CN101179603A - Method and device for controlling user network access in IPv6 network - Google Patents

Abstract

The present invention is proposed mainly to realize the requirement of one IP address prefix for one user network in IPv6, and to more effectively authenticate the user network and prevent address theft. In the solution provided by the present invention, the access device adds the feature information of the user network and the address information of the access device to the RS message forwarded to the router for the router to perform access authentication. Adopting the scheme provided by the invention not only achieves the purpose of one IP address prefix for one user network, but also more effectively implements access authentication to the user network, and prevents address theft to a greater extent.

Description

Method and device for controlling user network access in IPv6 network

technical field

The invention relates to an IPv6 network, in particular to a method and a device for performing access authentication on a user network in the IPv6 network.

Background technique

IPv6 (Internet Protocol Version 6) is the core protocol of the next-generation Internet, which solves many defects exposed by IPv4, such as scarcity of addresses, huge routing tables, and insufficient support for mobile devices. IPv6 defines stateful address autoconfiguration and stateless address autoconfiguration mechanisms.

Stateless address autoconfiguration does not require manual configuration on the user terminal (such as a computer in the user network), simplifies the configuration requirements for routers, and does not require additional servers; in contrast, stateful address autoconfiguration requires Dynamic Host Allocation Protocol server. Based on the stateless address autoconfiguration, the user terminal generates its own IP address by combining its corresponding interface identifier with the IPv6 address prefix broadcast by the router. The present invention is mainly aimed at the situation of stateless address automatic configuration.

In the existing IPv6 access network, most of the access devices are Layer 2 (link layer) devices. Since the router request message forwarded by the access device to the router does not contain the corresponding port identifier of the access device, the user network Access authentication is not based on port identifications that correspond one-to-one to the user network. In addition, if the access device is selected to allocate IP addresses, it is necessary to upgrade the access device, which is generally a layer 2 device, to a layer 3 (IP layer) device, resulting in an increase in the cost of the operator; The device broadcasts the received router advertisement message (Router Advertisement message, hereinafter referred to as RA message) to multiple user networks, so that the IPv6 address prefix reaches multiple user networks, which cannot effectively implement the IPv6 standard for one user network to correspond to one IP address. Address prefix requirements are also prone to address theft.

Therefore, how to fully realize the one-to-one correspondence between user networks and IP address prefixes in IPv6 networks and realize effective access authentication for user networks on the basis of retaining the original layer-2 access devices has become a common concern.

Contents of the invention

Before explaining the technical solution of the present invention, the following concepts that may appear below are explained first:

IPv6 network: communication network based on IPv6 protocol;

Nodes: including user terminals, access devices, routers, etc.;

Interface: a device used at a node to connect to a physical link, for example, a network card of a computer (a user terminal);

Link layer address: the link layer identifier of the interface, such as: the MAC address of the computer network card in Ethernet;

Link-local address: The format prefix is 1111 1110 10, which is used for communication between adjacent nodes on the same link, such as communication between hosts when there is no router on a single link. The user terminal can use the link-local address to communicate with other user terminals in the same user network;

User network: as an important feature of the IPv6 protocol and also as a technical purpose of the present invention, each user network (including one or more user terminals) is provided with an IPv6 address prefix different from other user networks. Usually, a user network is connected to a port corresponding to it on the access device via a physical link;

Port: the part used on the access device to connect with the user network via a physical link in one-to-one correspondence;

Port ID: Port feature information that is unique in at least one access device. When the port identifier is only unique locally (within the control range of an access device), it needs to be shared with the address information of the access device (for example, its Layer 2 address) in the global (the part corresponding to an interface of the router) , unless otherwise specified below, "global" shall be interpreted accordingly) to uniquely identify the user network; and when the port identifier is globally unique, the user can be uniquely identified globally without the address information of the access device network.

The present invention is proposed to solve the aforementioned problems in the prior art, and aims to provide a new access control method and its device, based on IPv6 address automatic configuration, combined with the port of the user network (ie, the user network port of the access device) The identification performs access authentication on user networks to ensure that different user networks have their own IPv6 address prefixes.

In order to achieve the above object, according to the first aspect of the present invention, a method for assisting in controlling user terminal access in an IPv6 network access device is provided, which is characterized in that, based on IPv6 stateless address automatic configuration, according to the The feature information of the user network to which the user terminal belongs is used to assist in controlling the access of the user terminal. The method specifically includes the following steps: receiving an access request message from a user terminal, the user terminal belonging to a user network; adding characteristic information of the user network to the access request message to generate a new access request message; sending the new access request message to a network controller; assisting in controlling the access of the user terminal based on the access response of the network controller.

According to the second aspect of the present invention, there is provided an access auxiliary control device for assisting in controlling user terminal access in an IPv6 network access device, which is characterized in that it is based on IPv6 stateless address automatic configuration, according to the The feature information of the user network to which the user terminal belongs is used to assist in controlling the access of the user terminal. Specifically comprising: a receiving device, configured to receive an access request message from a user terminal, the user terminal belonging to a user network; a generating device, by adding characteristic information of the user network to the access request message to generate a new an access request message; sending means for sending the new access request message to a network controller; auxiliary control means for assisting in controlling the access of the user terminal based on the access response of the network controller .

According to a third aspect of the present invention, there is provided a method for controlling user terminal access in a network controller of an IPv6 network, characterized in that, based on IPv6 stateless address automatic configuration, according to the user network to which the user terminal belongs feature information to perform access control on the user terminal. The method includes the following steps: receiving a new access request message from a user terminal forwarded by a subordinate access device, the new access request message including characteristic information of the user network to which the user terminal belongs; based on the Access Request message to provide the corresponding Access Response.

Among them, according to the access response mode of the network controller and the positional relationship between the network server and the network controller, according to the third aspect of the present invention, there are at least four situations to be discussed, which will be described below in conjunction with the accompanying drawings and specific embodiments to elaborate.

According to the fourth aspect of the present invention, there is provided an access control device for controlling user terminal access in a network controller of an IPv6 network, which is characterized in that, based on IPv6 stateless address automatic configuration, according to the The characteristic information of the user network is used to control the access of the user terminal. Specifically, it includes: a first receiving device, configured to receive a new access request message from a user terminal forwarded by an access device subordinate to it, the new access request message includes characteristic information of the user network to which the user terminal belongs ; Response means, configured to provide a corresponding access response based on the access request message.

By adopting the method and device provided by the invention, the access authentication of the user network under the IPv6 protocol can be effectively realized, and each user network can be guaranteed to have its own IP address prefix.

Description of drawings

The present invention is described in detail below in conjunction with accompanying drawing:

Fig. 1 is the access network schematic diagram of the IPv6 network according to a specific embodiment of the present invention;

FIG. 2 is a flow chart of a method for assisting in controlling user terminal access in an access device of an IPv6 network according to a specific embodiment of the present invention;

FIG. 3 shows options added by an access device or a router in a router solicitation message or a router broadcast message according to a specific embodiment of the present invention;

4 is a block diagram of an auxiliary access control device for assisting in controlling user terminal access in an access device of an IPv6 network according to a specific embodiment of the present invention;

5 is a flowchart of a method for controlling user terminal access in a network controller (such as a router) of an IPv6 network according to a specific embodiment of the present invention;

6 is a block diagram of an access control device for controlling user terminal access in a network controller (such as a router) of an IPv6 network according to a specific embodiment of the present invention;

FIG. 7 comprehensively shows the flow of a method for controlling access to a user network according to a specific embodiment of the present invention;

Fig. 8 shows a method for processing router solicitation messages and router broadcast messages by each network node according to a preferred embodiment of the present invention.

Detailed ways

Standard stateless address autoconfiguration is implemented through the following process:

i. After the interface is activated, the user terminal generates a link-local address. At this time, the link-local address belongs to the experimental state;

ii. Based on the neighbor discovery mechanism, the user terminal verifies the uniqueness of the link-local address within the user network, and assigns it to the interface after confirming the uniqueness of the link-local address;

iii. In the router broadcast message (RA message) discovery phase, the RA message can be periodically broadcast by the router. Usually, in order to avoid too long waiting time, the user terminal will actively initiate a router solicitation message (Router Solicitation message, hereinafter referred to as the RS message) to Request routers to send RA messages to obtain IP address prefix allocation;

iv. Combine the IP address prefix sent by the router via the access device with the corresponding interface identifier to finally generate its IP address. Before the address is assigned to the interface, the address must also be checked for uniqueness.

Among them, the interface is activated when any of the following conditions are met, including but not limited to:

系统启动后接口被初始化；

The interface is initialized after the system starts;

在临时的接口故障后或临时的接口禁用后，接口被重新初始化；

The interface is reinitialized after a temporary interface failure or after a temporary interface disable;

接口第一次连接到一个用户网络。

The interface is connected to a user network for the first time.

In the IPv6 stateless address automatic configuration scheme in the existing standard, there are two ways to send the routing broadcast message containing the IP address prefix:

-The router actively broadcasts RA messages to each access device through its broadcast interface periodically, specifically, uses ICMPv6 to encapsulate the RA message containing the IP address prefix and sends it to a multiple access devices under its jurisdiction broadcast address (multicastaddress);

- A user terminal in the user network sends an RS message to the router via the access device, and the sending interval and sending times of the RS message are usually limited by a predetermined value, for example: the sending interval is greater than or equal to RTR_SOLICITATION_INTERVAL (4 seconds); the sending times Less than or equal to MAX_RTR_SOLICITATIONS (3 times). After receiving the router solicitation message, the router does not have to wait until the next scheduled router broadcast message sending time, but should send the RA message immediately, wherein, which interface of the router the RS message comes from, the router will send the RA message through which interface.

FIG. 1 is a schematic diagram of an access network of an IPv6 network according to a specific embodiment of the present invention. The network shown in the figure includes multiple user networks (each user network may have multiple user terminals), an access device 3, a router 4, and an AAA (authentication, authorization, accounting) server 5. In this embodiment, The router and the AAA server are independent of each other. Ports a, b, and c on the access device 3 correspond to user networks I, II, and III, respectively. For the sake of brevity, the user end equipment (for example, Bridged CPE) required for access in the user network is not shown in the figure. Like the access device, the client device also does not need to be upgraded to a layer-3 device.

The technical solution of the present invention can be configured by configuring the auxiliary access control device 1 provided by the present invention in the existing access equipment and configuring the access control device 2 provided by the present invention in the existing network controller (such as a router) to fulfill.

Fig. 2 is a flowchart of a method for assisting in controlling user terminal access in an access device of an IPv6 network according to a specific embodiment of the present invention. The method will be described in detail below with reference to FIG. 2 and in combination with FIG. 1 .

As mentioned above, when a user terminal in a user network (taking user network 1 as an example) wishes to obtain an IPv6 address prefix, it can send an access request message to router 4 via access device 3. In this embodiment, the The access request message is an RS message defined in the IPv6 standard, and correspondingly, the access response message is an RA message.

Based on stateless address automatic configuration, when the interface is activated, the user equipment needs to obtain the link-local address of the interface first, and determine whether the link-local address has been used based on the neighbor discovery mechanism through duplicate address detection. After indicating that the address is unique, assign the address to the interface. Thereafter, the RS message is sent to the corresponding port on the access device through the interface. It is easy to understand that no matter which user equipment in the user network sends the RS message, it will reach the port via the physical link between the user network and the access device. .

In step S10, the access device 3 receives an RS message sent by a user equipment (such as a notebook computer in the user network 1) in a user network (taking the user network 1 as an example);

As mentioned above, in the prior art, the RS message forwarded by the access device to the router does not include information that can uniquely identify the user network, which directly or indirectly affects the validity of the user network authentication and the allocation of IPv6 address prefixes. (the so-called pertinence is that each user network can have its exclusive IP address prefix, and this IP address prefix will not be embezzled by users in other user networks), therefore, as the most important invention point of the present invention, in In step S11, the access device 3 adds the feature information of the user network to the RS message to be sent to the router 4. Specifically, the feature information of the user network includes the following situations:

- when the port identifier has global uniqueness, the characteristic information of the user network may only include the port identifier of the port corresponding to the user network;

- When the port identifier does not have global uniqueness (for example, uniqueness only at one access device), the feature information of the user network includes the port identifier of the port corresponding to the user network (only available at this access device) The user network is uniquely identified within the control range of the device) and the characteristic information of the access device to which the user network belongs, such as its link-layer address, so that the pair of "port identifier-access device link-layer address" can be globally unique identify the user network;

- if the network segment from the access device 3 to the router 4 uses virtual local area network (VLAN) technology in the access network, then the feature information of the user network may not include the layer 2 address of the access device 3, because the VLAN can Used to identify an "access device, router" pair.

To illustrate this invention point more clearly, please refer to FIG. 3, which shows an option (option) added by an access device in an RS message according to a specific embodiment of the present invention, and the option includes the corresponding user network The characteristic information of the present embodiment will be described in detail below in conjunction with FIG. 3 . In order to adapt to the definition of the RS message in the standard, the option includes the following five fields:

Type (type): 8 bits, used to identify the type of the option;

Length (length): 8-bit unsigned integer. The length of this option (including the "Type" and "Length" fields) is an integer multiple of 8 bytes. Here, if the "Length" field is zero, it is considered invalid, that is, the node will receive the A neighbor discovery message packet (ND Packet, RS, RA message belongs to the neighbor discovery message) with a length of zero option is automatically discarded;

Reserved (reserved): a reserved 16-bit field;

Access device address (access node address):

a. According to a preferred embodiment of the present invention, consider the situation that the port identification cannot globally uniquely identify the user network, the feature information includes the access device address, together with the port identification to be explained below at the router 4 place (or at AAA server 5 place) is used for the authentication of this user network 1. In addition, after receiving the RS message, the router 4 can ensure that it generates an RA message and then sends the RA message to the determined access device 3 by extracting and storing the address information of the access device;

b. According to a specific embodiment of the present invention, since the port identifier has the ability to globally uniquely identify the user network 1, the RS message forwarded upward by the access device 3 may not include the address of the access device, then, when the router 3 generates an RA After receiving the message, the RA message will be sent to a multicast address (all the access devices under it can receive it). Since only the access device 3 can correctly resolve the corresponding port identifier of the user network I, it can still Avoid the theft of address prefixes;

c. According to another specific implementation manner of the present invention, the port identifier does not have global uniqueness, that is, in different access devices, the corresponding port identifiers are completely the same. Then, when the option of the RS message forwarded by the access device 3 to the router 4 does not include the address of the access device, the router 4 will still broadcast the RA message after passing the authentication. The same port identification of the corresponding port on the access device 6 of a user network IV that is responsible for access by the access device 6 (not shown) that works under the router 4 is the same as the port identification of the port a corresponding to the user network 1, then When the broadcast RA message containing the IP address prefix assigned to the user network 1 arrives at the access device 6, the access device 6 has the ability to analyze the RA message, and then forward it to corresponding to the user network IV, the user equipment in the user network IV may involve the theft of IP address prefixes when accessing the network.

Port ID (Port ID): The 32-bit port ID can uniquely identify an access device within the control range of at least one access device (for example, the control range of access device 3 in Figure 1 includes user networks I, II, and III). user network. For example, in an access network using Digital Subscriber Line (DSL) technology, each DSL line is assigned a unique 32-bit identifier (ie, DSL port number) under the access device. The router 4 uses the port identifier for access authentication of the user network I.

After adding the option shown in Figure 3 in the RS message to be forwarded to router 4, a new RS message is generated, and then, proceed to step S12.

In step S12, the access device 3 sends the generated new RS message (including at least the port identifier corresponding to the user network 1) to the router 4 to which it belongs.

Thereafter, the router 4 will be responsible for the access authentication to the user network 1. If the authentication is successful, then send the RA message to the access device 3 (in this embodiment, the RS message includes the address of the access device 3) (the router 4 responds according to the authentication result and will carry out the third and fourth aspects of the present invention hereafter Introduced in detail), so in step S13, the access device 3 judges whether the RA message from the router 4 is received, which includes the IP address prefix assigned to the user network 1 and the corresponding port identifier of the user network 1.

In step S13, the judgment result is that the RA message from router 4 is received

Go to step S14. Since the RA message contains the port identifier corresponding to the user network 1, the access device 3 can purposefully send the RA message to the corresponding user network 1 (corresponding to the port identifier included in the RA message) in step S14, and Open the corresponding port for user network I. After receiving the RA message, each user equipment in the user network 1 extracts the IP address prefix therein and combines it with their respective interface identifiers to generate a 128-bit IP address. It should be understood that after the RS message from a user equipment in a user network is authenticated at the router or the AAA server, the router 4 sends the IP address prefix information to the user network via the access device 3, and all users in the user network The user terminal can learn the IP address prefix information. This method is especially applicable to the following situation: the user equipments in the user network are friendly to each other and belong to the same organization (family, enterprise, etc.).

The RA message from the router 4 usually includes the port identifier of the port corresponding to the user network 1, but the user equipment does not need the port identifier. Therefore, preferably, after the access device 3 receives the RA message from the router 4, before sending it to the corresponding user network, it deletes the characteristic information of the user network, that is, the port identifier. Specifically, the option can be changed from Deleted from the RA message. It should be understood that if the access device 3 directly sends the RA message to the user network 1 without deleting the port identifier, it will not affect the user equipment in the user network 1 to obtain the required IP address prefix information. For the RA message The user equipment may not process the unrecognized part of the port identifier.

In step S13, the judgment result is that the RA message from router 4 has not been received

If the access device 3 does not receive the RA message from the router 4 after forwarding the RS message to the router 4, it means that the authentication fails, and the router will not distribute the IPv6 address prefix for the user network 1. According to a specific embodiment of the present invention, in order to be compatible with the standard, the router 4 based on the present invention does not send an RA message to the access device 3 after the authentication fails, and after forwarding the RS message, the access device 3 enters the The same general state before the RS message from user network I, waiting for the next RS message from some user network.

Fig. 4 is a block diagram of an auxiliary access control device for assisting in controlling user terminal access in an access device of an IPv6 network according to a specific embodiment of the present invention. The device will be described in detail below with reference to FIG. 4 in conjunction with FIG. 1 . The auxiliary access control device 1 specifically includes a receiving device 10 , a generating device 11 , a sending device 12 , and an auxiliary control device 13 . The auxiliary control device 13 includes a judging device 131 and a controlled sending device 132 , preferably, also includes a deleting device 133 .

As mentioned above, when a user terminal in the user network 1 wishes to obtain an IPv6 address prefix, it can send an access request message to the router 4 via the access device 3. In this embodiment, the access request message is an IPv6 standard IPv6 address prefix. The RS message defined in , correspondingly, the access response message is an RA message.

Based on stateless address automatic configuration, when the interface is activated, the user equipment needs to obtain the link-local address of the interface first, and determine whether the link-local address has been used based on the neighbor discovery mechanism through duplicate address detection. After indicating that the address is unique, assign the address to the interface. Thereafter, the RS message is sent to the corresponding port on the access device through the interface. It is easy to understand that no matter which user equipment in the user network sends the RS message, it will reach the port via the physical link between the user network and the access device. .

The receiving device 10 receives an RS message sent by a user equipment in the user network 1 (eg, a laptop computer in the user network 1).

As mentioned above, in the prior art, the RS message forwarded by the access device to the router does not include information that can uniquely identify the user network, which directly or indirectly affects the validity of the user network authentication and the allocation of IPv6 address prefixes. (the so-called pertinence is that each user network can have its exclusive IPv6 address prefix, and this IPv6 address prefix will not be embezzled by users in other user networks), therefore, as the most important invention point of the present invention, then The generating means 11 in the entry device 3 adds the characteristic information of the user network to the RS message. Specifically, the characteristic information of the user network includes the following situations:

- when the port identifier has global uniqueness, the characteristic information of the user network may only include the port identifier of the port corresponding to the user network;

- When the port identifier is not globally unique (for example, unique only at one access device), the characteristic information of the user network includes the port identifier of the port corresponding to the user network (only available at the access device within the scope of control) and the characteristic information of the access device to which the user network belongs, such as its link-layer address, so that the pair of "port identifier-access device link-layer address" can be globally unique identify the user network;

- if the network segment from the access device 3 to the router 4 uses virtual local area network (VLAN) technology in the access network, then the feature information of the user network may not include the layer 2 address of the access device 3, because the VLAN can Used to identify an "access device, router" pair.

For the description of the options added by the access device 3 in the RS message to be forwarded, please refer to the above description in conjunction with FIG. 3 .

After adding the option shown in Figure 3 in the RS message to be forwarded to the router 4 by the generating means 11, a new RS message is generated and delivered to the sending means 12;

The sending device 12 sends the generated new RS message (including at least the port identifier corresponding to the user network 1) to the router 4 to which it belongs.

Thereafter, the router 4 will be responsible for the access authentication to the user network 1. If the authentication is successful, then send the RA message to the access device 3 (in this embodiment, the RS message includes the address of the access device 3) (the router 4 responds according to the authentication result and will carry out the third and fourth aspects of the present invention hereafter Details during introduction), so the judging device 131 in the auxiliary control device 13 judges whether the RA message from the router 4 is received, which includes the IP address prefix assigned to the user network 1 and the corresponding port identifier of the user network 1. The receiving device 10 may be responsible for receiving the RA message, and notify the judging device 131 after receiving the RA message.

The judging result of judging means 131 is that the RA message from router 4 is received

Since the RA message contains the port identifier corresponding to the user network 1, the controlled sending device 132 can purposely send the RA message to the corresponding user network 1 (corresponding to the port identifier included in the RA message), and for User network 1 opens the corresponding port. After receiving the RA message, each user equipment in the user network 1 can generate a 128-bit IP address by extracting the IP address prefix and combining it with their respective interface identifiers. It should be understood that after the RS message from a user equipment in a user network is authenticated at the router or the AAA server, the router 4 sends the IP address prefix information to the user network via the access device 3, and all users in the user network The user terminal can learn the IP address prefix information. This method is especially applicable to the following situation: the user equipments in the user network are friendly to each other and belong to the same organization (family, enterprise, etc.).

The RA message from the router 4 usually includes the port identifier of the port corresponding to the user network 1, but the user equipment does not need the port identifier, so preferably, the auxiliary control device 13 also includes a deletion device 133, which deletes the device 133 After the access device 3 receives the RA message from the router 4, before sending it to the corresponding user network, delete the characteristic information of the user network, that is, the port identifier. Specifically, the option is removed from the RA message. It should be understood that if the access device 3 directly sends the RA message to the user network 1 without deleting the port identifier, it will not affect the user equipment in the user network 1 to obtain the required IP address prefix information. For the RA message The user equipment may not process the unrecognized part of the port identifier.

The judging result of judging means 131 is that the RA message from router 4 has not been received

If the access device 3 does not receive the RA message from the router 4 after forwarding the RS message to the router 4, it means that the authentication fails, and the router will not distribute the IPv6 address prefix for the user network 1. According to a specific embodiment of the present invention, in order to be compatible with the standard, the router 4 based on the present invention does not send an RA message to the access device 3 after the authentication fails, and after forwarding the RS message, the access device 3 enters the The same general state before the RS message from user network I, waiting for the next RS message from some user network.

Fig. 5 is a flowchart of a method for controlling user terminal access in a network controller (eg, a router) of an IPv6 network according to a specific embodiment of the present invention. The method provided by the present invention will be described in detail below in conjunction with FIG. 5 and with reference to FIG. 1 . In this embodiment, the RS message is still used as an example for the access request message, and the RA message is still used as an example for the access response message.

In step S20, the router 4 receives the RS message forwarded by the access device 3. For the options added by the access device in the RS message, please refer to FIG. 3 and the description of FIG. 3 above. The port identifier corresponding to the user network 1 together with the address information of the access device 3 uniquely identifies the user network 1 . This provides sufficient conditions for efficient authentication of user networks.

Fig. 1 has only shown a kind of relation of router 4 and AAA server 5, and in actual application, AAA server both can be integrated with router, also can be mutually independent with router (as shown in Fig. 1); According to different implementations of the present invention way, there are at least two ways to respond to the access request (RS message) after authentication, therefore, after step S20, the specific implementation of the present invention includes at least the following situations (wherein, Figure 4 corresponds to the following situation 1) :

Scenario 1: AAA server and router integrated

and only provide a response when the authentication is successful

This scenario provides the best compatibility with existing standards. In this case, since the router 4 itself can perform the access authentication to the user network 1 according to the RS message, it proceeds to step S21 to extract the characteristic information of the user network 1 (including but not limited to the user network 1) from the RS message. Corresponding port identification and address information of the access device 3);

Then, in step S22, use the extracted port identifier and the address information of the access device 3 to perform access authentication to the user network 1, and obtain an access authentication result;

If the authentication is successful, then in step S23, generate an RA message according to the standard, which includes the IPv6 address prefix assigned to the user network 1. Unlike the prior art, the RA message also includes options as shown in Figure 3, so that the receiving The ingress device 3 can uniquely inform each user equipment in the user network 1 of the IPv6 address prefix. It is easy to understand that when router 4 receives RS message from access device 3, it can extract and store user network feature information (including port identification and address information of access device 3), or directly store the option shown in FIG. , used to be appended to the RA message generated based on the present invention.

After generating the RA message, the router 4 sends it to the corresponding access device 3 in step S24.

If the authentication fails, router 4 preferably does not make any response, and prepares to receive the next access request message (such as RS message).

Scenario 2: AAA server and router integrated

and provide a response regardless of whether the authentication was successful

In case 2, the process from router 4 to obtaining the access authentication result locally after receiving the RS message forwarded by access device 3 is exactly the same as in case 1.

Next, router 4 provides a corresponding response according to the access authentication result. Specifically, if the authentication is successful, similar to case 1, router 4 generates an RA message, which includes the IP address prefix assigned to user network 1 and the user network I characteristic information;

If the authentication fails, the router 4 generates an authentication failure indication message including an authentication failure indication message, and sends it to the corresponding access device 3 . The authentication failure indication message may be an RA message (those skilled in the art can understand that this function can be realized as long as a new option is added to the RA message), or other additionally defined messages.

Scenario 3: AAA server and router are independent of each other

and only provide a response if the authentication is successful

After receiving the RS message from the access device 3, the router 4 needs to perform access authentication on the user network 1. Since the AAA server and the router are independent of each other, the router 4 sends an authentication request to the AAA server 5. For example, the The RS message from the access device 3 is forwarded to the AAA server 5 as the authentication request, and a new authentication request message can also be generated based on the RS message, such as a RADIUS request (RadiusRequest, RADIUS is the abbreviation of Remote Authentication Dial In User Service , is the standard client/server mode of information exchange between the network remote access device, the user equipment and the server including user authentication and configuration information), and sends the new authentication request message to the AAA server 5.

The AAA server 5 performs access authentication to the user network 1 according to the authentication request, obtains an access authentication result (success/failure), and returns the access authentication result to the router 4 through an access authentication response message , wherein, the access authentication response message may be a RADIUS response message (RADIUS ACK/NACK);

Router 4 receives the access authentication result, and responds to the RS according to the access authentication result:

If the access authentication result from the AAA server shows that the user network 1 has passed the authentication, an RA message is generated, which includes the IP address prefix assigned to the user network and the corresponding port identification;

If the access authentication result from the AAA server shows that the user network I fails to pass the authentication, no response will be made.

Scenario 4: AAA server and router are independent of each other

and provide a response regardless of whether the authentication was successful

In case 4, the process from router 4 to receiving the access authentication result from the AAA server after receiving the RS message forwarded by access device 3 is exactly the same as in case 3.

Then, the router 4 provides a corresponding response according to the access authentication result from the AAA server 5. Specifically, if the authentication is successful, as in the case 3, the router 4 generates an RA message, which includes the IP address assigned to the user network 1 address prefix and characteristic information of the user network I;

If the authentication fails, the router 4 generates an authentication failure indication message including indication information indicating the authentication failure, and sends it to the corresponding access device 3 . The authentication failure indication message may be an RA message (those skilled in the art can understand that this function can be realized as long as a new option is added to the RA message), or other additionally defined messages.

Fig. 6 is a block diagram of an access control device for controlling user terminal access in a network controller (eg, router) of an IPv6 network according to a specific embodiment of the present invention. The access control device provided by the present invention will be described in detail below in conjunction with FIG. 6 and with reference to FIG. 1 .

In this embodiment, the RS message is still used as an example for the access request message, and the RA message is still used as an example for the access response message.

The access control device includes: a first receiving device 20 and a responding device 21, wherein, according to a specific embodiment of the present invention, the responding device 21 includes an obtaining device 210 and a providing device 211, and the obtaining device 210 includes an extracting device 2100 and authentication means 2101, the providing means 211 includes generating means 2110 and first sending means 2111. According to another specific implementation manner of the present invention, the obtaining means 210 further includes a second sending means 2102 and a second receiving means 2103 . For convenience, the devices (modules) that may be included in the access control device 2 according to different embodiments of the present invention are shown in FIG. 6 , and it should be understood that those skilled in the art can select Some of the devices (modules) are used to implement the access control device 2 provided by the present invention. For example, when the positional relationship between the router 4 and the AAA server is different from that shown in FIG. 1, but two in one, the second sending The device 2102 and the second receiving device 2103 can be omitted.

The first receiving means 20 receives the RS message sent by the access device 3, and for the options added by the access device 3 in the RS message, please refer to FIG. 3 and the description of FIG. 3 above. The port identifier corresponding to the user network 1 together with the address information of the access device 3 uniquely identifies the user network 1 . This provides sufficient conditions for effective authentication of user networks.

Fig. 1 has only shown a kind of relation of router 4 and AAA server 5, and in actual application, AAA server both can be integrated with router, also can be mutually independent with router (as shown in Fig. 1); According to different implementations of the present invention There are at least two ways to respond to the access request (RS message) after authentication. Therefore, after receiving the RS message, the specific implementation manners of the present invention include at least the following situations, wherein FIG. 1 corresponds to the following situations 1:

Scenario 1: AAA server and router integrated

and only provide a response when the authentication is successful

This scenario provides the best compatibility with existing standards. In this case, since the router 4 itself can perform access authentication to the user network I according to the RS message, the extraction device 2100 extracts the feature information of the user network I from the RS message (including but not limited to the corresponding port identification and address information of the access device 3);

Next, the authentication means 2101 uses the extracted port identifier and the address information of the access device 3 to perform access authentication on the user network 1, and obtain an access authentication result;

If the authentication is successful, the generating means 2110 generates an RA message according to the standard, which includes the IP address prefix assigned to the user network 1. Unlike the prior art, the RA message also includes options as shown in FIG. The ingress device 3 can uniquely inform each user equipment in the user network 1 of the IP address prefix. It is easy to understand that when router 4 receives RS message from access device 3, it can extract and store user network feature information (including port identification and address information of access device 3), or directly store the option shown in FIG. , used to be appended to the RA message generated based on the present invention.

After the RA message is generated, the first sending module 2111 sends the RA message to the corresponding access device 3 .

If the authentication fails, router 4 preferably does not make any response, and prepares to receive the next access request message (such as RS message).

Scenario 2: AAA server and router integrated

and provide a response regardless of whether the authentication was successful

In case 2, the process from router 4 to obtaining the access authentication result locally after receiving the RS message forwarded by access device 3 is exactly the same as in case 1.

Next, the responding means 21 provides a corresponding response according to the access authentication result. Specifically, if the authentication is successful, as in case 1, the generating means 2110 generates an RA message, which includes the IP address prefix assigned to the user network 1 and the Feature information of user network I;

If the authentication fails, generating means 2110 generates an authentication failure indication message including indication information indicating authentication failure, and sends it to the corresponding access device 3 . The authentication failure indication message may be an RA message (those skilled in the art can understand that this function can be realized as long as a new option is added to the RA message), or other additionally defined messages.

Scenario 3: AAA server and router are independent of each other

and only provide a response if the authentication is successful

After the first receiving device 20 receives the RS message from the access device 3, the router 4 needs to carry out access authentication to the user network 1. Since the AAA server 5 and the router 4 are independent of each other, the router 4 passes through the second sending device. 2102 Send an authentication request to the AAA server 5, for example, the RS message from the access device 3 may be used as the authentication request and forwarded to the AAA server 5, or a new authentication request message may be generated based on the RS message, such as a RADIUS request (Radius Request, RADIUS is the abbreviation of Remote Authentication Dial In User Service, which is a standard client/server mode for information exchange between network remote access devices, user devices, and servers containing user authentication and configuration information), and the new authentication The request message is sent to the AAA server 5 .

The AAA server 5 performs access authentication to the user network 1 according to the authentication request, obtains an access authentication result (success/failure), and returns the access authentication result to the router 4 through an access authentication response message, Wherein, the access authentication response message may be a RADIUS response message (RADIUS ACK/NACK);

The second receiving means 2103 receives the access authentication result, and then needs to respond to the RS according to the access authentication result:

If the access authentication result from the AAA server shows that the user network 1 has passed the authentication, then the generating means 2110 generates an RA message, which includes the IP address prefix assigned to the user network and the corresponding port identification;

If the access authentication result from the AAA server shows that the user network I fails to pass the authentication, no response will be made.

Scenario 4: AAA server and router are independent of each other

and provide a response regardless of whether the authentication was successful

In case 4, the process from router 4 to receiving the access authentication result from the AAA server after receiving the RS message forwarded by access device 3 is exactly the same as in case 3.

Next, the router 4 provides a corresponding response according to the access authentication result from the AAA server 5. Specifically, if the authentication is successful, as in the case 3, the generating means 2110 generates an RA message, which contains the information allocated to the user network 1. IP address prefix and characteristic information of the user network I;

If the authentication fails, the generating unit 2110 generates an authentication failure indication message including indication information indicating the authentication failure, and then the first sending unit 2111 sends it to the corresponding access device 3 . The authentication failure indication message may be an RA message (those skilled in the art can understand that this function can be realized as long as a new option is added to the RA message), or other additionally defined messages.

The method and device for accessing the device side and the router side have been described above with reference to the accompanying drawings. Fig. 7 comprehensively shows the flow of a method for controlling access to a user network according to a specific embodiment of the present invention. Its specific content has been described in detail above with reference to FIGS. 3-6 .

FIG. 8 shows a method for processing RS messages and RA messages by each network node according to a preferred embodiment of the present invention. Please refer to FIG. 1 at the same time. Specifically, the figure shows the destination address and source address of each layer of the message sent by each network node (that is, each packet header after encapsulation, such as Ethernet, IP, ICMP, etc.).

In each of the above embodiments, the RS message and RA message defined in the existing standard are fully utilized, and the signaling overhead is significantly reduced compared with the prior art. It should be understood that the access request message in the present invention is not limited to the RS message in this embodiment, and the access response message is also not limited to the RA message.

The present invention has been described above in conjunction with specific embodiments. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the appended claims.

Claims (30)

1. one kind is used for the method that the assist control user terminal inserts in the access device of IPv6 network, it is characterized in that, automatically dispose the access that comes this user terminal of assist control according to the characteristic information of user network under the described user terminal based on the IPv6 stateless address.

2. method according to claim 1 wherein, may further comprise the steps:

A. receive the access request message from a user terminal, this user terminal belongs to a user network;

B. by characteristic information, to generate a new access request message at additional this user network of described access request message;

C. send this new access request message to a network controller;

D. respond the access of this user terminal of assist control based on the access of described network controller.

3. method according to claim 2, wherein, described steps d comprises:

D1. judge whether to receive the access response message from this network controller, wherein this access response message comprises the route related information of described user network;

D2. when the access response message that receives from this network controller, this access response message is sent to the user network at this user terminal place.

4. method according to claim 3, wherein, described steps d 2 also comprises:

-when the access response message that receives from described network controller, insert the characteristic information of this user network of deletion the response message from this, to generate a new access response message;

-described new access response message is sent to the user network at this user terminal place.

5. according to each described method among the claim 1-4, it is characterized in that described access request message is a router request message, described access response message is a router broadcast message.

6. according to each described method among the claim 1-4, wherein,

The characteristic information of described user network comprises and the identifier of the corresponding access interface of this user network, AN (access node) address information etc. that described route related information is the IPv6 address prefix.

7. one kind is used for the access sub controlling unit that the assist control user terminal inserts in the access device of IPv6 network, it is characterized in that, automatically dispose the access that comes this user terminal of assist control according to the characteristic information of user network under the described user terminal based on the IPv6 stateless address.

8. device according to claim 7 wherein, comprising:

Receiving system is used to receive the access request message from a user terminal, and this user terminal belongs to a user network;

Generating apparatus is by the characteristic information at additional this user network of described access request message, to generate a new access request message;

Dispensing device is used to send this new access request message to a network controller;

Sub controlling unit is used for responding based on the access of described network controller the access of this user terminal of assist control.

9. device according to claim 8, wherein, described sub controlling unit also comprises:

Judgment means is used to judge whether to receive the access response message from this network controller, and wherein this access response message comprises the route related information of described user network;

Controlled dispensing device is used for should inserting response message and being sent to this user terminal when the access response message that receives from this network controller.

10. device according to claim 9, wherein, described sub controlling unit also comprises:

Delete device is used for when the access response message that receives from described network controller, inserts the characteristic information of this user network of deletion the response message from this, to generate a new access response message;

Wherein, described controlled dispensing device also is used for, and described new access response message is sent to the user network at described user terminal place.

11., it is characterized in that described access request message is a router request message according to each described device among the claim 7-10, described access response message is a router broadcast message.

12. according to each described device among the claim 7-11, it is characterized in that, the characteristic information of described user network comprises and the identifier of the corresponding access interface of this user network, AN (access node) address information etc. that described route related information is the IPv6 address prefix.

13. the access device in the IPv6 network is characterized in that, comprises according to each described access sub controlling unit that is used for the access of assist control user terminal among the claim 7-12.

14. one kind is used to control the method that user terminal inserts in IPv6 network of network controller, it is characterized in that, automatically dispose based on the IPv6 stateless address, come this user terminal is carried out access control according to the characteristic information of user network under the described user terminal.

15. method according to claim 14 wherein, may further comprise the steps:

G. receive the new access request message from a user terminal of its subordinate's an access device forwarding, described new access request message comprises the characteristic information of the affiliated user network of this user terminal;

H. provide corresponding access response based on described access request message.

16. method according to claim 15, wherein, step h may further comprise the steps:

H1. obtain an access authentication result based on described access request message;

H2. provide corresponding access response according to described access authentication result.

17. method according to claim 16, wherein, step h1 comprises:

-by the characteristic information that extracts this user network in the described access request;

-come this user network is carried out access authentication based on the characteristic information of this user network, to obtain the access authentication result.

18. according to claim 16 or 17 described methods, wherein, described step h2 comprises:

-when this user network passes through authentication, then generate one and insert response message, wherein, this access request-reply message comprises the route related information of this user network;

-described access response message is sent to described access device.

19. method according to claim 16, wherein, described step h1 comprises:

H11. send authentication request message to a webserver, comprise the characteristic information of described user network in this authentication request message;

H12. receive access authentication result from the described webserver;

Described step h2 also comprises, provides corresponding access response according to the access authentication result from the described webserver.

20. method according to claim 19, wherein, described step h2 comprises:

-when described access authentication result from the described webserver indicates this subscriber network by authentication, generate one and insert response message, wherein, this access request-reply message comprises the route related information of this user network.

21., it is characterized in that described access request message is a router request message according to each described method among the claim 14-20, described access response message is a router broadcast message.

22. one kind is used to control the access control apparatus that user terminal inserts in IPv6 network of network controller, it is characterized in that, based on the state automatic address configuration of IPv6 unit, come this user terminal is carried out access control according to the characteristic information of user network under the user terminal.

23. access control apparatus according to claim 22 wherein, comprising:

First receiving device is used to receive the new access request message from a user terminal that its subordinate's a access device is transmitted, and described new access request message comprises the characteristic information of user network under this user terminal;

Responding device is used for providing corresponding access response based on described access request message.

24. access control apparatus according to claim 21, wherein, described responding device comprises:

Obtain device, be used for obtaining an access authentication result based on described access request message;

Generator is used for providing corresponding access response according to described access authentication result.

25. access control apparatus according to claim 24, wherein, described acquisition device comprises:

Extraction element is used for being extracted by described access request the characteristic information of this user network;

Authenticate device comes this user network is carried out access authentication based on the characteristic information of this user network, to obtain the access authentication result.

26. according to claim 24 or 25 described access control apparatus, wherein, described generator comprises:

Generating apparatus is used for passing through authentication when this user network, then generates one and inserts response message, and wherein, this access request-reply message comprises the route related information of this user network;

First dispensing device is used for described access response message is sent to described access device.

27. access control apparatus according to claim 25, wherein, described acquisition device comprises:

Second dispensing device is used to send authentication request message to a webserver, comprises the characteristic information of described user network in this authentication request message;

Second receiving system is used to receive the access authentication result from the described webserver;

The described dress that provides directly also is used for, and provides corresponding access response according to described access authentication result from the described webserver.

28. access control apparatus according to claim 27, wherein, described generator also is used for, when described access authentication result from the described webserver indicates this subscriber network by authentication, generate one and insert response message, wherein, this access request-reply message comprises the route related information of this user network.

29., it is characterized in that described access request message is a router request message according to each described access control apparatus among the claim 22-28, described access response message is a router broadcast message.

30. the network controller in the IPv6 network is characterized in that, comprises according to each described access control apparatus that is used to control the user terminal access among the claim 22-29.

Images