so on. In particular, it should be noted that the shared key can be stored in plain text or by symmetric/asymmetric encryption, such as commonly used DES, 3DES, etc.

4) If the user data is not found, then go to step 5); if the user data is found, then go to step 8).

5) Judging according to the content in the domain data part, if the corresponding data can be found in the domain data part, the policy configured with this data will determine whether the next step is to perform authentication and accounting, or RADIUS Proxy, and other methods such as discarding , force failure, etc. At the same time, it is also necessary to judge some auxiliary parameters, such as the address of the next authentication and accounting server of RADIUS Proxy, port number, shared key and so on. In particular, it should be noted that the shared key can be stored in plain text or by symmetric/asymmetric encryption, such as commonly used DES, 3DES, etc.

6) If the domain data is not found, then go to step 7); if the domain data is found, then go to step 8).

7) Use the default configuration data.

8) The user packet processing strategy has been searched, and the next step of processing is performed according to the found processing strategy, including RADIUS forwarding, authentication, accounting, discarding, etc.

According to the above configuration and processing process, all the underlying AAA servers only need to configure one piece of domain data or default data, which can greatly ease the maintenance workload, generally by an order of magnitude. However, the high-level AAA servers need to be completely configured according to the roaming domain. For example, there are 10 roaming domains from server A to server B, and 5 roaming domains from server A to server C. In this way, server A needs to be configured with 15 roaming domains, and the same is true for other servers B and C. Configure as a mesh or semi-mesh network as required.

The hierarchical networking method can be two layers or multiple layers.

In another embodiment of the present invention, a star network may also be used for AAA server networking, as shown in FIG. 2( b ).

Its specific configuration format and processing flow are the same as the above-mentioned layered networking.

Therefore, during configuration, all edge AAA servers on the star network only need to configure one piece of domain data or default data, which can greatly reduce the maintenance workload, generally by an order of magnitude. On the AAA server of the central node in the star network, similar to the high-level AAA server in the above-mentioned layered network, it needs to be completely configured according to the roaming domain. That is, all roaming domains on the entire network should find corresponding configurations on the central node AAA server.

In actual networking, one of various networks such as mesh/semi-mesh, layered, and star can be used in combination, or multiple types can be used in combination.

The user roaming access process takes PPPoE authentication as an example, as shown in Figure 5. The specific process is as follows:

1) The PPPoE client sends a PADI (PPPoE Activation Discovery Initial Message) message to the PPPoE server device to start PPPoE access.

2) The PPPoE server sends a PADO message (PPPoE activation discovery offer message) to the client.

3) The client initiates a PADR (PPPoE Activation Discovery Request message) request to the PPPoE server according to the response.

4) The PPPoE server generates a session id (session identifier), and sends it to the client through PADS (PPPoE activation discovery session message).

5) LCP (Link Control Protocol) negotiation of PPP (Point-to-Point Protocol) is performed between the client and the PPPoE server to establish link layer communication. At the same time, negotiate to use the CHAP (Challenge Handshake Authentication Protocol) authentication method.

6) The PPPoE server sends a Challenge (challenge) message to the authentication client, providing a 128-bit Challenge (that is, a random word generated by the server).

7) After the client receives the Challenge message, it processes the password and Challenge with the known MD5 algorithm, and then sends it to the PPPoE server in the Response (response) message.

8) The PPPoE server sends Challenge, Challenge-Password and user name to the RADIUS (Remote User Dial-In Authentication Service) user authentication server (ie AAA server) in the roaming area for authentication.

9) The roaming RADIUS user authentication server identifies a roaming user according to the user name, and its attribution is in Beijing, for example, so the authentication message is forwarded to the intermediate AAA server. The intermediate AAA server is generally a layered network The high-level AAA server or the central node AAA server in a star network. The middle AAA server mainly completes the function of Proxy (proxy server), for example, is a RADIUS proxy server, and performs typical RADIUS Proxy functions such as known RFC2865, RFC2866, and RFC2869. Therefore, the authentication and accounting messages sent by the "roaming" AAA server are searched for the path of the "home" AAA server according to the domain name configuration, and then sent to the next intermediate AAA server until they are sent to the "home" AAA server. The intermediate AAA servers can be in the same area or in different areas. Generally, the intermediate AAA server does not directly perform user authentication and accounting functions, but forwards authentication and accounting packets according to the path information configured by various domain names.

10) the home RADIUS user authentication server judges whether the user is legal according to the user information, and then sends the response authentication success/failure message to the roaming ground RADIUS user authentication server by the intermediate AAA server as in step 9).

11) The roaming RADIUS user authentication server forwards the authentication success/failure message to the PPPoE server. If successful, the user will be authorized with the negotiation parameters and related service attributes of the user. If authentication fails, the process ends here.

12) The PPPoE server returns the authentication result to the client.

13) The user conducts NCP (Network Control Protocol) (such as IPCP or IP Control Protocol) negotiation, and obtains parameters such as the planned IP address through the PPPoE server.

14) If the authentication is successful, the PPPoE server initiates an accounting start request to the roaming RADIUS user accounting server.

15) the roaming ground RADIUS user accounting server finds that the user is a roaming user, and its place of origin is in Beijing, so just as above-mentioned step 9) this billing message is forwarded to the home place RADIUS user accounting server by the middle AAA server, and carries out True billing.

16) The home RADIUS user accounting server responds with an accounting start response message, and forwards it to the roaming RADIUS user accounting server through the intermediate server.

17) The roaming RADIUS user accounting server forwards the accounting start response message to the PPPoE server.

At this time, the user has passed the authentication and obtained legal authority, and can normally receive network services.

When the user wishes to terminate the network service, the network connection can also be disconnected through PPPoE, and the billing termination message will be sent according to the procedures in 14)-17).

As mentioned above, in this embodiment, when the user's authentication and accounting messages are forwarded between the "roaming" AAA server and the "home" AAA server (mainly in steps 9), 10) and 15), 16 )), it needs to go through multiple AAA servers in the middle.

Example 2: Roaming between two different operators/enterprises

Set up an AAA gateway on the boundary of each operator/enterprise. When a user roams between two operators/enterprises, all authentication and billing roaming between each other go through this gateway. All AAA servers, in addition to configuring local user authentication and accounting information, configure the domain names of all roaming users as the default path or roaming path to the AAA gateway. The specific configuration process is the same as that for the layered or star network above. Each AAA server in the network does not need to configure a path corresponding to each roaming domain name. In this way, when performing maintenance between two networks, every time a new domain name is added, deleted, or modified, only the corresponding path modification needs to be performed on the AAA gateway, and the AAA server in the network does not need to be modified, thereby reducing the The maintenance workload is reduced.

At the same time, because different operators may adopt different protocols, through the AAA gateway mode, protocol adaptation can be performed on the AAA gateway, and unified authentication statistics and billing settlement can be performed. Currently, RADIUS-RADIUS, RADIUS-DIAMETER, etc. are adapted to the protocol. These protocols can be adapted in one direction, but are generally adapted in two directions.

There are two methods for protocol adaptation:

1. When using the same protocol, since the two sides of the gateway have different requirements for attributes such as authentication and billing in the protocol, a conversion process is required, that is, attribute conversion is performed on the gateway to meet the requirements of both sides of the gateway. Specifically, taking RADIUS-RADIUS as an example, the sequence diagram of AAA gateway processing is shown in Fig. 7(a). The following describes the protocol adaptation process in combination with Figure 7(a):

1) A certain AAA server sends a RADIUS authentication request message to the AAA gateway, and its content typically includes, for example, the user name "zhangsan@beijing.com", the name of the user's access device, and the user's password.

2) The AAA gateway recognizes (generally, it can be simply identified by the domain name, or it can be identified strictly according to the above-mentioned AAA processing flow) that the message format of the AAA server is inconsistent with the message format requirements of the AAA server on the other side, for example, the other side The AAA server requires all user names to be capitalized, and requires the address of the AAA server where the user roams, and the user's access device name must give a corresponding numeric code for the access device, not the name. At this time, the AAA gateway, according to the requirements of the AAA server on the other side, changes all the user names in the received RADIUS message to uppercase, adds an attribute of the address of the AAA server where the user roams, and fills in the corresponding IP address of the AAA server. Finally, change the address to the corresponding digital code according to the pre-configured mapping table of device name and digital code. Then send the changed RADIUS reassembly packet to the AAA server on the other side.

3) The AAA server on the other side returns the authentication success message to the AAA gateway after the authentication is successful. The authentication success message generally includes the user name, the name of the user's access device, and the like.

4) After the above-mentioned AAA gateway receives the message, it recognizes that the message format does not match, and processes it according to the reverse process of the above-mentioned protocol adaptation process. Keep or change the user name to lowercase, and change the user access device name from the digital code to the corresponding device name according to the pre-configured mapping table between the device name and the digital code.

Other processes, such as RADIUS authentication packets and accounting packets, are also basically consistent with the above process.

In the above-mentioned protocol adaptation process, the currently commonly used technology is table mapping, that is, the attribute mapping table between operator A and operator B, so that conversion and inverse conversion are performed according to the attributes in the table and the specified conversion method during conversion .

Of course, the present invention is not limited to the form mapping method, and other widely used methods such as software modules or plug-in methods can also be used. For example, if operator A needs to roam with operator B, a software module or plug-in can also be added to the AAA gateway to complete the protocol adaptation function. Among them, changing the AAA gateway software or adding a patch is the easiest way to complete this function.

2. If different protocols are used, such as RADIUS, DIAMETER (an enhanced AAA protocol compatible with RADIUS protocol) and other protocols, then the gateway needs to convert from one protocol message to another protocol message. Taking RADIUS-DIAMETER as an example, the sequence diagram of AAA gateway processing is shown in Figure 7(b):

1) A certain AAA server sends a RADIUS authentication request message to the AAA gateway, and the content is typically such as the user name "zhangsan@beijing.com", the name of the user's access device, and the user's password.

2) The AAA gateway recognizes (generally, it can be simply identified by the domain name, or it can be identified strictly according to the above-mentioned AAA processing flow) that the message format of the AAA server is inconsistent with the message format requirements of the AAA server on the other side, for example, the other side The AAA server requires the use of the DIAMETER protocol, and requires all user names to be capitalized, and requires the address of the AAA server where the user roams, and the user's access device name must give a corresponding numeric code for the access device, not the name. At this time, the AAA gateway will change all the user names in the received RADIUS message to uppercase according to the requirements, add an attribute of the address of the AAA server where the user roams and fill in the corresponding IP address of the AAA server, and finally follow the pre-configured The mapping table of device names and digital codes is changed to the corresponding digital codes. Then send the new DIAMETER request package to the AAA server on the other side.

3) After the above-mentioned AAA server on the other side succeeds in authentication, it returns a DIAMETER response message (including authentication success information) to the AAA gateway. The authentication success message generally includes, for example, the user name, the name of the user's access device, and the like.

4) After receiving the message, the AAA gateway recognizes that the message format does not match, and processes it according to the reverse process of the above protocol adaptation process. Convert the DIAMETER protocol to the RADIUS protocol, and keep or change the user name to lowercase, and change the user access device name from the digital code to the corresponding device name according to the pre-configured mapping table between the device name and the digital code.

Other processes such as RADIUS authentication packets, accounting packets, and DIAMETER processing are also basically the same as the above-mentioned procedures.

Similar to the above-mentioned adaptation process of the same protocol, in the adaptation process of different protocols, the commonly used technology is table mapping, that is, the attribute mapping table between operator A and operator B, so that when converting, according to the attributes in the table Perform conversion and inverse conversion with the specified conversion method. Of course, methods commonly used in this field, such as software modules or plug-in methods, may also be used. The easiest way is to change the AAA gateway software or add patches to complete this function.

In the user roaming access process in this embodiment of the present invention, steps (1)-(8) are basically the same as those in the foregoing embodiments. The difference is that in step (9), if the roaming RADIUS user authentication server identifies a roaming user according to the user name, and its home server belongs to another operator, then the authentication message is forwarded earlier AAA gateway to the roaming location. Use the standard Proxy function (typically such as the well-known RADIUS Proxy function of RFC2865, RFC2866, RFC2869) in the AAA gateway to forward to the home AAA gateway. The home AAA gateway also uses the standard Proxy function to forward the authentication message to the home RADIUS user authentication server for real authentication.

In step (10), the home RADIUS user authentication server judges whether the user is legal according to the user information, and then forwards the authentication success/failure message to the roaming RADIUS user authentication server by the home AAA gateway and the roaming AAA gateway. The subsequent process is the same as the steps (11) to (13) of Embodiment 1.

The user billing process is as follows:

14) If the authentication is successful, the PPPoE server initiates an accounting start request to the roaming RADIUS user accounting server.

15) The roaming RADIUS user billing server finds that the user is a roaming user, and forwards the billing message to the home RADIUS user through the intermediate AAA gateway (the roaming AAA gateway and the home AAA gateway) as in the above step 9) The billing server performs real billing.

16) The home RADIUS user accounting server responds with an accounting start response message, and forwards it to the roaming RADIUS user accounting server through the intermediate AAA gateways (the home AAA gateway and the roaming AAA gateway).

17) The accounting server of the roaming RADIUS user forwards the responding accounting start response message to the roaming PPPoE server.

Embodiment 3: Roaming among multiple operators

When a specific user roams, it can only be roaming between two operator entities, but when a user connected to a certain access device roams, roaming among multiple operators will occur. Judging the roaming between multiple operators is actually the sum of judging the roaming situation of a certain user.

When each operator or enterprise communicates with each other, a bilateral agreement is negotiated. Therefore, when an operator or enterprise wants to communicate with multiple operators or enterprises, it must negotiate bilateral agreements multiple times, and there are differences between the agreements. Very inconvenient and technically difficult.

By forming a roaming alliance, all roaming data configurations are performed in the alliance, so that all operators and enterprises connected to the roaming alliance can roam with each other. And when an operator or enterprise wants to communicate with multiple operators or enterprises, it only needs to negotiate an agreement with the roaming alliance to communicate with all operators or enterprises. The agreement is completely consistent, the technical difficulty is low, and the negotiation time is short.

At the same time, the roaming alliance is interconnected with the AAA gateways of various operators and enterprise networks through the AAA gateway at the border, and can provide protocol adaptation, authentication statistics, billing and settlement, etc.

In order to achieve authentication statistics and billing settlement, etc., in addition to message forwarding and protocol conversion, authentication information and billing information must be stored and calculated on the AAA gateway of the operator or enterprise, and the AAA gateway of the roaming alliance, so that Two connected entities (for example, between operators) can check detailed authentication and billing information (ie, reconciliation function), as well as statistics of authentication information and settlement of billing information summarized by both parties. For example, there is a settlement agreement between the general operator and the operator. Assuming that the billing information is 3:7 between the roaming operator and the home operator, the revenue settlement is performed according to the aggregated billing information. Therefore, in the present invention, by storing the authentication and charging information on the AAA gateway, conventional authentication statistics, charging settlement, and account reconciliation methods can be adopted.

"Roaming alliance" may refer to an organization, and here may also refer to a group of AAA servers configured and managed uniformly. From the outside of the "roaming alliance", these AAA servers are somewhat similar to the above-mentioned AAA gateways, but these AAA servers are no longer a point-to-point relationship, but a many-to-many relationship. Further requirements are carried out on the basis of the above gateways, including many-to-many configuration and many-to-many adaptation. The configured format and search process are as described in Embodiment 2. In this example, what needs to be additionally explained is that all relevant roaming relationships between interoperable operators need to be configured in the AAA server of the "Roaming Alliance", and the roaming When the protocol adaptation requirements.

At the same time, the internal structure of the roaming alliance can be the mesh interconnection of the AAA servers on the edge of these roaming alliances, or it can have its internal network, which can be combined with mesh/semi-mesh, layered, star, etc. one, or a combination of several. It should be noted that the network referred to here refers to the logical network directly connected to the AAA server, not to the physical connection network.

Every time a roaming customer's information is added, deleted, or modified, such as domain name and home AAA server information, the configuration must be modified within the roaming alliance, so that all edge AAA servers connected to the roaming customer in the roaming alliance know the changed information . Depending on the internal network structure of the roaming alliance, the internal configuration changes of the roaming alliance are also different. If it is a mesh/semi-mesh network, each relevant edge AAA server needs to be modified; if it is a layered network, it needs to be modified by the high-level AAA server; if it is a star network, it needs to be modified by the central node AAA server. The same is true for other networks. The principle is to ensure that correct AAA paths are provided after modification.

The specific method for configuring the AAA gateway of the roaming alliance and implementing protocol adaptation on the AAA gateway of the roaming alliance is the same as the method for protocol adaptation between AAA gateways between two operators/enterprises.

The user roaming access process is basically as described above, the only difference is that after the user passes through the "home" AAA server to the "roaming" AAA server, it also needs to pass through the AAA gateway of each entity in the middle, and the roaming alliance's AAA gateway.

Specifically, with the AAA gateway as the boundary, the intermediate entity is generally (roaming AAA server →) the AAA network of the operator → the AAA gateway of the operator → roaming alliance → AAA gateway of the opposite operator → AAA network of the opposite operator (→Home AAA server). On each intermediate entity, implement conventional Proxy functions, such as RADIUS Proxy functions. Protocol adaptation is required on the edge AAA server of the roaming alliance. The adaptation process is the same as that described in Embodiment 2 and will not be repeated here.

The AAA server or AAA gateway of the roaming alliance is logically independent from each operator, and generally can be a network provided by an independent organization. However, operators can also cooperate to use the current AAA server or AAA gateway in their network as the AAA server of the roaming alliance. In addition, the roaming alliance may not even be independent hardware, but only a software module to realize its function. The roaming federation gateway and the operator gateway are logically and functionally independent, but can be implemented on the same physical entity such as the operator gateway.

In the user roaming access process in Embodiment 3, steps (1)-(8) are basically the same as those in the foregoing embodiments. The difference is that in step (9), if the roaming RADIUS user authentication server identifies a roaming user according to the user name, and its home server belongs to another operator, then the authentication message is forwarded earlier AAA gateway to the roaming location. Then go through the entities in between. With the AAA gateway as the boundary, the intermediate entity is generally (roaming AAA server →) the AAA network of the operator → the AAA gateway of the operator → roaming alliance → AAA gateway of the opposite operator → AAA network of the opposite operator (→ home AAA server)). All use the standard Proxy function (typically known as the RADIUS Proxy function of RFC2865, RFC2866, RFC2869) in the AAA gateway, and forward to the home AAA gateway. The home AAA gateway also uses the standard Proxy function to forward the authentication message to the home RADIUS user authentication server for real authentication.

In step (10), the home RADIUS user authentication server judges whether the user is legal according to the user information, and then passes the authentication success/failure message from the home AAA gateway through the AAA gateways of each entity in the middle, and the AAA gateway of the roaming alliance Go to the roaming RADIUS user authentication server. The subsequent process is the same as the steps (11) to (13) of Embodiment 1.

The user billing process is as follows:

14) If the authentication is successful, the roaming PPPoE server initiates an accounting start request to the roaming RADIUS user accounting server.

15) The roaming ground RADIUS user billing server finds that the user is a roaming user, then just like above-mentioned step 9), this billing message is roamed through the intermediate forwarding device (the AAA gateway of the home place passes through the AAA gateway of each entity in the middle, and The AAA gateway of the roaming alliance) forwards to the home RADIUS user accounting server for real accounting.

16) The home RADIUS user accounting server responds to the accounting start response message, and passes through the intermediate roaming forwarding device (the home AAA gateway passes through the AAA gateways of each entity in the middle, and the AAA gateway of the roaming alliance home AAA gateway and the roaming location AAA gateway) to the roaming RADIUS user accounting server.

17) The accounting server of the roaming RADIUS user forwards the responding accounting start response message to the roaming PPPoE server.

Embodiment 4: Roaming access between the access device and the AAA server

When a user connected to an access device (such as an access server) needs to roam, the domain name configured on the access device knows the corresponding relationship such as the home AAA server to which the user is connected, or the connected AAA gateway. Access devices can only be configured with limited domain name relationships, generally around dozens, typically 32, and poor scalability. When it is necessary to configure roaming domain names, it will certainly not be able to meet the needs of operation or management. Moreover, every time a home is added during roaming, a new roaming domain name needs to be added to all access devices in the entire network, so the amount of maintenance is very large.

In this embodiment of the present invention, by setting a roaming domain module on the access device, all other roaming users will go to the roaming domain except for the core relationship of the access device, such as the AAA server of the local home network, so that All roaming users are connected to the corresponding high-level AAA server or directly connected to the AAA gateway, and they forward the roaming information to the home.

In the roaming domain module, all local authentication will directly configure the corresponding AAA server (authentication, accounting); all special requirements (for example, an access enterprise requires the configuration of the enterprise's AAA server, but the AAA server is not local authentication user, special configuration is required), and the corresponding AAA server (authentication, accounting) will also be directly configured for the user.

Considering that the maintenance of each roaming domain module configuration is too large, a "roaming domain" configuration item is set. In this configuration item, all non-local and non-specially required users will go to the AAA server configured in the roaming domain. For authentication and accounting, the AAA server can be the above-mentioned AAA gateway, or any AAA server that can find the path of the user's home AAA server.

When configuring a roaming domain, you can use all the domain name information in the "username@domain name" mentioned above, or a part of the domain name information. For example, zhangsan@telecom.beijing.com can perform roaming configuration processing according to the domain name "telecom.beijing.com", or perform roaming configuration processing according to the domain name "beijing.com". The configuration method is the same as in the previous embodiment.

Usually, the AAA server can also set a roaming domain module to transfer all roaming users to other AAA servers or AAA gateways directly through the roaming domain. Its realization method is the same as that of access device providing roaming domain.

In this way, the access server or similar access devices and the AAA server do not need to configure all the corresponding relationships of the AAA servers, but only need to configure the core relationship and a roaming relationship. That is to say, when changing the network roaming relationship such as adding, modifying, or deleting, it only needs to be configured once on a certain AAA gateway or roaming alliance. Since roaming is configured on all access devices and roaming locations or intermediate AAA servers relationship, so it can be used immediately without modification on all devices and roaming locations or intermediate AAA servers. It has good scalability and can achieve zero maintenance for roaming.

The user roaming access process is basically the same as the previous example, except that the roaming configuration and control of the access device and AAA server are optimized.

Its concrete process is, after step (1) to (7) through above-mentioned embodiment, in step (8), if the roaming ground access server (PPPoE access server) is identified as roaming user according to such as username, Then directly find the corresponding AAA gateway or roaming alliance through the roaming domain module, or find the path of the home AAA server, and forward the authentication message to the AAA gateway in the roaming place. Or, when the roaming domain module is not set in the access server and the roaming domain module is set in the AAA server (RADIUS user authentication server in this example), in step (9), the RADIUS user authentication server identifies the If you are a roaming user, you can also find the corresponding AAA gateway or roaming alliance through the configured roaming domain module, or find the path of the home AAA server, and forward the authentication message to the roaming AAA gateway. Use the standard Proxy function (typically such as the well-known RADIUS Proxy function of RFC2865, RFC2866, RFC2869) in the AAA gateway to forward to the home AAA gateway. The home AAA gateway also uses the standard Proxy function to forward the authentication message to the home RADIUS user authentication server for real authentication.

In step (10), the home RADIUS user authentication server judges whether the user is legal according to the user information, and then finds the corresponding AAA with the authentication success/failure message through the roaming domain module configured in the home RADIUS user authentication server in the same manner as above Gateway or roaming alliance, so as to forward to the roaming RADIUS user authentication server. The subsequent process is the same as the steps (11) to (13) of Embodiment 1.

The user billing process is as follows:

14) If the authentication is successful, the PPPoE server initiates an accounting start request to the roaming RADIUS user accounting server.

15) The RADIUS user accounting server in the roaming area finds that the user is a roaming user, and then finds the corresponding AAA gateway or roaming alliance with the accounting message through the roaming domain module configured in the RADIUS user authentication server in the roaming area, just like the above step 9) , so as to forward it to the local RADIUS user accounting server for real accounting.

16) The home RADIUS user accounting server responds to the accounting start response message, finds the corresponding AAA gateway or roaming alliance through the configured roaming domain module, and forwards it to the roaming RADIUS user accounting server.

17) The accounting server of the roaming RADIUS user forwards the responding accounting start response message to the roaming PPPoE server.

Although the present invention has been described above in conjunction with multiple embodiments, the purpose of these descriptions is only to facilitate a clearer and more comprehensive understanding of the present invention, rather than to limit the present invention. For example, in these embodiments of the present invention, the PPPoE authentication method is used as an example to describe, obviously, the present invention can also be used for such as WEB authentication, 802.1X authentication and other conventional network user authentication methods other than PPPoE. In addition, the present invention is not limited to providing roaming services for users through protocols such as RADIUS and DIAMETER mentioned in the specification. Therefore, it is obvious that various modifications and equivalent substitutions can be made to the details of the embodiments of the present invention, and these modifications and equivalent substitutions still belong to the scope of the present invention.

Claims (12)

1. A method for providing roaming services for users in a network system, the network system comprising a client terminal; an access device including a roaming access device and a home access device of the roaming user; an AAA server including A roaming AAA server and the home AAA server of the roaming user; and a roaming forwarding device, connected between the roaming AAA server and the home AAA server, for forwarding authentication and accounting information of the roaming user, The methods include: (1) The roaming access device obtains user information according to the access request sent by the client terminal device of the roaming user; (2) The roaming access device sends the user information to the roaming AAA server for authentication; (3) The AAA server in the roaming place identifies the user information, and when it is determined to be a roaming user, sends the user's authentication information to the roaming forwarding device, and sends it to the AAA server in the user's home place through the roaming forwarding device for authentication; (4) The AAA server at the user's home location judges whether the user is legal according to the user information, and then sends the authentication success/failure message to the AAA server at the roaming place through the roaming forwarding device; (5) If the AAA server at the user's home location sends an authentication success message, the roaming AAA server will notify the roaming access device to authorize the user; if the authentication failure message is sent, refuse to provide access services to the user; (6) After the user is successfully authenticated, the roaming access device sends an accounting start request to the roaming AAA server; (7) The roaming AAA server forwards the charging message to the user's home AAA server through the roaming forwarding device for charging. 2. The method according to claim 1, characterized in that the step (3) further comprises: the roaming forwarding device according to the protocol type between the roaming AAA server and the home AAA server and the message format Requirements, protocol adaptation and packet format conversion. 3. The method according to claim 2, wherein the roaming forwarding device performs protocol adaptation and message format conversion according to a mapping table configured by the roaming forwarding device between device names and digital codes. 4. The method according to claim 1, 2 or 3, wherein the authentication method is PPPoE authentication, WEB authentication or 802.1X authentication. 5. The method according to claim 4, further comprising a process of determining a processing strategy for user authentication messages in the roaming forwarding device, the process comprising: When receiving the user's authentication message, parse out the attributes of the authentication message; Judging whether it is necessary to search for configuration data, if so, determine the strategy for processing the authentication message according to the content of the user data part; If no user data is found, determine the policy for processing the authentication message according to the content in the domain data part; If domain data is not found, default configuration data is used; and According to the determined processing strategy, proceed to the next step. 6. The method according to claim 5, further comprising the step of saving the forwarded user authentication and billing information in the roaming forwarding device. 7. A network system for providing roaming services for roaming users, comprising: client terminal; An access device, the access device is used to provide access services for client terminals, including the roaming access device where the roaming user is located and the home access device of the roaming user; The AAA server is used to authenticate the user information of the client terminal forwarded by the access device and to perform accounting for the successfully accessed client terminal, including the roaming AAA server where the roaming user is located and the home AAA server of the roaming user, It is characterized in that the system further includes a roaming forwarding device, which is connected between the roaming user's roaming AAA server and the home AAA server, and is used for forwarding the roaming user's authentication and accounting information. 8. The system according to claim 7, wherein the AAA servers belonging to the same network operator or enterprise adopt hierarchical networking, star networking, or hierarchical networking and star networking. Networking and a combination of mesh/semi-mesh networking. 9. The system according to claim 8, wherein the roaming forwarding device comprises a high-level AAA server in the network of the same operator or enterprise in the layered network, the star network The AAA server of the central node in the local area network or enterprise of the same network operator, or a combination of the two AAA servers, is used to perform protocol adaptation and authenticate packets for the multiple operators or enterprises forwarding. 10. The system according to claim 7, wherein the roaming forwarding device comprises an AAA gateway connected between two or more network operators or enterprises, for providing Perform protocol adaptation and forward authentication packets. 11. The system according to claim 7, wherein the roaming forwarding device further comprises a roaming alliance interconnected with multiple operators or enterprises through an AAA gateway, and is used to carry out agreements for the multiple operators or enterprises Forwarding of adaptation and authentication packets. 12. The system according to any one of the preceding claims, wherein the access device or the AAA server is provided with a roaming domain module for configuring path information, so as to configure roaming user authentication and charging information Go to the roaming forwarding device where the AAA server of the user's home location can be found.

Images