CN110958272B - Identity authentication method, identity authentication system and related equipment - Google Patents
Identity authentication method, identity authentication system and related equipment Download PDFInfo
- Publication number
- CN110958272B CN110958272B CN201911358163.6A CN201911358163A CN110958272B CN 110958272 B CN110958272 B CN 110958272B CN 201911358163 A CN201911358163 A CN 201911358163A CN 110958272 B CN110958272 B CN 110958272B
- Authority
- CN
- China
- Prior art keywords
- access router
- virtual access
- identity information
- user
- client device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明实施例公开了身份认证方法和相关设备，用于实现虚拟接入路由器场景下对拨号企业用户的认证和鉴权。本发明实施例方法包括：虚拟接入路由器只有在确定接收到的客户端发送的第一PADI广播报文中的用户第一身份信息与该虚拟接入路由器的身份相匹配时，才发送第二PADI广播报文到PPPOE服务器请求PPPOE服务器服务，虚拟接入路由器还需要发送携带有路由身份信息的第二PADO应答消息给客户端设备进行路由身份信息的验证；虚拟接入路由器建立与PPPOE服务器之间的第一会话，以及与所述客户端设备之间的第二会话之后，通过该第一会话和第二会话，转发客户端设备发送的用户第二身份信息到所述PPPOE服务器进行身份认证。
The embodiment of the present invention discloses an identity authentication method and related equipment, which are used to realize the authentication and authentication of dial-up enterprise users in the scenario of virtual access router. The method according to the embodiment of the present invention includes: the virtual access router sends the second ID only when it is determined that the user's first identity information in the received first PADI broadcast message sent by the client matches the identity of the virtual access router. The PADI broadcasts the message to the PPPOE server to request the PPPOE server service. The virtual access router also needs to send a second PADO response message carrying the routing identity information to the client device to verify the routing identity information; the virtual access router establishes a relationship with the PPPOE server. After the first session between the client device and the client device, and after the second session with the client device, through the first session and the second session, the user's second identity information sent by the client device is forwarded to the PPPOE server for identity authentication. .
Description
Technical Field
The present invention relates to the field of communications, and in particular, to an identity authentication method, an identity authentication system, and a related device.
Background
A traditional Access Router (AR) is placed at a user (enterprise) side, the user performs Point-to-Point Protocol over Ethernet (PPPoE) dialing on the AR, an operator Network device performs authentication and authorization on the user, and after the authentication is passed, an Internet Protocol (IP) address interconnected between public Network is allocated for a Wide Area Network (WAN) port of the user. Among other things, the PPPoE protocol provides a standard for multiple hosts to connect to a remote broadband access server in an ethernet network. The essence is to establish a point-to-point tunnel over the Ethernet with user authentication and IP address notification functions. PPPoE dialing is carried out on the traditional AR, namely, the authentication of a user can be completed, and the network equipment of an operator distributes the IP address of a public network for the WAN port of the AR.
The virtual access router (vAR, also called vCPE) moves most functions of the AR (such as IP routing, Network Address Translation (NAT), firewall) to the operator Network, and the Thin Customer premise Equipment (Thin Customer Premises Equipment, ThinCPE) at the Customer side only retains simple access functions. The user purchases vAR from the carrier, and after successful purchase, the station vAR is dedicated to serving the user (with different features depending on the package selected by the user). The user needs to go through the operator's access network to vAR he purchased, which is a two-tier network. To support PPPoE dial-up authentication, the current general idea is to authenticate vAR as a PPPoE client to a PPPoE Server (e.g., Broadband Remote Access Server (BRAS)).
However, in the virtual access router scenario, authentication in this way may result in the access link between the enterprise user side and vAR not being authenticated and no security is guaranteed.
Disclosure of Invention
The embodiment of the invention provides an identity authentication method, an identity authentication system and related equipment, which are used for realizing authentication and authorization of a dialing enterprise user in a virtual access router scene.
A first aspect of the embodiments of the present invention provides an identity authentication method, which is applied to a network system including a virtual access router, where the network system further includes a client device and a PPPOE server, and the identity authentication method includes:
the method comprises the steps that a virtual access router receives a first PADI broadcast message which is sent by client equipment and carries first identity information of a user, wherein the first identity information of the user is an identifier of the user of the client equipment in a network system, and the first PADI broadcast message is used for requesting PPPOE server service;
when the virtual access router determines that the first identity information of the user is matched with the identity of the virtual access router, the virtual access router sends a second PADI broadcast message to the PPPOE server, wherein the second PADI broadcast message is used for requesting the PPPOE server to serve;
after the virtual access router receives a first PADO response message returned by the PPPOE server, the virtual access router sends a second PADO response message carrying routing identity information to the client device, wherein the routing identity information is an identifier of the virtual access router in the network system;
after the virtual access router establishes a first session with the PPPOE server and a second session with the client device, the virtual access router forwards second identity information of a user sent by the client device to the PPPOE server for identity authentication through the first session and the second session, wherein the second identity information of the user comprises first identity information of the user;
when the virtual access router receives an authentication failure message sent by the PPPOE server, the virtual access router interrupts the second session with the client device.
With reference to the first aspect of the embodiment of the present invention, in a first implementation manner of the first aspect of the embodiment of the present invention, the method further includes:
the virtual access router receives an IP subnet address announcement request sent by the client equipment, the IP subnet address announcement request is used for requesting to establish mapping between the identifier of the second session and an intranet IP network segment, and the IP subnet address announcement request comprises the intranet IP network segment of the client equipment;
and after the virtual access router determines the legality of the intranet IP network segment, the virtual access router stores the binding relationship between the identifier of the second session and the intranet IP network segment and sends an IP subnet address advertisement response to the client equipment.
A second aspect of the embodiments of the present invention provides an identity authentication method, used in a network system including a virtual access router, where the network system further includes a client device and a PPPOE server, and the identity authentication method includes:
the method comprises the steps that client equipment sends a first PADI (platform discovery initiation) broadcast message carrying first identity information of a user in a network system, wherein the first PADI broadcast message is used for requesting a PPPoE server service, and the first identity information of the user is an identifier of the user of the client equipment in the network system;
the client device receives a second PADO response message which is sent by a virtual access router and carries routing identity information, wherein the routing identity information is a unique identifier of the virtual access router in the network system;
when the client device determines that the routing identity information matches the user first identity information, the client device establishes a second session with the virtual access router;
and the client equipment sends second identity information of the user to the virtual access router through the second session, so that the virtual access router forwards the second identity information of the user to the PPPOE server for identity authentication, wherein the second identity information of the user comprises the first identity information of the user.
With reference to the second aspect of the present embodiment, in a first implementation manner of the second aspect of the present embodiment, the network system further includes a DHCP server, and the method further includes:
the client device obtains the configuration of the intranet IP network segment from the DHCP server;
and the client equipment sends an IP subnet address announcement request to the virtual access router according to the configuration of the intranet IP network segment, wherein the IP subnet address announcement request is used for requesting the virtual access router to establish the mapping between the identifier of the second session and the intranet IP network segment.
A third aspect of the embodiments of the present invention provides a virtual access router, including:
a first receiving module, configured to receive a first PADI broadcast packet that is sent by a client device and carries first identity information of a user, where the first identity information of the user is an identifier of the user of the client device in a network system, and the first PADI broadcast packet is used to request a PPPOE server service;
a first sending module, configured to send a second PADI broadcast packet to the PPPOE server when it is determined that the first identity information of the user, carried in the first PADI broadcast packet received by the first receiving module, matches the identity of the virtual access router, where the second PADI broadcast packet is used to request a service of the PPPOE server;
a second sending module, configured to send, after receiving a first PADO response message returned by the PPPOE server, a second PADO response message carrying routing identity information to the client device, where the routing identity information is an identifier of the virtual access router in the network system;
a forwarding module, configured to forward, after a first session between the PPPOE server and the client device is established and a second session between the PPPOE server and the client device is established, second identity information of the user, which is sent by the client device, to the PPPOE server for identity authentication through the first session and the second session, where the second identity information of the user includes the first identity information of the user;
an interruption module, configured to interrupt the second session with the client device when receiving an authentication failure message sent by the PPPOE server.
With reference to the third aspect of the present embodiment, in a first implementation manner of the third aspect of the present embodiment, the virtual access router further includes:
a second receiving module, configured to receive an IP subnet address advertisement request sent by the client device, where the IP subnet address advertisement request is used to request to establish mapping between an identifier of the second session and an intranet IP network segment, and the IP subnet address advertisement request includes the intranet IP network segment of the client device;
a storage module, configured to store the binding relationship between the identifier of the second session and the intranet IP network segment after determining the validity of the intranet IP network segment included in the IP subnet address advertisement request received by the second receiving module;
and the third sending module is used for sending an IP subnet address announcement response to the client device after the storage module stores the binding relationship between the identifier of the second session and the intranet IP network segment.
A fourth aspect of the embodiments of the present invention provides a client device, including:
a fourth sending module, configured to send a first PADI broadcast packet carrying first identity information of a user in a network system, where the first PADI broadcast packet is used to request a PPPoE server service, and the first identity information of the user is an identifier of a user of the client device in the network system;
a third receiving module, configured to receive a second PADO response message carrying routing identity information sent by a virtual access router, where the routing identity information is a unique identifier of the virtual access router in the network system;
the establishing module is used for establishing a second session with the virtual access router when the routing identity information carried in the second PADO response message received by the third receiving module is determined to be matched with the first identity information of the user;
a fifth sending module, configured to send, through the second session established by the establishing module, second identity information of the user to the virtual access router, so that the virtual access router forwards the second identity information of the user to the PPPOE server for identity authentication, where the second identity information of the user includes the first identity information of the user.
With reference to the fourth aspect of the present embodiment, in a first implementation manner of the fourth aspect of the present embodiment, the client device further includes:
the acquisition module is used for acquiring the configuration of the intranet IP network segment from the DHCP server;
a sixth sending module, configured to send an IP subnet address advertisement request to the virtual access router according to the configuration of the intranet IP network segment obtained by the obtaining module, where the IP subnet address advertisement request is used to request the virtual access router to establish mapping between the identifier of the second session and the intranet IP network segment.
A fifth aspect of the embodiments of the present invention provides an identity authentication system, including:
a PPPOE server, the virtual access router described in the third aspect or the first implementation manner of the third aspect of the embodiment of the present invention, and the client device described in the fourth aspect or the first implementation manner of the fourth aspect of the embodiment of the present invention.
According to the technical scheme, the embodiment of the invention has the following advantages: in the embodiment of the invention, the virtual access router sends the second PADI broadcast message to the PPPOE server to request the PPPOE server for service only when determining that the first identity information of the user in the first PADI broadcast message sent by the received client is matched with the identity of the virtual access router, the virtual access router also needs to send the second PADO response message carrying the routing identity information to the client equipment, the client equipment authenticates the identity of the virtual access router, and the security of an access link between the client equipment and the virtual access router is ensured through the mutual authentication. The virtual access router establishes a first session with the PPPOE server, and after a second session between the client devices, forwards second identity information of a user sent by the client device to the PPPOE server for identity authentication through the first session and the second session, if the authentication fails, the virtual access router receives an authentication failure message sent by the PPPOE server, the virtual access router immediately interrupts the second session with the client devices, and only the client devices capable of authenticating through the PPPOE server can continue to perform subsequent processing, so that authentication and authentication of dialing enterprise users under a virtual access router scene are realized.
Drawings
Fig. 1 is a signaling flow diagram of an identity authentication method according to an embodiment of the present invention;
FIG. 2 is a flowchart illustrating an identity authentication method according to an embodiment of the present invention;
FIG. 3 is a flowchart illustrating an identity authentication method according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of a virtual access router according to an embodiment of the present invention;
fig. 5 is another schematic structural diagram of a virtual access router according to an embodiment of the present invention;
FIG. 6 is a schematic structural diagram of a client device according to an embodiment of the present invention;
FIG. 7 is a schematic structural diagram of a client device according to an embodiment of the present invention;
fig. 8 is another schematic structural diagram of a virtual access router in the embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The embodiment of the invention provides an identity authentication method which is applied to a network system comprising a virtual access router, client equipment and a PPPOE server and is used for realizing authentication and authorization of a dialing enterprise user in a virtual access router scene.
What appears in the embodiments of the present invention is:
PADI is the abbreviation of PPPoE Active Discovery Initiation, which means that PPPoE actively discovers the initial packet;
the PADO is an abbreviation of PPPoE Active Discovery Offer, and represents a PPPoE Active Discovery Offer packet;
PADR is an abbreviation of PPPoE Active Discovery Request, indicating a PPPoE Active Discovery Request packet;
PADS is an abbreviation of PPPoE Active Discovery Session-configuration PPPoE, indicating an Active Discovery Session acknowledgement packet;
DHCP is an abbreviation of Dynamic Host Configuration Protocol and represents a Dynamic Host Configuration Protocol;
WAN is an abbreviation of Wide Area Network, which means a Wide Area Network.
The identity authentication method in the embodiment of the present invention is described below from the perspective of signaling interaction among the three devices, i.e., the virtual access router, the client device, and the PPPOE server in the network system:
referring to fig. 1, an embodiment of an identity authentication method according to the embodiment of the present invention includes:
101. the method comprises the steps that client equipment sends a first PADI broadcast message carrying first identity information of a user in a network system;
the first PADI broadcast message is used for requesting a PPPoE server service, and the first identity information of the user is a unique identifier of the user of the client device in the network system;
optionally, the first identity information of the user may be an account name of a user that is unique throughout the network and allocated by the operator, or may be another identification ID that can uniquely identify the user, which is not limited herein.
It can be understood that, in practical applications, the message sent by each device may carry a source (sender) MAC address and a destination (receiver) MAC address. For example, the source MAC address of the first PADI broadcast packet may be the MAC address of the client device, and the destination MAC address may be a broadcast address, that is, the broadcast address is sent to all network devices connected to the first PADI broadcast packet in the network system.
102. The virtual access router determines that the first identity information of the user is matched with the identity of the virtual access router;
in this step, the virtual access router in the network system may receive the first PADI broadcast packet sent by the client device, and it is understood that the number of the virtual access routers in the network system may be multiple, and each virtual access router that receives the first PADI broadcast packet may determine whether the first identity information of the user in the first PADI broadcast packet matches with the identity of the virtual access router, and only the virtual access router that determines that the first identity information of the user matches with the identity of the virtual access router performs step 103.
It should be noted that the virtual access router is purchased by the user from the operator, and the operator has allocated the first identity information of the user matching the virtual access router to the virtual access router when creating the virtual access router.
103. The virtual access router sends a second PADI broadcast message to the PPPOE server;
and only when the virtual access router determines that the first identity information of the user in the first PADI broadcast message is matched with the identity of the virtual access router, the virtual access router sends a second PADI broadcast message to the PPPOE server to request the PPPOE service.
It will be appreciated that upon determining that the first identity information of the user matches the identity information of the virtual access router, the virtual access router may record the MAC address of the client device that sent the first PADI broadcast packet.
In this step, the source MAC address of the second PADI broadcast packet may be the MAC address of the virtual access router, and the destination MAC address may be a broadcast address. Each network device in the network system may be able to receive the second PADI broadcast message, but only the PPPOE server therein is able to recognize the second PADI broadcast message and give feedback.
104. After receiving a second PADI broadcast message sent by the virtual access router, the PPPOE server sends a first PADO response message to the virtual access router;
after the PPPOE server receives a second PADI broadcast message which is sent by the virtual access router and used for requesting the PPPOE server to provide service, if the PPPOE server agrees to provide service, a first PADO response message is sent to the virtual access router and used for responding to the service request of the second PADI broadcast message.
In this step, the source MAC address of the first PADO response message is the PPPOE server, and the destination MAC address is the virtual access router that sends the second PADI broadcast packet.
105. After receiving a first PADO response message sent by the PPPOE server, the virtual access router sends a second PADO response message carrying routing identity information to the client device, wherein the routing identity information is a unique identifier of the virtual access router in the network system;
after receiving the first PADO response message sent by the PPPOE server, the virtual access router may record the MAC address of the PPPOE server carried in the first PADO response message, and then send a second PADO response message carrying the routing identity information to the client device.
The routing identity information is a unique identifier of the virtual access router in the network system, and the routing identity information is used for authenticating identity consistency between the client equipment and the virtual access router.
The source MAC address of the second PADO reply message is the MAC address of the virtual access router, and the destination MAC address is the MAC address of the client device that sent the first PADI broadcast packet.
106. The client equipment determines that the received routing identity information is matched with the first identity information of the user;
after receiving the second PADO response message, the client device authenticates whether the routing identity information carried in the second PADO response message matches with the user first identity information of itself, and executes the subsequent session establishment procedure only after determining that the routing identity information matches with the user first identity information.
107. The method comprises the steps that client equipment sends a first PADR request message to the virtual access router, wherein the first PADR request message is used for requesting to establish a session with the virtual access router;
after the client device determines that the received routing identity information is matched with the first identity information of the user of the client device, the client device sends a first PADR request message to the virtual access router, wherein the first PADR request message is used for requesting to establish a session with the virtual access router.
The source MAC address of the first PADR request message is the MAC address of the client device, and the destination MAC address is the MAC address of the identity-matched virtual access router.
108. After receiving a first PADR request message sent by the client device, the virtual access router sends a second PADR request message to the PPPOE server, wherein the second PADR request message is used for requesting to establish a session with the PPPOE server;
after receiving a first PADR request message for requesting session establishment sent by a client device, a virtual access router needs to determine whether a session can be established with a PPPOE server, and then sends a second PADR request message to the PPPOE server, where the second PADR request message is used to request session establishment with the PPPOE server.
The source MAC address of the second PADR request message is the MAC address of the virtual access router, and the destination MAC address is the MAC address of the PPPOE server.
109. After receiving the second PADR request message, the PPPOE server sends a second PADS acknowledgement message to the virtual access router, where the second PADS acknowledgement message is used to acknowledge that a session is established with the virtual access router;
after receiving a second PADR request message requesting session establishment sent by the virtual access router, the PPPOE server sends a second PADS acknowledgement message to the virtual access router if the session establishment is agreed, where the second PADS acknowledgement message is used to acknowledge the session establishment with the virtual access router.
The source MAC address of the second PADS acknowledgement message is the MAC address of the PPPOE server, and the destination MAC address is the MAC address of the virtual access router.
110. After receiving a second PADS confirmation message sent by the PPPOE server, the virtual access router establishes a first session with the PPPOE server, sends a first PADS confirmation message to the client device, and establishes a second session with the client device, wherein the first PADS confirmation message comprises a session ID (identity) distributed for the client device;
after receiving a second PADS acknowledgement message sent by the PPPOE server, the virtual access router establishes a first session with the PPPOE server, and can store information of the first session, where the information of the first session includes an ID of the first session, and at this time, the virtual access router can feed back a first PADR request message sent by the client device, send the first PADS acknowledgement message to the client device, acknowledge that a second session is established with the client device, and can store information of the second session. The two-layer session, the second session between the client device and the virtual access router and the first session between the virtual access router and the PPPOE server, constitutes a PPPOE session between the client device and the PPPOE server.
It should be noted that each session has a session ID uniquely identifying the session, the session ID of the session between the virtual access router and the client device is assigned by the virtual access router, the first PADS acknowledgment message sent to the client device includes the session ID assigned by the virtual access router to the client device, and the session ID is used as the session ID of the second session, and the stored information of the second session includes information of the session ID. The session ID between the virtual access router and the PPPOE server is allocated by the PPPOE server, and the second PADS acknowledgement message sent to the virtual access router includes the session ID allocated by the PPPOE server to the virtual access router, as the session ID of the first session.
The source MAC address of the first PADS acknowledgement message is the MAC address of the virtual access router, and the destination MAC address is the MAC address of the client device.
111. After receiving the first PADS acknowledgement message sent by the virtual access router, the client device sends the second identity information of the user to the PPPOE server for identity authentication through the first session and the second session, where the second identity information of the user includes the first identity information of the user.
After receiving the first PADS acknowledgement message sent by the virtual access router, the client device indicates that a second session between the client device and the virtual access router is established, the client device sends the second identity information of the user to the virtual access router through the second session, the virtual access router forwards the second identity information of the user to the PPPOE server for identity authentication through the first session between the virtual access router and the PPPOE server, and the second identity information of the user includes the first identity information of the user.
It can be understood that the PPPOE server performs operations such as authentication, authorization, etc. on the received second identity information of the user.
Specifically, the RADIUS of the operator network stores information such as a user name, a password, and location information of the user. The PPPoE server can compare and authenticate the second identity information of the user with the legal information of the user in the RADIUS server.
Optionally, the second identity information of the user may further include a user password, and/or port information (which may represent client location information) of the intermediate agent on the PPPOE + transmission line, which is not limited herein.
After the PPPOE server authenticates the sent second identity information of the user, the PPPOE server feeds back an authentication result to the virtual access router:
and if the virtual access router receives the authentication failure message sent by the PPPOE server, the virtual access router interrupts a second session with the client equipment.
If the virtual access router receives the authentication success message sent by the PPPOE server, the virtual access router maintains the first session and the second session, and may continue to perform other processing.
In the embodiment of the invention, the authentication and authorization of the dialing enterprise user in the virtual access router scene are realized in the steps 101 to 111, the safety of an access link in the virtual access router scene is improved, and the authentication of the port information of the intermediate agent in the PPPOE + transmission line in the virtual access router scene is realized.
In practical application, after the identity authentication of the client device is successful, the client device sends a new WAN port address configuration request message to request the WAN port of the virtual access router to acquire the public network IP address. The virtual access router WAN port sends WAN port address configuration response information after acquiring public network IP (DNS and the like) configuration, but the public network IP address is not sent to the client equipment, and configuration information such as the public network IP and the DNS is stored on the virtual access router.
Optionally, in order to implement the requirement of inter-working with an intranet connected to the client device, the embodiment shown in fig. 1 may further include the following steps:
112. the client device obtains the configuration of the intranet IP network segment from the DHCP server;
the client device may obtain the configuration of the intranet IP network segment from a DHCP server of the intranet (deployed inside an enterprise).
Optionally, the DHCP server may be configured on the client device, or may exist independently, which is not limited herein.
The intranet IP network segment refers to an address segment which is located in the same IP network in an enterprise side, and one network segment is identified by the network segment IP address and a subnet mask.
113. The client device sends an IP subnet address announcement request to the virtual access router according to the configuration of the intranet IP network segment, wherein the IP subnet address announcement request is used for requesting the virtual access router to establish the mapping between the ID of the second session and the intranet IP network segment;
and the client equipment sends an IP subnet address notification request to the virtual access router according to the acquired configuration of the intranet IP network segment, wherein the IP subnet address notification request is used for requesting the virtual access router to establish the mapping between the ID of the second session and the intranet IP network segment.
Specifically, the IP subnet address advertisement request is used to establish mapping between a PPPoE session (layer two session and layer two session) and an internal IP network segment, assuming that there are multiple client devices dialing, there are multiple sessions between a virtual access router and multiple client devices, and in the direction from public network to internal network, a data packet does not have a destination MAC address of internal network, but only has a destination IP address of internal network, so that it is necessary to map from IP address to a certain path of PPPoE session, and further determine destination MAC.
It can be understood that, before a message from the network to the client device reaches the virtual access router, the destination IP is the IP address of the WAN port of the virtual access router, and after the message is received by the WAN port of the virtual access router, the destination IP is converted into the IP address of the intranet through NAT address conversion on the virtual access router. Each path of PPPOE session is identified by a session ID, a source address and a destination MAC address, and the message at this time does not carry session information from the virtual access router to the client device, so that a binding relationship from an intranet IP subnet address to the PPPOE session needs to be established.
114. And after receiving the IP subnet address advertisement request, the virtual access router detects the legality of the intranet IP network segment, stores the binding relationship between the ID of the second session and the intranet IP network segment, and sends an IP subnet address advertisement response to the client device.
And after the virtual access router receives an IP subnet address announcement request sent by the client equipment, detecting the legality of the intranet IP network segment in the IP subnet address announcement request, storing the binding relationship between the ID of the second session and the intranet IP network segment after determining that the legality is satisfied, and then sending an IP subnet address announcement response to the client equipment.
It is understood that the client device may further obtain other configurations (e.g., DNS, WINS, etc.) after receiving the IP subnet address advertisement response. After the configuration is completed, the enterprise-side user of the intranet can acquire the intranet IP configuration from the DHCP server, access the client device and start normal data communication.
The client device may also send an IPCP LAN subnet address configuration advertisement request, advertising the subnet and mask (IP address field) configured on the enterprise side user DHCP server that has access to the client device.
Optionally, in this embodiment, the client device may be a thin client ThinCPE or a PC with a dial function, which is not limited herein.
In practical application, an enterprise IT manager may hold an enterprise user account, and the enterprise IT manager may authenticate with the PPPOE server using the enterprise user account to complete configuration of an extranet of an enterprise. The PC of the employee having the employee account in the intranet needs to be networked after the enterprise IT administrator completes the configuration of the extranet.
Meanwhile, an enterprise employee database can be stored in the enterprise intranet or the virtual access router purchased by the enterprise, and when an employee in the enterprise accesses the network through the virtual access router, the virtual router can authenticate the employee. Specifically, the virtual access router may compare and authenticate identity information sent by an employee accessing the network with user legitimate information in a stored enterprise employee database, which is not limited herein.
In the embodiments of the present invention, in steps 112 to 114, through binding of PPPOE session IDs, network interworking between each device in an enterprise intranet connected to a client device in a virtual router scenario and PPPOE is achieved, and through configuration of an intranet IP network segment allocated by DHCP, a requirement for network interworking between each intranet device is achieved, so that even if an access network fails, normal communication between each device in the enterprise intranet can be performed.
The method for identity authentication in the embodiment of the present invention is described below from the perspective of the client device and the virtual access router, respectively:
from the perspective of a virtual access router:
referring to fig. 2, another embodiment of the identity authentication method according to the embodiment of the present invention includes:
201. the method comprises the steps that a virtual access router receives a first PADI broadcast message which is sent by client equipment and carries first identity information of a user;
the first identity information of the user is an identifier of the user of the client device in a network system, and the first PADI broadcast message is used for requesting a PPPOE server service.
202. When the virtual access router determines that the first identity information of the user is matched with the identity of the virtual access router, the virtual access router sends a second PADI broadcast message to the PPPOE server, wherein the second PADI broadcast message is used for requesting the PPPOE server to serve;
similar to steps 102 and 103, are not described in detail herein.
203. After the virtual access router receives a first PADO response message returned by the PPPOE server, the virtual access router sends a second PADO response message carrying routing identity information to the client device, wherein the routing identity information is an identifier of the virtual access router in the network system;
similar to step 105, further description is omitted here.
204. After the virtual access router establishes a first session with the PPPOE server and a second session with the client device, the virtual access router forwards second identity information of a user sent by the client device to the PPPOE server for identity authentication through the first session and the second session, wherein the second identity information of the user comprises first identity information of the user;
in this step, the process of establishing the first session and the second session is similar to that from step 108 to step 110, and is not described herein again.
After the first session and the second session are established, the virtual access router may forward the second identity information of the user sent by the client device to the PPPOE server for identity authentication, where the second identity information of the user includes the first identity information of the user of the client device.
It can be understood that the PPPOE server performs operations such as authentication, authorization, etc. on the received second identity information of the user.
Specifically, the RADIUS of the operator network stores information such as a user name, a password, and location information of the user. The PPPoE server can compare and authenticate the second identity information of the user with the legal information of the user in the RADIUS server.
Optionally, the second identity information of the user may further include a user password, and/or port information (which may represent client location information) of the intermediate agent on the PPPOE + transmission line, which is not limited herein.
After the PPPOE server authenticates the sent second identity information of the user, the PPPOE server feeds back an authentication result to the virtual access router:
if the authentication is successful, the virtual access router maintains the first session and the second session, and can continue other processing.
If the result is that the authentication fails, step 205 is triggered.
205. When the virtual access router receives an authentication failure message sent by the PPPOE server, the virtual access router interrupts the second session with the client device.
In the embodiment of the invention, the virtual access router sends the second PADI broadcast message to the PPPOE server to request the PPPOE server for service only when determining that the first identity information of the user in the first PADI broadcast message sent by the received client is matched with the identity of the virtual access router, the virtual access router also needs to send the second PADO response message carrying the routing identity information to the client equipment, the client equipment authenticates the identity of the virtual access router, and the security of an access link between the client equipment and the virtual access router is ensured through the mutual authentication. The virtual access router establishes a first session with the PPPOE server, and after a second session between the client devices, forwards second identity information of a user sent by the client device to the PPPOE server for identity authentication through the first session and the second session, if the authentication fails, the virtual access router receives an authentication failure message sent by the PPPOE server, immediately interrupts the second session between the virtual access router and the client devices, and only the client devices which can be authenticated by the PPPOE server can continue subsequent processing, so that authentication and authentication of dial-up enterprise users under a virtual access router scene are realized, and the security of an access link is ensured.
Optionally, as another embodiment of the identity authentication method in the embodiment of the present invention, after the identity information of the third user is successfully authenticated in the embodiment shown in fig. 2, the virtual access router may further receive an IP subnet address advertisement request sent by the client device, where the IP subnet address advertisement request is used to request to establish mapping between the identifier of the second session and an intranet IP network segment, and the IP subnet address advertisement request includes the intranet IP network segment of the client device; and after the virtual access router determines the legality of the intranet IP network segment, the virtual access router stores the binding relationship between the identifier of the second session and the intranet IP network segment and sends an IP subnet address advertisement response to the client equipment.
Similar to step 114, further description is omitted here.
In the embodiment of the invention, the network intercommunication between each device in the enterprise intranet connected with the client device and the PPPOE under the virtual router scene is realized by binding the identifier of the second session with the intranet IP network segment.
From the perspective of the client device:
referring to fig. 3, another embodiment of the identity authentication method according to the embodiment of the present invention includes:
301. the method comprises the steps that client equipment sends a first PADI (platform discovery initiation) broadcast message carrying first identity information of a user in a network system, wherein the first PADI broadcast message is used for requesting a PPPoE server service, and the first identity information of the user is an identifier of the user of the client equipment in the network system;
similar to step 101, it is not described herein.
Optionally, the client device may be a thin client ThinCPE or a PC with a dial-up function, which is not limited herein.
302. The client device receives a second PADO response message which is sent by a virtual access router and carries routing identity information, wherein the routing identity information is a unique identifier of the virtual access router in the network system;
after receiving the second PADO response message, the client device may determine whether the routing identity information carried in the second PADO response message matches the first identity information of the user, and only if it determines that the routing identity information matches, execute step 303.
303. When the client device determines that the routing identity information matches the user first identity information, the client device establishes a second session with the virtual access router;
when the client device determines that the routing identity information matches the first identity information of the user, a second session between the client device and the virtual access router is established, and the specific session establishment process is similar to steps 107 to 110, which is not described herein again.
304. And the client equipment sends the second identity information of the user to the virtual access router through the second session, so that the virtual access router forwards the second identity information of the user to the PPPOE server for identity authentication.
After the second session between the client device and the virtual access router is established, the client device may send the second identity information of the user to the virtual access router through the second session, so that the virtual access router forwards the second identity information of the user to the PPPOE server for identity authentication.
Optionally, the second identity information of the user may further include a user password, and/or port information (which may represent client location information) of the intermediate agent on the PPPOE + transmission line, which is not limited herein.
The sending process and the authentication process of the second identity information of the specific user are similar to step 111, and are not described herein again.
In the embodiment of the invention, the client equipment sends the first PADI broadcast message carrying the first identity information of the user to the virtual access router, so that the virtual access router authenticates the first identity information of the user, can receive the second PADO response message carrying the route identity information sent by the virtual access router after the authentication is passed, authenticates the route identity information, and starts the session establishment process after the authentication is passed. After the session is established, the third user identity information containing the first identity information of the user is sent to the PPPOE server for authentication, authentication and authorization of the dialing enterprise user under the scene of the virtual access router are achieved, and the safety of an access link is guaranteed.
Optionally, as another embodiment of the identity authentication method in the embodiment of the present invention, the network system may further include a DHCP server, and after the authentication of the third user identity information is successful in the embodiment shown in fig. 3, the client device may obtain the configuration of the intranet IP network segment from the DHCP server; and the client equipment sends an IP subnet address announcement request to the virtual access router according to the configuration of the intranet IP network segment, wherein the IP subnet address announcement request is used for requesting the virtual access router to establish the mapping between the identifier of the second session and the intranet IP network segment.
Similar to step 113, further description is omitted here.
Optionally, the DHCP server may exist independently, or may be configured on the client device, which is not limited herein.
In the embodiment of the invention, the client equipment acquires the configuration of the intranet IP network segment from the DHCP server, thereby realizing the requirement of network intercommunication among the intranet equipment and ensuring that the equipment in the intranet of an enterprise can normally communicate even if the access network fails. And requesting to establish mapping between the identifier of the second session and the intranet IP network segment through the IP subnet address announcement, so that network intercommunication between each device in the enterprise intranet connected with the client device and the PPPOE under a virtual router scene is realized.
Referring to fig. 4, a virtual access router 400 according to an embodiment of the present invention is described as follows:
a first receiving module 401, configured to receive a first PADI broadcast packet that is sent by a client device and carries first identity information of a user, where the first identity information of the user is an identifier of the user of the client device in a network system, and the first PADI broadcast packet is used to request a PPPOE server service;
a first sending module 402, configured to send a second PADI broadcast packet to the PPPOE server when it is determined that the first identity information of the user, carried in the first PADI broadcast packet received by the first receiving module 401, matches with the identity of the virtual access router, where the second PADI broadcast packet is used to request a service of the PPPOE server;
a second sending module 403, configured to send, after receiving the first PADO response message returned by the PPPOE server, a second PADO response message carrying routing identity information to the client device, where the routing identity information is an identifier of the virtual access router in the network system;
a forwarding module 404, configured to forward, after a first session between the PPPOE server and the client device is established and a second session between the PPPOE server and the client device is established, second identity information of the user, which is sent by the client device, to the PPPOE server for identity authentication through the first session and the second session, where the second identity information of the user includes the first identity information of the user;
an interrupting module 405, configured to interrupt the second session with the client device when receiving the authentication failure message sent by the PPPOE server.
Optionally, the second identity information of the user may further include a user password, and/or port information (which may represent client location information) of the intermediate agent on the PPPOE + transmission line, which is not limited herein.
In the embodiment of the present invention, only when it is determined that the first identity information of the user in the first PADI broadcast message sent by the client and received by the first receiving module 401 matches the identity of the virtual access router, the first sending module 402 sends the second PADI broadcast message to the PPPOE server to request the PPPOE server to serve, the second sending module 403 further needs to send the second PADO response message carrying the routing identity information to the client device, and the client device authenticates the identity of the virtual access router. Virtual access router establish with PPPOE server between the first session, and with after the second session between the client device, forward module 404 through this first session and second session, forward the user second identity information that client device sent to the PPPOE server carries out authentication, if the authentication fails, receive the authentication failure message that the PPPOE server sent, interrupt module 405 interrupts immediately and this client device between the second session, only can just continue subsequent processing through the client device of the authentication of PPPOE server, and like this, realize authentication and the authentication to dialing enterprise user under the virtual access router scene, guaranteed the security of access link.
Optionally, referring to fig. 5, as another embodiment of the virtual access router 500 in the embodiment of the present invention, the virtual access router 400 shown in fig. 4 may further include:
a second receiving module 501, configured to receive an IP subnet address advertisement request sent by the client device, where the IP subnet address advertisement request is used to request to establish mapping between an identifier of the second session and an intranet IP network segment, and the IP subnet address advertisement request includes the intranet IP network segment of the client device;
a storing module 502, configured to store the binding relationship between the identifier of the second session and the intranet IP network segment after determining the validity of the intranet IP network segment included in the IP subnet address advertisement request received by the second receiving module 501;
a third sending module 503, configured to send an IP subnet address advertisement response to the client device after the storing module 502 stores the binding relationship between the identifier of the second session and the intranet IP network segment.
In the embodiment of the present invention, the identifier of the second session is bound to the IP network segment of the intranet by the storage module 502, so that network interworking between each device in the intranet of the enterprise connected to the client device and the PPPOE under the virtual router scenario is achieved.
Referring to fig. 6, a client device 600 according to an embodiment of the present invention is described as follows:
a fourth sending module 601, configured to send a first PADI broadcast packet carrying first identity information of a user in a network system, where the first PADI broadcast packet is used to request a PPPoE server service, and the first identity information of the user is an identifier of a user of the client device in the network system;
a third receiving module 602, configured to receive a second PADO response message that is sent by a virtual access router and carries route identity information, where the route identity information is a unique identifier of the virtual access router in the network system;
an establishing module 603, configured to establish a second session with the virtual access router when it is determined that the routing identity information carried in the second PADO reply message received by the third receiving module 602 matches the first identity information of the user;
a fifth sending module 604, configured to send, through the second session established by the establishing module 603, the second identity information of the user to the virtual access router, so that the virtual access router forwards the second identity information of the user to the PPPOE server for identity authentication.
Optionally, the second identity information of the user may further include a user password, and/or port information (which may represent client location information) of the intermediate agent on the PPPOE + transmission line, which is not limited herein.
Optionally, the client device may be a thin client ThinCPE or a PC with a dial-up function, which is not limited herein.
In this embodiment of the present invention, the fourth sending module 601 sends the first PADI broadcast packet carrying the first identity information of the user to the virtual access router, so that the virtual access router authenticates the first identity information of the user, after the authentication is passed, the third receiving module 602 may receive the second PADO response message carrying the route identity information sent by the virtual access router, authenticate the route identity information, and the establishing module 603 starts the session establishing process after the authentication is passed. After the session is established, the fifth sending module 604 further sends the third user identity information including the first identity information of the user to the PPPOE server for authentication, so that authentication and authorization of the user of the dial-up enterprise under the virtual access router scene are realized, and the security of the access link is ensured.
Optionally, referring to fig. 7, as another embodiment of the client device 700 in the embodiment of the present invention, the client device 600 in the embodiment shown in fig. 6 may further include:
an obtaining module 701, configured to obtain a configuration of an intranet IP network segment from a DHCP server;
a sixth sending module 702, configured to send an IP subnet address advertisement request to the virtual access router according to the configuration of the intranet IP network segment obtained by the obtaining module 701, where the IP subnet address advertisement request is used to request the virtual access router to establish mapping between the identifier of the second session and the intranet IP network segment.
Optionally, the DHCP server may exist independently, or may be configured on the client device, which is not limited herein.
In the embodiment of the invention, the acquisition module 701 acquires the configuration of the intranet IP network segment from the DHCP server, so that the requirement of network intercommunication among intranet equipment is met, and even if an access network fails, the equipment in the intranet of an enterprise can still communicate normally. The sixth sending module 702 requests to establish mapping between the identifier of the second session and the IP network segment of the intranet through the IP subnet address advertisement, thereby implementing network interworking between each device in the intranet of the enterprise connected to the client device and PPPOE under the virtual router scenario.
Referring to fig. 8, another virtual access router 800 according to an embodiment of the present invention includes a memory 801, a processor 802, a receiver 803, and a transmitter 804 respectively connected to a bus, wherein:
the memory 801 is used for storing information such as necessary files for the processor 802 to process data, for example, information such as program codes for the processor 802 to execute the method of identity authentication shown in fig. 2.
A processor 802 for calling the program code stored in the memory 801 to implement the following functions:
the control receiver 803 receives a first PADI broadcast packet which is sent by a client device and carries first identity information of a user, where the first identity information of the user is an identifier of the user of the client device in a network system, and the first PADI broadcast packet is used to request a PPPOE server service;
when the virtual access router determines that the first identity information of the user is matched with the identity of the virtual access router, the virtual access router sends a second PADI broadcast message to the PPPOE server, wherein the second PADI broadcast message is used for requesting the PPPOE server to serve;
after the receiver 803 receives the first PADO response message returned by the PPPOE server, the transmitter 804 is controlled to send a second PADO response message carrying routing identity information to the client device, where the routing identity information is an identifier of the virtual access router in the network system;
after a first session with the PPPOE server and a second session with the client device are established, the control receiver 803 and the transmitter 804 forward, through the first session and the second session, second identity information of the user sent by the client device to the PPPOE server for identity authentication, where the second identity information of the user includes the first identity information of the user;
when the receiver 803 receives an authentication failure message sent by the PPPOE server, the second session with the client device is interrupted;
optionally, the processor 802 may also implement the following functions:
the control receiver 803 receives an IP subnet address advertisement request sent by the client device, where the IP subnet address advertisement request is used to request to establish mapping between the identifier of the second session and an intranet IP network segment, and the IP subnet address advertisement request includes the intranet IP network segment of the client device;
after the legitimacy of the intranet IP network segment is determined, the binding relationship between the identifier of the second session and the intranet IP network segment is stored in the memory 801, and the transmitter 804 is controlled to transmit an IP subnet address announcement response to the client device.
An embodiment of the present invention further provides another client device, whose structure is similar to that of the virtual access router in fig. 8, and includes: a memory, a processor, a receiver, and a transmitter, respectively coupled to the bus, wherein:
the memory is used for storing information such as necessary files for the processor to process data, for example, information such as program codes for the processor to execute the method of identity authentication shown in fig. 4.
A processor for calling the program code stored in the memory to implement the following functions:
a control transmitter sends a first PADI broadcast message carrying user first identity information in a network system, wherein the first PADI broadcast message is used for requesting a PPPoE server service, and the user first identity information is an identifier of a user of the client equipment in the network system;
a control receiver receives a second PADO response message which is sent by a virtual access router and carries routing identity information, wherein the routing identity information is a unique identifier of the virtual access router in the network system;
when the routing identity information is determined to be matched with the first identity information of the user, establishing a second session with the virtual access router;
and the control transmitter sends the second identity information of the user to the virtual access router through the second session, so that the virtual access router forwards the second identity information of the user to the PPPOE server for identity authentication.
Optionally, the processor may further implement the following functions:
acquiring the configuration of an intranet IP network segment from the DHCP server;
and controlling a transmitter to send an IP subnet address announcement request to the virtual access router according to the configuration of the intranet IP network segment, wherein the IP subnet address announcement request is used for requesting the virtual access router to establish mapping between the identifier of the second session and the intranet IP network segment.
The DHCP server may exist independently, or may be configured on the client device, which is not limited herein.
The embodiment of the invention also provides an identity authentication system, which comprises:
PPPOE server, the virtual access router shown in the embodiment corresponding to any one of fig. 4, fig. 5 or fig. 8, and the virtual access router shown in the embodiment corresponding to fig. 6 or fig. 7.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
The above-mentioned embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (11)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911358163.6A CN110958272B (en) | 2015-06-04 | 2015-06-04 | Identity authentication method, identity authentication system and related equipment |
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510304341.2A CN106302353B (en) | 2015-06-04 | 2015-06-04 | Identity authentication method, identity authentication system and related equipment |
| CN201911358163.6A CN110958272B (en) | 2015-06-04 | 2015-06-04 | Identity authentication method, identity authentication system and related equipment |
Related Parent Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510304341.2A Division CN106302353B (en) | 2015-06-04 | 2015-06-04 | Identity authentication method, identity authentication system and related equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110958272A CN110958272A (en) | 2020-04-03 |
| CN110958272B true CN110958272B (en) | 2021-10-15 |
Family
ID=57440150
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510304341.2A Active CN106302353B (en) | 2015-06-04 | 2015-06-04 | Identity authentication method, identity authentication system and related equipment |
| CN201911358163.6A Active CN110958272B (en) | 2015-06-04 | 2015-06-04 | Identity authentication method, identity authentication system and related equipment |
Family Applications Before (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510304341.2A Active CN106302353B (en) | 2015-06-04 | 2015-06-04 | Identity authentication method, identity authentication system and related equipment |
Country Status (2)
| Country | Link |
|---|---|
| CN (2) | CN106302353B (en) |
| WO (1) | WO2016192608A2 (en) |
Families Citing this family (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3598711B1 (en) * | 2017-04-01 | 2021-09-08 | Huawei Technologies Co., Ltd. | User authentication method and device |
| CN109309627B (en) * | 2017-07-27 | 2022-05-20 | 中兴通讯股份有限公司 | Load sharing method, system and computer readable storage medium |
| CN110620751B (en) * | 2018-06-20 | 2022-11-25 | 深圳市云猫信息技术有限公司 | WIFI routing terminal, access gateway, authentication method and authentication system thereof |
| CN110688637A (en) * | 2019-09-29 | 2020-01-14 | 广州大白互联网科技有限公司 | Authentication method and authentication system between internal and external network devices |
| CN112651522A (en) * | 2021-01-13 | 2021-04-13 | 广州视源电子科技股份有限公司 | Method, system, computer readable storage medium and processor for configuring device |
| CN113038472A (en) * | 2021-03-15 | 2021-06-25 | 南京林业大学 | Method for prohibiting wireless router DHCP from acquiring address in campus network of colleges and universities |
| US12069052B2 (en) * | 2021-05-28 | 2024-08-20 | Microsoft Technology Licensing, Llc | Client device capable of dynamically routing authentication requests to a backup authentication system |
| CN113453226B (en) * | 2021-06-29 | 2023-12-26 | 新华三大数据技术有限公司 | Dual-stack user admission authentication method and device |
| CN114006759B (en) * | 2021-10-29 | 2023-08-15 | 中国联合网络通信集团有限公司 | Network access method, network connection device, and readable storage medium |
| CN116017517A (en) * | 2022-12-05 | 2023-04-25 | 中国联合网络通信集团有限公司 | Wireless network construction method, device, equipment and storage medium |
| CN116915534B (en) * | 2023-07-06 | 2025-10-03 | 中国电信股份有限公司技术创新中心 | Information processing method, device, communication equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101931564A (en) * | 2009-06-25 | 2010-12-29 | 成都市华为赛门铁克科技有限公司 | Method and system for testing protocol anomaly, test device and control device |
| CN102946337A (en) * | 2012-12-11 | 2013-02-27 | 上海市共进通信技术有限公司 | Control method for automatically detecting PVC (Permanent Virtual Circuit) by ADSL (Asymmetrical Digital Subscriber Loop) router terminal |
| CN103347010A (en) * | 2013-06-21 | 2013-10-09 | 苏州经贸职业技术学院 | Access authentication processing method of multi-service-provider PPPoE in zone network |
| CN104243254A (en) * | 2014-09-29 | 2014-12-24 | 中国联合网络通信集团有限公司 | Access method and access device of PPPoE (Point to Point Protocol over Ethernet) |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7698456B2 (en) * | 2003-09-29 | 2010-04-13 | Cisco Technology, Inc. | Methods and apparatus to support routing of information |
| US7342920B2 (en) * | 2004-01-28 | 2008-03-11 | Sbc Knowledge Ventures, L.P. | Voice over internet protocol (VoIP) telephone apparatus and communications systems for carrying VoIP traffic |
| CN101192909B (en) * | 2006-11-22 | 2011-08-24 | 中国电信股份有限公司 | System and method for broadcast network access and IPTV access based on ADSL |
| EP1981217A1 (en) * | 2007-04-12 | 2008-10-15 | Nokia Siemens Networks Oy | Method for forwarding data packets in an access network and device |
| CN101087232B (en) * | 2007-07-27 | 2010-06-09 | 杭州华三通信技术有限公司 | An access method, system and device based on Ethernet point-to-point protocol |
| CN101399830B (en) * | 2007-09-29 | 2012-06-06 | 联想(北京)有限公司 | Virtual machine system and method for sharing Ethernet point to point protocol link |
| US8081569B2 (en) * | 2009-04-20 | 2011-12-20 | Telefonaktiebolaget L M Ericsson (Publ) | Dynamic adjustment of connection setup request parameters |
| JP5482453B2 (en) * | 2010-05-27 | 2014-05-07 | 富士通株式会社 | Router, information processing apparatus, and program |
-
2015
- 2015-06-04 CN CN201510304341.2A patent/CN106302353B/en active Active
- 2015-06-04 CN CN201911358163.6A patent/CN110958272B/en active Active
-
2016
- 2016-05-30 WO PCT/CN2016/083924 patent/WO2016192608A2/en not_active Ceased
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101931564A (en) * | 2009-06-25 | 2010-12-29 | 成都市华为赛门铁克科技有限公司 | Method and system for testing protocol anomaly, test device and control device |
| CN102946337A (en) * | 2012-12-11 | 2013-02-27 | 上海市共进通信技术有限公司 | Control method for automatically detecting PVC (Permanent Virtual Circuit) by ADSL (Asymmetrical Digital Subscriber Loop) router terminal |
| CN103347010A (en) * | 2013-06-21 | 2013-10-09 | 苏州经贸职业技术学院 | Access authentication processing method of multi-service-provider PPPoE in zone network |
| CN104243254A (en) * | 2014-09-29 | 2014-12-24 | 中国联合网络通信集团有限公司 | Access method and access device of PPPoE (Point to Point Protocol over Ethernet) |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2016192608A2 (en) | 2016-12-08 |
| WO2016192608A3 (en) | 2017-02-09 |
| CN110958272A (en) | 2020-04-03 |
| CN106302353B (en) | 2020-01-10 |
| CN106302353A (en) | 2017-01-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110958272B (en) | Identity authentication method, identity authentication system and related equipment | |
| CN101442516B (en) | Method, system and device for DHCP authentication | |
| US7733859B2 (en) | Apparatus and method for packet forwarding in layer 2 network | |
| CN101883158B (en) | Method and client for acquiring VLAN (Virtual Local Area Network) IDs (Identifiers) and network protocol addresses | |
| EP2346217B1 (en) | Method, device and system for identifying an IPv6 session | |
| US10819761B2 (en) | Electronic device and method for controlling electronic device | |
| KR100438431B1 (en) | Security system for virtual private network service access in communication network and method thereof | |
| KR20130059425A (en) | Dynamic host configuration and network access authentication | |
| CN106487788B (en) | A kind of user access method, SDN controller, forwarding device and subscriber access system | |
| WO2009003409A1 (en) | A method, system and equipment for network access | |
| CN101272403A (en) | Method, system and equipment for realizing wholesale of DHCP user services | |
| CN101980496A (en) | Message processing method and system, exchange board and access server equipment | |
| CN108307694A (en) | A kind of network connection information acquisition methods and router | |
| CN100362800C (en) | A method of triggering a user terminal to go online through a data message | |
| JP2001326696A (en) | Method for controlling access | |
| US20080046974A1 (en) | Method and System Enabling a Client to Access Services Provided by a Service Provider | |
| CN101547158B (en) | PADT message interaction method and device in PPPoE session | |
| CN106131177B (en) | Message processing method and device | |
| CN101753525A (en) | Method, system and equipment for realizing the business wholesale of DHCP users | |
| JP4852379B2 (en) | Packet communication device | |
| JP5261432B2 (en) | Communication system, packet transfer method, network switching apparatus, access control apparatus, and program | |
| CN101365238B (en) | Session converting method and apparatus | |
| CN103188662B (en) | A kind of method and device verifying WAP (wireless access point) | |
| CN104052826B (en) | The method and apparatus of discovery web medium server based on DHCP | |
| JP2004207788A (en) | Access control method, access control device, and access control system using the device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |