CN102740290B - Pre-authentication and pre-configuration method and system thereof - Google Patents

Abstract

The invention discloses a pre-authentication and pre-configuration method and a system thereof. The system for pre-authentication and pre-configuration comprises a current access point and a candidate access point which are positioned in different subnets, and further comprises a first virtual terminal positioned in the current access point and a second virtual terminal positioned in the candidate access point; and the first virtual terminal and the second virtual terminal communicate through a UDP channel. The system also comprises a candidate access point which belongs to a different network domain from the current access point, a third virtual terminal positioned at the candidate access point, a first virtual server which is in the same network domain as the current access point and a third virtual server which is in the same network domain as the candidate access point; and the first virtual terminal, the first virtual server, the third virtual terminal and the third virtual server are communicated through UDP channels. The invention can rapidly switch between different sub-networks of the same network domain and even between different network domains by using the virtual terminal and/or the virtual server to send the information related to the pre-authentication and the pre-configuration on the UDP layer.

Description

A pre-authentication and pre-configuration method and system thereof

technical field

The invention relates to the field of mobile communication, in particular to a pre-authentication and pre-configuration method and system thereof.

Background technique

When a communication terminal safely switches from one access point to another in the 802.11 network, it must exchange authentication information and configuration information with another access point, and then successfully connect after authentication and configuration. Among them, the authentication process based on 802.1X and the configuration process based on Dynamic Host Configuration Protocol (DynamicHost Configuration Protocol, DHCP) are the two main factors leading to the handover delay. FIG. 1 is a schematic diagram of an 802.11 authentication system based on 802.1X in the prior art. As shown in Figure 1, the EAP (EAP Over LAN, EAPOL) architecture in a local area network usually includes an authenticator (that is, an access point) and an authentication, authorization, and accounting (Authentication Authorization and Accounting, AAA) server. The authenticator is generally located at the edge of the network and communicates with the AAA server. This framework provides authentication and authorization functions for communication terminal equipment. The complete EAP process generally needs to be between the requester (communication terminal) and the authenticator (access point), between the authenticator and the access AAA server, and between the access AAA server and the hometown There are at least two round-trip interactions between AAA servers, causing a long delay and seriously affecting the quality of service. After passing the authentication and authorization, the process of configuration is the same.

In the existing 802.11i standard, a pre-authentication method is used to reduce this delay. Fig. 2 is a schematic diagram of 802.11i pre-authentication in the prior art. As shown in Figure 2, in 802.11i pre-authentication, the communication terminal (the supplicant entity in 802.1X) passes the currently connected access point and all candidate access points (authenticator entity in 802.1X) before handover ) for identity authentication. If the communication terminal switches to a pre-authenticated access point, it no longer needs to perform identity authentication with the access point, and only needs to spend a short time to execute the key negotiation process.

However, the currently used standard 802.11i pre-authentication only works on the second layer (MAC layer). Pre-authentication of a communication terminal handover from one access point to another is not supported.

DHCP is a TCP/IP (Transmission Control Protocol/Internet Protocol) standard that simplifies the configuration and management of host IP addresses. This standard provides an effective method for the use of DHCP server: that is to manage the dynamic allocation of IP addresses of communication terminals in the network and enable the related configuration information of DHCP clients on the network. When a communication terminal switches from one access point to another, it will obtain new IP configuration information from the newly connected access point, and this configuration information interaction and reconfiguration process will also cause a long delay , However, there is no method/device for reducing the handover delay in the prior art.

Contents of the invention

The technical problem to be solved by the present invention is to provide a safe and fast method for 802.11 networks in view of the defect that the delay caused by the authentication and/or configuration process cannot be reduced in the prior art when switching between subnets and domains. Toggle pre-authentication and provisioning methods.

The technical solution adopted by the present invention to solve its technical problems is:

A pre-authentication method is provided, which is used to perform pre-authentication before a communication terminal switches from a current access point to a candidate access point, where the current access point and the candidate access point belong to different subnets of the same network domain, The methods include:

The current access point receives the pre-authentication request information from the communication terminal, and transmits the received pre-authentication request information to the second virtual terminal through the UDP channel through the first virtual terminal, and the first virtual terminal is located at the current access point, The second virtual terminal is located at a candidate access point;

The candidate access point receives the pre-authentication request information through the UDP channel through the second virtual terminal for authentication, and returns the pre-authentication response information to the current access point through the second virtual terminal through the UDP channel;

The current access point receives the pre-authentication response information from the candidate access point through the first virtual terminal via a UDP channel, and transmits the pre-authentication response information to the communication terminal.

The present invention also provides a preconfiguration method, which is used for performing preconfiguration before the communication terminal switches from the current access point to the candidate access point, the current access point and the candidate access point belong to different networks in the same network domain. subnet, the method comprising:

The current access point receives the preconfiguration request information from the communication terminal, and transmits the received preconfiguration request information to the second virtual terminal through the UDP channel through the first virtual terminal, and the first virtual terminal is located at the current access point, The second virtual terminal is located at a candidate access point;

The candidate access point configures by receiving the pre-configuration request information through the UDP channel through the second virtual terminal, and returns pre-configuration response information to the current access point through the second virtual terminal through the UDP channel;

The current access point receives the preconfiguration response information from the candidate access point through the first virtual terminal via a UDP channel, and transmits the preconfiguration response information to the communication terminal for preconfiguration.

In a pre-configuration method of the present invention, it includes modifying the target MAC address of the pre-configuration request information to be the MAC address of the selected access point before sending the pre-configuration request information to the current access point, and modifying the The Ethernet type code of the preconfiguration request information; before sending the preconfiguration request information to the candidate access point, restore the Ethernet type code of the preconfiguration request information.

The present invention also provides a pre-authentication method, which is used for performing pre-authentication before the communication terminal switches from the current access point to the candidate access point, the current access point and the candidate access point belong to different network domains, so The methods described include:

The current access point receives the pre-authentication request information from the communication terminal, and transmits the received pre-authentication request information to the first virtual server through the UDP channel through the first virtual terminal, and the first virtual terminal is located at the current access point, The first virtual server and the current access point belong to the same network domain;

The third virtual server receives the pre-authentication request information from the first virtual server through the UDP channel, and transmits the pre-authentication request information to the third virtual terminal through the UDP channel, and the third virtual server and the candidate access points belong to the same network domain, and the third virtual terminal is located at the candidate access point;

The candidate access point receives the pre-authentication request information through the UDP channel through the third virtual terminal, and returns a pre-authentication response to the third virtual server through the UDP channel through the third virtual terminal information;

The third virtual server receives the pre-authentication response information from the third virtual terminal through a UDP channel, and transmits the pre-authentication response information to the first virtual server through a UDP channel;

The current access point receives the pre-authentication response information from the first virtual server via the UDP channel through the first virtual terminal, and transmits the pre-authentication response information to the communication terminal.

The present invention also provides a preconfiguration method, which is used for performing preconfiguration before the communication terminal switches from the current access point to the candidate access point, the current access point and the candidate access point belong to different network domains, including :

The current access point receives the preconfiguration request information from the communication terminal, and transmits the received preconfiguration request information to the first virtual configuration server via the UDP channel through the first virtual terminal, and the first virtual terminal is located at the current access point , the first virtual configuration server and the current access point belong to the same network domain;

The third virtual configuration server receives the preconfiguration request information from the first virtual configuration server through a UDP channel, and transmits the preconfiguration request information to a third virtual terminal through a UDP channel, and the third virtual configuration server and The candidate access point belongs to the same network domain and belongs to a different network domain from the first virtual configuration server, and the third virtual terminal is located at the candidate access point;

The candidate access point receives the preconfiguration request information through the UDP channel through the third virtual terminal, and returns the preconfiguration request information to the third virtual configuration server through the UDP channel through the third virtual terminal response message;

The third virtual configuration server receives the preconfiguration response information from the third virtual terminal through a UDP channel, and transmits the preconfiguration response information to the first virtual configuration server through a UDP channel;

The current access point receives the preconfiguration response information from the first virtual configuration server via the UDP channel through the first virtual terminal, and transmits the preconfiguration response information to the communication terminal for preconfiguration.

In a pre-configuration method of the present invention, it includes modifying the target MAC address of the pre-configuration request information to be the MAC address of the selected access point before sending the pre-configuration request information to the current access point, and modifying the The Ethernet type code of the preconfiguration request information; before sending the preconfiguration request information to the candidate access point, restore the Ethernet type code of the preconfiguration request information.

The present invention also provides a pre-authentication and pre-configuration system, which includes the current access point and at least one candidate access point located in different subnets of the same network domain, and also includes the first virtual terminal located at the current access point and the first virtual terminal located at the a second virtual terminal of the candidate access point;

The first virtual terminal is configured to communicate pre-authentication and/or pre-configuration request and/or response information with the second virtual terminal through a UDP channel;

The second virtual terminal is configured to communicate the pre-authentication and/or pre-configuration request and/or response information with the first virtual terminal through a UDP channel.

In the pre-authentication and pre-configuration system of the present invention, the second virtual terminal is also used to restore the pre-configuration request information before forwarding the pre-configuration request information after the Ethernet code of the pre-configuration request information Ethercode of configuration request information.

The present invention also provides a pre-authentication and pre-configuration system, which includes a current access point located in different network domains and at least one candidate access point, and also includes a first virtual terminal located at the current access point, a virtual terminal located at the candidate access point a third virtual terminal, a first virtual server belonging to the same network domain as the current access point, and a third virtual server belonging to the same network domain as the candidate access point;

The first virtual terminal is used to communicate pre-authentication and/or pre-configuration request and/or response information with the first virtual server through a UDP channel;

The first virtual server is configured to communicate the pre-authentication and/or pre-configuration request and/or response information with the first virtual terminal and the third virtual server respectively through a UDP channel;

The third virtual server is configured to communicate the pre-authentication and/or pre-configuration request and/or response information with the first virtual server and the third virtual terminal respectively through a UDP channel;

The third virtual terminal is used to communicate the pre-authentication and/or pre-configuration request and/or response information with the third virtual server through a UDP channel.

In the pre-authentication and pre-configuration system of the present invention, the third virtual terminal is also used to restore the pre-configuration request information before forwarding the pre-configuration request information after the Ethernet code of the pre-configuration request information Ethercode of configuration request information.

The beneficial effects of a pre-authentication and pre-configuration method and its system of the present invention are: by using a virtual terminal and/or a virtual server to send information related to pre-authentication and pre-configuration at the UDP layer, it can be quickly and safely in the same network domain Switching between different subnets or even different network domains improves the quality of communication services.

Description of drawings

The present invention will be further described below in conjunction with accompanying drawing and embodiment, in the accompanying drawing:

FIG. 1 is a schematic diagram of an 802.11 authentication system based on 802.1X in the prior art.

Fig. 2 is a schematic diagram of 802.11i pre-authentication in the prior art.

Fig. 3 is a flowchart of a pre-authentication method for cross-subnet handover according to an embodiment of the present invention;

FIG. 4 is a flow chart of a pre-authentication method for handover across network domains according to an embodiment of the present invention;

FIG. 5 is a flowchart of a pre-authentication method according to an embodiment of the present invention;

6 is a flow chart of a preconfiguration method for cross-subnet handover according to an embodiment of the present invention;

FIG. 7 is a flow chart of a preconfiguration method for cross-network domain handover according to an embodiment of the present invention;

FIG. 8 is a flow chart of a preconfiguration method according to an embodiment of the present invention;

9 is a schematic diagram of a pre-authentication and pre-configuration system for cross-subnet handover according to an embodiment of the present invention;

Fig. 10 is a schematic diagram of a pre-authentication and pre-configuration system for cross-domain handover according to an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Fig. 3 is a flowchart of a pre-authentication method for inter-subnet handover according to an embodiment of the present invention. In this embodiment, the pre-authentication method for inter-subnet handover starts at step 110 .

In step 110, the current access point receives the pre-authentication request information from the communication terminal, and transmits the received pre-authentication request information to the second virtual terminal through the UDP channel through the first virtual terminal, wherein the first virtual terminal is located at the current access point. point, the second virtual terminal is located at the candidate access point. The pre-authentication request information is standard 802.11i pre-authentication information, which includes the source MAC address and the destination MAC address. The first virtual terminal can obtain the UDP address (including IP and UDP port) of the destination virtual terminal according to the pre-authentication request information. A routing table may be pre-configured in the first virtual terminal, and all bindings (binding) between MAC addresses and virtual terminal/virtual server addresses are stored in the routing table. The routing table can be configured in advance, for example, the routing table of the first virtual terminal is configured as follows: {MAC address of the second access point=>address of the second virtual terminal}, the second access point is at least one candidate access Click on one of them. The routing table can also be dynamically updated, for example, the reverse route of the uplink frame routing can be updated into the routing table for use when sending downlink frames. The first virtual terminal can also query the required route from the central server, where all binding information of all access points in the same network domain is stored. The first virtual terminal may send the pre-authentication request information to the second virtual terminal via the UDP channel according to the MAC address of the candidate access point and the found route.

In step 120, the candidate access point receives the pre-authentication request information through the UDP channel through the second virtual terminal for authentication, and returns the pre-authentication response information to the current access point through the second virtual terminal through the UDP channel. For example, the candidate access point can send the pre-authentication request information to the authentication server AS1 in the same network domain. AS1 authenticates the communication terminal according to the pre-authentication request information, generates the pre-authentication response information including the authentication key, and returns it to the candidate access point. The candidate access point then sends the pre-authentication response information to the current access point (that is, the first virtual terminal) via the UDP channel through the second virtual terminal. However, this is only for illustration rather than limitation, and various 802.1X-based authentication methods may be included in various embodiments of the present invention. In the downlink communication in which the candidate access point returns the pre-authentication response information to the communication terminal, the reverse route of the uplink communication in which the communication terminal sends the pre-authentication request information to the candidate access point can be used. The functions of the second virtual terminal and the first virtual terminal similar and will not be described in detail here.

In step 130, the current access point receives the pre-authentication response information from the candidate access point via the UDP channel through the first virtual terminal, and transmits the pre-authentication response information to the communication terminal. The communication terminal can store and manage the pre-authentication response information from multiple candidate access points, and select a corresponding one for authentication when switching. Since the pre-authentication is performed before the handover, only the negotiation of the authentication key is needed in the handover authentication process, which consumes very little time and improves the quality of the communication service.

Fig. 4 is a flowchart of a pre-authentication method for inter-network domain handover according to an embodiment of the present invention. In this embodiment, the pre-authentication method for inter-network handover starts at step 210 .

In step 210, the current access point receives the pre-authentication request information from the communication terminal, and transmits the received pre-authentication request information together with the additional network domain information (such as ESSID) of the candidate access point through the UDP channel through the first virtual terminal For the first virtual server, the first virtual terminal is located at the current access point, and the first virtual server and the current access point belong to the same network domain.

In step 220, the third virtual server receives the pre-authentication request information from the first virtual server through the UDP channel, and transmits the pre-authentication request information to the third virtual terminal through the UDP channel, and the third virtual server and the candidate access point belong to the same The network domain belongs to a different network domain from the first virtual server, and the third virtual terminal is located at the candidate access point. Wherein, the pre-authentication request information is standard 802.11i pre-authentication information, which includes the source MAC address and the destination MAC address. . The first virtual server transmits the pre-authentication request information to the third virtual server in the network domain to which the candidate access point belongs according to the additional network domain information (for example, from the first virtual server to the third virtual server). For example, the binding between network domain information and the corresponding virtual server can be pre-configured on each virtual server according to the roaming agreement between network domains, such as {"the third network domain" => the third virtual server}, and can also be based on the reverse Routing updates the binding information on the virtual server. When the additional network domain information indicates that the destination network domain of the pre-authentication request information is the third network domain, the first virtual server may send the pre-authentication request information to the third virtual server according to the binding information, wherein the third network domain is The network domain to which the candidate access point belongs. After receiving the pre-authentication request information, the third virtual server can obtain the UDP address (including IP and UDP port) of the destination virtual terminal according to the pre-authentication request information. A routing table may be pre-configured in the third virtual server, and the routing table stores MAC addresses and all bindings (bindings) of all access points in the same network domain. The routing table can be configured in advance, for example, the routing table of the third virtual server is configured as follows: {MAC address of the third access point=>address of the third virtual terminal}, the third access point is at least one candidate access point Click on one of them. The routing table can also be dynamically updated, for example, the reverse route of the uplink frame routing can be updated into the routing table for use when sending downlink frames. The third virtual server can also query the required route from the central server, and the central server stores all binding information of all access points in the same network domain. The third virtual server may send the pre-authentication request information to the third virtual terminal via the UDP channel according to the MAC address of the candidate access point and the found route. In the above-mentioned uplink communication process, when the virtual terminal and the virtual server receive the uplink frame, the source UDP address (the UDP address of the virtual terminal/virtual server, including IP and UDP port) and the source MAC address (the UDP address of the communication terminal) to be delivered MAC address) to update the corresponding routing binding in reverse.

In step 230, the candidate access point receives the pre-authentication request information through the UDP channel through the third virtual terminal, and returns the pre-authentication response information to the third virtual server through the UDP channel through the third virtual terminal. For example, the candidate access point can send the pre-authentication request information to the authentication server AS3 in the same network domain. AS3 authenticates the communication terminal according to the pre-authentication request information, generates the pre-authentication response information including the authentication key, and returns it to the candidate access point. The candidate access point sends the pre-authentication response information to the third virtual server through the UDP channel through the third virtual terminal. However, this is only for illustration rather than limitation, and various 802.1X-based authentication methods may be included in various embodiments of the present invention.

In step 240, the third virtual server receives the pre-authentication response information from the third virtual terminal through the UDP channel, and transmits the pre-authentication response information to the first virtual server through the UDP channel. In the downlink communication returning the pre-authentication response information, the reverse route of the above-mentioned uplink communication can be used. The function of the third virtual terminal is similar to that of the first virtual terminal, and the function of the third virtual server is similar to that of the first virtual server. Describe in detail.

In step 250, the current access point receives the pre-authentication response information from the first virtual server via the UDP channel through the first virtual terminal, and transmits the pre-authentication response information to the communication terminal. The communication terminal can store and manage the pre-authentication response information from multiple candidate access points, and select a corresponding one for authentication when switching. Since the pre-authentication is performed before the handover, only the negotiation of the authentication key is needed in the handover authentication process, which consumes very little time and improves the quality of the communication service.

Fig. 5 is a flowchart of a pre-authentication method according to an embodiment of the present invention. In this embodiment, the pre-authentication method for inter-subnet/inter-network handover within a subnet/intra-network domain starts at step 301 .

In step 301, the first access point receives pre-authentication request information from the currently connected communication terminal. In step 302, the first access point determines whether the corresponding handover is an intra-subnet handover, an intra-network inter-subnet handover or an inter-network domain handover according to the candidate access point address in the pre-authentication request information.

If it is an intra-subnet handover, go to step 303. In step 303, the first access point directly sends the pre-authentication request information to the corresponding candidate access point in the MAC layer. In step 304, the candidate access point authenticates the communication terminal according to the received pre-authentication request information. In step 305, the candidate access point returns pre-authentication response information to the first access point. In step 306, the first access point sends pre-authentication response information to the communication terminal.

If it is inter-subnet switching within the network domain, go to step 307. In step 307, the first access point transmits the received pre-authentication request information to the second virtual terminal at the candidate access point through the UDP channel through the first virtual terminal. In step 308, the candidate access point receives the pre-authentication request information through the UDP channel through the second virtual terminal, and performs authentication. In step 309, the candidate access point transmits the pre-authentication response information to the first virtual terminal through the UDP channel through the second virtual terminal. In step 310, the first access point receives the pre-authentication response information via the UDP channel through the first virtual terminal, and transmits the received pre-authentication response information to the communication terminal sending the pre-authentication request for fast authentication during handover.

If switching across network domains, go to step 311. In step 311, the first access point transmits the received pre-authentication request information and the additional network domain information (such as ESSID) of the candidate access point to the first virtual server in the network domain through the UDP channel through the first virtual terminal. In step 312, the first virtual server transmits the pre-authentication request information to the third virtual server belonging to the same network domain as the candidate access point through the UDP channel according to the additional network domain information. In step 313, the third virtual server transmits the pre-authentication request information to the pre-authentication request information based on the destination MAC address and the pre-configured routing table (all bindings of all access points in the same network domain are stored in the virtual server). A third virtual terminal at the entry point. In step 314, the candidate access point receives the pre-authentication request information through the UDP channel through the third virtual terminal, and performs authentication. In step 315, the candidate access point transmits the pre-authentication response information to the third virtual server through the UDP channel through the third virtual terminal. In step 316, the third virtual server transmits the pre-authentication response information to the first virtual server through the UDP channel according to the reverse route during the uplink communication. In step 317, the first virtual server transmits the received pre-authentication response information to the first virtual terminal through a UDP channel. In step 318, the first access point receives the pre-authentication response information via the UDP channel through the first virtual terminal, and transmits the received pre-authentication response information to the communication terminal sending the pre-authentication request for quick authentication during handover.

Fig. 6 is a flowchart of a pre-configuration method for inter-subnet handover according to an embodiment of the present invention. In this embodiment, the pre-configuration method for inter-subnet handover starts at step 410 .

In step 410, the current access point receives the preconfiguration request information from the communication terminal, and transmits the received preconfiguration request information to the second virtual terminal through the UDP channel through the first virtual terminal, wherein the first virtual terminal is located in the current access point. point, the second virtual terminal is located at the candidate access point. The preconfiguration request information may include address information (such as MAC address) and DHCP information of the candidate access point or the second virtual terminal. The original DHCP information packet includes the underlying packet header, and the virtual terminal/virtual server needs to use the MAC address. The first virtual terminal can obtain the UDP address (including UDP and IP port) of the destination virtual terminal according to the pre-configuration request information. The MAC of the target access point of the standard DHCP packet generated by the DHCP client located at the communication terminal or access point is the broadcast address (0xfffffffffff), which cannot be routed by the virtual terminal through the routing table. Compared with the standard DHCP data packet, the DHCP data packet adopted in the present invention does not change the essential content except that the destination MAC address is changed to the MAC address of the candidate access point, so the protocol flow will not be affected. In most embodiments, the DHCP server located at the access point will receive many pre-configuration request messages (also called DHCP request messages), and the MAC addresses of these DHCP request messages may be different from the MAC address of the server. This will cause the DHCP server on the current access point to accept and process the provisioning request message. In order to avoid this situation, in some embodiments of the present invention, the target MAC address of the pre-configuration request information can be modified to be the MAC address of the selected access point, and the MAC address of the DHCP information sent by the DHCP client of the communication terminal can be changed. Layer Ethernet type code (ie IP is 0x0800), as long as it is changed to an unused form.

In step 420, the candidate access point performs configuration by receiving the preconfiguration request information through the UDP channel through the second virtual terminal, and returns the preconfiguration response information to the current access point through the UDP channel through the second virtual terminal. For example, the candidate access point can send the pre-configuration request information to the configuration server in the same network domain, and the configuration server configures the communication terminal according to the pre-configuration request information, generates a pre-configuration response information containing the configuration information, and returns it to the candidate access point point, the candidate access point then sends the preconfiguration response information to the current access point (that is, the first virtual terminal) via the UDP channel through the second virtual terminal. However, this is only for illustration and not for limitation. In various embodiments of the present invention, various configuration methods based on DHCP may be included. In addition, if the Ethernet type code is changed in the above step 410, in order not to affect the response of the DHCP server, the second virtual terminal should send the Ethernet type code of the MAC layer of the pre-configuration request information before sending the pre-configuration request information to the configurer. Code modification restore.

In step 430, the current access point receives the preconfiguration response information from the candidate access point via the UDP channel through the first virtual terminal, and transmits the preconfiguration response information to the communication terminal. The communication terminal can store and manage pre-configuration response information from multiple candidate access points, and select an appropriate one for configuration when switching. Since the pre-configuration is carried out before the handover, the configuration time during the handover is saved, the time delay is reduced, and the quality of the communication service is improved.

Fig. 7 is a flow chart of a pre-configuration method for inter-network handover according to an embodiment of the present invention. In this embodiment, the preconfiguration method for inter-network handover starts at step 510 .

In step 510, the current access point receives the provisioning request information from the communication terminal, and transmits the received provisioning request information and the additional network domain information (such as ESSID) of the candidate access point through the UDP channel through the first virtual terminal For the first virtual server, the first virtual terminal is located at the current access point, and the first virtual server and the current access point belong to the same network domain. The preconfiguration request information may include address information (such as MAC address) and DHCP information of the candidate access point or the third virtual terminal. The original DHCP information packet includes the underlying packet header, and the virtual terminal/virtual server needs to use the MAC address. The first virtual terminal can obtain the UDP address (including UDP and IP port) of the destination virtual terminal according to the pre-configuration request information. The MAC of the target access point of the standard DHCP packet generated by the DHCP client located at the communication terminal or access point is the broadcast address (0xfffffffffff), which cannot be routed by the virtual terminal through the routing table. Compared with the standard DHCP data packet, the DHCP data packet adopted in the present invention does not change the essential content except that the destination MAC address is changed to the MAC address of the target access point, so the protocol flow will not be affected. In most embodiments, the DHCP server located at the access point will receive many pre-configuration request messages (also called DHCP request messages), and the MAC addresses of these DHCP request messages may be different from the MAC address of the server. This will cause the DHCP server on the current access point to accept and process the provisioning request message. In order to avoid this situation, in some embodiments of the present invention, it is possible to change the Ethernet type code (that is, IP is 0x0800) of the MAC layer of the DHCP information sent by the DHCP client of the communication terminal, as long as it is changed into an unused form That's it.

In step 520, the third virtual server receives the preconfiguration request information from the first virtual server through the UDP channel, and transmits the preconfiguration request information to the third virtual terminal through the UDP channel, and the third virtual server and the candidate access point belong to the same The network domain belongs to a different network domain from the first virtual server, and the third virtual terminal is located at the candidate access point. Wherein, the preconfiguration request information may include address information (such as MAC address) and DHCP information of the candidate access point or the third virtual terminal. The first virtual server transmits the preconfiguration request information to the third virtual server in the network domain to which the candidate access point belongs according to the additional network domain information (for example, from the first virtual server to the third virtual server). For example, the binding between network domain information and the corresponding virtual server can be pre-configured on each virtual server according to the roaming agreement between network domains, such as {"the third network domain" => the third virtual server}, and can also be based on the reverse Routing updates the binding information on the virtual server. When the additional network domain information indicates that the destination network domain of the preconfiguration request information is the third network domain, the first virtual server may send the preconfiguration request information to the third virtual server according to the binding information, wherein the third network domain is The network domain to which the candidate access point belongs.

In step 530, the candidate access point receives the preconfiguration request information through the UDP channel through the third virtual terminal, and returns the preconfiguration response information to the third virtual server through the UDP channel through the third virtual terminal. If the Ethernet type code is changed in the above step 510, in order not to affect the operation of the DHCP server, the third virtual terminal will modify the Ethernet type code of the MAC layer of the pre-configuration request information before sending the pre-configuration request information to the configurator. reduction. In addition, the candidate access point can send the pre-configuration request information to the configuration server in the same network domain, and the configuration server configures the communication terminal according to the pre-configuration request information, generates a pre-configuration response information containing the configuration information, and returns it to the candidate access point point, the candidate access point sends the preconfiguration response information to the third virtual server through the UDP channel through the third virtual terminal. However, this is only for illustration and not for limitation. In various embodiments of the present invention, various configuration methods based on DHCP may be included.

In step 540, the third virtual server receives the preconfiguration response information from the third virtual terminal through the UDP channel, and transmits the preconfiguration response information to the first virtual server through the UDP channel. In the downlink communication of returning the pre-configuration response information, the reverse route of the above-mentioned uplink communication can be used. The function of the third virtual terminal is similar to that of the first virtual terminal, and the function of the third virtual server is also similar to that of the first virtual server. Describe in detail.

In step 550, the current access point receives the preconfiguration response information from the first virtual server via the UDP channel through the first virtual terminal, and transmits the preconfiguration response information to the communication terminal. The communication terminal can store and manage pre-configuration response information from multiple candidate access points, and select an appropriate one for configuration when switching. Since the pre-configuration is carried out before the handover, the configuration time during the handover is saved, the time delay is reduced, and the quality of the communication service is improved.

Fig. 8 is a flowchart of a provisioning method according to an embodiment of the present invention. In this embodiment, the preconfiguration method for inter-subnet/inter-network handover within a subnet/intra-network domain starts at step 601 .

In step 601, the first access point receives preconfiguration request information from a currently connected communication terminal. In step 602, the first access point determines whether the corresponding handover is an intra-subnet handover, an intra-network inter-subnet handover or an inter-network domain handover according to the candidate access point address in the pre-configuration request information.

If it is an intra-subnet handover, go to step 603. In step 603, the first access point directly sends the preconfiguration request information to the corresponding candidate access point in the MAC layer. In step 604, the candidate access point configures the communication terminal according to the received pre-configuration request information. In step 605, the candidate access point returns preconfiguration response information to the first access point. In step 606, the first access point sends preconfiguration response information to the communication terminal.

If the intra-network handover is performed across subnets, step 607 is performed. In step 607, the first access point transmits the received preconfiguration request information to the second virtual terminal at the candidate access point through the UDP channel through the first virtual terminal. In step 608, the candidate access point receives the preconfiguration request information through the UDP channel through the second virtual terminal, and performs configuration. In step 609, the candidate access point transmits the preconfiguration response information to the first virtual terminal through the UDP channel through the second virtual terminal; in step 610, the first access point receives the preconfiguration response information through the UDP channel through the first virtual terminal Response information, and pass the received pre-configuration response information to the communication terminal that sent the pre-configuration request for quick configuration during handover.

If it is switching across network domains, go to step 611. In step 611, the first AP transmits the received pre-configuration request information and additional network domain information (such as ESSID) of the candidate AP to the first virtual server in the network domain through the UDP channel through the first virtual terminal. In step 612, the first virtual server transmits the preconfiguration request information to the third virtual server belonging to the same network domain as the candidate access point through the UDP channel according to the additional network domain information. In step 613, the third virtual server transmits the preconfiguration request information to the third virtual terminal located at the candidate access point. In step 614, the candidate access point receives the preconfiguration request information through the UDP channel through the third virtual terminal, and performs configuration. In step 615, the candidate access point transmits the preconfiguration response information to the third virtual server through the UDP channel through the third virtual terminal. In step 616, the third virtual server transmits the preconfiguration response information to the first virtual server through the UDP channel. In step 617, the first virtual server transmits the received preconfiguration response information to the first virtual terminal through a UDP channel. In step 618, the first access point receives the pre-configuration response information via the UDP channel through the first virtual terminal, and transmits the received pre-configuration response information to the communication terminal that sent the pre-configuration request for quick configuration during handover.

The pre-configuration method shown in Figure 6-8 is different from the pre-authentication method shown in Figure 3-5 (802.11i pre-authentication frames are passed for pre-authentication, and DHCP packets are passed for pre-configuration). Much the same.

FIG. 9 is a schematic diagram of pre-configuration and a pre-configuration system for inter-subnet handover according to an embodiment of the present invention. In this embodiment, the pre-authentication and pre-configuration system includes the current access point and at least one candidate access point located in different subnets of the same network domain (as shown in FIG. 9, the first The access point AP1 and the second access point AP2 located in the second subnet) further include a first virtual terminal VCL1 located at the current access point and a second virtual terminal VCL2 located at the candidate access point.

VCL1 is used to communicate pre-authentication and/or pre-configuration request and/or response information with VCL2 through a UDP channel. VCL2 may be used to communicate the pre-authentication and/or pre-configuration request and/or response information with VCL1 through a UDP channel. The VCL2 can also be used to restore the Ethernet type code of the preconfiguration request information before forwarding the preconfiguration request information after the Ethernet type code of the preconfiguration request information is modified. For the specific process, reference may be made to the description of FIGS. 3 and 6 . VCL1 can run on the current access point, and VCL2 can run on the candidate access point. Although FIG. 9 only shows one candidate access point AP2, this is only for simplification of illustration and not for limitation. In various embodiments of the present invention, any suitable number of candidate access points may be included.

Fig. 10 is a schematic diagram of pre-configuration and pre-configuration system for cross-domain handover according to an embodiment of the present invention. In this embodiment, the pre-authentication and pre-configuration system includes current access points located in different network domains and at least one candidate access point (as shown in FIG. 10, the current access point AP1 located in the first network domain and the current access point AP1 located in the The candidate access point AP3 of the second network domain also includes the first virtual terminal VCL1 located at the current access point, the third virtual terminal VCL3 located at the candidate access point, and the first virtual terminal VCL3 belonging to the same network domain as the current access point. The server VS1 and the third virtual server VS3 belonging to the same network domain as the candidate access point.

VCL1 is used to communicate pre-authentication and/or pre-configuration request and/or response information with VS 1 through UDP channel. VS1 is used to communicate the pre-authentication and/or pre-configuration request and/or response information with VCL1 and VS3 respectively through the UDP channel. VS3 is used to communicate pre-authentication and/or pre-configuration request and/or response information with VS1 and VCL3 respectively through the UDP channel. VCL3 is used for communication of pre-authentication and/or pre-configuration request and/or response information with VS3 through UDP channel. The VCL3 can also be used to restore the Ethernet type code of the preconfiguration request information before forwarding the preconfiguration request information after the Ethernet type code of the preconfiguration request information is modified. For the specific process, reference may be made to the description of FIGS. 4 and 7 . VCL1 can run on the current access point, and VCL3 can run on the candidate access point. VS1 and VS3 can run on corresponding servers, such as authentication servers. Although FIG. 10 only shows one candidate access point AP3, this is only for simplification of illustration and not for limitation. In various embodiments of the present invention, any suitable number of candidate access points may be included.

In addition to the systems shown in Fig. 9 and Fig. 10, in other embodiments of the present invention, the embodiments shown in Fig. 9 and Fig. 10 can also be combined to simultaneously realize safe and fast switching across subnets and cross-network domains .

In a word, the present invention extends standard 802.11i pre-authentication to cross-subnet/cross-domain scenarios by introducing two new types of entity virtual terminals and virtual servers, and the present invention supports Medium) to reduce authentication and configuration delays during handover. The present invention can also use the positioning/routing mechanism combined with the MAC address to realize the communication of the access points between subnets and/or network domains, so as to perform 802.11i pre-configuration and DHCP pre-configuration, for example, use the MAC address to route 802.11i pre-authentication information and DHCP information. At the same time, the invention is compatible with the existing standard 802.11i and the DHCP standard, and does not need to modify the software entity of the existing network side.

The present invention is applied in the 802.11 (Wi-Fi) network, so that it can support the safe and fast switching of the mobile client (intra-subnet/intra-network domain/cross-subnet/cross-network domain), so as to better support time-sensitive applications such as VoIP (Skype).

Although the present invention is described through specific embodiments, those skilled in the art should understand that various changes and equivalent substitutions can be made to the present invention without departing from the scope of the present invention. In addition, various modifications may be made to the invention for a particular situation or material without departing from the scope of the invention. Therefore, it is intended that the invention not be limited to the particular embodiments disclosed, but should include all implementations falling within the scope of the appended claims.

Claims (10)

1. A pre-authentication method, which is used to perform pre-authentication before a communication terminal switches from a current access point to a candidate access point, the current access point and the candidate access point belonging to different subnets of the same network domain , characterized in that the method includes: The current access point receives the pre-authentication request information from the communication terminal, the first virtual terminal obtains the UDP address of the second virtual terminal according to the pre-authentication request information, and transmits the received pre-authentication request information via UDP through the first virtual terminal The channel is passed to a second virtual terminal, the first virtual terminal is located at the current access point, and the second virtual terminal is located at the candidate access point; The candidate access point receives the pre-authentication request information through the UDP channel through the second virtual terminal for authentication, and returns the pre-authentication response information to the current access point through the second virtual terminal through the UDP channel; The current access point receives the pre-authentication response information from the candidate access point through the first virtual terminal via a UDP channel, and transmits the pre-authentication response information to the communication terminal. 2. A pre-configuration method, which is used to perform pre-configuration before a communication terminal switches from a current access point to a candidate access point, the current access point and the candidate access point belong to different subnets of the same network domain , characterized in that the method includes: The current access point receives the pre-configuration request information from the communication terminal, the first virtual terminal obtains the UDP address of the second virtual terminal according to the pre-configuration request information, and transmits the received pre-configuration request information via UDP through the first virtual terminal The channel is passed to a second virtual terminal, the first virtual terminal is located at the current access point, and the second virtual terminal is located at the candidate access point; The candidate access point configures by receiving the pre-configuration request information through the UDP channel through the second virtual terminal, and returns pre-configuration response information to the current access point through the second virtual terminal through the UDP channel; The current access point receives the preconfiguration response information from the candidate access point through the first virtual terminal via a UDP channel, and transmits the preconfiguration response information to the communication terminal for preconfiguration. 3. The preconfiguration method according to claim 2, characterized in that, before sending the preconfiguration request information to the current access point, modifying the target MAC address of the preconfiguration request information to be the MAC address of the selected access point address, and modify the Ethernet type code of the pre-configuration request information; before sending the pre-configuration request information to the candidate access point, restore the Ethernet type code of the pre-configuration request information. 4. A pre-authentication method, used to perform pre-authentication before a communication terminal switches from a current access point to a candidate access point, the current access point and the candidate access point belong to different network domains, characterized in that , the method includes: The current access point receives the pre-authentication request information from the communication terminal, and transmits the received pre-authentication request information to the first virtual server through the UDP channel through the first virtual terminal, and the first virtual terminal is located at the current access point, The first virtual server and the current access point belong to the same network domain; The third virtual server receives the pre-authentication request information from the first virtual server through the UDP channel, the third virtual server obtains the UDP address of the third virtual terminal according to the pre-authentication request information, and sends the UDP address of the third virtual terminal through the UDP channel The pre-authentication request information is transmitted to a third virtual terminal, the third virtual server and the candidate access point belong to the same network domain, and the third virtual terminal is located at the candidate access point; The candidate access point receives the pre-authentication request information through the UDP channel through the third virtual terminal, and returns a pre-authentication response to the third virtual server through the UDP channel through the third virtual terminal information; The third virtual server receives the pre-authentication response information from the third virtual terminal through a UDP channel, and transmits the pre-authentication response information to the first virtual server through a UDP channel; The current access point receives the pre-authentication response information from the first virtual server via the UDP channel through the first virtual terminal, and transmits the pre-authentication response information to the communication terminal. 5. A preconfiguration method, used for performing preconfiguration before a communication terminal switches from a current access point to a candidate access point, the current access point and the candidate access point belong to different network domains, characterized in that ,include: The current access point receives the preconfiguration request information from the communication terminal, the first virtual terminal obtains the UDP address of the third virtual terminal according to the preconfiguration request information, and transmits the received preconfiguration request information through the UDP channel through the first virtual terminal For the first virtual configuration server, the first virtual terminal is located at the current access point, and the first virtual configuration server and the current access point belong to the same network domain; The third virtual configuration server receives the preconfiguration request information from the first virtual configuration server through a UDP channel, and transmits the preconfiguration request information to a third virtual terminal through a UDP channel, and the third virtual configuration server and The candidate access point belongs to the same network domain and belongs to a different network domain from the first virtual configuration server, and the third virtual terminal is located at the candidate access point; The candidate access point receives the preconfiguration request information through the UDP channel through the third virtual terminal, and returns the preconfiguration request information to the third virtual configuration server through the UDP channel through the third virtual terminal response message; The third virtual configuration server receives the preconfiguration response information from the third virtual terminal through a UDP channel, and transmits the preconfiguration response information to the first virtual configuration server through a UDP channel; The current access point receives the preconfiguration response information from the first virtual configuration server via the UDP channel through the first virtual terminal, and transmits the preconfiguration response information to the communication terminal for preconfiguration. 6. The preconfiguration method according to claim 5, characterized in that, before sending the preconfiguration request information to the current access point, modifying the target MAC address of the preconfiguration request information to be the MAC address of the selected access point address, and modify the Ethernet type code of the pre-configuration request information; before sending the pre-configuration request information to the candidate access point, restore the Ethernet type code of the pre-configuration request information. 7. A pre-authentication and pre-configuration system, comprising a current access point and at least one candidate access point located in different subnets of the same network domain, characterized in that it also includes a first virtual terminal located at the current access point and a second virtual terminal located at a candidate access point; The first virtual terminal obtains the UDP address of the second virtual terminal according to the pre-authentication and/or pre-configuration request information, and the first virtual terminal is used to perform pre-authentication and/or pre-authentication with the second virtual terminal through a UDP channel or communication of preconfigured request and/or response messages; The second virtual terminal is configured to communicate the pre-authentication and/or pre-configuration request and/or response information with the first virtual terminal through a UDP channel. 8. The pre-authentication and pre-configuration system according to claim 7, wherein the second virtual terminal is also used to forward the pre-configuration request information after the Ethernet type code of the pre-configuration request information is modified. Restore the Ethernet type code of the pre-configuration request information before configuring the request information. 9. A pre-authentication and pre-configuration system, including a current access point located in different network domains and at least one candidate access point, characterized in that it also includes a first virtual terminal located at the current access point, a first virtual terminal located at the candidate access point The third virtual terminal of the point, the first virtual server belonging to the same network domain as the current access point, and the third virtual server belonging to the same network domain as the candidate access point; The first virtual terminal obtains the UDP address of the third virtual terminal according to the pre-configuration request information, and the first virtual terminal is used to perform pre-authentication and/or pre-configuration request and/or response information with the first virtual server through the UDP channel Communication; The first virtual server is configured to communicate the pre-authentication and/or pre-configuration request and/or response information with the first virtual terminal and the third virtual server respectively through a UDP channel; The third virtual server obtains the UDP address of the third virtual terminal according to the pre-authentication request information, and the third virtual server is used to perform the pre-authentication with the first virtual server and the third virtual terminal respectively through a UDP channel. communication of authentication and/or provisioning request and/or response messages; The third virtual terminal is used to communicate the pre-authentication and/or pre-configuration request and/or response information with the third virtual server through a UDP channel. 10. The pre-authentication and pre-configuration system according to claim 9, wherein the third virtual terminal is also used to forward the pre-configuration request information after the Ethernet type code of the pre-configuration request information is modified. Restore the Ethernet type code of the pre-configuration request information before configuring the request information.