WO2009049557A1

WO2009049557A1 - An authentication-conversion-based communication method, system and device

Info

Publication number: WO2009049557A1
Application number: PCT/CN2008/072700
Authority: WO
Inventors: Weilong Ouyang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-10-15
Filing date: 2008-10-15
Publication date: 2009-04-23
Also published as: CN101414998A; CN101414998B

Abstract

An authentication-conversion-based communication method and a gateway device and a system of network edge, the method comprises: acquiring the authentication information of a client device; and encapsulating the authentication information as the external network authentication protocol message, then sending it to the external network in order to execute an authentication of the external network; and applying an external address and allocating an internal address for the client device after the authentication of the external network is succeed; and building a mapping table which denoting the correspondence of the internal address and the external address; and creating an relaying table according to the mapping table and a relaying strategy; and then, making the client device communicate with the external network according to the relaying table. The present invention may make a client access to a gateway and the network operators signed up with the client itself at the same time.

Description

Communication method, system and device based on authentication mechanism conversion

Technical field

The present invention relates to the field of communications technologies, and in particular, to a communication method, system, and device based on an authentication mechanism conversion. Background technique

Traditional telecom operators establish networks that carry different services and provide different services for different users. For example: PSTN (Public Switched Telephone Network), bearer telephone service, DDN (Digital Data Network) Private line and so on. As telecom competition continues to increase, telecom operators combine different networks into one network to carry multiple services, thereby reducing operating costs and improving profitability. More and more services appear on IP (Internet Protocol) and continue to improve performance, such as Voice over IP, Video over IP, and TV over IP. Therefore, the telecommunication operator selects the IP bearer network as the bearer technology of the converged network, and the telecommunication operator pays more attention to the authentication and charging of the user. However, PPP (Point-to-Point Protocol) dialing is only applicable to dial-up Internet access and DSL (Digital Subscriber Loop) access, and other access methods are not well supported.

The service provider evolves from the PPP (Dial-up) access mode to the access mode of all IP services of the subscriber through a unified transmission mode. The access mode is a Subscriber Session, which includes two basic sessions. IP session (session) and PPP Session (session).

In a broadband environment, IP sessions can be statically or dynamically established via DHCP (Dynamic Host Configuration Protocol), such as IP session calls authenticated by PANA (Network Access Protocol Workgroup), or IP authenticated via DHCP Auth. Conversation call. With the popularity of broadband access (such as DSL) and digital devices (such as PCs), devices inside gateways (including home networks or enterprise gateways) pass LAN (Local Area Network) and WLAN (Wireless Local). Area Network (Wireless Ethernet) interconnects to form an independent network that can be directly connected to a broadband metropolitan area network through a gateway. Users can also get the same experience as cable TV by connecting to the broadband network, or they can log in to the company network via the Internet to access e-mail or servers, so that they can work directly at home.

In the prior art, the Layer 2 bridging function provided by the home gateway is used, and the network operator that the user subscribes to is subscribed by using a protocol such as point-to-point dialing, and accesses the Internet through the home gateway; or directly uses DHCP access. Go to the home gateway, access the gateway and access the Internet through the home gateway to enable the user to access the friend's gateway.

In carrying out the process of the present invention, the inventors have found that the prior art has at least the following problems:

The use of the point-to-point dial-up protocol and the use of DHCP cannot be performed at the same time, so that the user cannot access the gateway and the network operator that is contracted by the user at the same time, and manual intervention is required when switching. Summary of the invention

The embodiment of the invention provides a communication method, a device and a system based on the authentication mechanism, so that the user can access the gateway and the network operator contracted by the user at the same time.

An embodiment of the present invention provides a communication method based on an authentication mechanism, which includes: acquiring authentication information of a user equipment;

Encapsulating the authentication information into an external network authentication protocol packet, and sending the authentication information to an external network for authentication of the external network;

After the authentication of the external network is successful, apply for an external address for the user equipment, and allocate an internal address;

Establishing a mapping table indicating a correspondence between the internal address and the external address; generating a forwarding table according to the mapping table and a forwarding policy;

And performing communication between the user equipment and an external network according to the forwarding table.

The embodiment of the present invention further provides a communication system based on an authentication mechanism, including a user equipment and an external network device, and further includes:

a gateway device at the edge of the network, configured to acquire authentication information of the user equipment, The authentication information is encapsulated into an external network authentication protocol packet, and is sent to the external network for authentication of the external network. After the external network authentication succeeds, the user equipment is requested to apply for an external address, and the address allocation discovery report is received from the user equipment. And assigning an internal address to the user equipment, establishing a mapping table indicating the correspondence between the internal address and the external address, generating a forwarding table according to the mapping table and the forwarding policy, and performing the user according to the forwarding table. Communication of the device with the external network.

The embodiment of the invention further provides a network edge gateway device, comprising: an authentication module, configured to acquire authentication information of the user equipment, encapsulate the authentication information into an external network authentication protocol, and send the external information The authentication request of the network authentication protocol is requested to perform authentication of the external network;

a forwarding table generating module, configured to: when receiving an authentication success message of the external network, request an external address for the user equipment, receive an address allocation discovery message from the user equipment, and allocate an internal address to the user equipment, and establish a mapping table indicating a correspondence between the internal address and the external address, and generating a forwarding table according to the mapping table and a forwarding policy;

And a communication module, configured to send the authentication request message, receive an authentication response message, and perform communication between the user equipment and an external network according to the forwarding table.

Compared with the prior art, in the embodiment of the present invention, after allocating the address for the user, the home gateway may construct a permission table of the user access gateway according to the user account and the external user access permission table, and establish the internal address of the user and Static mapping of external addresses; At the same time, the forwarding of users and gateway devices is dynamically implemented through the permission table. In this way, the user can not only access the services provided by the network operator that he has contracted, but also access the services provided by the gateway. DRAWINGS

1 is a structural diagram of implementing a functional model in an embodiment of the present invention;

2 is a flowchart of an authentication implementation in an embodiment of the present invention;

3 is a structural diagram of implementing a functional model in an embodiment of the present invention;

4 is a flowchart of an authentication implementation in an embodiment of the present invention; 5 is a structural diagram of implementing a functional model in Embodiment 3 of the present invention; FIG. 6 is a flowchart of an authentication implementation in Embodiment 3 of the present invention;

7 is a structural diagram of implementing a functional model in Embodiment 4 of the present invention;

8 is a flowchart of an authentication implementation in Embodiment 4 of the present invention;

FIG. 9 is a structural diagram of a gateway device of a network edge according to an embodiment of the present invention; FIG. 10 is a schematic structural diagram of a system in an embodiment of the present invention. detailed description

An embodiment of the present invention provides a method for converting an authentication mechanism, including:

1. Convert the authentication information from the user equipment into an external network authentication protocol packet. The specific process includes: obtaining a user identifier and a MAC (Media Access Control) address from the authentication information of the user equipment, and encapsulating the user identifier and the MAC address according to an external network protocol. The access mode of the user equipment authentication information includes but is not limited to: 802. lx access mode, PPPoE access mode, and the like; the external network authentication protocol packet includes but is not limited to: PPPoE and DHCP Auth packets.

2. Performing external network authentication on the user equipment by using the external network authentication protocol. The external network authentication protocol uses the external network authentication protocol to convert the authentication information of the user equipment, and the specific process includes: sending an authentication request to the authentication server, and receiving an authentication response message returned by the authentication server.

3. The authentication success message of the external network is converted into the authentication success message of the user equipment, and the user equipment is notified that the authentication is successful. After the user equipment is successfully authenticated, the method further includes: assigning an external address and an internal address on the gateway where the user equipment is located, where the internal address allocated to the user equipment is an address allocation discovery packet received from the user equipment. The internal address on the gateway where the gateway is located; the mapping table indicating the correspondence between the internal address and the external address on the gateway where the internal address and the external address are established.

4. The external user access permission table of the gateway is preset, and the external user access permission table includes a range of user session identifiers (including a MAC address or an internal IP address of the user equipment) that allow access to the gateway; Scope and external users The access permission table determines the access authority of the user equipment, and the access gateway of the user equipment is a forwarding policy of the user equipment, where determining the permission of the user equipment to access the gateway specifically includes: allowing the user equipment to access the gateway And the external network; or prohibiting the user equipment from accessing the gateway and the external network; or allowing the user equipment to access the gateway and prohibiting access to the external network; or allowing the user equipment to access the external network and prohibiting access to the gateway. A forwarding table is generated according to the mapping table and the forwarding policy, and communication between the user equipment and the external device is performed according to the forwarding table.

In the first embodiment of the present invention, when the user uses the EAP SIM access mode (the EAP-SIM authentication mode is mainly used for the SIM card authentication mode of the cellular mobile operator WLAN, the two-way authentication and dynamic key between the user and the network are supported. In this authentication mode, the client uses the WLAN network card with the SIM card reader, that is, the 802.1x dial-up access method to access the gateway, and the friend's home gateway uses the DHCP Auth access method to access the international network. The Internet, and the friend's home gateway set the external user access permission table to support WLAN access, the functional model of the implementation scheme is shown in Figure 1, the user device (such as a portable device) connects to the home gateway through the WLAN network, and through the home gateway Connect to the gateway and IP edge device, connect to the Internet through the IP edge device, and the IP edge device connects to the external DHCP server and the authentication server at the same time.

The user equipment includes an 802.1X authentication client and a DHCP client. The home gateway includes: an internal DHCP server, configured to receive an access request of a DHCP client in the user equipment, and access the internal MAC address of the gateway through the gateway. The 802. lx authentication entity is configured to receive an authentication request of the 802. lx authentication client, access the IP edge device through the DHCP authentication client, or access the IP edge device through the user MAC forwarding table in the home gateway.

The authentication implementation process of the first embodiment is as shown in FIG. 2, and includes:

S201: The user equipment uses the 802. lx authentication entity to exchange the Association message with the home gateway through the WLAN, and requires access to the home gateway.

S202. The Authenticator of the home gateway sends an EAPoL/EAP-Request/Identitiy message to the user equipment to authenticate the user equipment.

S203: The user equipment responds to the home gateway with EAPoL/EAP-Response/Identitiy The message carries the account information of the user equipment.

S204, the home gateway does not have the user equipment authentication data, so the home gateway initiates the DHCP Auth/EAP and 802. lx/EAP SIM authentication conversion mechanism, and extracts the EAP message and the user's MAC address from 802. lx to reconstruct the DHCP Auth message. The broadband access server sends a DHCP Discover/Auth-port/EAP message, requests authentication, and records the account of the user equipment.

S205. The broadband access server sends a DHCP EAP/EAP-Request/Identity message to the home gateway to obtain an account of the user equipment.

S206. The home network sends a DHCP EAP/EAP-Reponse/Identity message to the broadband access server, where the message carries the account of the user equipment.

S207: The broadband access server sends a Radius Request/EAP Message/EAP-Response/Identity message to the authentication server, requesting authentication of the user equipment.

S208: The authentication server responds to the broadband access server with a Radius Request/EAP Message/EAP-Request/SIM/Start message according to the type of the user equipment, and the message carries the version list AT- Version-list, starts the authentication, and performs parameter negotiation.

S209, the broadband access server receives the Radius Request/EAP Message/EAP-Request/SIM/Start message, sends a DHCP EAP/EAP-Request/SIM/Start message to the home gateway, starts authentication, and performs parameter negotiation.

S210: The home gateway converts the DHCP-authenticated EAP message into an 802. lx EAP message EAPoL/EAP-Request/SIM/Start and sends it to the user equipment.

S211, the user equipment responds to the home gateway with an authentication response message EAPoL/EAP-Response/SIM/Start, and the message carries a start request.

S212, the home gateway encapsulates the 802. lx EAP response message EAPoL/EAP-Response/SIM/Start into DHCP EAP/EAP-Response/SIM/Start according to the DHCP Auth protocol format, and forwards it to the broadband access server.

S213: The broadband access server sends a Radius Request/EAP Message/EAP-Response/SIM/Start message to the authentication server, requesting access to the Internet.

S214, the authentication server sends a Radius Request/EAP Message/EAP-Success/DHCP Request message to the broadband access server, where the message carries the inquiry User confirmation parameters: for example, level AT - RAND and address AT - MAC.

S215, the broadband access server sends a DHCP EAP/EAP-Request/SIM/Challenge message to the home gateway, and notifies the user that the device reports the confirmation parameter.

S216, the home gateway converts the DHCP-authenticated EAP message into an 802. lx EAP message EAPoL/EAP-Request/SIM/Challenge and sends it to the user equipment.

S217, the user equipment responds to the home gateway with an authentication response message EAPoL/EAP-Response/SIM/Challenge, and the message carries the confirmation parameter.

S218, the home gateway encapsulates the 802. lx EAP response message EAPoL/EAP-Response/SIM/ Challenge into DHCP EAP/EAP-Response/SIM/ Challenge according to the DHCP Auth protocol format, and forwards it to the broadband access service.

S219, the broadband access server takes the DHCP Auth format and sends the EAP message to the authentication server through the Radius protocol, the Radius Request/EAP Message/EAP-Response/SIM/ Challenge, and the message carries the confirmation parameter of the user equipment.

S220: The authentication server authenticates the user according to the confirmation parameter of the user equipment, and sends a Radius Request/EAP Message/EAP-Success/DHCP Request message to the broadband access server to notify the user that the authentication is successful.

S221: The broadband access server notifies the home gateway of the user equipment authentication by using the DHCP offer/EAP-Success/yiaddr message.

S222: After confirming that the user is successfully authenticated, the home gateway sends an authentication success message EAPoL/EAP-Success to the user equipment, and continues the DHCP Auth process to apply for an external address on the gateway where the user equipment is located.

S223 to s227, after confirming the successful authentication, the user initiates an address allocation discovery message (DHCP Request), and the address allocation server of the home gateway directly responds to the address allocation confirmation (DHCPACK) and starts the address allocation process to allocate the internal address on the gateway where the user is located. . After allocating the address for the user, the home gateway constructs the permission table of the user's access gateway according to the user account and the external user access permission table, and establishes a static mapping of the user's internal address and the external address; and simultaneously realizes the dynamic access table by accessing the gateway. Forwarding of users and gateway devices. In this way, users can not only access the network operators provided by their own contract. The service can also access the services provided by the gateway.

In the second embodiment of the present invention, when the user uses the EAP SIM access mode (802.1x dial-up access mode), the friend's home gateway uses PPPoE (Ethernet Point-to-Point Protocol) to access the Internet, but does not set When the external user access table supports WLAN access, the functional model of the implementation scheme is shown in Figure 3. The rest is the same as the structure of Figure 1 except that the home gateway uses the PPPoE authentication client instead of the DHCP authentication client.

The authentication implementation process of the second embodiment is as shown in FIG. 4, and includes:

S401: The user equipment uses an 802.1x authentication client to exchange Association messages with the home gateway through the WLAN, and requests access to the home gateway.

S402: The 802.1X authentication body (Authenticator) of the home gateway sends an EAPoL/EAP-Request/Identitiy message to the user equipment to authenticate the user equipment.

S403. The user equipment sends an EAPoL/EAP-Response/Identitiy message to the home gateway to the home gateway, where the message carries the account information of the user equipment.

S404, the home gateway does not have the user equipment authentication data, so the home gateway initiates the PPPoE/EAP and 802.1 x/EAP SIM authentication conversion mechanism, and after the PPPoE discovery phase ends, the EAP message and the user's MAC address are retrieved from the 802. lx. A PPPoE authentication message is constructed according to the PPPoE EAP authentication protocol, and a PPPoE/LCP/EAP message is sent to the broadband access server to request authentication and record the account of the user equipment.

S405. The broadband access server sends a PPPoE/EAP/EAP-Request/Identity message to the home gateway, and obtains an account of the user equipment.

S406: The home gateway sends a PPPoE/EAP/EAP-Reponse/Identity message to the broadband access server, where the message carries the account of the user equipment.

S407. The broadband access server sends a Radius Request/EAP Message/EAP-Response/Identity message to the authentication server, requesting authentication of the user equipment.

S408: The authentication server responds to the broadband access server with a Radius Request/EAP Message/EAP-Request/SIM/Start message according to the type of the user equipment, and the message carries the version list AT- Version-list, starts the authentication, and performs parameter negotiation.

S409, the broadband access server receives the Radius Request/EAP After the message/EAP-Request/SIM/Start message, the PPPoE/EAP/EAP-Request/SIM/Start message is sent to the home gateway to initiate authentication and perform parameter negotiation.

S410: The home gateway converts the PPPoE-certified EAP message into an 802. lx EAP message EAPoL/EAP-Request/SIM/Start and sends the message to the user equipment.

S411, the user equipment responds to the home gateway with an authentication response message EAPoL/EAP-Response/SIM/Start, and the message carries a start request.

S412, the home gateway encapsulates the 802. lx EAP response message EAPoL/EAP-Response/SIM/Start into PPPoE/EAP/EAP-Response/SIM/Start according to the PPPoE protocol format, and forwards it to the broadband access server.

S413: The broadband access server sends a Radius Request/EAP Message/EAP-Response/SIM/Start message to the authentication server, requesting access to the Internet.

S414: The authentication server sends a Radius Request/EAP Message/EAP-Success/DHCP Request message to the broadband access server, where the message carries the user confirmation parameter that needs to be queried: for example, level AT-RAND and address AT-MAC.

S415, the broadband access server sends a PPPoE/EAP/EAP-Request/SIM/Challenge message to the home gateway, and notifies the user equipment to report the confirmation parameter.

S416, the home gateway converts the PPPoE-certified EAP message into an 802. lx EAP message EAPoL/EAP-Request/SIM/Challenge and sends it to the user equipment.

S417, the user equipment responds to the home gateway with an authentication response message EAPoL/EAP-Response/SIM/Challenge, and the message carries the confirmation parameter.

S418, the home gateway will encapsulate the 802. lx EAP response message EAPoL/EAP-Response/SIM/ Challenge into PPPoE/EAP/EAP-Response/SIM/ Challenge according to the PPPoE protocol format, and forward it to the broadband access service.

S419, the broadband access server takes the PPPoE format to take out the EAP message and responds to the authentication server by using the Radius protocol Radius Request/EAP Message/EAP-Response/SIM/Challenge, and the message carries the confirmation parameter of the user equipment.

S420: The authentication server authenticates the user according to the confirmation parameter of the user equipment, and sends a Radius Request/EAP to the broadband access server. The message/EAP-Success/DHCP Request message informs the user that the authentication is successful. S421: The broadband access server notifies the home gateway of the user equipment success by using the PPPoE/EAP/EAP-Success/yiaddr message.

S422: After confirming that the user is successfully authenticated, the home gateway sends an authentication success message EAPoL/EAP-Success to the user equipment, and continues the PPPoE process to apply for an external address on the gateway where the user equipment is located.

S423 to s426, after confirming the successful authentication, the user initiates an address allocation discovery message (DHCP Request), and the address allocation server of the home gateway directly responds to the address allocation confirmation (DHCPACK) and starts the address allocation process to allocate the internal address on the gateway where the user is located. . After allocating the address to the user equipment, the home gateway constructs the permission table of the user's access gateway according to the user account and the external user access permission table, and establishes a static mapping of the user's internal address and the external address; The user accesses the network to publish and establish a mapping relationship between the user's internal address and the external address. In this way, the user can only access the services provided by the network operator that he or she has contracted but cannot access the services provided by the gateway.

In the third embodiment of the present invention, when the user uses the PPPoE dialing access mode, and the friend's home gateway uses the DHCP Auth to access the Internet, the friend's home gateway sets the external user access permission table to allow the user to access part of the gateway. When the resources support PPPoE access, the functional model of the implementation scheme is shown in Figure 5. The user equipment only includes the PPPoE client, and the 802. lx authentication in the home gateway is replaced by the PPPoE proxy. The other parts are the same as in Figure 1. .

The authentication implementation process of the third embodiment is as shown in FIG. 6, and includes:

Step s601 to step s604, when the user equipment accesses the home gateway by using the Ethernet, the user equipment starts PPPoE dialing, and the PPPoE proxy (Proxy) of the home gateway negotiates with the user to establish PPPoE.

In step s605, the user equipment sends a PPPoE/PPP/LCP/Configure-Resquest configuration request message to the home gateway.

Step s606, the home gateway sends the user equipment PPPoE/PPP/LCP/Configure-Ack configuration response message.

Step s607: The home gateway initiates authentication of the user equipment, and initiates authentication conversion of DHCP Auth/CHAP and PPPoE. Taking CHAP as an example, the home gateway constructs a DHCP message DHCP Discover/Auth-Prot/CHAP according to the user's MAC, and sends it to the broadband access server to initiate address allocation.

Step s608: The broadband address server sends the address discovery packet DHCP Discover to the external DHCP server.

Step s609: The external DHCP server returns an address allocation confirmation message (DHCP Offer) to the broadband address server, where the message carries a parameter such as challenge.

Step s610, the broadband access server returns an address allocation confirmation message to the home gateway.

(DHCP Offer) and carry parameters such as challenge.

Step s611: The home gateway extracts a challenge message from the DHCP message to construct a PPP CHAP authentication message PPPoE/PPP/CHAP/Challenge, and initiates authentication of the user equipment.

Step s612: The user equipment sends a PPPoE/PPP/CHAP/Response message to the home gateway, where the message carries the user equipment's own account number and authentication parameters, such as the encrypted word according to the challenge and the user password.

Step s613: The home gateway extracts the account and the authentication parameter of the user equipment from the PPP CHAP message, and the MAC address of the user equipment reconstructs the DHCP Request message to request the broadband access server for authentication and records the user account.

Step s614: The broadband access server sends a Radius/Access-Request/CHAP/Response to the authentication server, requesting authentication of the request of the user equipment.

Step s615, the authentication server authenticates and responds to the authentication result via Radius/Access-Accept/CHAP/Response.

Step s616: The broadband access server sends a DHCP Request request message to the DHCP server, requesting an address to be allocated.

In step s617, the DHCP server sends a DHCP Ack acknowledgment message to the broadband access server, where the message carries the assigned address. Step S618, the broadband access server confirms that the user authentication is passed, and responds to the gateway.

A DHCP Ack/CHAP/Success message notifies the user that the authentication is successful and completes the user's address allocation process.

Step s619: The home gateway sends a DHCP Ack message to the PPPoE CHAP authentication engineering message and sends the message to the user equipment.

Step s619 to step s624, after confirming that the authentication is successful, the user equipment starts the address allocation process, and the PPPoE agent of the home gateway allocates the address inside the gateway to the user through the built-in DHCP server. After assigning the address to the user, the home gateway constructs a permission table of the user's access gateway according to the user account and the external user access permission table, and establishes a static mapping of the user's internal address and the external address; since the permission table only allows the user to access the gateway. Part of the resource, therefore, the forwarding table between the user and part of the resources of the external network is dynamically set by the user accessing the permission table of the gateway and the mapping relationship between the internal address and the external address of the user is established. In this way, the user can only access the services provided by the network operator that he has contracted but cannot access the services provided by the gateway.

In the fourth embodiment of the present invention, when the user uses the PANA dial-up access method, and the friend's home gateway uses the DHCP Auth to access the Internet, the friend's home gateway sets the external user access permission table to allow the user to access part of the gateway. When the resources support PANA access, the functional model of the implementation scheme is shown in Figure 7. The PANA client replaces the PPPoE client in the user equipment, and the PANA proxy in the home gateway replaces the PPPoE proxy. The other parts are the same as in Figure 5.

The authentication implementation process of the fourth embodiment is as shown in FIG. 8, and includes:

Step s801 to step s804, when the user directly uses the Ethernet to the home gateway, the user first initiates a normal DHCP address allocation process, and the built-in DHCP server of the home gateway allocates an internal address to the user according to a normal process.

Step s805: After obtaining the internal address, the user sends a PANA Client Initiation to start the PANA authentication negotiation process.

Step s806: The home gateway starts the PANA authentication proxy (Proxy) to perform the PANA authentication negotiation process with the user and initiates the authentication conversion of the DHCP Auth/EAP and PANA. Taking the EAP CHAP as an example, the home gateway constructs the DHCP Auth message according to the user MAC. (DHCP Discover/Auth prot/EAP) Requests authentication from the broadband access server and negotiates to use the EAP authentication method.

Step s807: The broadband access server responds to the DHCP EAP/EAP-Request/Identity message to the home gateway, and starts the EAP authentication process.

Step s808: If the home gateway does not have the user account information, the DHCP EAP/EAP-Request/Identity is converted into a PANA Auth request/EAP Request message, and the user is notified to start EAP authentication.

Step s809 and step s812, the user responds to the home gateway with a PANA Auth request / EAP Response message, where the message carries the user's account and other related authentication information.

Step s813, the home gateway extracts the EAP message in the PANA message, constructs a DHCP EAP/EAP-Response/Identity according to the user identifier (user account) and the user session identifier (the user's MAC and IP), sends the packet to the broadband access server, and records the user. Account information.

Step s814, the home gateway sends a PANAAuth response to the user.

Step s815: The broadband access server extracts the EAP message from the DHCP message, and requests the authentication server to authenticate the request of the user through the Radius protocol.

Step s816: The authentication server authenticates the user according to the authentication information of the EAP message, and once authenticated, responds to the broadband access server with a Radius Request/EAP Message/EAP-Success message.

Step s817: The broadband access server sends an EAP message from the Radius response message, and confirms that the user authentication is passed, and the home gateway user is notified to pass the DHCP offer/EAP-Success/yiaddr.

Step s818: After confirming that the user authentication is successful, the home gateway allocates a Session Id to the PANA session, and converts the DHCP message into a PANA Bind request according to the EAP message, the Session Id, and the internal address of the user extracted from the DHCP offer/EAP-Success/yiaddr message. (EAP Success, Session Id, IP Filter) message, informing the user that the authentication passes and establishes the binding between the user's internal address and the Session Id. The home gateway sends a DHCP Request message to the broadband access server to continue the DHCP Auth process, and requests the user for an external address on the gateway. In step s819, after confirming that the authentication is successful, the user responds to the home gateway with a PANABind answer confirming that the binding is successfully established, and the user's IP session is successfully established.

Step s820 to step s822, after the proxy user applies to the external address of the user, the home gateway constructs a permission table of the access gateway of the user according to the user account and the external user access permission table, and establishes a static mapping of the internal address and the external address of the user; At the same time, the user and the gateway device are dynamically forwarded through the permission table of the user's access gateway and the mapping relationship between the user's internal address and the external address is established. In this way, the user can access the services provided by the network operator that he or she has signed up, and can also access some resources of the gateway.

The embodiment of the invention further provides a network edge gateway device, as shown in FIG. 9, comprising:

The authentication module 10 is configured to obtain the authentication information of the user equipment, encapsulate the authentication information into an external network authentication protocol packet, and send an authentication request including the external network authentication protocol packet to the communication module 30 to request the external network. Certification.

The forwarding table generating module 20 is configured to: when receiving the authentication success message, apply for an external address on the gateway where the user equipment is located, receive an address allocation discovery message from the user equipment, and allocate, on the gateway where the user equipment is located The internal address, and the mapping table of the user equipment is established according to the internal address and the external address, and the forwarding policy of the user equipment is constructed according to the account of the user equipment and the external user access authority table, and according to the mapping table and forwarding The policy generates a forwarding table.

The communication module 30 is configured to send the request message sent by the authentication module 10 to receive the authentication response message, and perform communication between the user equipment and the external device according to the forwarding table generated by the forwarding table generation module 20.

Further, the forwarding table generating module 20 specifically includes:

The mapping table establishing sub-module 210 is configured to establish a mapping table of the user equipment according to an external address on the gateway and an internal address on the gateway.

The forwarding policy establishing sub-module 220 is configured to construct a forwarding policy of the user equipment according to the account of the user equipment and the external user access authority table.

Further, the mapping table establishing submodule 210 includes:

The external address allocating unit 2110 is configured to: when receiving the authentication success message, The external address on the gateway where the user device applies.

The internal address allocation unit 2120 is configured to receive an address assignment from the user equipment, and allocate an internal address on the gateway where the user equipment is located.

The mapping table establishing unit 2130 is configured to establish a mapping table of the user equipment according to the external address and the internal address determined by the external address assigning unit 2110 and the internal address assigning unit 2120.

Further, the forwarding policy establishing submodule 220 includes:

The access permission table unit 2210 is configured to set an external user access permission table of the gateway, and the identity identifier.

The access authority determining unit 2220 is configured to determine, according to the user identifier and the external user access permission table set by the access authority form element 2210, the access gateway of the user equipment, and the access gateway of the user equipment is the forwarding policy.

Further, the authentication module 10 includes:

The authentication information extraction sub-module 110 is configured to obtain a user identifier list from the authentication information of the user equipment.

The external network protocol encapsulation sub-module 120 is configured to encapsulate the user identification list obtained by the authentication information extraction sub-module 110 according to an external network protocol.

The authentication request sending sub-module 130 is configured to send an authentication request including the external network authentication protocol packet to the communication module 30.

The mobile service experience brought by wireless access to users. With the large-scale deployment of hotspots such as WLANs, users can access the Internet when they leave home, and switch back to the home gateway to access the Internet. When a user visits a friend's home, he can also access the gateway in the friend's home through his own account, and use the service signed by the friend and the network operator to access the Internet to use the service signed by himself.

The embodiment of the present invention further provides a communication system based on the authentication mechanism conversion. As shown in FIG. 10, the user equipment 1001, the external network device 1003, and the gateway device 1005 at the network edge are used. Describe the authentication information of the user equipment, and encapsulate the authentication information into an external network authentication protocol packet; When the user equipment is authenticated by the external network, the network device applies for the external address on the gateway where the user equipment is located; receives the address allocation discovery packet from the user equipment, and allocates the gateway for the user equipment. An internal address, and establishing a mapping table of the user equipment according to the internal address and the external address; and constructing a forwarding policy of the user equipment according to the account of the user equipment and an external user access authority table; and according to the mapping table and the The forwarding policy generates a forwarding table, and performs communication between the user equipment and the external network device according to the forwarding table.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is a better implementation. the way. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium, including a plurality of instructions for making a A computer device (which may be a personal computer, server, or network device, etc.) performs the methods described in various embodiments of the present invention.

In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A communication method based on an authentication mechanism conversion, comprising: acquiring authentication information of a user equipment;

2. The communication method based on the authentication mechanism conversion according to claim 1, wherein the method for constructing the forwarding policy specifically includes:

And configuring a forwarding policy of the user equipment according to an account of the user equipment and an external user access permission table.

The communication method based on the authentication mechanism conversion according to claim 2, wherein the forwarding policy of the user equipment according to the account number of the user equipment and the external user access authority table specifically includes:

Setting an external user access permission table of the gateway, where the external user access permission table includes a list of user identifiers that allow access to the gateway;

Determining the access gateway of the user equipment according to the user identifier list and the external user access permission table, where the access authority of the user equipment is the forwarding policy.

The communication method based on the authentication mechanism conversion according to claim 3, wherein the forwarding policy specifically includes:

Allowing the user device to access the gateway and the external network; or

Disabling the user equipment from accessing the gateway and the external network; or

Allowing the user device to access the gateway and prohibit access to the external network; or

The user equipment is allowed to access the external network and access to the gateway is prohibited.

The communication method based on the authentication mechanism conversion according to claim 1, wherein the obtaining the authentication information of the user equipment, and encapsulating the authentication information into the external network authentication protocol packet is specifically:

Obtaining a user identifier list from the authentication information of the user equipment;

The user identification list is encapsulated according to an external network authentication protocol.

The communication method based on the authentication mechanism conversion according to claim 5, wherein the user identification list includes a user identifier and a user session identifier, the user identifier includes a user account, and the user session identifier includes a user equipment. Media access control MAC address or internal IP address.

The communication method based on the authentication mechanism conversion according to any one of claims 1 to 6, wherein the access mode of the authentication information of the user equipment includes: an 802.1x access mode, a PPPoE access mode, or PANA access mode; the external network authentication protocol packet includes: PPPoE or DHCP Auth packet.

8. A communication system based on an authentication mechanism conversion, comprising a user equipment and an external network, characterized in that:

9. A network edge gateway device, comprising:

The authentication module is configured to obtain authentication information of the user equipment, encapsulate the authentication information into an external network authentication protocol, and send an authentication request including the external network authentication protocol to request authentication of the external network. ;

a forwarding table generating module, configured to: when receiving an authentication success message of the external network, request an external address for the user equipment, receive an address allocation discovery message from the user equipment, and allocate an internal address to the user equipment, and Establishing a mapping table indicating the correspondence between the internal address and the external address, and generating a forwarding table according to the mapping table and the forwarding policy;

The gateway device of the network edge according to claim 9, wherein the forwarding table generating module comprises:

a mapping table establishing submodule, configured to establish a mapping table indicating a correspondence between the internal address and the external address;

A forwarding policy establishment sub-module for accessing the account of the user device and the external user The permission table constructs a forwarding policy of the user equipment.

The gateway device of the network edge according to claim 10, wherein the forwarding policy establishing submodule comprises:

An access permission table unit, configured to set an external user access permission table of the gateway, the external identifier;

The access authority determining unit is configured to determine, according to the user identifier and the external user access permission table, the permission of the access gateway of the user equipment, where the access gateway of the user equipment is the forwarding policy.

12. The gateway device of the network edge according to claim 10, wherein the mapping table establishing submodule comprises:

An external address allocation unit, configured to request an external address for the user equipment when receiving a success message of the external network authentication;

An internal address allocation unit, configured to receive an address allocation discovery message from the user equipment, and allocate an internal address to the user equipment;

A mapping table establishing unit is configured to establish a mapping table indicating a correspondence between the external address and the internal address.

The gateway device of the network edge according to any one of claims 9 to 12, wherein the authentication module specifically includes:

An authentication information extraction submodule, configured to obtain a user identifier list from the authentication information of the user equipment;

An external network protocol encapsulation submodule for using the user identification list according to an external network Encapsulation protocol

The authentication request sending submodule is configured to send an authentication request that includes the external network authentication protocol packet.