CN108243261A - Access control method and access device for a dual-stack terminal - Google Patents

Abstract

Disclosed are an access control method and access equipment for a dual-stack terminal. The method of the present invention includes: the access device forwards the message for assigning the IPv4 address to the dual-stack terminal; before the authentication of the dual-stack terminal is successful, the access device discards the message for assigning the IPv6 address to the dual-stack terminal; after the authentication of the dual-stack terminal is successful , the access device forwards the packet for assigning an IPv6 address to the dual-stack terminal. The invention can solve the problem of prolongation when the dual-stack terminal accesses the network.

Description

Access control method and access device for a dual-stack terminal

technical field

The invention relates to the technical field of the Internet, in particular to an access control method and access equipment for a dual-stack terminal.

Background technique

Dual stack (English: dual stack, DS) technology is the transition technology from Internet Protocol version 4 (English: Internet Protocol version 4, IPv4) network to Internet Protocol version 6 (English: Internet Protocol version 6, IPv6) network. In the dual-stack technology, both the IPv4 protocol stack and the IPv6 protocol stack are installed on the terminal equipment and network equipment. Dual-stack terminals can access IPv4 networks through IPv4 addresses, and can access IPv6 networks through IPv6 addresses.

Captive portal (English: captive portal) authentication is one of the authentication methods of wireless local area network (English: wireless local area network, WLAN). If captive portal authentication is deployed, dual-stack terminals can access network resources only after authentication is completed. The WLAN may not support captive portal authentication for IPv6.

When the network does not support IPv6 captive portal authentication, the dual-stack terminal can automatically try to use the IPv4 address to access the network, so as to realize the access of the dual-stack terminal. However, because the dual-stack terminal usually tries to access the network with the IPv6 address first, it will switch to the IPv4 mode when the access to the network with the IPv6 address fails. Therefore, it takes longer for a dual-stack terminal to access the network, which affects user access experience.

Contents of the invention

The present application provides an access control method and access equipment for a dual-stack terminal, which are used to solve the problem of delay when the dual-stack terminal accesses a network.

In the first aspect, the present application provides an access control method for a dual-stack terminal, where the dual-stack terminal supports the IPv4 protocol stack and the IPv6 protocol stack, and the method includes: the access device forwards the information for assigning the IPv4 address to the dual-stack terminal message. Before the authentication of the dual-stack terminal is successful, the access device discards the packet for assigning an IPv6 address to the dual-stack terminal; after the authentication of the dual-stack terminal is successful, the access device forwards the packet to the dual-stack A packet for assigning an IPv6 address to a terminal.

Since the dual-stack terminal can only obtain the IPv4 address, the dual-stack terminal can only use the IPv4 address to access the network. This avoids that when the network needs to use the IPv4 authentication method to authenticate the dual-stack terminal, the dual-stack terminal still preferentially tries to access the network with the IPv6 address. Therefore, the time delay for the dual-stack terminal to access the network is reduced.

In a possible implementation manner, the packet for assigning an IPv6 address to the dual-stack terminal includes one or more of the following: a DHCP packet requesting an IPv6 address sent by the dual-stack terminal to a DHCP server; A DHCP message carrying the IPv6 address of the dual-stack terminal sent to the dual-stack terminal; a routing advertisement message carrying the IPv6 address prefix of the dual-stack terminal sent by the router to the dual-stack terminal.

In a possible implementation manner, before the authentication of the dual-stack terminal is successful, the method further includes: the access device intercepts the DNS response message sent by the DNS server to the dual-stack terminal; the DNS response The message includes the IPv4 address of the domain name requested by the dual-stack terminal and the IPv6 address of the domain name; after the access device deletes the IPv6 address in the DNS response message, it sends the DNS response message to The dual-stack terminal.

Since the access device further deletes the IPv6 address in the DNS response message, the dual-stack terminal can only obtain the IPv4 address of the domain name, and thus can only use the IPv4 address to access the network. It is further ensured that when the network needs to use the IPv4 authentication method to authenticate the dual-stack terminal, the dual-stack terminal first uses the IPv4 address to access the network. Therefore, the time delay for the dual-stack terminal to access the network is reduced.

In a second aspect, the present application provides an access device, where the access device includes: a transceiver and a processor; wherein the processor is configured to:

Using the transceiver to forward the message for assigning an IPv4 address to the dual-stack terminal, wherein the dual-stack terminal supports an IPv4 protocol stack and an IPv6 protocol stack;

Before the authentication of the dual-stack terminal is successful, discarding the packet received by the transceiver for assigning an IPv6 address to the dual-stack terminal; and,

After the dual-stack terminal is successfully authenticated, the transceiver is used to forward a message for assigning an IPv6 address to the dual-stack terminal.

In a possible implementation manner, the packet for assigning an IPv6 address to the dual-stack terminal includes one or more of the following: a DHCP packet requesting an IPv6 address sent by the dual-stack terminal to a DHCP server; A DHCP message carrying the IPv6 address of the dual-stack terminal sent to the dual-stack terminal; a routing advertisement message carrying the IPv6 address prefix of the dual-stack terminal sent by the router to the dual-stack terminal.

In a possible implementation manner, before the authentication of the dual-stack terminal succeeds, the processor is further configured to: use the transceiver to intercept a DNS response message sent by the DNS server to the dual-stack terminal; The DNS response message includes the IPv4 address of the domain name requested by the dual-stack terminal and the IPv6 address of the domain name; and, after deleting the IPv6 address in the DNS response message, use the transceiver to send the DNS response The message is sent to the dual-stack terminal.

Since the principle and beneficial effect of the access device to solve the problem can refer to the above-mentioned first aspect and the implementation of each possible dual-stack terminal access control method in the first aspect and the beneficial effects brought by it, the access device For implementation, reference may be made to the implementation of the first aspect and the implementation of each possible access control method for a dual-stack terminal in the first aspect, and repeated descriptions will not be repeated.

In a third aspect, the present application provides an access device for a dual-stack terminal, where the dual-stack terminal supports an IPv4 protocol stack and an IPv6 protocol stack, and the access device includes:

A forwarding module, configured to forward a packet for assigning an IPv4 address to the dual-stack terminal;

A processing module, configured to discard the packet for assigning an IPv6 address to the dual-stack terminal before the authentication of the dual-stack terminal is successful, and forward the packet to assign an IPv6 address to the dual-stack terminal after the authentication of the dual-stack terminal is successful message.

In a possible implementation manner, the packet for assigning an IPv6 address to the dual-stack terminal includes one or more of the following: a DHCP packet requesting an IPv6 address sent by the dual-stack terminal to a DHCP server; A DHCP message carrying the IPv6 address of the dual-stack terminal sent to the dual-stack terminal; a routing advertisement message carrying the IPv6 address prefix of the dual-stack terminal sent by the router to the dual-stack terminal.

In a possible implementation manner, the access device further includes:

An intercepting module, configured to intercept the DNS response message sent by the DNS server to the dual-stack terminal before the authentication of the dual-stack terminal is successful; the DNS response message includes the IPv4 address of the domain name requested by the dual-stack terminal and the IPv6 address of said domain name;

The processing module is further configured to send the DNS response message to the dual-stack terminal after deleting the IPv6 address in the DNS response message.

Since the principle and beneficial effect of the access device to solve the problem can refer to the above-mentioned first aspect and the implementation of each possible dual-stack terminal access control method in the first aspect and the beneficial effects brought by it, the access device For implementation, reference may be made to the implementation of the first aspect and the implementation of each possible access control method for a dual-stack terminal in the first aspect, and repeated descriptions will not be repeated.

In a fourth aspect, the present application provides a storage medium, the storage medium is a computer-readable storage medium, the computer-readable storage medium stores a program, the program includes instructions, and the instructions are executed by an electronic device with a processor At this time, the electronic device is made to execute the access control method for a dual-stack terminal in the first aspect and each possible implementation manner of the first aspect.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

Figure 1 is a schematic diagram of a network architecture for captive portal authentication;

FIG. 2 is a schematic flowchart of a dual-stack terminal access control method provided by some embodiments of the present invention;

Fig. 3 (a) is a schematic diagram of processing before authentication of the authentication process of the access control scheme for dual-stack terminals provided by some embodiments of the present invention;

FIG. 3(b) is a schematic diagram of the authentication process of the access control scheme for dual-stack terminals provided by some embodiments of the present invention;

Fig. 3(c) is a schematic diagram after authentication of the authentication process of the access control scheme for dual-stack terminals provided by some embodiments of the present invention;

FIG. 4 is a schematic structural diagram of an access device of a dual-stack terminal provided by some embodiments of the present invention;

Fig. 5 is a schematic structural diagram of an access device provided by some embodiments of the present invention.

Detailed ways

If the network only deploys IPv4 captive portal authentication but does not support IPv6 captive portal authentication, dual-stack terminals still preferentially use IPv6 addresses to access the network, resulting in prolonged access to the network. Embodiments of the present invention provide an access control method and an access device for a dual-stack terminal, which are used to solve the problem of delay when a dual-stack terminal accesses a network and improve user access experience.

The access control scheme of the dual-stack terminal provided by the embodiment of the present invention restricts the dual-stack terminal to only obtain the IPv4 address but not the IPv6 address before the authentication is successful, so that the dual-stack terminal can only use the IPv4 address to access the network. Dual-stack terminals use IPv4 addresses to access the network, triggering IPv4 captive portal authentication, thus reducing the delay for dual-stack terminals to access the network.

In order to more clearly illustrate the technical problems that can be solved by the embodiments of the present invention, the captive portal authentication will be briefly introduced below.

FIG. 1 shows a schematic diagram of a network architecture for captive portal authentication. As shown in FIG. 1 , the exemplary architecture includes: a terminal 101 , an access device 102 , a redirection device 103 , a captive portal authentication server 104 and an Authentication Authorization Accounting (AAA) server 105 . The AAA server 105 is, for example, a remote authentication dial in user service (English: Remote Authentication Dial In User Service, RADIUS) server. The captive portal authentication server 104 and the AAA server 105 may be independent physical devices, or may be implemented by the same physical device.

The terminals involved in this application may include handheld devices with communication functions, vehicle-mounted devices, wearable devices, computing devices, and the like. A client system for accessing the network can be installed on the terminal 101, such as a hypertext transfer protocol (English: HyperText Transfer Protocol, HTTP) or a network protocol (English: Hyper Text Transfer Protocol over Secure Socket Layer, HTTPS) browser, application (English: : application, APP), etc., to initiate a network access request.

The access device involved in this application may include a switch, a router, an access point (English: access point, AP) in a WLAN, and the like. The access device may include a network device directly (wired or wirelessly) connected to the terminal, such as the access device 102 directly connected to the terminal 101 shown in FIG. 1 , and a network indirectly connected to the terminal at the access layer equipment. For example, the access device 102 and the redirection device 103 are in the same physical device, and the redirection device 103 is not directly connected to the terminal.

The redirecting device 103 may include a switch, a router, a wireless controller in a WLAN, and the like. The redirecting device 103 is mainly used to redirect the network access request from the unauthenticated terminal to the captive portal authentication server. The captive portal authentication server 104 is mainly used to provide portal services and push authentication pages, and exchange authentication information with the access device after receiving the authentication information input by the terminal on the authentication page. The AAA server 105 is mainly used to communicate with the access device, exchange authentication information, and complete authentication of the terminal.

Based on the example architecture shown in FIG. 1 , after the terminal 101 initiates a network access request, the access device 102 receives the terminal 101's network access request and forwards the request. If the terminal 101 is not authenticated, the redirection device 103 redirects the network access request of the terminal 101 to the captive portal authentication server 104 .

Furthermore, as shown in FIG. 1 , after the redirection device 103 redirects the access network request of the unauthenticated terminal 101 to the captive portal authentication server 104, the captive portal authentication server 104 will push the authentication page to the terminal 101, and the terminal 101 will open the authentication page on the authentication page. After entering the authentication information such as user name and password, submit it to the captive portal authentication server 104 (①), the captive portal authentication server 104 then exchanges the authentication information of the user with the redirection device 103 (②), and the redirection device 103 and the AAA server 105 Communication (③), the authentication of the terminal 101 is completed.

Because the captive portal authentication triggers the authentication process through the network access request initiated by the terminal, the terminal can only access network resources after the authentication is completed. Therefore, if the captive portal authentication is deployed on the network, the terminal needs to obtain an IP address first to initiate a network access request. During the transition from an IPv4 network to an IPv6 network, there are two situations in which a terminal obtains an IP address:

For a terminal supporting the IPv4 protocol stack, since the IPv4 address can be configured through a Dynamic Host Configuration Protocol (English: Dynamic Host Configuration Protocol, DHCP), a terminal supporting the IPv4 protocol stack can obtain an IPv4 address through a DHCP server;

For a dual-stack terminal supporting both the IPv4 protocol stack and the IPv6 protocol stack, on the one hand, the dual-stack terminal can obtain an IPv4 address through a DHCP server. On the other hand, since the IPv6 address can be configured through a stateful (English: stateful) address allocation method (such as using the Dynamic Host Configuration Protocol Version 6 (DHCPv6) protocol) or through a stateless (English: stateless) address allocation method (such as Use the Internet Control Management Protocol Version 6 (Internet Control Management Protocol Version 6, ICMPv6) protocol) for configuration (the specific IPv6 address allocation method to be used can be configured by the network administrator). Therefore, the dual-stack terminal can also obtain the IPv6 address through the DHCP server or the router in the network, wherein the way in which the dual-stack terminal obtains the IPv6 address through the router in the network belongs to the stateless address allocation method.

Specifically, for example, the architecture shown in Figure 1 may further include a DHCP server for configuring an IPv4 address for the terminal; or the architecture shown in Figure 1 may further include a DHCP service and/or router for configuring IPv4 for a dual-stack terminal. addresses as well as IPv6 addresses. In some practical scenarios, the DHCP server may not be configured separately, for example, the DHCP protocol may be enabled on the redirection device 103 .

It can be seen that since dual-stack terminals can obtain IPv6 addresses and IPv4 addresses, and will preferentially use IPv6 addresses to initiate network access requests, if the network only deploys IPv4 captive portal authentication but does not support IPv6 captive portal authentication, the dual-stack When the terminal fails to use the IPv6 address to access the network, it will switch to the IPv4 mode, resulting in prolonged access to the network and poor user access experience.

In order to solve the above problems, an embodiment of the present invention provides an access control method and access device for a dual-stack terminal. Embodiments of the present invention will be described below in conjunction with the accompanying drawings.

FIG. 2 shows a schematic flow diagram of a method for access control of a dual-stack terminal provided by an embodiment of the present invention. The flow can be specifically implemented by hardware, software programming, or a combination of software and hardware.

The access device may be configured to execute the process shown in FIG. 2 . For example, based on the network architecture example of captive portal authentication shown in FIG. 1 , the access device 102 may be configured to execute the process shown in FIG. 2 . The functional modules used in the access device to implement the access control scheme for dual-stack terminals provided by the embodiments of the present invention can be specifically implemented through hardware, software programming, and a combination of software and hardware. The hardware can include one or more signal processing and / or ASIC.

As shown in Figure 2, the process specifically includes the following processing procedures:

On the one hand, in order to enable the dual-stack terminal to obtain an IPv4 address, the access device forwards a message for assigning an IPv4 address to the dual-stack terminal (201).

The access device forwards the packet for assigning an IPv4 address to the dual-stack terminal, which may include: the access device forwards the DHCP message sent by the dual-stack terminal to the DHCP server requesting an IPv4 address, and the access device sends the DHCP server packet to the dual-stack terminal. The sent DHCP response message carrying the IPv4 address of the dual-stack terminal; furthermore, the dual-stack terminal will be able to obtain the IPv4 address normally.

Wherein, the aforementioned DHCP message requesting an IPv4 address and the DHCP message carrying the IPv4 address of the dual-stack terminal may be expressed as a DHCPv4 message under the IPv4 protocol.

On the other hand, in order to achieve the purpose of restricting dual-stack terminals to only use IPv4 addresses to access the network, to avoid access failures caused by dual-stack terminals preferentially using IPv6 addresses to access the network when the network needs to use IPv4 authentication methods to authenticate dual-stack terminals. In the extended problem, before the authentication of the dual-stack terminal succeeds, the access device discards the packet (202) for assigning the IPv6 address to the dual-stack terminal.

The packet discarded by the access device for assigning an IPv6 address to the dual-stack terminal may include one or more of the following: a DHCP packet sent by the dual-stack terminal to the DHCP server to request an IPv6 address; A DHCP message with the IPv6 address of the dual-stack terminal; a routing announcement (English: Router Advertisement, RA) message carrying the prefix of the IPv6 address of the dual-stack terminal sent by the router to the dual-stack terminal.

For example, in some embodiments of the present invention, if the network is configured to use a stateful address allocation method to allocate IPv6 addresses, since the stateful address allocation method mainly implements IPv6 address configuration through the DHCPv6 protocol, the access device receives the dual When a DHCP packet requesting an IPv6 address is sent by a dual-stack terminal, the DHCP packet can be discarded, so that the dual-stack terminal cannot obtain an IPv6 address, and can only use the obtained IPv4 address to access the network.

For another example, in some embodiments of the present invention, if the access device fails to discard the DHCP message requesting an IPv6 address sent by the dual-stack terminal in time, resulting in the DHCP server receiving the DHCP message and sending If the stack terminal sends a DHCP message carrying the IPv6 address of the dual-stack terminal, the access device can discard the DHCP message carrying the IPv6 address of the dual-stack terminal sent by the DHCP server, so that the dual-stack terminal cannot obtain the IPv6 address;

For another example, in some embodiments of the present invention, if the network is configured to use the stateless address allocation method to allocate IPv6 addresses, since the stateless address allocation method mainly implements IPv6 address configuration through the ICMPv6 protocol, the ICMPv6 protocol supports the address of the network node Automatic configuration. Specifically, the router can carry the IPv6 address prefix information in the RA message to assign an IPv6 address prefix to the terminal. The terminal can obtain a global unicast address by receiving the address prefix advertised by the router and combining its own interface. Therefore, access When a device receives an RA packet carrying an IPv6 address prefix from a router, it can discard the RA packet, so that a dual-stack terminal cannot obtain an IPv6 address.

Wherein, both the DHCP message requesting the IPv6 address and the DHCP message carrying the IPv6 address of the dual-stack terminal can be regarded as a DHCPv6 message corresponding to the IPv6 protocol.

Which address allocation method the network uses to allocate IPv6 addresses can be configured by the network administrator, which will not be described in detail in this application.

It can be seen that through the above two aspects of processing, before the authentication is successful, the dual-stack terminal will only be able to obtain an IPv4 address, so that the dual-stack terminal can only use the IPv4 address to access the network, thereby avoiding the need to use IPv4 authentication on the network When dual-stack terminals are authenticated in this way, due to the dual-stack terminals preferentially using IPv6 addresses to access the network, the time for dual-stack terminals to access the network is prolonged.

Specifically, in some embodiments of the present invention, if captive portal authentication is deployed in the network, the dual-stack terminal needs to initiate an access network request to enter the authentication process, and can access network resources only after the authentication is completed. Because the access device can discard the packet that assigns an IPv6 address to the dual-stack terminal before authentication, the dual-stack terminal can only obtain the IPv4 address but not the IPv6 address, and the dual-stack terminal will directly use the IPv4 address to access the The network triggers IPv4 captive portal authentication to realize the access of dual-stack terminals. Therefore, it is avoided that when the network does not support IPv6 captive portal authentication, the dual-stack terminal still preferentially uses the IPv6 address to access the network, reducing the time delay for the dual-stack terminal to access the network.

Furthermore, in order to ensure that the dual-stack terminal can access IPv4 and IPv6 network resources after the authentication is successful, after the dual-stack terminal is authenticated successfully, the access device can forward the message (203) that assigns the IPv6 address to the dual-stack terminal, so that the authentication A successful dual-stack terminal can obtain an IPv6 address, and then access IPv6 network resources.

Before the authentication of the dual-stack terminal succeeds, the access device discards any received packets for assigning IPv6 addresses to the dual-stack terminal. After the dual-stack terminal is successfully authenticated, the access device no longer screens the packets that assign IPv6 addresses to the dual-stack terminal and discards such packets, but performs the normal forwarding process. Therefore, after the dual-stack terminal is successfully authenticated, the access device forwards the received message (a message for assigning an IPv6 address to the dual-stack terminal).

The access device can enable the function of discarding packets that allocate IPv6 addresses for dual-stack terminals before the dual-stack terminal authentication is successful, and disable this function after the dual-stack terminal authentication is successful, and perform the normal packet forwarding function, so that it can be forwarded normally A packet for assigning an IPv6 address to a dual-stack terminal, so that the dual-stack terminal after successful authentication can obtain an IPv6 address.

It can be seen that through the above processing process, the dual-stack terminal can successfully complete authentication and access the network without basically modifying and upgrading the existing IPv4 network, meeting the network access policy requirements of the dual-stack terminal first authenticated and then accessing the Internet, and improving the dual-stack terminal User access experience.

Further, the IPv6 protocol provides two types of IPv6 addresses, one is a global unicast address (English: Global Unicast Address, GUA), which can be used to access any IPv6 node device with a reachable route in the network, and the other is a local link The address (English: Link-Local Address, LLA) is only used for local link communication and can be generated by the dual-stack terminal itself. When a dual-stack terminal uses a client that supports dual-stack to access the network, it can decide whether to use an IPv4 address or an IPv6 address to access the network according to the address carried in the DNS response message returned by the DNS server.

Therefore, considering that if the dual-stack terminal obtains the IPv6 address of the domain name to be accessed before the authentication is successful, it may use the local link address generated by itself to access the IPv6 address of the domain name, in some embodiments of the present invention, In order to avoid the above possible situation, it is also possible to further restrict the dual-stack terminal from obtaining the IPv6 address of the requested domain name before the authentication is successful, so as to ensure that the dual-stack terminal can only use the IPv4 address to access the network.

After receiving the DNS resolution request message sent by the dual-stack terminal, the Domain Name System (English: Domain Name System, DNS) server will return to the dual-stack terminal the IPv4 address carrying the domain name requested by the dual-stack terminal and the IPv6 address of the domain name. Therefore, in some embodiments of the present invention, before the dual-stack terminal authentication is successful, the access device can also intercept the DNS response message sent by the DNS server to the dual-stack terminal, and delete the DNS response message. The IPv6 address in the article, and then send the DNS response message after deleting the IPv6 address to the dual-stack terminal, so that the dual-stack terminal can only obtain the IPv4 address of the requested domain name, and then can only use the IPv4 address to access the network.

In some embodiments of the present invention, the dual-stack terminal initiates a DNS resolution request and requests the DNS server for the IP address corresponding to the domain name resolution. After the DNS server queries the domain name resolution address, it will return a DNS response message containing the A record and the AAAA record to the dual-stack terminal. Stack terminal, where the A record is the DNS record used to resolve the domain name to an IPv4 address, and the AAAA record is the DNS record used to resolve the domain name to an IPv6 address; after the access device obtains the DNS response message, it can keep the DNS Reply to the A record in the message, delete the AAAA record, and then send it to the dual-stack terminal, so that the dual-stack terminal cannot obtain the AAAA record, and thus cannot obtain the IPv6 address of the domain name.

Among them, in order to adapt to the difficult situation of deploying pure IPv6 DNS, the dual-stack terminal can complete IPv6 address resolution through the IPv4 DNS server, and the above-mentioned DNS resolution request message and DNS response message can be DNSv4 messages under the IPv4 protocol.

It can be seen that, through the access control scheme of the dual-stack terminal provided in the embodiment of the present invention, the access device discards the message for assigning an IPv6 address for the dual-stack terminal before the dual-stack terminal is successfully authenticated, and modifies the DNS in a targeted manner. In the reply message, the IPv6 address of the domain name is deleted, so that the dual-stack terminal can only use the IPv4 address to access the network before the authentication is successful, ensuring that when the network needs to use the IPv4 authentication method to authenticate the dual-stack terminal, the dual-stack terminal first uses Accessing the network with an IPv4 address triggers IPv4 captive portal authentication, thereby reducing the delay for dual-stack terminals to access the network.

As an example, FIG. 3( a ), FIG. 3( b ) and FIG. 3( c ) respectively show examples of processing procedures in application of the access control scheme for dual-stack terminals provided by some embodiments of the present invention. 3( a ) shows an example of a processing flow before authentication, FIG. 3( b ) shows an example of a processing flow during authentication, and FIG. 3( c ) shows an example of a processing flow after authentication.

As shown in the figure, the access device includes a wireless access point 302 directly connected to the dual-stack terminal 301 and a wireless controller 303 indirectly connected to the dual-stack terminal 301 . Wherein, the wireless access point 302 is used to execute the access control solution of the dual-stack terminal provided by the embodiment of the present invention, and the wireless controller 303 is a redirection device.

As shown in Figure 3(a), before the dual-stack terminal 301 passes the authentication, the wireless access point 302 discards the DHCPv6 message of the dual-stack terminal 301, but normally forwards the DHCPv4 message of the dual-stack terminal 301 to the wireless controller 303, Therefore, the dual-stack terminal 301 cannot obtain an IPv6 address, but can only obtain an IPv4 address; or, before the dual-stack terminal 301 is authenticated, the wireless access point 302 discards the RA message sent by the router in the network, so that the dual-stack terminal 301 cannot Obtain an IPv6 address;

As shown in Figure 3(b), during the authentication process of the dual-stack terminal 301, the wireless access point 302 intercepts the DNSv4 response message sent by the DNS server to the dual-stack terminal 301, and deletes the AAAA record (the IPv6 address of the domain name) in it. Afterwards, it is sent to the dual-stack terminal 301, so that the dual-stack terminal 301 can only obtain the A record (the IPv4 address of the domain name), and the IPv4 address of the domain name can not be obtained according to the A record, and the IPv6 address of the domain name cannot be obtained, so that the dual-stack terminal 301 cannot be used An IPv6 address of the link-local address type accesses the network;

Through the above process, the dual-stack terminal 301 will only be able to obtain the IPv4 address and only the IPv4 address of the domain name, thereby ensuring that the dual-stack terminal 301 can only use the IPv4 address to access the network, and then be able to use the captive portal where the network does not support IPv6 During authentication, IPv4 captive portal authentication is directly triggered to realize the access of dual-stack terminals.

After the dual-stack terminal 301 successfully passes the IPv4 captive portal authentication, the dual-stack terminal 301 can access the Internet normally, access IPv4 network resources through the IPv4 address, and obtain an IPv6 address, access IPv6 network resources through the IPv6 address, and wirelessly access Node 302 and wireless controller 303 normally forward data traffic, as shown in Figure 3(c).

To sum up, in the access control scheme of the dual-stack terminal provided in the embodiment of the present invention, the access device forwards the packet for assigning an IPv4 address to the dual-stack terminal; The terminal assigns an IPv6 address message, and after the dual-stack terminal is successfully authenticated, forwards the message of assigning an IPv6 address to the dual-stack terminal, so that the dual-stack terminal cannot obtain the IPv6 address before authentication, because the dual-stack terminal can only obtain the IPv6 address. to an IPv4 address, so a dual-stack terminal can only use an IPv4 address to access the network. The access device further intercepts the DNS response message returned by the DNS server and deletes the IPv6 address of the domain name carried in it, so that the dual-stack terminal can only obtain the IPv4 address of the domain name, thus further ensuring that the dual-stack terminal can only use IPv4 address to access the network. Through the above series of measures, the dual-stack terminal can only use the IPv4 address to access the network before the authentication is successful. Therefore, when the network needs to use the IPv4 authentication method to authenticate the dual-stack terminal, the dual-stack terminal can first use the IPv4 address to access the network, thereby It can reduce the time delay for dual-stack terminals to access the network.

Based on the same technical concept, the embodiment of the present invention also provides an access device for a dual-stack terminal, which can execute the method flow described in the foregoing embodiments of the present invention, and the access device is used to implement the present invention The functional modules of the method procedures described in the foregoing embodiments may be implemented by hardware, software programming, and a combination of software and hardware, and the hardware may include one or more signal processing and/or application-specific integrated circuits.

Fig. 4 shows a schematic structural diagram of an access device of a dual-stack terminal provided by some embodiments of the present invention. As shown in Fig. 4, the access device includes:

A forwarding module 401, configured to forward a message for assigning an IPv4 address to a dual-stack terminal;

The processing module 402 is configured to discard the packet for assigning an IPv6 address to the dual-stack terminal before the authentication of the dual-stack terminal is successful, and forward the packet for assigning the IPv6 address to the dual-stack terminal after the authentication of the dual-stack terminal is successful.

The message for assigning an IPv6 address to the dual-stack terminal includes one or more of the following: a DHCP message for requesting an IPv6 address sent by the dual-stack terminal to the DHCP server; The DHCP message of the address; the routing announcement message carrying the IPv6 address prefix of the dual-stack terminal sent by the router to the dual-stack terminal.

In some embodiments of the present invention, the access device further includes:

The intercepting module 403 is configured to intercept the DNS response message sent by the DNS server to the dual-stack terminal before the authentication of the dual-stack terminal succeeds. Wherein, the DNS response message includes the IPv4 address of the domain name requested by the dual-stack terminal and the IPv6 address of the domain name.

The intercepting module 403 is further configured to delete the IPv6 address in the DNS response message, and then send the DNS response message to the dual-stack terminal.

Based on the same inventive concept, the problem-solving principles and beneficial effects of the dual-stack terminal access device provided by some embodiments of the present invention can be referred to the implementation of the method shown in Figure 2 above and the beneficial effects brought by it. The dual-stack terminal For the implementation of the access device, reference may be made to the implementation of the foregoing method embodiments, and repeated descriptions will not be repeated.

Based on the same technical concept, some embodiments of the present invention also provide an access device for a dual-stack terminal, which can be used to implement the access device for a dual-stack terminal described in the foregoing embodiments of the present invention into the control process.

FIG. 5 shows a schematic structural diagram of an access device of a dual-stack terminal provided by some embodiments of the present invention. As shown in FIG. 5 , the access device may include: a transceiver 501 and a processor 502 .

The transceiver 501 and the processor 502 may be connected through a bus or in other ways.

The transceiver 501 may include interfaces for connecting with other network devices. For example, it may include an interface connected to user equipment, an interface connected to a captive portal authentication server, and an interface connected to other service devices. The interface can be a wired interface, a wireless interface or a combination thereof. The wired interface can be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface or a combination thereof. The wireless interface may be, for example, a wireless local area network (English: wireless local area network, WLAN) interface, a cellular network interface or a combination thereof.

The processor 502 may be a central processing unit (English: central processing unit, CPU), or a combination of a CPU and a hardware chip. The aforementioned hardware chip may be one or more of the following combinations: application-specific integrated circuit (English: application-specific integrated circuit, ASIC), field-programmable logic gate array (English: field-programmable gate array, FPGA), complex programmable Logic device (English: complex programmable logic device, CPLD), general array logic (English: generic array logic, abbreviation: GAL) and network processor (English: network processor, NP).

The access device may also include memory. Programs are stored in the memory to instruct the processor to work. The memory may include a volatile memory (English: volatile memory), such as a random-access memory (English: random-access memory, RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a read-only Memory (English: read-only memory, ROM), flash memory (English: flash memory), hard disk (English: hard disk drive, HDD) or solid-state hard disk (English: solid-state drive, SSD); The memory can also include A combination of the above types of memory.

Processor 502 is used for:

Use the transceiver 501 to forward the message for assigning an IPv4 address to the dual-stack terminal;

Before the dual-stack terminal authentication is successful, discard the packet received by the transceiver 501 to allocate an IPv6 address for the dual-stack terminal; arts.

The message for assigning an IPv6 address to the dual-stack terminal includes one or more of the following: a DHCP message sent by the dual-stack terminal to the DHCP server requesting an IPv6 address; a message carrying the IPv6 address of the dual-stack terminal sent by the DHCP server to the dual-stack terminal DHCP message: a routing advertisement message carrying the IPv6 address prefix of the dual-stack terminal sent by the router to the dual-stack terminal.

Before the authentication of the dual-stack terminal succeeds, the processor 502 is further configured to:

Use the transceiver 501 to intercept the DNS response message sent by the DNS server to the dual-stack terminal; wherein, the DNS response message includes the IPv4 address of the domain name requested by the dual-stack terminal and the IPv6 address of the domain name;

And, after deleting the IPv6 address in the DNS response message, the transceiver 501 is used to send the DNS response message to the dual-stack terminal.

Based on the same technical concept, the principles and beneficial effects of the problem-solving principles and beneficial effects of the dual-stack terminal access device provided by some embodiments of the present invention can be referred to the implementation of the method shown in Figure 2 above and the beneficial effects brought about. For the implementation of the access device of the terminal, reference may be made to the implementation of the foregoing method embodiments, and repeated descriptions will not be repeated.

Based on the same technical concept, an embodiment of the present invention also provides a storage medium, the storage medium is a computer-readable storage medium, the computer-readable storage medium stores a program, the program includes instructions, and the instructions are When the electronic device of the processor executes, the electronic device executes the flow of the access control method for the dual-stack terminal described in the foregoing embodiments of the present invention. For details, refer to the description of the foregoing embodiments, which will not be repeated in this application.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention, the present invention is also intended to include these modifications and variations.

Claims (9)

1. a kind of connection control method of double stack terminals, which is characterized in that double stack terminals support Internet protocol fourth edition IPv4 protocol stacks and Internet protocol sixth version IPv6 protocol stacks, this method include：

Message of the access device forwarding for double stack terminal distribution IPv4 addresses；

Before double stack terminal authentication successes, the access device is discarded as the report of double stack terminal distribution IPv6 addresses Text；

After double stack terminal authentication successes, report of the access device forwarding for double stack terminal distribution IPv6 addresses Text.

2. the method as described in claim 1, which is characterized in that the message packet for double stack terminal distribution IPv6 addresses Include following one or more：

The DHCP message of request IPv6 addresses that double stack terminals are sent to dynamic host configuration protocol DHCP server；

The DHCP message for the IPv6 addresses for carrying double stack terminals that the Dynamic Host Configuration Protocol server is sent to double stack terminals；

The route announcement message for the IPv6 address prefixes for carrying double stack terminals that router is sent to double stack terminals.

3. the method as described in claim 1, which is characterized in that before double stack terminal authentication successes, the method is also Including：

The access device intercepts and captures the DNS response messages that domain name system DNS server is sent to double stack terminals；The DNS Response message includes the IPv4 addresses of domain name of double stack terminal requests and the IPv6 addresses of domain name；

After the access device deletes the IPv6 addresses in the DNS response messages, the DNS response messages are sent to described Double stack terminals.

4. a kind of access device, which is characterized in that including：Transceiver and processor, wherein,

The processor is used for：

The message for double stack terminal distribution Internet protocol fourth edition IPv4 addresses is forwarded with the transceiver, wherein, it is described double Stack terminal supports IPv4 protocol stacks and Internet protocol sixth version IPv6 protocol stacks；

Before the double stack terminal authentications success, it is double stack terminal distribution IPv6 to abandon the transceiver and receive The message of location；And

After double stack terminal authentication successes, with report of the transceiver forwarding for double stack terminal distribution IPv6 addresses Text.

5. access device as claimed in claim 4, which is characterized in that the report for double stack terminal distribution IPv6 addresses Text includes following one or more：

The DHCP message of request IPv6 addresses that double stack terminals are sent to Dynamic Host Configuration Protocol server；

The DHCP message for the IPv6 addresses for carrying double stack terminals that the Dynamic Host Configuration Protocol server is sent to double stack terminals；

The route announcement message for the IPv6 address prefixes for carrying double stack terminals that router is sent to double stack terminals.

6. access device as claimed in claim 4, which is characterized in that before double stack terminal authentication successes, the place Reason device is additionally operable to：

Dns server is intercepted and captured to the DNS response messages of double stack terminals transmissions with the transceiver；The DNS response messages Include the IPv4 addresses of domain name of double stack terminal requests and the IPv6 addresses of domain name；And it deletes the DNS and answers After answering the IPv6 addresses in message, the DNS response messages are sent to double stack terminals with the transceiver.

7. a kind of access device of double stack terminals, which is characterized in that double stack terminals support IPv4 protocol stacks and IPv6 agreements Stack, the access device include：

Forwarding module, for forwarding the message for double stack terminal distribution IPv4 addresses；

Processing module, for before double stack terminal authentication successes, being discarded as double stack terminal distribution IPv6 addresses Message, and after double stack terminal authentication successes, forward the message for double stack terminal distribution IPv6 addresses.

8. access device as claimed in claim 7, which is characterized in that the report for double stack terminal distribution IPv6 addresses Text includes following one or more：

The DHCP message of request IPv6 addresses that double stack terminals are sent to Dynamic Host Configuration Protocol server；

The DHCP message for the IPv6 addresses for carrying double stack terminals that the Dynamic Host Configuration Protocol server is sent to double stack terminals；

The route announcement message for the IPv6 address prefixes for carrying double stack terminals that router is sent to double stack terminals.

9. access device as claimed in claim 7, which is characterized in that the access device further includes：

Interception module, for before double stack terminal authentication successes, intercepting and capturing what dns server was sent to double stack terminals DNS response messages, the DNS response messages include IPv4 addresses and the domain name of the domain names of double stack terminal requests After deleting the IPv6 addresses in the DNS response messages, it is whole to be sent to double stacks by IPv6 addresses for the DNS response messages End.