[go: up one dir, main page]

WO2018039901A1 - 用于ip地址分配的方法、装置、系统和计算机程序产品 - Google Patents

用于ip地址分配的方法、装置、系统和计算机程序产品 Download PDF

Info

Publication number
WO2018039901A1
WO2018039901A1 PCT/CN2016/097285 CN2016097285W WO2018039901A1 WO 2018039901 A1 WO2018039901 A1 WO 2018039901A1 CN 2016097285 W CN2016097285 W CN 2016097285W WO 2018039901 A1 WO2018039901 A1 WO 2018039901A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
area code
vpn
access node
node
Prior art date
Application number
PCT/CN2016/097285
Other languages
English (en)
French (fr)
Inventor
王华涛
Original Assignee
深圳前海达闼云端智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳前海达闼云端智能科技有限公司 filed Critical 深圳前海达闼云端智能科技有限公司
Priority to CN201680002833.9A priority Critical patent/CN107005603A/zh
Priority to PCT/CN2016/097285 priority patent/WO2018039901A1/zh
Publication of WO2018039901A1 publication Critical patent/WO2018039901A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming

Definitions

  • the present invention relates to the field of virtual private networks, and more particularly to a method, apparatus, system and computer program product for IP address allocation.
  • the Remote Authentication Dial In User Service is a widely used protocol.
  • the RADIUS server also has the function of assigning an IP address to the RADIUS client.
  • the IP address of the network access service can be implemented based on an IP address pool or multiple IP address pools. distribution.
  • the RADIUS server can implement IP address allocation by using the following methods:
  • VSA Vendor-Specific Attributes
  • the IP address pool identifier Pool Name needs to be defined on the NAS.
  • the NAS needs to comply with the RADIUS extension protocol RFC 2869.
  • the RADIUS server can send the packet in the Access-Receive packet (type 88 attribute).
  • the frame pool property, and the system administrator needs to manually configure the NAS for the user and update the authorization properties.
  • the independent software vendor (ISV: Independent Software Vendors) cannot use the framing pool attribute, but can define an IP address pool, that is, the RADIUS server uses the defined IP address pool by using the VSA model.
  • the method is related to the implementation of each ISV, such as Cisco, which uses the Cisco AV-Pair attribute to send IP address pool information.
  • the RADIUS server matches the configured IP address pool according to the NAS-IP-Address and NAS-Port attributes of the RADIUS client. Once RADIUS service After the device is started, the IP address pool configuration information of the RADIUS server cannot be changed unless the RADIUS authentication service is stopped.
  • the inventor of the present invention finds that the first method needs to configure an IP address pool on each NAS, and the centralized management capability is poor; the second method is related to each ISV device, resulting in private attributes being The ISV is mastered and the compatibility is poor.
  • the third method is to restart the RADIUS authentication service to make the modification of the IP address pool take effect and the operation flexibility is poor.
  • the embodiment of the invention provides a method, a device, a system and a computer program product for IP address allocation, so as to solve the Open VPN (Open Virtual Private Network) authentication without stopping the authentication service.
  • Open VPN Open Virtual Private Network
  • the coupling between the IP address allocation of the service and the IP address of the access node is strong, and the technical problem of poor deployment capability based on the expansion of the access node is poor.
  • an embodiment of the present invention provides a method for IP address allocation, which is used in an access node, and includes:
  • an embodiment of the present invention provides a method for IP address allocation, including:
  • an embodiment of the present invention provides an apparatus for IP address allocation, including:
  • a sending module configured to send an area code of the access node to the authentication server when the connection request sent by the client is received, where the area code is used to indicate an area where the access node is located;
  • the receiving module is configured to receive an IP address selected by the authentication server from the IP address pool corresponding to the area code, and forward the IP address to the client.
  • an embodiment of the present invention provides an apparatus for IP address allocation, including:
  • An allocating module configured to select an IP address from the pool of IP addresses corresponding to the area code according to the area code in the authentication request message from the access node, and send the IP address to the access node, where the area code is used to indicate The area where the access node is located.
  • an embodiment of the present invention provides a system for IP address allocation, including:
  • An access device configured to send an area code of the access device to the authentication device when receiving the connection request sent by the client, receive an IP address sent by the authentication device according to the area code, and forward the IP address to the client end;
  • an authentication device configured to select an IP address from the pool of IP addresses corresponding to the area code and send the IP address to the access device.
  • embodiments of the present invention provide a computer program product for use with an apparatus for IP address allocation, the computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein
  • the computer program mechanism includes instructions for performing the various steps of any of the above methods.
  • the access node side of the present invention receives the user IP address sent by the authentication server according to the area code, so that when the access node is extended, the solution between the IP address allocation and the IP address of the access node can be realized without changing the configuration of the authentication server. Coupling, and flexible deployment of access nodes.
  • FIG. 1 is a schematic diagram of a method for an IP address allocation on a VPN node side according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic diagram of an application scenario for IP address allocation according to Embodiment 2 of the present invention.
  • Embodiment 3 is a flowchart of a method for IP address allocation in Embodiment 2 of the present invention.
  • FIG. 4 is a schematic diagram of an application scenario for IP address allocation in Embodiment 3 of the present invention.
  • FIG. 5 is a flowchart of a method for IP address allocation according to Embodiment 3 of the present invention.
  • FIG. 6 is a flowchart of an operation for IP address allocation in Embodiment 3 of the present invention.
  • FIG. 7 is a structural diagram of an apparatus for assigning an IP address on a VPN node side according to Embodiment 4 of the present invention.
  • FIG. 8 is a structural diagram of a system for IP address allocation according to Embodiment 5 of the present invention.
  • the present invention provides that the VPN node sends an authentication request message including the area code to the RADIUS server, and receives the area code from the RADIUS server after the authentication request message is successfully authenticated according to the authentication request message. Sending the user IP address, and sending the received user IP address to the VPN client, so that the VPN node sends an access request message containing the user IP address from the VPN client to the gateway, and then the gateway according to the access The user IP address in the request message is routed to the destination IP address via the tunnel.
  • the RADIUS server is configured to perform an Open VPN server extension by configuring an extended attribute value in the RADIUS protocol as an area code and configuring a correspondence between the area code and the IP address pool identifier in the configuration file on the RADIUS server side.
  • the IP address pool can be dynamically selected according to the area code value, so that the Open VPN server can be flexibly deployed without changing the RADIUS server configuration, that is, when the Open VPN server needs to be added, the Open is implemented. Rapid expansion of the VPN server and rapid replacement of the Open VPN server when the existing Open VPN server is unavailable. The details will be described below.
  • FIG. 1 is a schematic diagram of a method for an IP address allocation on a VPN node side according to Embodiment 1 of the present invention. As shown in FIG. 1 , the method is used in an access node, and the method includes:
  • Step 101 When receiving the connection request sent by the client, send the area code of the access node to the authentication server, where the area code is used to indicate the area where the access node is located.
  • Step 102 Receive an IP address selected by the authentication server from an IP address pool corresponding to the area code, and forward the IP address to the client.
  • the VPN node After receiving the connection request (for example, the login request) from the user, the VPN node carries the area code information in the authentication request message and sends it to the RADIUS server.
  • the access node used in the authentication service network is a VPN node
  • the authentication server is a RADIUS server
  • the client is a VPN client
  • the login request from the user may also be an access request from the user, that is, used for the RADIUS server. Authenticate whether the user has access rights.
  • the VPN node carries its own area code in an authentication request message and sends it to the RADIUS server.
  • the RADIUS server authenticates the authentication request message, and after the authentication succeeds, sends the available user IP address in the IP address pool corresponding to the area code to the VPN node, and the VPN node sends the user IP address to the VPN client for VPN.
  • the client carries the user IP address in the subsequent access request message.
  • the VPN node After receiving the access request message from the VPN client, including the user IP address, the VPN node directly forwards the access request message to the gateway, and the gateway resolves the access request message to obtain the user IP address in the access request message. Based on the obtained user IP address, the gateway uses the correspondence between the user IP address and the destination IP address pre-stored on the gateway side to route the access request message to the destination IP address corresponding to the user IP address through the tunnel, thereby implementing message interworking.
  • the gateway may be a router, that is, a routing rule is set on the router, such as a correspondence between a pre-stored user IP address and a destination IP address.
  • the RADIUS server is modified, that is, the custom extended attribute field is added to the RADIUS database, and the corresponding relationship between the customized extended attribute and the IP address pool is configured in the configuration file.
  • the RADIUS server dynamically selects an IP address pool according to the area code of the Open VPN service, and returns the source IP address corresponding to the area code to the VPN client via the VPN node. Therefore, when the VPN node is expanded and replaced, the decoupling between the IP address allocation and the IP address of the Open VPN server is implemented.
  • the method further includes:
  • the CPU usage of the VPN node is detected.
  • the CPU usage setting can be set according to the actual situation.
  • a new VPN node is created by using the image.
  • the node instance pre-creates a mirror, that is, starts a new VPN node by mirroring.
  • the method further includes:
  • the area code is obtained from the existing access node, and the acquired area code is configured for the access node.
  • the affiliated VPN node When the affiliated VPN node detects that it has been created, it obtains the area code and RADIUS server identifier in the original VPN node, and sets its own area code and RADIUS server identifier according to the area code and RADIUS server identifier respectively.
  • the new VPN The area code and RADIUS server ID in the node are the same as the area code and RADIUS server ID in the original VPN node.
  • the new VPN node is an extended VPN node of the original VPN node.
  • the new VPN node sends an authentication request message containing the area code to the RADIUS server, receives the user IP address sent by the RADIUS server according to the area code in the authentication request message, and sends the received user IP address to the VPN client. So that the new VPN node sends an access request message containing the user IP address from the VPN client to the gateway, and then the gateway routes the access request message to the destination IP address according to the user IP address in the access request message.
  • the area code is obtained from the existing VPN node, and the obtained area code is configured for the VPN node, including:
  • EAP Extensible Authentication Protocol
  • PPP Point to Point Protocol
  • EAP can support additional authentication methods in PPP.
  • the RADIUS protocol can utilize EAP-Message and Message-
  • the Authenticator attribute supports EAP, where the attribute consists of a Type-Length-Value triplet that can be used to add new attribute values without affecting the implementation of the protocol.
  • the RADIUS attribute carries detailed information about authentication, authorization, and accounting requests and responses. It is generally recommended that the same type of attributes remain in the same order, but the order of different types of attributes does not have to be maintained. In addition, the length of the RADIUS packet is usually specified at the end of the attribute list. For the convenience of reference, the attribute format is listed here. The fields are transmitted in the order from left to right, specifically:
  • the Type field occupies one byte, and the latest RADIUS Type field value is currently allocated in the latest RFC. Attribute values 192-223 are reserved for experimentation, attribute values 224-240 are reserved for specific implementations, and attribute values 241-255 are reserved.
  • the RADIUS Plugin is open source software and can be used as the RADIUS client of Open VPN.
  • the RADIUS Plugin mainly includes two functions, namely:
  • the RADIUS protocol provides some reserved attributes for the customer to customize. Therefore, the extended area code of the Open VPN server is added to the extended attribute value by using the extended attribute value 224-240 in the RADIUS protocol, and the RADIUS using Open VPN is used.
  • Plugin acts as a RADIUS client and uses Free RADIUS as the RADIUS server to modify Free RADIUS. That is, the custom extended attribute field is added to the Free RADIUS database, and the corresponding extended attribute and IP address pool are configured in the configuration file. relationship.
  • Free RADIUS can dynamically select an IP address pool according to the area code of the Open VPN service, and return a service-related IP address to the VPN client.
  • the specific implementation method for the IP address allocation on the RADIUS server side is: selecting an IP address from the IP address pool corresponding to the area code according to the area code in the authentication request message from the access node, and sending the IP address to the connection In the ingress node, the area code is used to indicate the area where the access node is located.
  • the RADIUS server receives the authentication request message from the Open VPN node, and authenticates the user login information (ie, the connection request) in the authentication request message to determine whether the user has the login right (ie, the connection permission). If the user does not have the login permission, The authentication fails, and the authentication failure message is returned to the VPN client via the Open VPN node. If the user has the login right, the authentication succeeds, and the corresponding area code is used to correspond to the IP address pool identifier according to the area code in the authentication request message. The relationship is obtained by obtaining an IP address pool identifier corresponding to the area code in the authentication request message, obtaining an available IP address from the corresponding IP address pool according to the obtained IP address pool identifier, and sending the available IP address to the Open VPN node.
  • the method further comprises:
  • the IP address pool is dynamically selected based on the area code of the Open VPN service, and the IP address obtained by the Open VPN client is decoupled from the Open VPN server (ie, the Open VPN node), that is, multiple IP address pools are pre-configured. Multiple area codes, so that when the Open VPN server is extended, the Open VPN server can be quickly expanded and replaced without changing the configuration of the RADIUS server.
  • the Open VPN server ie, the Open VPN node
  • multiple IP address pools are pre-configured. Multiple area codes, so that when the Open VPN server is extended, the Open VPN server can be quickly expanded and replaced without changing the configuration of the RADIUS server.
  • FIG. 2 is a schematic diagram of an application scenario for IP address allocation in Embodiment 2 of the present invention.
  • an Open VPN node is set up in Beijing, Shanghai, and Guangzhou to form an Open VPN service network, and for each The Open VPN nodes are assigned a zone code.
  • Open VPN users in Beijing can interact with Open VPN users in Guangzhou and Shanghai.
  • Open VPN users in Guangzhou can only interact with Open VPN users in Beijing.
  • Open VPN users in Shanghai can only work with Beijing.
  • Open VPN user interaction, Shanghai Open VPN users and Guangzhou Open VPN users can not interact.
  • the reserved attribute Type field storage area code of the RADIUS extended protocol is set, that is, the reserved attribute of the RADIUS plugin of the Open VPN (such as the type field attribute value 224) is area_code, the Open VPN access point in Beijing, RADIUS Plugin
  • the area_code attribute value is area_bj; in Guangzhou's Open VPN access point, the RADIUS Plugin's area_code attribute value is area_gz; in Shanghai's Open VPN access point, the RADIUS Plugin's area_code attribute value is area_sh.
  • the RADIUS server configure the IP address pool with the area_code attribute value as area_bj as bj_pool, and the area_code attribute value for the area_gz IP address pool as gz_pool, area_code attribute.
  • the IP address pool with the value of area_sh is sh_pool.
  • the available IP address of bj_pool is 10.100.0.0/16
  • the available IP address of gz_pool is 10.101.0.0/16
  • the available IP address of sh_pool is 10.102.0.0/16.
  • the path with the source IP address being 10.100.0.0/16 and the destination IP address being 10.101.0.0/16 and 10.102.0.0/16 Go to the corresponding Open VPN server in Guangzhou and Shanghai.
  • the source IP address is 10.102.0.0/16 and the destination IP address is 10.100.0.0/16.
  • the path is routed to the Open VPN server in Beijing.
  • Open VPN users in Beijing can interact with Open VPN users in Shanghai and Guangzhou.
  • Open VPN users in Guangzhou can only interact with Open VPN users in Beijing.
  • Open VPN users in Shanghai can only work with Open in Beijing.
  • the IP address pool matching the area code area_bj is bj_pool, the available IP address is 10.100.0.0/16; the IP address pool matching the area code area_gz is gz_pool, the available IP address is 10.101.0.0/16; and the area code area_sh matches.
  • the IP address pool is sh_pool and the available IP address is 10.102.0.0/16.
  • Configure the RADIUS Plugin reserved attribute area_code (such as type field attribute value 224) as the area code area_bj on the Open VPN server in Beijing.
  • Configure the RADIUS Plugin reserved attribute area_code (such as the type field attribute value 224) on the Open VPN server in Guangzhou.
  • FIG. 3 is a flowchart of a method for IP address allocation according to Embodiment 2 of the present invention.
  • a user access amount of a hot spot is steeply increased, such as Open VPN Server bj.
  • Open VPN Server bj When the user's access requirements are not met, the Beijing Open VPN access service is quickly deployed to meet the user's explosive access.
  • the specific implementation method of rapidly deploying Open VPN access service is as follows:
  • Step 301 The first Open VPN server extends the second Open VPN server.
  • the first Open VPN server uses the image to create a new Open VPN server in the cloud platform or the Internet Data Center (IDC: Internet Data Center), and sets the second.
  • the Open VPN server name is Open VPN Serverbj02.
  • Step 302 The first Open VPN server configures the RADIUS Plugin on the second Open VPN server by using the image.
  • the first Open VPN server uses the image to install the RADIUS Plugin of the Open VPN server on the Open VPN Server bj02, and the second Open VPN server obtains the reserved attribute of the RADIUS Plugin by obtaining the area code of the first Open VPN server and the RADIUS server identifier.
  • the type field attribute value 224) is area_code, set the area_code attribute value to the area code area_bj, and set the RADIUS authentication service to the RADIUS server.
  • Step 303 Start the Open VPN service of the second Open VPN server.
  • the elastic expansion of the Open VPN access service is implemented based on pre-configured service rules without modifying the RADIUS Server configuration.
  • the RADIUS plugin of the Open VPN server is used as a RADIUS client, and the RADIUS server (such as a Free RADIUS server) is modified accordingly.
  • the area code of the Open VPN service is attached to the reserved attribute (224-240) of the RADIUS extension protocol, so that the RADIUS server can dynamically select the IP address pool according to the area code and the correspondence between the configured area code and the IP address pool identifier.
  • the service rules are pre-defined in the routers in the Open VPN network, and tunnels are established with the Open VPN server, which are used to implement Open VPN users with different access rights when using different IP address pools.
  • the Open VPN user group is used in a centralized manner, the Open VPN server and the centralized RADIUS authentication can be used to flexibly provide Open VPN services without interrupting the RADIUS server.
  • FIG. 4 is a schematic diagram of an application scenario for IP address allocation in Embodiment 3 of the present invention.
  • FIG. 4(a) it is a cloud platform Cloud BJ (ie, Open VPN Server bj) in the Beijing area and a cloud in the Guangzhou area.
  • the platform Cloud GZ Open VPN Server gz
  • FIG. 5 is a flowchart of a method for IP address allocation according to Embodiment 3 of the present invention.
  • a technician needs to be provided before providing an Open VPN access service.
  • the RADIUS server is modified.
  • the pre-configuration of the rapid deployment includes:
  • Step 501 Set a correspondence between the area code and the IP address pool on the RADIUS server side.
  • the IP address pool with the area code area_bj is bj_pool, the available IP address is 10.100.0.0/16; the IP address pool with the area code area_gz is gz_pool, and the available IP address is 10.101.0.0/16.
  • Step 502 Deploy an Open VPN server on the cloud platform side. Deploy on the cloud platform Cloud BJ
  • the public network IP address is 202.106.1.1
  • the reserved attribute area_code of the RADIUS Plugin (such as the type field attribute value 224) is set to the area code area_bj.
  • the public network IP address is 202.106.2.1.
  • an image vpn_image_bj is created for the Open VPN Server instance of the cloud platform Cloud BJ
  • an image vpn_image_gz is created for the Open VPN Server instance of the cloud platform Cloud GZ.
  • Step 503 Configure routes of the area codes area_bj and area_gz on the router, and establish a tunnel with the cloud platform. That is, the interconnection of IP addresses 10.100.0.0/16 and 10.101.0.0/16 can be used.
  • Step 504 Configure an A record of the domain name on the DNS server side.
  • the A record of the domain name bj.pop.cloudvpn.com configured on the Domain Name System Server (DNS Server: Domain Name System Server) in the Open VPN service network is 202.106.1.1, and the domain name gz.pop.cloudvpn.com Recorded as 202.106.2.1.
  • the Open VPN Client in the Beijing area can use the domain name bj.pop.cloudvpn.com to connect to the Open VPN service.
  • the Open VPN Client in the Guangzhou area can use gz.pop.cloudvpn.com. This domain name connects to the Open VPN service.
  • the CPU usage setting value can be set to 70%.
  • the Open VPN access is flexibly extended. The specific implementation method is as follows:
  • Step 505 The Open VPN server on the cloud platform side uses an image to open an instance.
  • the Open VPN server uses the image vpn_image_bj to open two Open VPN instances.
  • the IP addresses of the instances are 202.106.1.2 and 202.106.1.3 respectively.
  • the cloud platform Cloud GZ use the image vpn_image_gz to enable two Open VPN instances.
  • the IP addresses of the instances are 202.106.2.2 and 202.106.2.3 respectively.
  • Step 506 The DNS server increases the resolution record. That is, the DNS server adds the A records 202.106.1.2 and 202.106.1.3 of the domain name bj.pop.cloudvpn.com, and the domain name. A records of gz.pop.cloudvpn.com 202.106.2.2 and 202.106.2.3.
  • the Open VPN access service capability in the Beijing area and the Open VPN access service capability in the Guangzhou area can be effectively improved, without modifying the RADIUS server configuration and following predetermined business rules.
  • the convenience of the flexible expansion of the Open VPN access service is realized.
  • FIG. 6 is a flowchart showing the work of IP address allocation in the third embodiment of the present invention. As shown in FIG. 6, after completing all the above configurations, the specific workflow of the elastic extension for the Open VPN access service is as follows:
  • Step 601 The client BJ obtains the public network IP address, and sends an authentication request message to the Cloud BJ according to the public network IP address.
  • the client BJ sends an access request message to the DNS server.
  • the DNS server parses the public network IP address 202.106.1.1 according to the domain name in the received access request message, and sends the public network IP address 202.106.1.2 to the client BJ.
  • the client BJ sends an authentication request message to the public network IP address 202.106.1.2, which is the Open VPN instance of Cloud BJ, according to the received public network IP address 202.106.1.2.
  • Step 602 The Cloud BJ receives the source IP address sent by the RADIUS server according to the area code after the authentication request message is successfully authenticated, and sends the received source IP address to the client BJ.
  • the Open VPN instance of Cloud BJ carries the area code in the authentication request message and sends it to the RADIUS server.
  • the RADIUS server authenticates the received authentication request message, and after the authentication succeeds, determines an IP address pool corresponding to the area code according to the area code carried in the authentication request message.
  • the obtained IP address is obtained from the IP address pool, that is, the source IP address, and the obtained source IP address is sent to the Open VPN instance of the Cloud BJ.
  • the Open VPN instance of Cloud BJ sends a message indicating that the authentication of the source IP address is successful to Client BJ.
  • Step 603 The client BJ sends an access request message including the source IP address to the router via the Cloud BJ, so that the router routes the access request message to the destination IP address according to the source IP address.
  • the Client BJ sends an access request message containing the source IP address to the router via the tunnel via the Open VPN instance of Cloud BJ.
  • the router utilizes the source IP address in the access request message.
  • the preset service rule is to route the access request message to the destination IP address corresponding to the source IP address through the tunnel to implement information exchange between the users.
  • the technical personnel in the field can adapt to different application scenarios according to actual needs, for example, the client BJ can access the Internet resources, and can perform point-to-point access with the client gz, or other application scenarios, which is not limited in this application. .
  • an Open VPN server in the existing Cloud BJ fails and is unavailable, a new Open VPN server can be deployed, and all information about the unavailable Open VPN server is configured to the new Open VPN server, and a new one is started.
  • the Open VPN server can replace the unavailable Open VPN server and repair the Open VPN access service without modifying the configuration of the RADIUS server, thus achieving rapid replacement of the Open VPN server.
  • an apparatus for IP address allocation is also provided in the embodiment of the present invention. Since the principle of solving the problem of these devices is similar to the method of assigning an IP address, the implementation of these devices can refer to the implementation of the method. , the repetition will not be repeated.
  • FIG. 7 is a structural diagram of an apparatus for assigning an IP address on a VPN node side according to Embodiment 4 of the present invention. As shown in FIG. 7, the apparatus may include:
  • the sending module 701 is configured to send the area code of the access node to the RADIUS server when receiving the connection request sent by the client.
  • the receiving module 702 is configured to receive an IP address selected by the authentication server from the IP address pool corresponding to the area code, and forward the IP address to the client.
  • the creating module 703 is configured to create a new access node when the load rate of the associated access node exceeds a set value.
  • the configuration module 704 is configured to: when detecting that the access node to which the access node is created, obtain the area code from the existing access node, and configure the acquired area code for the access node.
  • the access node used in the authentication service network is a VPN node
  • the authentication server is a RADIUS server
  • the client is a VPN client.
  • the sending module includes:
  • the area code of the VPN node is carried in the authentication request message and sent to the RADIUS server.
  • the configuration module further includes:
  • an apparatus for IP address allocation is also provided in the embodiment of the present invention. Since the principle of solving the problem of these devices is similar to the method of assigning an IP address, the implementation of these devices can refer to the implementation of the method. , the repetition will not be repeated.
  • An allocating module configured to select an IP address from the pool of IP addresses corresponding to the area code according to the area code in the authentication request message from the access node, and send the IP address to the access node, where the area code is used to indicate The area where the access node is located.
  • a system for IP address allocation is also provided in the embodiment of the present invention. Since the principle of solving the problem is similar to the method for IP address allocation, the implementation of the system can be referred to the method. The implementation, repetitions will not be repeated.
  • FIG. 8 is a structural diagram of a system for IP address allocation according to Embodiment 5 of the present invention. As shown in FIG. 8, the system may include:
  • the access device 801 is configured to: when receiving the connection request sent by the client, send the area code of the access device to the authentication device 802, receive the IP address sent by the authentication device 802 according to the area code, and forward the The client.
  • the authentication device 802 is configured to select an IP address from the IP address pool corresponding to the area code and send the IP address to the access device 801.
  • an embodiment of the present invention further provides a computer program product for IP address allocation used in conjunction with a system for IP address allocation, due to its principle and one for IP.
  • the method of address allocation is similar, so the implementation can refer to the implementation of the method, and the repeated description will not be repeated.
  • the computer program product comprises a computer readable storage medium and a computer program mechanism embodied therein, the computer program mechanism comprising instructions for performing the various steps of any of the foregoing methods.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. Instructions are provided for implementation in the flowchart The steps of a process or a plurality of processes and/or block diagrams of a function specified in a block or blocks.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了用于IP地址分配的方法、装置、系统和计算机程序产品，一种用于IP地址分配的方法包括：在接收到客户端发送的连接请求时，将接入节点的区域代码发送给认证服务器，所述区域代码用于表示所述接入节点所在的区域；接收所述认证服务器从所述区域代码对应的IP地址池中选择的IP地址，并转发给所述客户端。本发明通过改造认证服务器，在进行接入节点扩展时，无需改动认证服务器的配置，就能够实现IP地址分配与接入节点的IP地址间的解耦。

Description

用于IP地址分配的方法、装置、系统和计算机程序产品 技术领域
本发明涉及虚拟专用网络领域，特别涉及用于IP地址分配的方法、装置、系统和计算机程序产品。
背景技术
在验证、授权和记账(AAA：Authentication、Authorization、Accounting)认证中，远程用户拨号认证系统(RADIUS：Remote Authentication Dial In User Service)是被广泛使用的一种协议。RADIUS服务器除AAA认证功能外，还具有为RADIUS客户端分配IP地址的功能，即能够基于一个IP地址池或者多个IP地址池实现基于网络接入服务(NAS：Network Access Service)协议的IP地址分配。现有技术中，当有多个IP地址池时，RADIUS服务器能够采用如下方法实现IP地址的分配，具体为：
1)利用RADIUS协议中的分帧池属性(framed-pool)；
2)利用特定供应商属性(VSA：Vendor-Specific Attributes)；
3)利用RADIUS服务器端IP地址池合用。
在第一种方法中，需要在NAS上定义IP地址池标识Pool Name，同时，NAS需要符合RADIUS扩展协议RFC 2869，RADIUS服务器才能在“访问-接收”信息包(类型为88属性)中发送分帧池属性，而系统管理员需要手动为用户配置NAS并更新授权属性。
在第二种方法中，独立软件供应商(ISV：Independent Software Vendors)不能使用分帧池属性，但可以定义IP地址池，即利用VSA模型，由RADIUS服务器使用所定义的IP地址池。此外，该方法与各ISV的实现有关，比如思科，是利用Cisco AV-Pair属性发送IP地址池信息。
在第三种方法中，RADIUS服务器根据RADIUS客户端的NAS-IP-Address、NAS-Port属性匹配所配置的IP地址池。一旦RADIUS服务 器启动后，将无法更改RADIUS服务器的IP地址池配置信息，除非停止RADIUS认证服务。
在实现本发明的过程中，本发明的发明人发现：第一种方法需要在每台NAS上配置IP地址池，集中管理能力较差；第二种方法与各ISV设备有关，导致私有属性由各ISV掌握，兼容性较差；第三种方法需要重新启动RADIUS认证服务，才能使IP地址池的修改生效，操作灵活性较差。
发明内容
本发明实施例提出了用于IP地址分配的方法、装置、系统和计算机程序产品，以解决在不停止认证服务的情况下，基于开放源码的虚拟专用网络(Open VPN：Open Virtual Private Network)认证服务的IP地址分配与接入节点的IP地址间的耦合性较强，以及基于接入节点扩展的弹性部署能力较差的技术问题。
在一个方面，本发明实施例提供了一种用于IP地址分配的方法，用于接入节点中，包括：
在接收到客户端发送的连接请求时，将接入节点的区域代码发送给认证服务器，所述区域代码用于表示所述接入节点所在的区域；
接收所述认证服务器从所述区域代码对应的IP地址池中选择的IP地址，并转发给所述客户端。
在另一个方面，本发明实施例提供了一种用于IP地址分配的方法，包括：
根据来自接入节点的认证请求消息中的区域代码，从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入节点，所述区域代码用于表示所述接入节点所在的区域。
在另一个方面，本发明实施例提供了一种用于IP地址分配的装置，包括：
发送模块，用于在接收到客户端发送的连接请求时，将接入节点的区域代码发送给认证服务器，所述区域代码用于表示所述接入节点所在的区域；
接收模块，用于接收所述认证服务器从所述区域代码对应的IP地址池中选择的IP地址，并转发给所述客户端。
在另一个方面，本发明实施例提供了一种用于IP地址分配的装置，包括：
分配模块，用于根据来自接入节点的认证请求消息中的区域代码，从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入节点，所述区域代码用于表示所述接入节点所在的区域。
另一个方面，本发明实施例提供了一种用于IP地址分配的系统，包括：
接入装置，用于在接收到客户端发送的连接请求时，将接入装置的区域代码发送给认证装置，接收所述认证装置根据所述区域代码发送的IP地址，并转发给所述客户端；
认证装置，用于从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入装置。
在另一个方面，本发明实施例提供了一种与用于IP地址分配的装置结合使用的计算机程序产品，所述计算机程序产品包括计算机可读的存储介质和内嵌于其中的计算机程序机制，所述计算机程序机制包括用于执行上述任一方法中各个步骤的指令。
有益效果如下：
本发明接入节点侧接收认证服务器根据区域代码发送的用户IP地址，使得在进行接入节点扩展时，无需改动认证服务器的配置，就能够实现IP地址分配与接入节点的IP地址间的解耦，以及接入节点的弹性部署。
附图说明
下面将参照附图描述本发明的具体实施例，其中：
图1为本发明实施例一中VPN节点侧用于IP地址分配的方法原理图；
图2为本发明实施例二中用于IP地址分配的应用场景示意图；
图3为本发明实施例二中用于IP地址分配的方法流程图；
图4为本发明实施例三中用于IP地址分配的应用场景示意图；
图5为本发明实施例三中用于IP地址分配的方法流程图；
图6为本发明实施例三中用于IP地址分配的工作流程图；
图7为本发明实施例四中VPN节点侧用于IP地址分配的装置结构图；
图8为本发明实施例五中用于IP地址分配的系统结构图。
具体实施方式
为了使本发明的技术方案及优点更加清楚明白，以下结合附图对本发明的示例性实施例进行进一步详细的说明，显然，所描述的实施例仅是本发明的一部分实施例，而不是所有实施例的穷举。并且在不冲突的情况下，本说明中的实施例及实施例中的特征可以互相结合。
发明人在发明过程中注意到：现有的RADIUS服务器在选择IP地址池后，需要重新启动RADIUS服务器，才能使IP地址池的修改生效。可见，在不停止RADIUS认证服务的情况下，基于Open VPN认证服务的IP地址分配与Open VPN服务器的IP地址间的耦合性较强，基于Open VPN服务器扩展的弹性部署能力较差。
针对上述不足，本发明提出了VPN节点将包含区域代码的认证请求消息发送给RADIUS服务器；接收来自所述RADIUS服务器在对所述认证请求消息认证成功后，根据所述认证请求消息中的区域代码发送的用户IP地址，并将接收到的用户IP地址发送给VPN客户端，以使VPN节点将来自所述VPN客户端的包含用户IP地址的访问请求消息发送给网关，再由网关根据所述访问请求消息中的用户IP地址，将所述访问请求消息经由隧道路由给目的IP地址。
本发明通过将RADIUS协议中的某一扩展属性值配置为区域代码，以及在RADIUS服务器侧的配置文件中配置区域代码与IP地址池标识的对应关系，使得在进行Open VPN服务器扩展时，RADIUS服务器能够根据区域代码值动态选择IP地址池，从而实现在无需改动RADIUS服务器配置的情况下，弹性部署Open VPN服务器，即当需要增加Open VPN服务器时，实现Open  VPN服务器的快速扩展，以及当现有Open VPN服务器不可用时，实现Open VPN服务器的快速替换。下面进行具体说明。
实施例一、
图1示出了本发明实施例一中VPN节点侧用于IP地址分配的方法原理图，如图1所示，用于接入节点中，该方法包括：
步骤101、在接收到客户端发送的连接请求时，将接入节点的区域代码发送给认证服务器，所述区域代码用于表示所述接入节点所在的区域。
步骤102、接收所述认证服务器从所述区域代码对应的IP地址池中选择的IP地址，并转发给所述客户端。
在步骤101中，VPN节点接收到来自用户的连接请求(如，登录请求)后，将区域代码信息携带在认证请求消息中，一并发送给RADIUS服务器。其中，用于认证服务网络中的接入节点为VPN节点，认证服务器为RADIUS服务器，客户端为VPN客户端，而来自用户的登录请求也可以是来自用户的接入请求，即用于RADIUS服务器认证该用户是否具有接入权限。
在步骤102中，VPN节点将自身的区域代码携带在认证请求消息中发送至RADIUS服务器。RADIUS服务器对认证请求消息进行认证，并在认证成功后，发送与区域代码对应的IP地址池中的可用用户IP地址给VPN节点，VPN节点再将该用户IP地址发送给VPN客户端，以便VPN客户端在后续的访问请求消息中携带该用户IP地址。
当VPN节点接收到来自VPN客户端的包含用户IP地址的访问请求消息后，直接将访问请求消息转发给网关，由网关对该访问请求消息进行解析，得到访问请求消息中的用户IP地址。网关根据得到的用户IP地址，利用网关侧预存的用户IP地址与目的IP地址的对应关系，将访问请求消息经由隧道路由给与该用户IP地址对应的目的IP地址，从而实现消息的互通。其中，网关可以是路由器，即在路由器上设置路由规则，如预存的用户IP地址与目的IP地址的对应关系。
本实施例通过对RADIUS服务器进行改造，即在RADIUS的数据库中增加自定义扩展属性字段，以及在配置文件中配置自定义扩展属性与IP地址池的对应关系。配置完成后，在对Open VPN客户端认证成功后，RADIUS服务器根据Open VPN服务的区域代码动态选择IP地址池，并将与区域代码对应的源IP地址经由VPN节点返回给VPN客户端。从而在进行VPN节点的扩展以及替换时，实现IP地址分配与Open VPN服务器的IP地址间的解耦。
优选的，还包括：
当所属的接入节点的负载率超过设定值时，创建新的接入节点。
对VPN节点的CPU占用率进行检测，CPU占用率的设定值可以根据实际情况进行设定，当VPN节点的CPU占用率超过设定值时，利用镜像创建新的VPN节点。其中，节点实例(instance)预先制作一个镜像，即通过镜像的方式启动新的VPN节点。
优选的，还包括：
在检测到所属的接入节点被创建时，从已有的接入节点中获取区域代码，并为所属的接入节点配置获取到的区域代码。
当所属的VPN节点检测到自身已被创建时，获取原有VPN节点中的区域代码和RADIUS服务器标识，根据所述区域代码和RADIUS服务器标识分别设置自身的区域代码和RADIUS服务器标识，新的VPN节点中的区域代码和RADIUS服务器标识与原有VPN节点中的区域代码和RADIUS服务器标识一致。其中，新的VPN节点为原有VPN节点的扩展VPN节点。
新的VPN节点将包含区域代码的认证请求消息发送给RADIUS服务器，接收RADIUS服务器根据认证请求消息中的区域代码发送的用户IP地址，并将接收到的用户IP地址发送给VPN客户端。以使新的VPN节点将来自VPN客户端的包含用户IP地址的访问请求消息发送给网关，再由网关根据访问请求消息中的用户IP地址，将访问请求消息经由隧道路由给目的IP地址。
其中，新的VPN节点的具体实现方法与原有VPN节点的具体实现方法 一致，因此，此处不再赘述。
优选的，从已有的VPN节点中获取区域代码，并为所属的VPN节点配置获取到的区域代码，包括：
从已有的VPN节点的RADIUS插件的保留属性中获取区域代码，并将获取到的区域代码配置到所属的VPN节点的RADIUS插件的保留属性中。针对RADIUS扩展协议RFC 2869中的RADIUS保留属性进行说明，具体如下：
可扩展认证协议(EAP：Extensible Authentication Protocol)是对点到点协议(PPP：Point to Point Protocol)的扩展，通过EAP能够在PPP内支持额外的认证方法，RADIUS协议能够利用EAP-Message和Message-Authenticator属性支持EAP，其中，属性由Type-Length-Value三元组组成，能够用于添加新的属性值而又不影响协议的实现。
RADIUS属性携带着认证、授权和计费请求与响应的详细信息，通常建议相同类型的属性保持顺序不变，而对于不同类型的属性其顺序则不必保持。此外，通常将RADIUS报文的长度在属性列表的末尾指明，为引用方便，此处列出属性格式，按照从左至右的顺序传输各域，具体为：
Figure PCTCN2016097285-appb-000001
Type域占一个字节，目前最新的RADIUS Type域值在最新的RFC中分配。属性值192-223保留给实验用，属性值224-240保留给特定实现用，属性值241-255保留不用。
RADIUS Plugin为开源软件，可作为Open VPN的RADIUS客户端，RADIUS Plugin主要包括两个功能，分别是：
1)RADIUS认证和Open VPN的记账支持；
2)RADIUS属性分析：
①IP地址类型；
②路由类型；
③实时计费间隔时间；
④来自其他脚本的特定供应商属性。
通常，RADIUS协议会提供一些保留属性给客户进行自定义，因此，利用RADIUS协议中的扩展属性值224-240，将Open VPN服务器的自定义区域代码添加到扩展属性值中，利用Open VPN的RADIUS Plugin作为RADIUS客户端，以及利用Free RADIUS作为RADIUS服务器，对Free RADIUS进行改造，即在Free RADIUS的数据库中增加自定义扩展属性字段，以及在配置文件中配置自定义扩展属性与IP地址池的对应关系。配置完成后，在对Open VPN客户端认证成功后，Free RADIUS能够根据Open VPN服务的区域代码来动态选择IP地址池，并返回一个与服务相关的IP地址给VPN客户端。
此外，RADIUS服务器侧用于IP地址分配的具体实现方法为：根据来自接入节点的认证请求消息中的区域代码，从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入节点，所述区域代码用于表示所述接入节点所在的区域。
RADIUS服务器接收来自Open VPN节点的认证请求消息，对认证请求消息中的用户登录信息(即连接请求)进行认证，确定该用户是否具有登录权限(即连接权限)，若该用户不具有登录权限，则认证失败，经由Open VPN节点返回认证失败消息给VPN客户端；若该用户具有登录权限，则认证成功，继续根据认证请求消息中的区域代码，利用预设区域代码与IP地址池标识的对应关系，获取与认证请求消息中的区域代码对应的IP地址池标识，根据获取到的IP地址池标识，从相应的IP地址池中获取可用IP地址，并发送该可用IP地址给Open VPN节点。
优选地，还包括：
对所述认证请求消息进行认证，若认证失败，则发送认证失败消息给所 述VPN节点。
本实施例基于Open VPN服务的区域代码进行IP地址池的动态选择，实现Open VPN客户端得到的IP地址与Open VPN服务器(即Open VPN节点)解耦，即通过预先配置多个IP地址池，多个区域代码，以便在进行Open VPN服务器扩展时，无需改动RADIUS服务器的配置，就能实现Open VPN服务器的快速扩展以及替换。此外，根据不同的IP地址池，还能够在每个Open VPN服务器上实现个性化防火墙策略以及针对不同区域用户应用不同的路由策略。
为了便于本发明的实施，下面以实例进行说明。
实施例二、
图2示出了本发明实施例二中用于IP地址分配的应用场景示意图，如图2所示，在北京，上海，广州三地搭建Open VPN节点，组建Open VPN服务网络，并为每个Open VPN节点分别分配一个区域代码。在RADIUS服务器侧设置与为每个Open VPN节点所分配的区域代码对应的IP地址池。在路由器侧设置业务规则，具体为，北京的Open VPN用户能够与广州、上海的Open VPN用户交互，广州的Open VPN用户只能与北京的Open VPN用户交互，上海的Open VPN用户只能与北京的Open VPN用户交互，上海的Open VPN用户与广州的Open VPN用户不能交互。
假定利用RADIUS扩展协议的保留属性Type域存储区域代码，即设置Open VPN的RADIUS插件(RADIUS Plugin)的保留属性(如type域属性值224)为area_code，在北京的Open VPN接入点，RADIUS Plugin的area_code属性值为area_bj；在广州的Open VPN接入点，RADIUS Plugin的area_code属性值为area_gz；在上海的Open VPN接入点，RADIUS Plugin的area_code属性值为area_sh。
在RADIUS服务器中，配置area_code属性值为area_bj的IP地址池为bj_pool，area_code属性值为area_gz的IP地址池为gz_pool，area_code属性 值为area_sh的IP地址池为sh_pool。bj_pool的可用IP地址为10.100.0.0/16，gz_pool的可用IP地址为10.101.0.0/16，sh_pool的可用IP地址为10.102.0.0/16。
在Open VPN网络的核心路由器中配置路由规则，并建立和Open VPN服务器的隧道，即将源IP地址为10.100.0.0/16，目的IP地址为10.101.0.0/16，10.102.0.0/16的路径路由到相应的广州、上海的Open VPN服务器。将源IP地址为10.101.0.0/16，目的IP地址为10.100.0.0/16的路径路由到北京的Open VPN服务器，将源IP地址为10.102.0.0/16，目的IP地址为10.100.0.0/16的路径路由到北京的Open VPN服务器。利用所配置的路由规则，实现北京的Open VPN用户能够与上海，广州的Open VPN用户交互，广州的Open VPN用户只能与北京的Open VPN用户交互，上海的Open VPN用户只能与北京的Open VPN用户交互，上海的Open VPN用户与广州的Open VPN用户不能交互。
将不同地区的用户接入到不同的Open VPN服务器，针对访问权限设置的方法具体为：
在RADIUS服务器上配置区域代码和IP地址池的对应关系，以及IP地址池中的可用IP地址。与区域代码area_bj匹配的IP地址池为bj_pool，可用IP地址为10.100.0.0/16；与区域代码area_gz匹配的IP地址池为gz_pool，可用IP地址为10.101.0.0/16；与区域代码area_sh匹配的IP地址池为sh_pool，可用IP地址为10.102.0.0/16。
在北京的Open VPN服务器上配置RADIUS Plugin的保留属性area_code(如type域属性值224)为区域代码area_bj；在广州的Open VPN服务器上配置RADIUS Plugin的保留属性area_code(如type域属性值224)为区域代码area_gz；在上海的Open VPN服务器上配置RADIUS Plugin的保留属性area_code(如type域属性值224)为区域代码area_sh。
基于所设定的区域代码，在Open VPN网络的核心路由器中配置相应的路由规则，并建立和Open VPN Server的隧道。即使用北京Open VPN接入的用户能够与使用广州、上海Open VPN接入的用户交互，而使用广州Open VPN 接入与使用上海Open VPN接入的用户不能交互。
当北京(上海/广州)的Open VPN用户出现爆发式增长时，通过快速部署多台Open VPN服务器，将新部署的Open VPN服务器上的RADIUS Plugin的保留属性area_code的属性值设置为area_bj(area_sh/area_gz)，即可在不需要修改RADIUS服务器配置的情况下，实现Open VPN的弹性部署。
图3示出了本发明实施例二中用于IP地址分配的方法流程图，如图3所示，针对Open VPN服务网络中，某一热点的用户接入量陡增，如Open VPN Server bj无法满足用户的接入需求时，通过快速部署北京Open VPN接入服务，满足用户的爆发式接入。快速部署Open VPN接入服务的具体实现方法如下：
步骤301：第一Open VPN服务器扩展第二Open VPN服务器。当第一Open VPN服务器的CPU占有率达到设定值时，第一Open VPN服务器利用镜像在云平台或者互联网数据中心(IDC：Internet Data Center)创建一台新的Open VPN服务器，并设定第二Open VPN服务器名称为Open VPN Serverbj02。
步骤302：第一Open VPN服务器利用镜像在第二Open VPN服务器上配置RADIUS Plugin。第一Open VPN服务器利用镜像在Open VPN Server bj02上安装Open VPN服务器的RADIUS Plugin，再由第二Open VPN服务器通过获取第一Open VPN服务器的区域代码和RADIUS服务器标识，设置自身RADIUS Plugin的保留属性(如type域属性值224)为area_code，设置area_code属性值为区域代码area_bj，设置RADIUS认证服务为RADIUS Server。
步骤303：启动第二Open VPN服务器的Open VPN服务。在无需修改RADIUS Server配置的情况下，基于预先设置的业务规则，实现Open VPN接入服务的弹性扩充。
本实施例中，利用Open VPN服务器的RADIUS Plugin作为RADIUS客户端，通过对RADIUS服务器(如Free RADIUS服务器)进行相应的改造， 即将Open VPN服务的区域代码附加到RADIUS扩展协议的保留属性(224-240)中，以使RADIUS服务器能够根据区域代码，并利用配置的区域代码与IP地址池标识的对应关系动态选择IP地址池。此外，在Open VPN网络中的路由器中预先设定业务规则，并建立和Open VPN服务器的隧道，用于实现Open VPN用户在使用不同的IP地址池时，所具备的访问权限不同。当Open VPN用户群体出现集中使用时，通过快速部署Open VPN服务器，以及集中的RADIUS认证，实现在不中断RADIUS服务器工作的情况下，弹性提供Open VPN服务。
实施例三、
在Open VPN服务网络中，当某一热点的用户接入量陡增，如北京区域的Open VPN Server BJ和广州区域的Open VPN Server GZ无法满足用户的接入需求时，通过快速部署北京区域和广州区域的Open VPN接入服务，满足用户的爆发式接入。
图4示出了本发明实施例三中用于IP地址分配的应用场景示意图，如图4(a)所示，为北京区域的云平台Cloud BJ(即Open VPN Server bj)和广州区域的云平台Cloud GZ(即Open VPN Server gz)未扩充Open VPN接入服务的Open VPN拓扑示意图，如图4(b)所示，为北京区域的云平台Cloud BJ和广州区域的云平台Cloud GZ扩充Open VPN接入服务后的Open VPN拓扑示意图。图5示出了本发明实施例三中用于IP地址分配的方法流程图，如图5所示，为快速实现云平台的弹性扩充，在对外提供Open VPN接入服务前，需要技术人员对RADIUS Server进行一定的改造，快速部署前期配置具体包括：
步骤501：在RADIUS Server侧设置区域代码和IP地址池的对应关系。区域代码为area_bj的IP地址池为bj_pool，可用IP地址为10.100.0.0/16；区域代码为area_gz的IP地址池为gz_pool，可用IP地址为10.101.0.0/16。
步骤502：在云平台侧部署Open VPN服务器。在云平台Cloud BJ上部署 一个Open VPN Server，公网IP地址为202.106.1.1，配置RADIUS Plugin的保留属性area_code(如type域属性值224)为区域代码area_bj。在云平台Cloud GZ上部署一台Open VPN Server，公网IP地址为202.106.2.1，配置RADIUS Plugin的保留属性area_code(如type域属性值224)为区域代码area_gz。此外，分别为云平台Cloud BJ的Open VPN Server实例(instance)制作一个镜像vpn_image_bj；为云平台Cloud GZ的Open VPN Server实例制作一个镜像vpn_image_gz。
步骤503：在路由器上配置区域代码area_bj和area_gz的路由，并建立和云平台的隧道。即可用IP地址10.100.0.0/16和10.101.0.0/16的互联互通。
步骤504：在DNS Server侧配置域名的A记录。在Open VPN服务网络中的域名系统服务器(DNS Server：Domain Name System Server)上配置设定的域名bj.pop.cloudvpn.com的A记录为202.106.1.1，域名gz.pop.cloudvpn.com的A记录为202.106.2.1。
技术人员通过上述四个步骤的配置后，北京区域的Open VPN Client就可以使用bj.pop.cloudvpn.com这个域名连接Open VPN服务，广州区域的Open VPN Client就可以使用gz.pop.cloudvpn.com这个域名连接Open VPN服务。
当业务快速发展时，单台Open VPN服务器的CPU占用率经常达到70％以上，此处可以设定CPU占用率的设定值为70％。为保证服务体验，针对Open VPN接入进行弹性扩充，具体实现方法如下：
步骤505：云平台侧Open VPN服务器使用镜像的方式开启实例。在云平台Cloud BJ上，Open VPN服务器使用镜像vpn_image_bj开启两个Open VPN实例，实例的IP地址分别为202.106.1.2，202.106.1.3。在云平台Cloud GZ上，使用镜像vpn_image_gz开启两个Open VPN实例，实例的IP地址分别为202.106.2.2，202.106.2.3。
步骤506：DNS服务器增加解析记录。即DNS服务器增加域名bj.pop.cloudvpn.com的A记录202.106.1.2和202.106.1.3，以及域名 gz.pop.cloudvpn.com的A记录202.106.2.2和202.106.2.3。
通过上述两个步骤的配置，能够有效提升北京区域的Open VPN接入服务能力和广州区域的Open VPN接入服务能力，在无需修改RADIUS服务器配置，以及遵循预先设定的业务规则的情况下，实现Open VPN接入服务弹性扩充的便利性。
图6示出了本发明实施例三中IP地址分配的工作流程图，如图6所示，当完成上述所有配置后，针对Open VPN接入服务，弹性扩充的具体工作流程如下：
步骤601：Client BJ获取公网IP地址，并根据公网IP地址发送认证请求消息给Cloud BJ。Client BJ发送接入请求消息给DNS服务器，DNS服务器根据接收到的接入请求消息中的域名解析出公网IP地址202.106.1.1，并将公网IP地址202.106.1.2发送给Client BJ。Client BJ根据接收到的公网IP地址202.106.1.2，将认证请求消息发送给公网IP地址202.106.1.2，即Cloud BJ的Open VPN实例。
步骤602：Cloud BJ接收来自RADIUS服务器在对认证请求消息认证成功后，根据区域代码发送的源IP地址，并将接收到的源IP地址发送给Client BJ。Cloud BJ的Open VPN实例将区域代码携带在认证请求消息中，并发送给RADIUS服务器。RADIUS服务器对接收到的认证请求消息进行认证，并在认证成功后，根据认证请求消息中携带的区域代码确定与该区域代码相对应的IP地址池。根据所确定的IP地址池获取可用IP地址，即源IP地址，将获取到的源IP地址发送给Cloud BJ的Open VPN实例。Cloud BJ的Open VPN实例将包含源IP地址的认证成功的消息发送给Client BJ。
步骤603：Client BJ将包含源IP地址的访问请求消息经由Cloud BJ发送给路由器，以便路由器根据源IP地址，将访问请求消息经由隧道路由给目的IP地址。Client BJ将包含源IP地址的访问请求消息经由Cloud BJ的Open VPN实例经由隧道发送给路由器。路由器根据访问请求消息中的源IP地址，利用 预设的业务规则，将访问请求消息经由隧道路由给与源IP地址相对应的目的IP地址，实现用户间的信息交互。
具体实施时，本领域技术人员可以根据实际需要适应不同的应用场景，如Client BJ既能够访问互联网资源，也能够与Client gz进行点到点的访问，或其他应用场景，本申请对此不作限制。
此外，当现有Cloud BJ中的某一Open VPN服务器出现故障，不可用时，也可以部署新的Open VPN服务器，将不可用Open VPN服务器的相关信息全部配置给新的Open VPN服务器，启动新的Open VPN服务器，就可以实现不可用Open VPN服务器的替换，修复Open VPN的接入服务，而无需修改RADIUS服务器的配置，从而实现Open VPN服务器的快速替换。
实施例四、
基于同一发明构思，本发明实施例中还提供了一种用于IP地址分配的装置，由于这些设备解决问题的原理与一种IP地址分配的方法相似，因此这些设备的实施可以参见方法的实施，重复之处不再赘述。
图7示出了本发明实施例四中VPN节点侧用于IP地址分配的装置结构图，如图7所示，装置可以包括：
发送模块701，用于在接收到客户端发送的连接请求时，将接入节点的区域代码发送给RADIUS服务器。
接收模块702，用于接收所述认证服务器从所述区域代码对应的IP地址池中选择的IP地址，并转发给所述客户端。
创建模块703，用于当所属的接入节点的负载率超过设定值时，创建新的接入节点。
配置模块704，用于在检测到所属的接入节点被创建时，从已有的接入节点中获取区域代码，并为所属的接入节点配置获取到的区域代码。
优选地，用于认证服务网络中的接入节点为VPN节点，认证服务器为RADIUS服务器，客户端为VPN客户端。
优选地，所述发送模块包括：
将VPN节点的区域代码携带在认证请求消息中发送至RADIUS服务器。
优选地，所述配置模块还包括：
从已有的VPN节点的RADIUS插件的保留属性中获取区域代码，并将获取到的区域代码配置到所属的VPN节点的RADIUS插件的保留属性中。
基于同一发明构思，本发明实施例中还提供了一种用于IP地址分配的装置，由于这些设备解决问题的原理与一种IP地址分配的方法相似，因此这些设备的实施可以参见方法的实施，重复之处不再赘述。
本发明实施例四中RADIUS服务器侧用于IP地址分配的装置可以包括：
分配模块，用于根据来自接入节点的认证请求消息中的区域代码，从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入节点，所述区域代码用于表示所述接入节点所在的区域。
实施例五、
基于同一发明构思，本发明实施例中还提供了一种用于IP地址分配的系统，由于该系统解决问题的原理与一种用于IP地址分配的方法相似，因此该系统的实施可以参见方法的实施，重复之处不再赘述。
图8示出了本发明实施例五中用于IP地址分配的系统结构图，如图8所示，系统可以包括：
接入装置801，用于在接收到客户端发送的连接请求时，将接入装置的区域代码发送给认证装置802，接收所述认证装置802根据所述区域代码发送的IP地址，并转发给所述客户端。
认证装置802，用于从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入装置801。
实施例六、
基于同一发明构思，本发明实施例还提供了一种与用于IP地址分配的系统结合使用的用于IP地址分配的计算机程序产品，由于其原理与一种用于IP 地址分配的方法相似，因此其实施可以参见方法的实施，重复之处不再赘述。所述计算机程序产品包括计算机可读的存储介质和内嵌于其中的计算机程序机制，所述计算机程序机制包括用于执行任一前述方法中各个步骤的指令。
为了描述的方便，以上所述装置的各部分以功能分为各种模块或单元分别描述。当然，在实施本发明时可以把各模块或单元的功能在同一个或多个软件或硬件中实现。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图 一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。

Claims (16)

  1. 一种用于IP地址分配的方法，其特征在于，用于接入节点中，该方法包括：
    在接收到客户端发送的连接请求时，将接入节点的区域代码发送给认证服务器，所述区域代码用于表示所述接入节点所在的区域；
    接收所述认证服务器从所述区域代码对应的IP地址池中选择的IP地址，并转发给所述客户端。
  2. 如权利要求1所述的方法，其特征在于，用于认证服务网络中的接入节点为VPN节点，认证服务器为RADIUS服务器，客户端为VPN客户端。
  3. 如权利要求2所述的方法，其特征在于，所述将VPN节点的区域代码发送给RADIUS服务器，包括：
    将VPN节点的区域代码携带在认证请求消息中发送至RADIUS服务器。
  4. 如权利要求1所述的方法，其特征在于，还包括：
    当所属的接入节点的负载率超过设定值时，创建新的接入节点。
  5. 如权利要求1或2所述的方法，其特征在于，还包括：
    在检测到所属的接入节点被创建时，从已有的接入节点中获取区域代码，并为所属的接入节点配置获取到的区域代码。
  6. 如权利要求5所述的方法，其特征在于，从已有的VPN节点中获取区域代码，并为所属的VPN节点配置获取到的区域代码，包括：
    从已有的VPN节点的RADIUS插件的保留属性中获取区域代码，并将获取到的区域代码配置到所属的VPN节点的RADIUS插件的保留属性中。
  7. 一种用于IP地址分配的方法，其特征在于，用于认证服务器中，该方法包括：
    根据来自接入节点的认证请求消息中的区域代码，从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入节点，所述区域代码用于表示所述接入节点所在的区域。
  8. 一种用于IP地址分配的装置，其特征在于，用于接入节点中，该装置包括：
    发送模块，用于在接收到客户端发送的连接请求时，将接入节点的区域代码发送给认证服务器，所述区域代码用于表示所述接入节点所在的区域；
    接收模块，用于接收所述认证服务器从所述区域代码对应的IP地址池中选择的IP地址，并转发给所述客户端。
  9. 如权利要求8所述的装置，其特征在于，用于认证服务网络中的接入节点为VPN节点，认证服务器为RADIUS服务器，客户端为VPN客户端。
  10. 如权利要求9所述的装置，其特征在于，所述发送模块包括：
    将VPN节点的区域代码携带在认证请求消息中发送至RADIUS服务器。
  11. 如权利要求8所述的装置，其特征在于，还包括：
    创建模块，用于当所属的接入节点的负载率超过设定值时，创建新的接入节点。
  12. 如权利要求8或9所述的装置，其特征在于，还包括：
    配置模块，用于在检测到所属的接入节点被创建时，从已有的接入节点中获取区域代码，并为所属的接入节点配置获取到的区域代码。
  13. 如权利要求12所述的装置，其特征在于，所述配置模块包括：
    从已有的VPN节点的RADIUS插件的保留属性中获取区域代码，并将获取到的区域代码配置到所属的VPN节点的RADIUS插件的保留属性中。
  14. 一种用于IP地址分配的装置，其特征在于，用于认证服务器中，该装 置包括：
    分配模块，用于根据来自接入节点的认证请求消息中的区域代码，从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入节点，所述区域代码用于表示所述接入节点所在的区域。
  15. 一种用于IP地址分配的系统，其特征在于，包括：
    接入装置，用于在接入节点处，接收到客户端发送的连接请求时，将接入装置的区域代码发送给认证装置，接收所述认证装置根据所述区域代码发送的IP地址，并转发给所述客户端；
    认证装置，用于在认证服务器处，从所述区域代码对应的IP地址池中选择IP地址并发送给所述接入装置。
  16. 一种与用于IP地址分配的装置结合使用的计算机程序产品，所述计算机程序产品包括计算机可读的存储介质和内嵌于其中的计算机程序机制，所述计算机程序机制包括用于执行权利要求1-6中任一所述方法中各个步骤的指令。
PCT/CN2016/097285 2016-08-30 2016-08-30 用于ip地址分配的方法、装置、系统和计算机程序产品 WO2018039901A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201680002833.9A CN107005603A (zh) 2016-08-30 2016-08-30 用于ip地址分配的方法、装置、系统和计算机程序产品
PCT/CN2016/097285 WO2018039901A1 (zh) 2016-08-30 2016-08-30 用于ip地址分配的方法、装置、系统和计算机程序产品

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/097285 WO2018039901A1 (zh) 2016-08-30 2016-08-30 用于ip地址分配的方法、装置、系统和计算机程序产品

Publications (1)

Publication Number Publication Date
WO2018039901A1 true WO2018039901A1 (zh) 2018-03-08

Family

ID=59431088

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/097285 WO2018039901A1 (zh) 2016-08-30 2016-08-30 用于ip地址分配的方法、装置、系统和计算机程序产品

Country Status (2)

Country Link
CN (1) CN107005603A (zh)
WO (1) WO2018039901A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109194774B (zh) * 2018-08-09 2021-10-22 中兴克拉科技（苏州）有限公司 一种lpwan网络服务器的设备地址扩展方法
CN110401666B (zh) * 2019-07-30 2022-05-13 四川虹魔方网络科技有限公司 一种基于用户身份的网络权限分配方法
CN110677426B (zh) * 2019-09-30 2021-11-16 北京天融信网络安全技术有限公司 一种数据传输方法、装置、存储介质及vpn设备
CN111683164B (zh) * 2020-07-08 2022-11-04 厦门网宿有限公司 一种ip地址的配置方法及vpn服务系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002015490A1 (en) * 2000-08-14 2002-02-21 Telefonaktiebolaget L M Ericsson (Publ) Method of providing router with subnetwork address pool in a cellular telecommunications network
US20050122946A1 (en) * 2003-11-18 2005-06-09 Won Chan Y. DHCP pool sharing mechanism in mobile environment
CN102025798A (zh) * 2010-12-15 2011-04-20 华为技术有限公司 地址分配处理方法、装置和系统
WO2013020267A1 (zh) * 2011-08-08 2013-02-14 华为数字技术有限公司 Ip地址分配方法和系统以及设备
CN103828333A (zh) * 2011-09-26 2014-05-28 三菱电机株式会社 Ip地址分配系统及ip地址分配方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7366182B2 (en) * 2004-08-13 2008-04-29 Qualcomm Incorporated Methods and apparatus for efficient VPN server interface, address allocation, and signaling with a local addressing domain
CN101114972B (zh) * 2006-07-26 2011-01-26 成都迈普产业集团有限公司 Ip电信网系统中建立虚拟专网的方法
CN102480403B (zh) * 2010-11-30 2014-12-10 华为技术有限公司 提供虚拟私有网业务的方法、设备和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002015490A1 (en) * 2000-08-14 2002-02-21 Telefonaktiebolaget L M Ericsson (Publ) Method of providing router with subnetwork address pool in a cellular telecommunications network
US20050122946A1 (en) * 2003-11-18 2005-06-09 Won Chan Y. DHCP pool sharing mechanism in mobile environment
CN102025798A (zh) * 2010-12-15 2011-04-20 华为技术有限公司 地址分配处理方法、装置和系统
WO2013020267A1 (zh) * 2011-08-08 2013-02-14 华为数字技术有限公司 Ip地址分配方法和系统以及设备
CN103828333A (zh) * 2011-09-26 2014-05-28 三菱电机株式会社 Ip地址分配系统及ip地址分配方法

Also Published As

Publication number Publication date
CN107005603A (zh) 2017-08-01

Similar Documents

Publication Publication Date Title
JP7641276B2 (ja) マルチテナントソフトウェア定義ワイドエリアネットワーク（ｓｄ－ｗａｎ）ノードを提供するための方法、システム、およびコンピュータ読取可能媒体
CN103580980B (zh) 虚拟网络自动发现和自动配置的方法及其装置
US10015046B2 (en) Methods and apparatus for a self-organized layer-2 enterprise network architecture
CN107580065B (zh) 一种私有云接入方法及设备
US8605582B2 (en) IP network system and its access control method, IP address distributing device, and IP address distributing method
US8966075B1 (en) Accessing a policy server from multiple layer two networks
CN104506670B (zh) 建立网游连接的方法、设备及系统
CN105228121B (zh) 使用rest式接口的订户管理
EP2154825A1 (en) Systems and methods for provisioning network devices
CN106487556B (zh) 业务功能sf的部署方法及装置
WO2014166247A1 (zh) 一种虚拟网络管理的实现方法和系统
CN103379010A (zh) 一种虚拟网络实现方法及系统
US20180083968A1 (en) Method and system for authorizing service of user, and apparatus
WO2018039901A1 (zh) 用于ip地址分配的方法、装置、系统和计算机程序产品
JP2005252717A (ja) ネットワーク管理方法及びネットワーク管理サーバ
JP6378442B2 (ja) 仮想化ネットワークにおいてサービスを展開するための方法、及び装置
CN103200030B (zh) 网络管理的装置和方法
JP2005517352A (ja) ネットワーク・アドレス・トランスレータ設定のためにパラメータを借りる方法及び装置
WO2012041168A1 (zh) 用于IPv6网络的网络连接处理方法及其装置
JP2005236394A (ja) ネットワークシステム及びネットワーク制御方法
WO2023273877A1 (zh) 基于自动开通系统的网元配置方法、系统、设备和存储介质
CN113595848B (zh) 一种通信隧道建立方法、装置、设备及存储介质
US20060193330A1 (en) Communication apparatus, router apparatus, communication method and computer program product
WO2023134557A1 (zh) 一种基于工业互联网标识的处理方法及装置
TW201517654A (zh) 傳輸路徑控制系統

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16914471

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 07/06/2019)

122 Ep: pct application non-entry in european phase

Ref document number: 16914471

Country of ref document: EP

Kind code of ref document: A1