WO2007000120A1

WO2007000120A1 - An authentication access system, method and server

Info

Publication number: WO2007000120A1
Application number: PCT/CN2006/001500
Authority: WO
Inventors: Weilong Ouyang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-06-29
Filing date: 2006-06-29
Publication date: 2007-01-04
Also published as: CN1889484A; CN100421403C

Abstract

An authentication access system, method and server can solve the problem that the prior art need to add the WEB devices to the system, the client must support multiple protocols, the IP address can’t be bound with the access location, and the plug and play of devices can’t be realized. The system includes: a broadband access server (BRAS) connected with the access device, and a function server connected with the BRAS. The BRAS includes: a protocol termination module for receiving and terminating the protocol messages transmitted by the access device, and an agent module for constructing the request message. The BRAS also includes: a scheduling module connected between the protocol termination module and the agent module for constructing the authentication information for non-dialing access mode and transmitting the authentication information to the agent module, and forwarding the address allocation information and the charging information, or directly forwarding the authentication information of dialing access mode to the agent module and forwarding the address allocation information and the charging information.

Description

TECHNICAL FIELD The present invention relates to an authentication access system and an authentication access method and server.

Background technique

At present, the revenue of operators in broadband metropolitan area network services is not proportional to the number of network users. In order to increase revenue, operators continue to add new services to the network, so that network services involve all aspects of home network life, thereby generating value-added benefits. For example, services such as Voice over IP (Voice Protocol), Voice over IP (IPTV), and Internet games. It also promotes the transition of home networks into a multi-service network environment. A home network of the prior art is shown in FIG. 1. The home network includes: an access device that provides different services, such as a PC (Personal Computer) 111, a set top box (STB, Set Top Box) 112, IP phone 113, IP TV 114, etc.), the access device is connected to a digital subscriber line (DSL, Digital Subscriber Line) or a local Ethernet via a Remote Test Unit (RTU) 120 or a Routing Gateway 120 Access technologies such as a LAN (Local Area Network) are connected to a Layer 2 multiplexer (Multixer) 130 such as a Digital Subscriber Line Multiplexer (DSLAM, DAL Access Multiplexer), and the Multiplexer 130 extracts the Ethernet from the access medium. After the Ethernet protocol packet, the packet is transparently transmitted to the broadband access server (BRAS, Broad Remote Access) through its own asynchronous transfer mode (ATM, Asynchronous Transfer Mode) or Ethernet uplink interface. Server 140 performs link termination and provides Internet (Internet) access and other value-added services for the access device.

For operators, when adding new services, they must also effectively bill the services used by users to obtain more revenue. At present, it mainly adopts a single billing method such as monthly subscription. A comprehensive study of different billing strategies (eg, real-time, traffic, or duration) found that using a variety of billing methods can significantly increase profitability, while also providing users with autonomous consumption strategies.

However, there are many different devices that provide different functions in the current multi-service home network, and they work in different ways. For example: IP phones must be online, so usually With the private line configuration (DHCP, Dynamic Host Configuration Protocol) and other private line access methods, IPTV does not need to continue online, only need to go online when watching, so you can use dial-up access, or dial-up and dedicated line hybrid access. If the IP phone and the IPTV belong to the same user, the IP phone and the IPTV can only be charged separately according to the different access modes (for example, the IP phone adopts the monthly charging mode, and the IPTV adopts the traffic accounting method. ), it is impossible to use a variety of billing policies to perform unified billing management for this user. That is to say, in the above network environment, the access modes of the access devices are different, so that the various charging devices in the network cannot perform unified charging management on the various access devices existing in the network. To solve this technical problem, the access authentication methods of the various access devices need to be unified, that is, the non-authenticated access mode is authenticated and accessed, and then unified management and charging are performed.

At present, the networking of the dial-up access mode of the prior art is as shown in FIG. 2.

In the framework of the networking, the authentication access process of the Point-to-Point over Ethernet (PPPOE) dial-up access method is as follows:

An access device (eg, PC, STB) 110 initiates a dial-up terminal, initiates a PPPoE request, the request is routed through a home network or a home gateway, and the Multiplexer bridges to the BRAS

140;

The BRAS 140 peer-to-peer (PPP) protocol version 4/6 module 141 terminates the PPPoE message and creates a corresponding virtual link to notify the dial-up client (not shown) to initiate authentication;

The access device 110 sends the account number and password to the BRAS 140 through a Password Authentication Protocol (PAP) or a challenge handshake authentication protocol (CHP);

After receiving the account number and password sent by the client, the BPP 140 PPP Protocol Module 4/6 module 141 sends it to the proxy server 142 and constructs an authentication request accordingly. Thereafter, the authentication request is sent to the function server 150 for authentication;

If the authentication is passed, the proxy server 142 notifies the dial-up client to apply for an IP address through the PPP protocol version 4/6 module 141;

The access device 110 applies for an IP address to the BRAS 140;

After receiving the address allocation request, the PPP protocol version 4/6 module 141 of the BRAS 140 requests the proxy server 142 for an IP address, and the proxy server 142 generally uses the dynamic of the shared address pool. Assigning, or the function server 150 specifies the static allocation mode to be delivered, and assigning an IP address to the dialing client;

After the proxy server 142 successfully assigns the address, the PFP protocol 4/6 module 141 informs the access device 110 of the IP address it has applied for;

The access device 110 uses the IP address to access the network through the virtual link.

Currently, the non-authenticated access modes used in the prior art mainly include: a DHCP access mode and an automatic address configuration access mode.

The access process of the DHCP access mode is as follows:

After the user starts the PC, the PC automatically opens the Dynamic Address Configuration Protocol Client (DHCP Client) function and starts to apply for an IP address. The DHCP client sends a search message (DHCP DISCOVER) to the interface link where the NIC is located to find an available DHCP server (DHCP Server). After detecting the DHCP DISCOVER packet, the BRAS forwards the packet to the DHCP server by using its internal forwarding function (DHCP Relay).

After receiving the message, the DHCP server confirms that the PC can be assigned an IP address, and then responds with a confirmation message. The confirmation message is forwarded to the DHCP client of the PC through the BRAS. At this point, the PC finds an available DHCP Server.

The DHCP client sends a request to the DHCP server to allocate an IP address packet through the BRAS. After receiving the request, the DHCP server allocates an IP address and network related parameters to the PC, and sends a response packet to the user through the BRAS. Thereafter, the user PC accesses the network using the obtained IP address and associated network parameters.

The access process of the automatic address configuration access mode is as follows:

After the user starts the access device, the access device automatically starts the automatic address configuration function of the IPv6 protocol. The access device detects whether there is an interface ID with the same interface ID as the interface ID of the network interface, and the interface ID of the interface is configured by the MAC address of the network card of the access device.

If it does not exist, apply for the IP address prefix and network parameters of the link to the router connected to the link. The router constructs a globally unique IP address according to the BP address prefix assigned to it and the interface ID, and then feeds back to the UE. Thereafter, the user accesses the network using the obtained IP address and associated network parameters. In order to enable the non-authenticated access method to apply for an IP address and an access network by means of authentication, the prior art provides an authentication access method based on Internet web page (WEB) authentication technology for a private line access mode such as DHCP. The process is as follows:

The steps before requesting the assignment of an IP address message to the BRAS are the same as the non-authentication access method described above.

Before the BRAS receives the notification confirming that the user is authenticated by WEB, it does not allow the user to use the network, and discards the user other than the Hypertext Transfer Protocol (HTTP) message. After that, the HTTP packet is redirected to the WEB server.

The WEB Server forcibly sends an authentication page to the user. After receiving the authentication page, the user manually inputs a pre-assigned account number and password in the web page, and then sends an HTTP-based authentication request to the BRAS. The BRAS forwards the authentication request to the WEB Server.

The WEB Server sends the user's account and password to the authentication server for authentication. After the authentication server identifies the authentication result, the WEB Server is notified of the authentication result. If the authentication is passed, the WEB Server notifies the BRAS that the user can use the network normally, and forcibly sends the authentication pass page to the user, prompting the user to access the Internet normally. Otherwise, inform the user that the authentication failed.

The purpose of the non-authenticated access mode can be unified into the authentication access mode by using the WEB authentication technology, thereby achieving unified charging and management for devices with different access modes. However, it is obvious that the method needs to set a processing module corresponding to the WEB technology in the BRAS, and the WEB device such as the WEB Server needs to be added in cooperation with the BRAS and the authentication server to provide the authentication function for the non-authenticated access mode.

At the same time, non-PC terminals are required to support the HTTP protocol, the Secure Hypertext Transfer Protocol (HTTPS) protocol, and the WEB authentication protocol. Moreover, WEB authentication technology requires pre-allocation of accounts and passwords, but information appliances based on IPv6 protocols need to be plug-and-play, so this method cannot be implemented for terminal devices that do not integrate multiple protocols and/or require plug-and-play.

The WEB authentication technology cannot also bind the user's IP address to the access location. This is vulnerable to attack in the actual working environment.

Summary of the invention The present invention provides an authentication access system, an authentication access method, and a server, which can conveniently implement authentication access of a client supporting a non-authenticated access mode.

According to an aspect of the present invention, an authentication access system includes: a broadband access server BRAS connected to an access device, and a function server connected to the BRAS;

The BRAS includes: a protocol termination module, configured to receive and terminate a protocol packet sent by the access device, and a proxy module, configured to construct a request message; the BRAS further includes: a scheduling module A3S, which is connected to the protocol termination Between the module and the proxy module, configured to construct authentication information for the non-dial access mode and send to the proxy module, and forward the address allocation information and the charging information; or directly forward the authentication information of the dialing access mode to the proxy module, and forward the Address allocation information and billing information.

The proxy module includes: an authentication proxy module, an address assignment proxy module, and a charging proxy module, which are respectively connected to the A3S; and the address allocation proxy module is configured to construct an address according to location information of the access device And an authentication requesting module, configured to: according to the location information of the access device, and the authentication information, an authentication request message; the charging proxy module, configured to use the location information of the access device And the authentication information constructs a charging request message.

The function server includes: an authentication module, which is connected to the authentication proxy module, and configured to authenticate the sent authentication request message; and an address allocation module, which is connected to the address allocation proxy module, for authenticating The access device allocates an IP address; and the charging module is connected to the charging proxy module for charging the service.

The protocol termination module includes: a dynamic host configuration protocol (DHCP) module, which is used to terminate DHCP protocol packets; a point-to-point protocol (PPP) module, which is used to terminate PPP protocol packets; and an auto configuration (Auto config) module. Protocol packet used to terminate stateless address configuration.

According to another aspect of the present invention, in an authentication access method, an access request message initiated by an access device to authenticate an access mode and a non-authentication access mode is received by a broadband access server (BRAS), and the access is authenticated. The mode-initiated access request message is forwarded directly to the function server for authentication. After receiving the access request message initiated by the non-authenticated access mode, the BRAS obtains the location information of the access device to construct authentication information, and sends the authentication information to the function server. Send and carry The authentication request message of the authentication information is authenticated by the function server, and the BRAS determines whether the user is allowed to access according to the authentication result.

The non-authenticated access mode is a dynamic host configuration access mode, or the automatic access mode is configured; the authentication access mode is a point-to-point access mode.

The obtaining the location information of the access device is: obtaining the access request message sent by the access device, or sending, by the BRAS, a query request to the digital subscriber line multiplexer (DSLAM) where the access device is located to obtain .

The authentication information constructed by BRAS includes: account number and / or password. The account is constructed according to the port number of the DSLAM and the BRAS port number where the access device is located, and the password is constructed according to the BRAS port number; or, according to the DSLAM port number and/or the connection where the access device is located The account and password are constructed by entering a media access control (MAC) address of the device; or the password is constructed based on the BRAS port number and/or the IP address of the interface.

The DSLAM port number includes: a device number of the DSLAM and a port number of the access device; the BRAS port number includes: a device number of the BRAS and a port number of the access device.

After the authentication, the IP address assigned to the user is bound to the access device. And binding the IP address to the access device according to the port information of the BRAS and the MAC address of the access device; or binding the IP address to the access device according to the DSLAM port number where the access device is located.

After the access device initiates the access request by using the non-authentication access mode and assigns the IP address to the device, the following steps are also included: After receiving the access packet sent by the access device, the BRAS starts to charge the access packet. . After the charging starts, the access information of the access device is periodically detected, and when the access information is not detected, the charging is terminated. The access information is an address resolution protocol (ARP) packet, a neighbor discovery protocol (ND) packet, or a global link IP address applied by the user.

According to still another aspect of the present invention, a broadband access server is provided, including: a protocol termination module, configured to receive and terminate a protocol packet sent by the access device; a proxy module, configured to construct a request message; a scheduling module A3S, which is connected between the protocol termination module and the proxy module, configured to construct authentication information for the non-dial access mode and send it to the proxy module Block, and forwarding address allocation information and charging information; or directly forwarding the authentication information of the dialing access mode to the proxy module, and forwarding the address allocation information and the charging information.

The proxy module includes: an authentication proxy module, an address assignment proxy module, and a charging proxy module, which are respectively connected to the A3S;

The address allocation proxy module is configured to construct an address allocation request message according to the location information of the access device;

The authentication proxy module is configured to construct an authentication request message according to the location information of the access device and the authentication information;

The charging proxy module is configured to construct a charging request message according to the location information of the access device and the authentication information.

The broadband access server further includes: an address allocation module connected to the address assignment proxy module, configured to allocate an address for the authenticated access device.

The protocol termination module includes:

The dynamic host configuration protocol, the DHCP module, is used to terminate the protocol packets of the DHCP protocol. The PPP module is used to terminate the PPP protocol packets.

The Auto config module is automatically configured to terminate the association of stateless address configurations. The beneficial effects of the present invention are as follows:

The authentication access system of the present invention can construct the authentication information for the non-authentication access mode, so that the non-authentication access mode is unified into the authentication access mode. After the access is successful, the accounting information is constructed by using the authentication information to charge the access device.

The problem that the access device supports multiple protocols is solved, and the difficulty of protocol configuration of the access device and the cost of the access device are reduced.

In addition, the system using the present invention only needs to add a scheduling module to the system, which reduces the system cost.

The invention does not need to allocate an account number and a password in advance, but the scheduling module automatically constructs a globally unique account and password according to the location information of the access device, so the invention can be compatible with all IP devices and realize plug and play function. .

The invention unifies the address allocation of various access modes into the address allocation module, which facilitates unified management and planning of addresses. Further, according to the location information of the access device, the device is Binding to its corresponding IP address ensures that the device can apply for the same IP address each time, simplifying the operation and reducing the cost.

The invention provides an effective supporting means for the long-term coexistence of the IPv4 protocol and the IPv6 protocol by separating the access mode and the authentication mode.

Based on the system and the authentication method of the present invention, a unified charging policy can be used for charging for various access modes, which facilitates implementing multiple charging policies in the system, so that operators can obtain greater benefits.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram of a prior art home network;

2 is a network diagram of a system for dial-up access in the prior art;

3 is a networking diagram of an embodiment of a system of the present invention;

4 is a flow chart of an embodiment of a method of the present invention.

In the embodiment, the system can implement the authentication function for the non-authenticated access mode, so that the system does not need to support multiple protocols, so that the system can implement the binding of the IP address and the access location, and To improve the compatibility of the system with the IP device, the present invention adds a scheduling module (A3S) to the access authentication system, which is used to construct the authentication information for the non-authenticated access mode, so that the non-authenticated access mode can be normalized into the authentication mode.

The network of the authentication access system of the present invention is shown in FIG. 3. The system includes: a broadband access server (BRAS) 400 connected to the access device 300, and a function server 500 connected to the BRAS 400.

The BRAS 400 includes:

The protocol termination module 410 connected to the access device 300 includes a Dynamic Host Configuration Protocol (DHCP) module 411, a Point-to-Point Protocol Module (PPP) module 412, and an Auto Config module 413, and protocols of other protocols. a module (not shown), wherein the automatic configuration module 413 may be a stateless automatic address configuration module based on an IPv6 protocol;

a scheduling module (A3S) 420 connected to the protocol termination module 410; The proxy module 430 connected to the A3S 420 includes an address assignment proxy module 431, an authentication proxy module 432, and a billing proxy module 433.

The function server 500 includes an authentication module 520 connected to the authentication proxy module, an address assignment module 510 connected to the address assignment proxy module, and a billing module 530 connected to the billing proxy module.

The BRAS 400 is configured to receive an access request message sent by the access device 300, and perform access processing on the request message. In the BRAS 400:

The protocol termination module 410 is configured to receive and terminate the protocol packet from the access device 300. The DHCP module 411 is used to terminate the DHCP protocol packet; the PPP module 412 is used to terminate the PPP protocol packet; and the Auto config module 413 is used to terminate the protocol for the stateless address configuration.

The A3S 420 is configured to construct an account and a password for a non-authenticated access mode (for example, a private line access mode), and forward the account and the password, or directly forward the account of the authenticated access method sent by the user. And password; and forwarding address allocation information and billing information after the authentication is passed.

The authentication proxy module 432 inside the proxy module 430 is configured to construct an authentication request message according to the location information of the access device and/or the media access control address, and the account and password configured by the A3S 420; The address allocation proxy module 431 is configured to construct an address allocation request message according to the location information and/or the MAC address of the access device; the charging proxy module 433 is configured to use location information and/or MAC according to the access device. The address is used to construct an accounting request message.

The authentication module 520 is configured to authenticate the authentication request information sent by the authentication proxy module. The address allocation module 510 is configured to allocate an IP address to the authenticated access device. 530 is used to charge the service.

The above address allocation module can also be set in the BRAS, and the connection relationship and function are unchanged.

That is, the broadband access server provided by the embodiment of the present invention can provide a unified authentication, address, and charging mechanism for multiple access modes. E.g:

For non-dial-up access, the broadband access server constructs authentication messages and processes them. The certificate process, address allocation and billing according to the authentication result.

For dial-up access, the broadband access server relays the authentication message, the address message, and the charging message to the function server, where the transfer refers to the account and password, the address, and the charging message that will extract the authentication message of the dialing mode. Interface protocol forwarding of the function server.

The A3S may be configured to perform an authentication message according to the foregoing message proxy user when the user accesses the application address or the check address overlap message in a non-dial manner; after collecting the authentication and the address assignment succeeding, the A3S is responsible for collecting and reporting the charging proxy module. The corresponding charging information, for example, according to the charging policy delivered by the authentication band module, constructs an accounting message for the charging event of the protocol termination module.

The method of the present invention normalizes the non-authenticated access method into the authenticated access method by constructing authentication information for the non-authenticated access method in the system. The flow of the embodiment of the method of the present invention is shown in Figure 4, and includes the following steps:

51. The access device sends an access request message to the BRAS by using an authenticated access mode or a non-authenticated access mode.

52, the BRAS determines the manner in which the access request message is initiated, if initiated in the authenticated access mode, then proceeds to step S5; if initiated in the non-authenticated access mode, proceeds to step S3;

53. The BRAS constructs authentication information according to the location information of the access device.

54. The BRAS sends an authentication request message carrying the authentication information to the function server.

55, the function server authenticates the user; if there is access permission, then proceeds to step S7; otherwise, proceeds to step S6;

56. Informing the user of the reason for the access failure;

57. The function server allocates an IP address to the access device.

58. The access work is completed by the BRAS.

The specific implementation steps of the method of the present invention are described below by way of two examples of non-authenticated access methods.

Example 1: The DHCP access mode is authenticated and accessed.

The access device initiates an access request using a DHCP version 4 or 6 (v4/v6) protocol, and the access request message is bridged to the BRAS device through the RTU, and the Multiplexer or DSLAM. The protocol termination module in the BRAS determines the protocol format of the request access message, and concludes that the message is initiated by the DHCP v4/v6 protocol. Then, the message is transferred to the DHCP module in the protocol termination module to terminate the DHCP protocol packet of the user. After the above operation is completed, the processed request access message is sent to the A3S module to apply for an IP address from the system.

The A3S sends an acknowledgment message to the system to confirm whether the corresponding address allocation server and authentication server are configured on the interface where the access device is located. After confirming that the device is set, the A3S obtains the location information in the access request message sent by the access device, or the BRAS sends a query request to the DSLAM where the access device is located to obtain the location information of the access device, To construct authentication information. That is, the account is constructed according to the DSLAM port number and the BRAS port number where the access device is located, and the password is constructed according to the BRAS port number. The DSLAM port number includes: a DSLAM device number and a user access port number (for example, an asymmetric digital subscriber line (ADSL, Asymmetric) port number); the BRAS port number includes: a BRAS device number and a user connection Incoming port number (for example: physical port number, virtual local area network identifier (VLAN, Virtual LAN)). The account number and password may also be constructed according to the DSLAM port number of the access device and/or the media access control address of the access device, or according to the BRAS port number and/or the IP address of the interface.

After the authentication information such as the password and the account is configured for the access device, the A3S sends the authentication information to the authentication proxy module, where the authentication proxy module is based on the location information of the access device and/or the media access control address. And an account and password constructed by the A3S to construct an authentication request message, and send the authentication request message to the authentication module.

After receiving the authentication request message, the authentication module parses the account and password of the access device, and authenticates the authentication information. The authentication module records the corresponding information of the user, and simultaneously issues the corresponding policy, and feeds the authentication result to the A3S through the authentication proxy module. If the A3S confirms that the user authentication fails, the information of the corresponding server cannot be directly returned to the access device; otherwise, the A3S informs the address allocation proxy module that the authentication is passed.

After receiving the message of the authentication, the address allocation proxy module constructs an address allocation request message according to the location information and/or the MAC address of the access device, and sends the message to the address allocation module. The location information includes: a port number of a digital subscriber line multiplexer where the access device is located And BRAS port number.

The address allocation module allocates a corresponding IP address and corresponding lease period to the device according to the port information and the MAC address of the user, and establishes a binding relationship between the MAC address, the port information, and the IP address. Thereafter, the assigned IP address and the corresponding lease are fed back to the A3S through the address assignment agent module.

Based on the obtained IP address, the A3S establishes a mapping relationship between the IP address and the policy of the user that is delivered. After that, the DHCP module notifies the user that the address allocation is successful, and the BRAS completes the subsequent access work. This is the end of the process.

Example 2: Authenticate the automatic configuration access mode and access it.

The automatic configuration mode is proposed in the IP version 6 protocol. This access mode is stateless, and the access mode will automatically configure the address for the access device. The method is as follows: The access device creates an IP address of the local link network segment to which the interface belongs, and then sends a link detection message to the system to detect whether the created address is a duplicate address. After receiving the Duplicated Address Detection (DAD), the protocol termination module in the BRAS transfers the duplicated address detection (DAD) to the automatic configuration module. After confirming that the address does not currently conflict, the protocol termination module initiates the A3S. Authentication request.

The A3S sends an acknowledgment message to the system to confirm whether the corresponding address allocation server and authentication server are configured on the interface where the access device is located. After confirming that the device is set, the A3S obtains the location information in the access request message sent by the access device, or the BRAS sends a query request to the DSLAM where the access device is located to obtain the location information of the access device, To construct authentication information. That is, the account is constructed according to the DSLAM port number and the BRAS port number where the access device is located; and the password is constructed according to the BRAS port number. Or use other location information to construct authentication information.

After receiving the authentication request message, the authentication module parses the account and password of the access device, and authenticates the authentication information. The authentication module records the corresponding information of the user, and at the same time The corresponding policy is issued, and the authentication result is fed back to the A3S through the authentication agent module. If the A3S confirms that the user authentication fails, the access device directly returns to the access device cannot use the address or address overlap information; otherwise, the A3S informs the distribution agent module that the authentication is passed and the created address does not overlap.

The distribution agent module constructs an address allocation request message according to the location information and/or the MAC address of the access device, and sends the message to the address allocation module. The location information includes: a port number of the digital subscriber line multiplexer where the access device is located, and a BRAS port number.

The address allocation module allocates a local link IP address and a corresponding lease period created by the access device according to the port information and the MAC address of the user, and establishes a binding between the MAC address, the port information, and the IP address. relationship. Thereafter, the assigned IP address and the corresponding lease are fed back to the A3S through the address assignment proxy module. Complete access to the local link.

Then, the A3S applies to the address allocation proxy module for the global address network segment information corresponding to the interface where the access device is located. The authentication and access procedures are the same as the above process. After obtaining the global address network segment information, the BRAS completes the subsequent access work. This is the end of the process.

In order to achieve the effect of unauthenticated access mode normalization to the authentication access mode, the access mode requiring authentication can also be implemented by using the authentication access system of the present invention.

Example 3: Point-to-point access.

a. The access device uses the PPPoE protocol to apply for access to the network. The request access message is bridged to the BRAS device through the RTU and the Multiplexer. The protocol termination module in the BRAS device determines the protocol format of the request access message, and the message is initiated by the PPPoE protocol. Then, the message is transferred to the PPP protocol module inside the protocol termination module, and the PPPoE protocol is terminated and a corresponding virtual link is created. Afterwards, the access device is notified to initiate an authentication request in the virtual link. If the access device accesses the network using the Point-to-Point Protocol (PPPoA) protocol based on the asynchronous transfer mode, the process directly jumps to step b;

b. The PPP protocol module extracts the account and password input by the user from the request message and sends it to the A3S. In this case, A3S no longer constructs authentication information for the access device, but directly sends the authentication information input by the user to the authentication proxy module. The authentication agent module constructs an authentication request message according to the authentication information and the location information, and sends the authentication request message to the authentication module.

When the authentication module fails to respond to the authentication, the A3S notifies the PPP protocol module to the access device. Initiating a broken link request and tearing down the corresponding virtual connection; otherwise, the A3S notifies the PPP protocol module to initiate an address allocation request to the access device, and requests the corresponding IP address from the address allocation proxy module.

Subsequent allocation and binding BP address processing is consistent with the DHCP access mode. After the A3S obtains the assigned IP address, if the PPPv4 user initiates the access request, the A3S feeds back the corresponding IP address to the PPP protocol module; if the PPPv6 user initiates the access request, the user is located The pre-configured IP address prefix of the interface is returned to the access device, and the IP address prefix of the virtual link is saved. When the user initiates the automatic address configuration, the user automatically returns a corresponding IP address prefix to the system, thereby enabling the access device. Get a real IP address.

Based on the foregoing system and the authentication access method, after the IP address is assigned to the access device, the charging step is started, and the following is the corresponding authentication access method, which is specifically described by three examples.

Example 1-1: The charging method corresponding to the DHCP access method.

After the operation of assigning an IP address is complete, the DHCP protocol module in the protocol termination module waits for the ARP or ND packet sent by the user.

When the access device accesses the Internet using the assigned IP address, and the DHCP module receives the message, it determines that the user is online, and reports the user to the A3S module to go online. Thereafter, the A3S module initiates a charging start request to the charging module through the charging proxy module, and starts charging for the user.

After the start of the accounting, the DHCP protocol module checks whether there is an ARP (Address Resolution Protocol) or ND (Neighbor Discovery) packet of the user. When the DHCP protocol module detects that the ARP or D neighbor of the access device is in the "out of position" state, the user is determined to go offline, and the user is reported to the A3S module to go offline. After that, the A3S sends a termination charging request to the charging module through the charging proxy module, and ends charging the user.

Example 2-1: Automatically configure the accounting method corresponding to the access method.

After the operation of assigning an IP address is completed, the automatic configuration module in the protocol termination module waits for the global link IP address information sent by the access device.

When the access device uses the assigned IP address to access the Internet, and the automatic configuration module detects the global link IP address information of the user, it determines that the user goes online and sends the A3S module to the A3S module. Report the user online. Thereafter, the A3S module initiates a charging start request to the charging module through the charging proxy module, and starts charging for the user.

After the accounting starts, the automatic configuration module detects whether there is a global link IP address every certain period of time. When the automatic configuration module detects that the global link IP address of the access device is not in the state, the user is determined to go offline, and reports the user to the A3S module to go offline. Then the A3S passes the charging proxy module to the charging module. A termination charging request is sent and the user is charged.

Example 3-1: Point-to-point PPP access mode The charging method is similar to the above two charging method examples.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

Rights request

An authentication access system, comprising: a broadband access server BRAS connected to the access device, and a function server connected to the BRAS;

The BARS is configured to construct authentication information and an authentication request message corresponding to the authentication information for the non-authentication mode access; after the authentication is passed, the request information and the charging information are allocated for the access configuration address of the non-authentication mode;

The function server is configured to authenticate the access of the non-authentication mode after receiving the foregoing authentication request message, and perform charging for the non-authentication mode access after the authentication is passed.

The authentication access system according to claim 1, wherein the BRAS comprises: a protocol termination module, configured to receive and terminate a protocol packet sent by the access device; and a proxy module, configured to construct The request message further includes: a scheduling module A3S connected between the protocol termination module and the proxy module, configured to construct authentication information for non-authentication access and send to the proxy module, forward address allocation information, and The fee policy forwards or constructs the charging information; or directly forwards the authentication information of the authentication access mode to the proxy module, and forwards the address allocation information and the charging information.

The system of claim 2, wherein the proxy module comprises: an authentication proxy module, an address assignment proxy module, and a charging proxy module, respectively connected to the A3S;

The address allocation proxy module is configured to construct an address allocation request message according to the information of the access device;

The authentication proxy module is configured to construct an authentication request message according to the information of the access device and the authentication information;

The charging proxy module is configured to construct a charging request message according to the information of the access device and the authentication information.

The system of claim 3, wherein the function server comprises: an authentication module, connected to the authentication agent module, for authenticating the sent authentication request message;

An address allocation module, connected to the address allocation proxy module, configured to allocate an address for the authenticated access device; The charging module is connected to the charging proxy module and configured to charge the service.

The system of claim 3, wherein the BRAS further comprises: an address assignment module coupled to the address assignment proxy module, configured to allocate an address for the authenticated access device.

The system of claim 5, wherein the function server comprises: an authentication module, connected to the authentication agent module, configured to authenticate the sent authentication request message;

The charging module is connected to the charging proxy module and configured to charge the service.

The system according to any one of claims 1 to 6, wherein the protocol termination module comprises:

Dynamic host configuration protocol DHCP module, used to terminate DHCP protocol packets; Point-to-point protocol PPP module, used to terminate PPP protocol ^艮文;

The Auto config module is automatically configured to terminate protocol packets configured for stateless address.

8. An authentication access method, where an access request message initiated by an access device in a non-authenticated access mode is received by a broadband access server BRAS; and the BRAS receives an access request initiated by a non-authenticated access mode. After the message is obtained, the information about the access device is configured to construct authentication information, and an authentication request message carrying the authentication information is sent to the function server, and the function server authenticates the user, and the BRAS determines whether to allow the user to access according to the authentication result. .

9. The method according to claim 8, further comprising: the BRAS directly forwards the access request message initiated by the authentication access mode to the function server for authentication.

The method of claim 9, wherein the non-authenticated access mode is an active access mode, or the access mode is automatically configured; and the authenticated access mode is a point-to-point access mode.

The method of claim 10, wherein the obtaining the information of the access device comprises: acquiring from an access request message sent by the access device, or from the BRAS to the digital user where the access device is located The line multiplexer DSLAM sends a query request to obtain.

The method according to claim 11, wherein the constructing the authentication information comprises: constructing the account according to a port number of the DSLAM and a BRAS port number where the access device is located, and constructing according to the BRAS port number The password; or, the access device The DSLAM port number and/or the media access control MAC address of the access device are configured to construct the account number and password; or the password is constructed according to the BRAS port number and/or the IP address of the interface.

The method of claim 12, wherein the DSLAM port number comprises: a device number of the DSLAM and a port number of the access device;

The BRAS port number includes: a device number of the BRAS and a port number of the access device.

14. The method according to claim 9, wherein after the authentication is passed, the method further comprises: BRAS constructing an address allocation request, the function server assigning an IP address to the access device; or the BRAS assigning an IP address to the access device.

The method according to claim 14, wherein after the authentication, the IP address assigned to the user is bound to the access device.

The method according to claim 15, wherein the access device is bound with an IP address according to the port information of the BRAS and the MAC address of the access device; or, according to the DSLAM where the access device is located The port number is the IP address bound to the access device.

The method of claim 15, wherein, when the access device initiates the access request by using the non-authenticated access mode, and after the IP address is allocated to the access device, the method further includes:

The BRAS receives the access packet from the access device and starts charging it.

The method according to claim 17, wherein after the charging starts, the access information of the access device is periodically detected, and when the access information is not detected, the charging is terminated.

The method according to claim 17 or 18, wherein the access information is an address resolution protocol ARP packet of the user, a neighbor discovery protocol ND^艮, or a global link IP requested by the user. address.

A broadband access server, comprising: a protocol termination module, configured to receive and terminate a protocol packet sent by the access device; and a proxy module, configured to construct a request message;

The method further includes: a scheduling module A3S connected between the protocol termination module and the proxy module, configured to construct authentication information for the non-dial-up access method, send the information to the proxy module, forward the address allocation information, and calculate The fee policy forwards or constructs the charging information; or directly forwards the authentication information of the dialing access mode to the proxy module, and forwards the address allocation information and the charging information.

The broadband access server according to claim 20, wherein the proxy module comprises: an authentication proxy module, an address assignment proxy module, and a charging proxy module, which are respectively connected to the A3S;

The broadband access server of claim 20, further comprising: an address allocation module connected to the address assignment proxy module, configured to allocate an address for the authenticated access device.

The broadband access server according to any one of claims 20 to 22, wherein the protocol termination module includes: