CN1681243B - Method for realizing user authentication of wide-band network special bus - Google Patents

Abstract

The invention discloses a method for realizing authentication of a dedicated line user of a broadband network, which is applied to a broadband access system at least including a broadband access server and an authentication server, and the broadband access server has a dedicated line port for accessing a dedicated line user; The method includes the steps: the dedicated line port is configured as a fast authentication mode, and an account generation strategy is constructed; the broadband access server generates an authentication account according to the aforementioned account generation strategy, and sends an authentication request to the authentication server; the authentication server parses the authentication request, and the authentication The account is authenticated to determine whether the leased line user is allowed to go online, and returns the authentication result. The invention has high versatility, is easy to expand and does not increase additional cost.

Description

A Method for Realizing User Authentication of Broadband Network Dedicated Line

technical field

The invention relates to broadband network technology, in particular to a method for authenticating users in the broadband network.

Background technique

With the development of information technology, more and more attention has been paid to broadband networks featuring high bandwidth, wide coverage and various access methods, and more and more users have been attracted.

At present, broadband network users can be divided into two categories: dial-up users and leased line users. The so-called leased line users refer to users who access the broadband network through a Layer 2 leased line port. Generally speaking, a layer-2 leased line port includes an Ethernet port, a permanent virtual private line (PVC, Pernament Virtual Circuit) or a virtual local area network (VLAN, Virtual Local Area Network) to access a physical port or a logical port of a layer-2 leased line user; Ethernet ports include GE (Gigabit Ethernet) optical ports, FE (FastEthernet, Fast Ethernet) electrical/optical ports; among them, the permanent virtual private line supports IPOEOA (IP overEthernet over ATM) users, Ethernet ports and virtual local area network support IPOE (IP over Ethernet) users.

For different user types, the authentication and accounting policies are different. Wherein, since leased line users are generally long-term online users such as enterprise group users, a method adopted in the prior art is to assign static IP addresses, and leased line users directly go online after starting up, and charge by monthly subscription. The disadvantage of this method is that it lacks authentication and management of leased line users, and cannot perform statistics and billing based on actual traffic.

Another method used in the prior art for managing leased line users is: bundle the leased line users, bind attributes such as the user's VLAN ID, MAC address (network card address) and IP address (Internet Protocol address), and pass The broadband access server reports to the authentication server, and the authentication server performs user authentication, and determines whether the user is legal according to the aforementioned attributes. Using the VLAN port binding method can well solve the management of private line users accessing the Internet: the broadband access server can guarantee network security (such as preventing address theft, mutual infringement, etc.) , statistics related information, can accurately locate when and where users go online to realize billing according to traffic duration.

However, this prior art has some deficiencies: a separate private protocol needs to be developed between the broadband access server and the authentication server, and the private protocol is used to transmit user attributes and perform user authentication according to the attributes, resulting in its The versatility is limited, so it cannot be applied to a third-party authentication server, which is not conducive to expansion; and will cause additional cost.

Contents of the invention

In view of this, the technical problem to be solved by the present invention is to provide a universal method for realizing broadband network leased line user authentication that is easy to expand and does not increase additional costs.

For this reason, the technical solution of the present invention to solve the technical problem is: to provide a method for realizing broadband network leased line user authentication, which is applied to a broadband access system including at least a broadband access server and an authentication server, and the broadband access server has To access the leased line port of the leased line user; the method includes the steps of:

1) The dedicated line port is configured as a fast authentication mode, and an account generation strategy is constructed; wherein the dedicated line port provides a physical port or a logical port for Layer 2 access for the broadband access server;

2) The broadband access server, as the client of the authentication server, generates an authentication account according to the aforementioned account generation strategy, and sends an authentication request to the authentication server;

3) The authentication server parses the authentication request, authenticates the authentication account to determine whether the dedicated line user is allowed to go online, and returns an authentication result;

Wherein, the step 1) includes: configuring the dedicated line port as a static or dynamic fast authentication mode, and specifying the specific account generation strategy of the dedicated line port at the same time; the configuration process of the dedicated line port includes: in the port mode, use the command To configure the authentication method of the leased line user, among them,

When the leased line port is configured in a static fast authentication mode, the command includes a keyword indicating that the port is configured as a Layer 2 leased line port and requires authentication, and a keyword used to specify the authentication account of the leased line port, And a keyword used to indicate a password; when the leased line port is configured as a dynamic fast authentication mode, the command includes a keyword used to indicate that the port is configured as a layer 2 leased line port and authentication of a leased line user is required, for Indicates the keyword used to authenticate the leased line user when the leased line user goes online based on the information of the leased line user, and the keyword used to indicate the authentication password of the leased line user.

Wherein, after the step 3), the broadband access server sends an accounting start request to the authentication server after the authentication is passed.

Wherein, the account generation strategy is to designate an authentication account based on the leased line port or construct an internal account based on the information of the leased line user.

Wherein, the information of the leased line user includes IP address, MAC address, VLAN and/or PVC.

Wherein, when the dedicated line port is configured as a static fast authentication mode, in step 2), the broadband access server generates an authentication account and password according to the aforementioned account generation strategy, and sends an authentication request to the authentication server.

Wherein, after the authentication is passed, the broadband access server allows the leased line users on the leased line port to go online, and accumulates all traffic of all leased line users on the leased line port to the leased line port.

Wherein, when the dedicated line port is configured as a dynamic fast authentication mode, in step 2), when the broadband access server detects the online request of the dedicated line user, it constructs a corresponding internal account for the dedicated line user according to the configured account generation strategy, And initiate an authentication request to the authentication server.

Wherein, after said step 3), it also includes that after the authentication is passed, the broadband access server allows the dedicated line user to access, sends a billing start request to the authentication server, and starts charging the dedicated line user until the dedicated line user is detected. The accounting end request is initiated only when the user goes offline.

Wherein, before the step 2), account information is also established on the authentication server.

Wherein, the authentication server enters the corresponding IP address or IP network segment under the dedicated line user account when establishing the account information.

Compared with the prior art, the beneficial effects of the present invention are as follows: First, because the present invention configures the dedicated line port as a fast authentication mode and specifies an account generation strategy, the broadband access server is a dedicated line port or detects a dedicated line user's online request. Automatically generate the authentication account according to the account generation strategy, and send the authentication request to the authentication server, so that there is no need to develop a separate private protocol between the broadband access server and the authentication server, which can be applied to the third-party authentication server, and the versatility and scalability are improved. Big improvement. Secondly, it can not only realize the authentication of the leased line users, but also shield the authentication process from the leased line users, making it easier for the leased line users to access the Internet. Thirdly, it can accurately count the duration and traffic of leased line ports and leased line users, and implement flexible billing policies. Finally, by configuring static quick authentication or dynamic authentication, independent management or group management of leased line users can be realized. The account generation policy can be fixed according to the situation, or can be constructed according to the information of the leased line users. In addition, there is no additional cost since there is no need to develop a separate proprietary protocol.

Description of drawings

Fig. 1 is a schematic diagram of a broadband access system;

Fig. 2 is the flow chart of the method for realizing broadband network private line user authentication of the present invention;

Fig. 3 is the flow chart of the embodiment that the present invention adopts static fast authentication mode;

Fig. 4 is a flow chart of an embodiment of the present invention using a dynamic fast authentication method.

Detailed ways

Referring to FIG. 1 , the method for realizing broadband network leased line user authentication in the present invention is applied to a broadband access system, and the system includes an authentication server 110 , a broadband access server 120 , a switch 130 and a user terminal 140 .

Wherein, the authentication server 110 provides functions such as authentication, authorization, and billing for leased line users, and is also called Remote Authentication Dial-In User Service (RADIUS, Remote Authentication Dial-In User Service). It includes a user authentication management module, which is used to limit the legal use of the network by leased line users, and is combined with a broadband access server to achieve one-to-one correspondence between leased line users, IP addresses and time periods; a user account management module, which is used to identify users Effective management of accounts; billing module, used for billing dedicated line users; database, used to store authentication account and password information.

The broadband access server 120 is an indispensable tool for authentication and billing of leased line users, and can serve as a client of the authentication server 110 to transmit information such as authentication and billing of leased line users to the authentication server 110 .

The broadband access server 120 has a dedicated line port (not shown in the figure), and the dedicated line port refers to a physical port or a logical port for accessing a dedicated line user, including an Ethernet port ETH_PORT (FE/GE), PVC, VLAN, etc. to provide two Layer access physical or logical port, where the fast authentication mode is configured. The broadband access server 120 stores the account generation policy of the leased line port configuration.

The switch 130 includes a DSLAM (Digital Subscriber Liner Multiplexer, Digital Subscriber Line Access Server), a LAN Switch (Local Area Network Switch), etc., for realizing the access of leased line users.

The invention realizes fast authentication of the dedicated line users by corresponding the dedicated line port to the authentication account, or corresponding each dedicated line user on the dedicated line port to an internal account. The fast authentication means that the leased line user needs to be authenticated but does not need to explicitly input the authentication account number and password by the leased line user, but the broadband access server 120 automatically generates the authentication account number and password, and initiates an authentication request to the authentication server 110 , after the authentication is passed, the leased line user is allowed to access. Therefore, the authentication of the leased line users can be realized, and at the same time, the authentication process can be shielded from the leased line users, making it easier for the leased line users to access the Internet.

On this basis, the broadband access server 120 can also send a charging start request to the authentication server 110 to start charging for the leased line users, and accurately record the duration and traffic of the leased line users. Of course, dedicated line users can also use other billing methods such as monthly subscription fees.

Please refer to Fig. 2, the flow process of the method that the present invention realizes broadband network leased line user authentication comprises:

1) The private line port is configured as a fast authentication method, and an account generation strategy is constructed;

2) The broadband access server generates an authentication account according to the aforementioned account generation strategy, and sends an authentication request to the authentication server;

3) The authentication server parses the authentication request, authenticates the authentication account to determine whether the dedicated line user is allowed to access, and returns an authentication result.

Wherein, the fast authentication method described in step 1) can be divided into a static fast authentication method and a dynamic fast authentication method.

In the static quick authentication mode, when step 1) a certain dedicated line port is configured as a static quick authentication mode, its account generation strategy is to specify a fixed authentication account number and password based on the dedicated line port; After the policy is established, immediately implement step 2), automatically generate an authentication account based on the dedicated line port, and initiate an authentication request to the authentication server for all dedicated line users corresponding to the dedicated line port.

The static fast authentication method can be used to accurately count the traffic information of a leased line port. That is, after a leased line port has been authenticated, the leased line users on the leased line port do not need to be authenticated to go online, but go online directly. All traffic of all leased line users on the port is accumulated on the leased line port and processed as a leased line user. The types of leased line ports that can be supported by static fast authentication include but are not limited to: FE, GE, PVC, and VLAN. The specific user connection types that can be accessed on these dedicated line ports include IPOEOA, IPOE, etc.

The dynamic fast authentication method means that the object of fast authentication is a specific leased line user on a leased line port. When a leased line port is configured as a dynamic fast authentication method in step 1), the broadband access server does not initiate authentication immediately, but only when it detects that a leased line user is online on the leased line port, it will perform the authentication according to the specific circumstances in step 3). According to the account generation policy, a corresponding internal account is automatically generated for the leased line user, and an authentication request is sent to the authentication server.

After the authentication is passed, the leased line user is allowed to access, and at the same time, an accounting start request is sent to the authentication server to start accounting for the leased line user, and the billing end request is not initiated until the leased line user is detected to be offline.

By adopting the dynamic fast authentication method, accurate time duration and/or flow accounting can be performed for each leased line user or user group on a leased line port. The dynamic fast authentication mode supports user types such as IPOEOA and IPOE.

In order to facilitate the understanding of the method for realizing broadband network leased line user authentication in the present invention, the present invention will be further described below in conjunction with the embodiments.

Please refer to FIG. 3 , which is a flow chart of an embodiment of the present invention using a static fast authentication method.

First, implement step S1, configure a dedicated line port as a static fast authentication mode, and specify a specific account generation strategy for the dedicated line port.

The specific configuration process of this embodiment is: in port mode, use the command

L2-acc-policy

by-port username<username>

[password<passowrd>]

To configure the authentication method of leased line users, where L2-acc-policy is a keyword, which is used to indicate that the port is configured as a layer 2 leased line port, and authentication is required; by-port username is a keyword, used to specify the leased line-based Port authentication account; Password is optional, indicating the password.

When a dedicated line port is configured as a static fast authentication mode, step S2 is immediately implemented, and the broadband access server automatically generates an authentication account and password based on the dedicated line port according to the account generation strategy, initiates an authentication request to the authentication server, and uploads the authentication account and password .

Step S3, the authentication server checks the authentication account number and password, checks whether there is a matching authentication account number in the database, and decides whether to pass the authentication. If the authentication is passed, implement step S4, send an authentication success response to the broadband access server, and enter step S5; If it fails, go to step S7.

Step S5, the broadband access server allows the leased line user corresponding to the leased line port to access, initiates an accounting start request to the authentication server, starts the accounting of the leased line port; and regularly obtains the flow information of the leased line port and reports it to the authentication server. It should be noted that after a leased line port has been authenticated, the leased line users on the leased line port no longer need authentication to go online, but go online directly, but all the traffic of all leased line users on the leased line port is accumulated to the leased line port , as a leased line user, the broadband access server ensures that the traffic counted on the leased line port is the sum of the traffic of all online users of the leased line port, including uplink and downlink.

Step S6, once the working mode of the leased line port is no longer the static fast authentication mode, that is, in the port mode, the command no L2-acc-policy is used to cancel the authentication mode of the leased line port, and the billing of the leased line port should be terminated immediately. The broadband access server sends an accounting end request to the authentication server.

In step S7, the authentication server sends an authentication failure response to the broadband access server, and proceeds to step S8.

Step S8, the broadband access server rejects the dedicated line user of the dedicated line port to go online.

Please refer to FIG. 4 , which is a flow chart of an embodiment of the present invention using a dynamic fast authentication method.

First, implement step D1, configure a leased line port as a dynamic fast authentication mode, and specify a specific account generation strategy for the leased line port at the same time. The account generation strategy refers to constructing and how to construct an authentication account based on the information of the leased line user.

The specific configuration process of this embodiment is: in port mode, use the command

L2-acc-policy

{by-userip[mask<mask>][prefix<prefix>][surfix<surfix>]

[password<passowrd>]

To configure the authentication method of the leased line user, where L2-acc-policy is a keyword, which indicates that the port is configured as a Layer 2 leased line port, and authentication of the leased line user is required; by-userip is a keyword, indicating that according to the The IP address is authenticated when the leased line user goes online. There are many ways how to generate the authentication account of the leased line user: for example, the mask is to specify the IP address of the leased line user and <mask> to operate and operate, and the prefix refers to the IP address of the leased line user. Add the prefix <prefix>, surfix refers to adding the suffix <surfix> after the IP address of the leased line user, these three methods can be used in combination to realize a flexible user account construction method; the Password keyword and the following items indicate the leased line user authentication password.

For example, the IP address of a dedicated line port is: 10.11.128.1, and the subnet mask is: 255.255.255.0. Configure the following fast authentication methods under the leased line port:

L2-acc-policy

by-userip mask 255.255.255.248 prefix gd-surfix@163

password 0 szdx

According to the above configuration, the user authentication accounts that may be generated on the leased line port include: 10.11.128.32@163", etc., if the IP address of a dedicated line user on the leased line port is 10.11.128.10, then the user's quick authentication account is: "gd-10.11.128.8@163".

Other account generation policies are basically similar, and can be dynamically generated based on other user information, such as MAC address, VLAN, PVC, and other information. like:

L2-acc-policy

{|by-mac[prefix<prefix>][surfix<surfix>]

|by-vlan[prefix<prefix>][surfix<surfix>]

|by-vpivci[prefix<prefix>][surfix<surfix>]}

[password<passowrd>]

When a leased line port is configured as the Layer 2 dynamic fast authentication method, all user connections on the leased line port will automatically go online through the fast authentication method.

In step D2, when the broadband access server detects whether there is a dedicated line user's online request, it will enter step D3 when it detects the dedicated line user's online request.

Step D3, automatically constructing a corresponding internal account for the leased line user according to the configured account generation policy, and sending an authentication request to the authentication server.

Step D4, the authentication server checks the internal account number, checks whether there is a matching internal account number in the database, and decides whether to pass the authentication. If the authentication is passed, implement step D5, send an authentication success response to the broadband access server, and enter step D6; if the authentication fails, Step D8 is carried out.

In step D6, the broadband access server allows the leased line user to go online normally, and then initiates an accounting start request to the authentication server to start accounting for the leased line user.

Step D7, when the broadband access server detects that the leased line user is offline, it immediately ends the charging for the user, and the broadband access server sends a charging end request to the authentication server.

In step S8, the authentication server sends an authentication failure response to the broadband access server, and proceeds to step D9.

Step D9, the broadband access server rejects the dedicated line user to go online.

In addition, when the leased line port no longer works in the dynamic fast authentication mode, or the leased line port is deleted, the broadband access server will log off all online users on the leased line port and end the billing.

It can be understood that, in the present invention, it is required that the authentication server must establish correct account and password information in the database in advance for all dedicated line ports or dedicated line users requiring fast authentication according to the configured account generation strategy.

In addition, when it is necessary to bind the IP address of the leased line user with the internal account of the leased line user on the authentication server, the authentication server must record the corresponding IP address or IP network segment under the account of the leased line user, and when these leased line users go online Check the legitimacy of its IP address.

The above is only a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications should also be It is regarded as the protection scope of the present invention.

Claims (10)

1. method that realizes broadband network individual line subscriber authentication is applied to comprise at least the broadband access system of BAS Broadband Access Server and certificate server, and described BAS Broadband Access Server has the port of private line that is used to insert individual line subscriber; It is characterized in that, comprise step:

1) port of private line is configured to the rapid authentication mode, structure account number generation strategy; Wherein said port of private line provides the physical port or the logic port of two layers of access for described BAS Broadband Access Server;

2) BAS Broadband Access Server generates the authentication account number as the client of certificate server according to aforementioned account number generation strategy, sends authentication request to certificate server;

3) certificate server is resolved described authentication request, described authentication account number is authenticated determining whether allowing individual line subscriber to reach the standard grade, and the return authentication result;

Wherein, described step 1) comprises: described port of private line is configured to static state or dynamic rapid authentication mode, specifies the concrete number of the account generation strategy of this port of private line simultaneously; The layoutprocedure of described port of private line comprises: under port mode, and with ordering the authentication mode that disposes individual line subscriber, wherein,

When described port of private line is configured to static rapid authentication mode, described order comprises that being used to represent to dispose this port is the two layers of port of private line and the keyword that need authenticate, be used to specify the keyword of the authentication account number of described port of private line, and the keyword that is used to represent password; When described port of private line is configured to dynamic rapid authentication mode, described order comprises that being used to represent to dispose this port is the two layers of port of private line and the keyword that need carry out the authentication of individual line subscriber, be used to represent the keyword that the information according to individual line subscriber authenticates when individual line subscriber is reached the standard grade, and the keyword that is used to point out the authenticate password of this individual line subscriber.

2. the method for realization broadband network individual line subscriber authentication according to claim 1 is characterized in that: comprise also after described step 3) that after authentication is passed through BAS Broadband Access Server sends to charge to certificate server and begins request.

3. the method for realization broadband network individual line subscriber according to claim 1 authentication is characterized in that: described account number generation strategy is based on that port of private line is specified the authentication account number or based on the inner account number of the information structuring of individual line subscriber.

4. the method for realization broadband network individual line subscriber authentication according to claim 3, it is characterized in that: the information of described individual line subscriber comprises IP address, MAC Address, VLAN and/or PVC.

5. according to the method for claim 1 or the authentication of 2 described realization broadband network individual line subscribers, it is characterized in that: when described port of private line is configured to static rapid authentication mode, described step 2) in, BAS Broadband Access Server generates authentication account number and password according to aforementioned account number generation strategy, sends authentication request to certificate server.

6. the method for realization broadband network individual line subscriber authentication according to claim 5, it is characterized in that: after authentication is passed through, BAS Broadband Access Server allows the individual line subscriber on this port of private line to reach the standard grade, and all flows of all individual line subscribers on this port of private line all are accumulated to port of private line.

7. the method for realization broadband network individual line subscriber authentication according to claim 1, it is characterized in that: when described port of private line is configured to dynamic rapid authentication mode, described step 2) in, when detecting individual line subscriber, BAS Broadband Access Server reaches the standard grade when request, account number generation strategy according to configuration is the corresponding inside account number of individual line subscriber structure, and initiates authentication request to certificate server.

8. the method for realization broadband network individual line subscriber authentication according to claim 7, it is characterized in that: after described step 3), also comprise after authentication is passed through, BAS Broadband Access Server allows this individual line subscriber to insert, send charging to certificate server and begin request, startup is to the charging of this individual line subscriber, rolls off the production line and just initiates the charging ending request up to detecting this individual line subscriber.

9. the method for realization broadband network individual line subscriber authentication according to claim 1 is characterized in that: in described step 2) also comprise before and set up account on the certificate server.

10. the method for realization broadband network individual line subscriber authentication according to claim 9 is characterized in that: certificate server is charged to corresponding IP address or IP network section under the individual line subscriber account number when setting up account.

Images