CN118473710A - Authentication method of PPPoE message and BRAS equipment - Google Patents

Abstract

The present specification provides a PPPoE message authentication method and BRAS device, the method comprising: receiving a PPPoE message, encapsulating the PPPoE message with an IPv6 message header, obtaining the path information of the PPPoE message passing through each routing device recorded in the IPv6 message header, and sending the path information and the authentication information of the PPPoE message to an authentication server. Through this method, it is possible to verify whether the physical location information of the PPPoE terminal is correct when the PPPoE message is forwarded at the third layer. Thus, the binding authentication of the user account and the user location information is realized, which effectively improves the security of the PPPoE network and prevents the acts of impersonation and theft of accounts.

Description

A PPPoE message authentication method and BRAS device

Technical Field

The present invention relates to the field of communication technology, and in particular to a PPPoE message authentication method and a BRAS device.

Background Art

PPPoE (Point-to-Point Protocol over Ethernet) is a network protocol that combines Ethernet in broadband connections with the Point-to-Point Protocol (PPP) for DSL connections and Ethernet access to the Internet. The PPPoE protocol allows multiple users to access the service provider's network via Ethernet and establish a virtual point-to-point connection. This connection is commonly used to achieve Internet access via telephone lines (ADSL services) or cables.

In traditional PPPoE networks, authenticating access users based solely on usernames and passwords poses certain security risks. If a user account is stolen, the thief can easily use the account to access the network from other locations.

Summary of the invention

In order to overcome the problems existing in the related art, this specification provides a PPPoE message authentication method and BRAS device.

According to a first aspect of an embodiment of this specification, a PPPoE message authentication method is provided, the method being applied to a BRAS device, the method comprising:

Receiving a PPPoE message, wherein the PPPoE message is encapsulated with an IPv6 message header;

Obtaining path information of the PPPoE message passing through each routing device recorded in the IPv6 message header;

The path information and the authentication information of the PPPoE message are sent to an authentication server, so that the authentication server authenticates the PPPoE terminal that sends the PPPoE message according to the path information and the authentication information.

The method for encapsulating the IPv6 message header for the PPPoE message includes:

The PPPoE terminal or the first routing device along the PPPoE message path encapsulates the PPPoE message with an IPv6 message header.

The IPv6 source address in the IPv6 message header is the address of the first routing device, and the IPv6 destination address in the IPv6 message header is the address of the BRAS.

Wherein, obtaining the path information of the PPPoE message passing through each routing device recorded in the IPv6 message header includes:

The SID list in the IPv6 message header is obtained, wherein the SID list records the path information of the PPPoE message passing through each routing device.

The step of sending the path information and the authentication information of the PPPoE message to the authentication server includes:

The IPv6 header of the PPPoE message is removed, and the path information is loaded into the NAS-PORT-ID attribute and sent to the authentication server.

It can be seen from the above embodiments that by encapsulating the PPPoE message with an IPv6 message header, and recording the path information of each routing device through which the PPPoE message passes through the IPv6 message header, and carrying the path information when sending authentication information to the authentication server, the authentication server verifies whether the physical location information of the PPPoE terminal is correct while authenticating according to the user name and key, thereby preventing the user account from being stolen and the thief from easily using the account to access the network in other places.

According to a second aspect of an embodiment of this specification, a BRAS device is provided, the BRAS device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following method when executing the program:

Receiving a PPPoE message, wherein the PPPoE message is encapsulated with an IPv6 message header;

Obtaining path information of the PPPoE message passing through each routing device recorded in the IPv6 message header;

The path information and the authentication information of the PPPoE message are sent to an authentication server, so that the authentication server authenticates the PPPoE terminal that sends the PPPoE message according to the path information and the authentication information.

According to a third aspect of an embodiment of this specification, a BRAS device is provided, the BRAS device comprising:

A receiving module, used for receiving a PPPoE message, wherein the PPPoE message encapsulates an IPv6 message header;

An acquisition module, used to acquire the path information of the PPPoE message passing through each routing device recorded in the IPv6 message header;

The sending module is used to send the path information and the authentication information of the PPPoE message to the authentication server, so that the authentication server authenticates the PPPoE terminal that sends the PPPoE message according to the path information and the authentication information.

The IPv6 source address in the IPv6 message header is the address of the first routing device through which the PPPoE message passes, and the IPv6 destination address in the IPv6 message header is the address of the BRAS.

The acquisition module is specifically used to acquire the SID list in the IPv6 message header, and the SID list records the path information of the PPPoE message passing through each routing device.

The sending module is specifically used to remove the IPv6 message header of the PPPoE message, and load the path information into the NAS-PORT-ID attribute and send it to the authentication server.

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

FIG. 1 is a flow chart of a method for authenticating a PPPoE message according to an exemplary embodiment of the present specification.

FIG. 2 is a schematic diagram of a network architecture according to an exemplary embodiment of this specification.

DETAILED DESCRIPTION

Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and/or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

Currently, in the same Layer 2 network, by deploying PPPoE relay equipment between PPPoE client (PPPoE terminal) and PPPoE server, the user's physical location information is transmitted to the BRAS device (PPPoE server function is deployed on the BRAS device) through the access line ID (access-line-id). The content of the access line ID includes two parts: circuit-id and remote-id. The BRAS device directly copies the access line ID to the NAS-PORT-ID attribute of RADIUS and sends it to the RADIUS server. The RADIUS server compares the received NAS-PORT-ID attribute with the physical location information configured in the database to verify whether the user's physical location information is correct. In this way, the binding authentication of the user account and the user's location information is realized.

When there is a router between the PPPoE client and the PPPoE server (that is, when a three-layer network is required), a layer of IPv6 encapsulation will be added to the PPPoE message through PPPoE over IPv6 for forwarding in router devices such as the metropolitan area network. Finally, after the PPPoE message reaches the BRAS device, the IPv6 header will be stripped off and restored to the original PPPoE message.

Since all PPPoE protocol messages are data link layer messages, they can only be forwarded on the same Layer 2 network, and cannot support location detection of PPPoE messages forwarded through a Layer 3 network.

In order to solve the above technical problems, the embodiment of the present disclosure provides a PPPoE message authentication method, which is applied to a BRAS device. As shown in FIG1 , the method includes:

S101 receives a PPPoE message, wherein the PPPoE message is encapsulated with an IPv6 message header;

S102 obtains the path information of the PPPoE message passing through each routing device recorded in the IPv6 message header;

S103 sends the path information and the authentication information of the PPPoE message to an authentication server, so that the authentication server authenticates the PPPoE terminal that sends the PPPoE message according to the path information and the authentication information.

In this embodiment, the PPPoE client (hereinafter referred to as the PPPoE terminal) encapsulates the IPv6 message header for the PPPoE message when forwarding it through the three-layer network. In one example, the PPPoE terminal can encapsulate the IPv6 message header for the PPPoE message to be forwarded through the three-layer network, or the first routing device (such as a router, a switch with routing function, etc.) through which the PPPoE message passes can encapsulate the IPv6 message header for the PPPoE message.

In a network architecture as shown in Figure 2, the PPPoE terminal sends a PPPoE message to Router A, and Router A encapsulates the PPPoE with an IPv6 message header, wherein the source address in the IPv6 message header is the address information of Router A, and the destination address in the IPv6 message header is the address information of the PPPoE Server (i.e., the BRAS device).

In this embodiment, after encapsulating the PPPoE message with an IPv6 message header, Router A searches the IPv6 routing table according to the IPv6 destination address and forwards the PPPoE over IPv6 message (i.e., the PPPoE message encapsulated with an IPv6 message header) from the corresponding interface.

In this embodiment, when the PPPoE over IPv6 message passes through a routing device, the corresponding routing device can encapsulate its own address information into the IPv6 message header. As shown in Figure 2, assuming that Router B and Router C have the PPPoE over IPv6 source tracing function, when the PPPoE over IPv6 message passes through Router B, Router B encapsulates its own address information into the IPv6 message header, and when the PPPoE over IPv6 message passes through Router C, Router C encapsulates its own address information into IPv6. The above-mentioned address information includes IP address information or port information or corresponding SID identification.

In other embodiments, the PPPoE terminal or the first routing device through which the PPPoE message passes can pre-plan the path of the PPPoE over IPv6 message and encapsulate the path information through each routing device in the IPv6 message header.

In this embodiment, each routing device adds its own address information to the access line ID in the PPPoE message, and records the path information in the form of a Segment List, namely, a SID list.

In one example, the routing devices on the PPPoE over IPv6 message forwarding path can be arranged in order from near to far. For example, Segment List[0] represents the first SID of the path, Segment List[1] represents the second SID of the path, and so on. When passing through the Nth routing device, the address information of the routing device is added to Segment List[N-1] in the access line ID.

The BRAS device (i.e., the PPPoE Server device in FIG2 ) acts as a tail node in the PPPoE over IPv6 scenario and is responsible for removing the IPv6 encapsulation from the PPPoE message when it receives the IPv6 encapsulation.

When the PPPoE online process reaches the authentication stage, that is, after the BRAS device receives the message with the user name and password sent by the PPPoE terminal, it extracts the Segment List in the access line ID of the message; at the same time, the BRAS device carries not only the access line ID and the access port information on the BRAS device, but also the Segment List in the RADIUS authentication request message sent to the RADIUS server. Since the SID of each routing device is unique in the network, the RADIUS server can accurately identify and verify all routing devices passing through the PPPoE over IPv6 online process.

Specifically, after receiving the authentication message sent by the BRAS device, the RADIUS server obtains the path information (SID identifier) of the PPPoE over IPv6 message through the NAS-PORT-ID attribute, and verifies whether the path information of the message is legal (by matching the path information preset in itself). If it is legal and the username and password are verified correctly, the PPPoE terminal is allowed to access the network. If it is illegal, the PPPoE terminal is not allowed to access the network even if the username and password are verified correctly.

It can be seen from the above embodiments that the address information of each routing device is added to the access line ID of the PPPoE message through the path information of the routing device that the PPPoE message passes through after adding IPv6 encapsulation. The BRAS device copies the access line ID in the PPPoE message to the NAS-PORT-ID attribute of RADIUS and sends it to the RADIUS server. The RADIUS server compares the received NAS-PORT-ID attribute with the physical location information configured in the database to verify whether the user's physical location information is correct. In this way, the binding authentication of the user account and the user location information is realized, which effectively improves the security of the PPPoE network and prevents the impersonation and theft of accounts.

Based on the above embodiments, an embodiment of the present disclosure further provides a BRAS device, the BRAS device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following method when executing the program:

Receiving a PPPoE message, wherein the PPPoE message is encapsulated with an IPv6 message header;

Obtaining path information of the PPPoE message passing through each routing device recorded in the IPv6 message header;

The path information and the authentication information of the PPPoE message are sent to an authentication server, so that the authentication server authenticates the PPPoE terminal that sends the PPPoE message according to the path information and the authentication information.

Based on the contents of the above method embodiments, the embodiment of the present disclosure further provides a BRAS device, the BRAS device comprising:

A receiving module, used for receiving a PPPoE message, wherein the PPPoE message encapsulates an IPv6 message header;

An acquisition module, used to acquire the path information of the PPPoE message passing through each routing device recorded in the IPv6 message header;

The sending module is used to send the path information and the authentication information of the PPPoE message to the authentication server, so that the authentication server authenticates the PPPoE terminal that sends the PPPoE message according to the path information and the authentication information.

The IPv6 source address in the IPv6 message header is the address of the first routing device through which the PPPoE message passes, and the IPv6 destination address in the IPv6 message header is the address of the BRAS.

The acquisition module is specifically used to acquire the SID list in the IPv6 message header, and the SID list records the path information of the PPPoE message passing through each routing device.

The sending module is specifically used to remove the IPv6 message header of the PPPoE message, and load the path information into the NAS-PORT-ID attribute and send it to the authentication server.

For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

The above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention claimed herein. The specification is intended to cover any variations, uses or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not claimed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims (10)

1. The authentication method of the PPPoE message is characterized by being applied to BRAS equipment, and comprises the following steps:

Receiving a PPPoE message, wherein the PPPoE message encapsulates an IPv6 message header;

Acquiring path information of each routing device of the PPPoE message path recorded in the IPv6 message header;

and sending the path information and the authentication information of the PPPoE message to an authentication server so that the authentication server authenticates the PPPoE terminal sending the PPPoE message according to the path information and the authentication information.

2. The method of claim 1, wherein encapsulating the PPPoE message header with an IPv6 message header comprises:

And the PPPoE terminal or the first routing equipment of the PPPoE message path encapsulates the IPv6 message header for the PPPoE message.

3. A method according to claim 1 or 2, characterized in that,

And the IPv6 source address in the IPv6 message header is the address of the first routing device, and the IPv6 destination address in the IPv6 message header is the address of the BRAS.

4. The method according to claim 1, wherein obtaining path information of each routing device of the PPPoE message path recorded in the IPv6 message header comprises:

And acquiring an SID list in the IPv6 message header, wherein the SID list records path information of each routing device of the PPPoE message path.

5. The method of claim 1, wherein the sending path information and authentication information of the PPPoE message to an authentication server comprises:

And eliminating the IPv6 message header of the PPPoE message, loading the path information into the NAS-PORT-ID attribute and sending the path information to the authentication server.

6. A BRAS device, the BRAS device comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the following method when executing the program:

Receiving a PPPoE message, wherein the PPPoE message encapsulates an IPv6 message header;

Acquiring path information of each routing device of the PPPoE message path recorded in the IPv6 message header;

and sending the path information and the authentication information of the PPPoE message to an authentication server so that the authentication server authenticates the PPPoE terminal sending the PPPoE message according to the path information and the authentication information.

7. A BRAS device, the BRAS device comprising:

The receiving module is used for receiving the PPPoE message, and the PPPoE message encapsulates an IPv6 message header;

the acquisition module is used for acquiring path information of each routing device of the PPPoE message path recorded in the IPv6 message header;

And the sending module is used for sending the path information and the authentication information of the PPPoE message to the authentication server so that the authentication server authenticates the PPPoE terminal sending the PPPoE message according to the path information and the authentication information.

8. The BRAS device of claim 7, wherein an IPv6 source address in the IPv6 header is an address of a first routing device of a PPPoE message pathway, and an IPv6 destination address in the IPv6 header is an address of the BRAS.

9. The BRAS device of claim 7, wherein,

The obtaining module is specifically configured to obtain a SID list in an IPv6 packet header, where path information of each routing device in the PPPoE packet path is recorded in the SID list.

10. The BRAS device of claim 7, wherein,

The sending module is specifically configured to reject an IPv6 header of the PPPoE packet, load path information into NAS-PORT-ID attribute, and send the path information to the authentication server.