Embodiment
For making the object of the embodiment of the present invention, technical scheme and advantage clearly understand, below in conjunction with embodiment and accompanying drawing, the embodiment of the present invention is described in further details.At this, schematic description and description of the present invention is for explaining the present invention, but not as a limitation of the invention.
The method of a kind of IP accessing terminal to network that Fig. 2 provides for the embodiment of the present invention, the method is applied to aaa server, please refer to Fig. 2, and the method comprises:
Step 201: according to user signing contract information or customer service changed information, binds the IP protocol information that user ID and IP terminal are supported, and preserves this binding relationship;
Step 202: the authentication request receiving the IP terminal that BRAS sends, this authentication request comprises the user ID of this IP terminal;
Step 203: the user ID according to this IP terminal carries out certification to this IP terminal, if certification is passed through, then searches the IP protocol information of this IP terminal support from this binding relationship according to this user ID;
Step 204: the IP protocol information of this IP terminal support found is returned to BRAS, so that this BRAS is according to this IP protocol information, is IP address and/or the IPv6 address prefix of this IP terminal distribution respective version.
In the present embodiment, user ID can be user name, then the step 201 of the present embodiment is bound by the IP protocol information that user name and IP terminal are supported, and preserve binding relationship; The step 203 of the present embodiment is from this binding relationship, search the IP protocol information of IP terminal support according to user name.
In the present embodiment, user ID also can be the logical port number information that IP terminal accesses on BRAS, and logical port number information is here such as frame, groove, port or information of virtual local area network.
The IP protocol version that the IP protocol information of the present embodiment can be supported for IP terminal and/or be IP terminal configuration IP address and prefix protocol type used.Here IP protocol version comprises: IPv4 version and/or IPv6 version; Comprising for IP terminal configuration IP address and prefix protocol type used here: IPCP agreement, IPv6CP agreement, DHCPv6 agreement, DHCPv4 agreement, ND agreement and/or DHCP-PD agreement.
In the present embodiment, BRAS is different access way, the IP terminal configuration of IP address in different ways of different IP protocol version.Such as: BRAS is that the IPv4 terminal that accesses of PPPOE mode is by IPCP (The PPP Internet ProtocolControl Protocol RFC1332 defines) protocol configuration address and network layer parameter; BRAS is that the IPv6 terminal that accesses of PPPOE mode is by IPv6CP (The PPP Internet Protocol version 6 Control Protocol, RFC5072 defines) protocol configuration IPv6 link-local address, by DHCPv6 (Dynamic Host configuration protocol version 6, RFC3315 defines) configuration of IP v6 global address and network layer parameter; BRAS is that the IPv4 terminal that accesses of IPOE mode is by DHCPv4 (Dynamic Host configuration protocol version) protocol configuration IPv4 address and network layer parameter; BRAS be the IPv6 terminal that accesses of IPOE mode by DHCPv6 protocol configuration IPv6global address and network layer parameter, be called there is state DHCPv6 mechanism; Or by ND (Neighbor Discovery, RFC4861 define) configuration of IP v6global address, by DHCPv6 protocol configuration network layer parameter, be called stateless DHCPv6 mechanism; Especially, when IP terminal equipment is CPE, BRAS supports to CPE, then by ND agreement, IPv6 address prefix to be configured to the IP device of household internal by DHCP-PD (DHCP prefix delegation prefix delegation RFC3633 defines) mode configuration of IP v6 address prefix by CPE.
In the present embodiment, IP protocol information can be transmitted by the IP protocol version attribute of radius protocol, also can be transmitted by the IP address of radius protocol and prefix configuration mode attribute, can also according to the specification of diameter agreement, by the attribute value of expansion to transmission.Be illustrated by different embodiments below.
By the method that the embodiment of the present invention provides, when user is signing or change business time, the IP protocol information that user ID and IP terminal are supported is bound, the follow-up IP protocol information by this IP terminal support is handed down to BRAS, so that this BRAS is IP address and/or the IPv6 address prefix of this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
The flow chart of the method for a kind of IP accessing terminal to network that Fig. 3 provides for the embodiment of the present invention, the method is corresponding with method embodiment illustrated in fig. 2, is applied to BRAS, please refer to Fig. 3, and the method comprises:
Step 301: the authentication request sending described IP terminal after the access request receiving IP terminal to aaa server;
Step 302: the IP protocol information receiving the described IP terminal support that described aaa server returns;
Step 303: the IP address and/or the IPv6 address prefix that according to described IP protocol information are described IP terminal distribution respective version.
In the present embodiment, same, the IP protocol version that IP protocol information can be supported for IP terminal and/or be IP terminal configuration IP address and prefix protocol type used.Here IP protocol version can comprise: IPv4 version and/or IPv6 version; Can comprise for IP terminal configuration IP address and prefix protocol type used here: IPCP agreement, IPv6CP agreement, DHCPv6 agreement, DHCPv4 agreement, ND agreement and/or DHCP-PD agreement.
In the present embodiment, this IP protocol information can be transmitted by the IP protocol version attribute of radius protocol; Also can be transmitted by the IP address of radius protocol and prefix configuration mode attribute; Can also according to the specification of diameter agreement, by the attribute value of expansion to transmission.Be illustrated by different embodiments below.
By the method that the embodiment of the present invention provides, when user is signing or change business time, the IP protocol information that user ID and IP terminal are supported is bound by aaa server, the follow-up IP protocol information by this IP terminal support is handed down to the BRAS of the present embodiment, after the BRAS of the present embodiment receives this IP protocol information, according to IP address and/or IPv6 address prefix that this IP protocol information is this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
In order to make Fig. 2 and method embodiment illustrated in fig. 3 clearly understandable, be described in detail by the method for different embodiments to the present embodiment below.
Fig. 4 is the method for application the present embodiment, and IP terminal accesses the flow chart of aaa server by BRAS, and please refer to Fig. 4, this flow process comprises:
Step 401: during the signing or change business of user, the IP protocol information that user ID and IP terminal are supported, according to user signing contract information or customer service changed information, is bound, and is preserved this binding relationship by aaa server, so far, this binding relationship is configured on AAA server;
Step 402:IP terminal initiates network insertion request to BRAS, in network insertion request message, carry user ID;
Step 403:BRAS receives the network insertion request message of IP terminal, carries user ID and initiates authentication request to aaa server;
Step 404:AAA server carries out certification according to the user ID in authentication request to IP terminal, if certification is passed through, then in the binding relationship preserved, searches the IP protocol information of this IP terminal support according to user ID;
Step 405:AAA server notifies that BRAS certification is passed through, and in certification is by message, carry the IP protocol information of IP terminal support;
The IP protocol information that step 406:BRAS supports according to IP terminal is IP address and/or the IPv6 address prefix of IP terminal distribution respective version;
Step 407:BRAS sends network insertion response message to IP terminal, carries the IP address of distribution and/or IPv6 address prefix and other IP layer parameters, so that IP terminal is according to the IP address of this network insertion response message configuration itself and other IP layer parameters.
So far, IP terminal can start the communication with IP network.
In the present embodiment, when BRAS and AAA server is communicated by radius protocol, IP protocol version (Framed-IP-Protocol-Version) the attribute transmission that IP protocol information newly can be defined by radius protocol, this attribute transmission be IP terminal support IP protocol version.When access way is fixing, BRAS can be just the IP address that IP terminal configuration is correct according to this IP protocol version information.
Wherein, Framed-IP-Protocol-Version attribute format is defined as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value(cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
Value for Framed-IP-Protocol-Version.
Length
6
Value
The Value field is four octets,used to indicate the IP version of the
host.
1 ipv4 version
2 ipv6 version
3 both ipv4 and ipv6 version
Wherein, type is type field, represents the value of this IP protocol version attribute; Length is the length that this IP protocol version attribute measures with byte, and value is 6; Value is value field, and length is 4 bytes, represents by different values the IP version that main frame is supported, such as: value is 1 expression IPv4 version, value is 2 expression IPv6 versions, value is that IPv4 version and IPv6 version are supported in 3 expressions simultaneously.
In the present embodiment, when BRAS and AAA server is communicated by radius protocol, the IP address that IP protocol information newly can be defined by radius protocol and the transmission of prefix configuration mode (Framed-IP-AddressPrefix-Config-Mode) attribute, this attribute transmission be IP terminal configuration IP address and prefix protocol type used, such as IPCP, DHCPv6 etc.AAA server configures protocol type information used to BRAS by transmitting IP address and prefix, further instructs BRAS how to be IP address and the prefix of IP terminal configuration right version accurately.
Wherein, Framed-IP-AddressPrefix-Config-Mode attribute format is defined as follows:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value(cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type
Value for Framed-IP-AddressPrefix-Config-Mode.
Length
6
Value
The Value field is four octets,used bit mask to indicate the IP address
or prefix configuration protocol.multiple configuration protocol can be
combined in the same attribute.
0x1 PPP IPCP
0x2 DHCPv4
0x4 PPP IPv6CP
0x8 stateful DHCPv6
0x10 ND with stateless DHCPv6
0x20 DHCPv6 PD
Wherein, type is type field, represents the value of this IP address and prefix configuration mode attribute; Length is the length that this IP address and prefix configuration mode attribute measure with byte, and value is 6; Value is value field, and length is 4 bytes, and use bitmask to represent IP address or prefix configuration mode, various configurations agreement can be incorporated in same property value.Such as 0x1 represents PPP IPCP; 0x2 represents DHCPv4; 0x4 represents PPP IPv6CP; 0x8 represents stateful DHCPv6; 0x10 represents ND with stateless DHCPv6; 0x20 represents DHCPv6PD.
In the present embodiment, when BRAS and AAA server is by DIAMETER protocol communication, IP protocol information can according to the specification of diameter agreement, is realized by the AVP of expansion (attribute value pairs attribute value to).
By the method provided embodiment illustrated in fig. 4, when user is signing or change business time, the IP protocol information that user ID and IP terminal are supported is bound by aaa server, the follow-up IP protocol information by this IP terminal support is handed down to BRAS, after BRAS receives this IP protocol information, according to IP address and/or IPv6 address prefix that this IP protocol information is this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
Fig. 5 is in method embodiment illustrated in fig. 4, and BRAS and AAA server is communicated by radius protocol, and user ID is user name, and support the flow chart that the IP terminal of IPv4 and IPv6 is accessed by PPPOE mode, please refer to Fig. 5, this flow process comprises simultaneously:
Step 501: during the signing or change business of user, the IP protocol information that user name and IP terminal are supported is bound by aaa server, and preserves this binding relationship, and so far, this binding relationship has been configured on AAA server;
In the present embodiment, IP protocol information is 3 by the value of Framed-IP-Protocol-Version attribute representation, represent and support IPv4 and IPv6 simultaneously, and be 0x13 by the value of Framed-IP-AddressPrefix-Config-Mode attribute representation, represent that by IPCP, IPv6CP, stateful DHCPv6 agreement be IP terminal configuration IP address.
Step 502:IP terminal in response (Response) message in PPP CHAP stage, carry user name and password (username & password) asks access authentication to BRAS;
In the present embodiment, IP terminal and BRAS are after PPPOE discovery stage and PPP LCP stage consult link layer parameter, and in the PPP CHAP stage, IP terminal carries user name and password to BRAS certification by response message.Here password can be the value after being calculated by one-way hash function.
Step 503:BRAS, by authentication request (Access-Request) message of radius protocol, carries user name and password initiates authentication request to aaa server;
Step 504:AAA server, according to the user name in authentication request message and password, carries out certification to IP terminal, if certification is passed through, searches IP protocol information corresponding to this IP terminal according to this user name from binding relationship before;
Step 505:AAA server is passed through by (Access-Accept) message informing BRAS IP terminal authentication by the certification of radius protocol, and carries IP protocol information within the message;
In the present embodiment, IP protocol information is 3 by the value of Framed-IP-Protocol-Version attribute representation, represent and support IPv4 and IPv6 simultaneously, and be 0x13 by the value of Framed-IP-AddressPrefix-Config-Mode attribute representation, represent that by IPCP, IPv6CP, stateful DHCPv6 agreement be IP terminal configuration IP address.
Step 506:BRAS, according to the instruction of IP protocol information, by PPP IPCP agreement, is IP terminal configuration IPv4 address and network parameter;
Step 507:BRAS, according to the instruction of IP protocol information, by PPP IPv6CP agreement, is IP terminal configuration IPv6 linklocal address;
Step 508:BRAS, according to the instruction of IP protocol information, by DHCPv6 agreement, is IP terminal configuration IPv6 global address and network parameter.
Wherein, step 506-508 be BRAS according to IP protocol information, be the IP address of IP terminal distribution respective version and/or the step of IPv6 address prefix, wherein, the order that step 506-508 performs on BRAS can be any, without temporal sequencing.
So far, IP terminal can start the communication with IP network.
By the method provided embodiment illustrated in fig. 5, when user is signing or change business time, the IP protocol information that user name and IP terminal are supported is bound by aaa server, the follow-up IP protocol information by this IP terminal support is handed down to BRAS, after BRAS receives this IP protocol information, according to IP address and/or IPv6 address prefix that this IP protocol information is this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
Fig. 6 is in method embodiment illustrated in fig. 4, IP terminal is CPE, accessed by IPOE mode, BRAS realizes DHCPv6server function, support by DHCPv6 mode to be CPE configuration of IP v6 address, DHCPv6PD mode is that CEP configures delegated prefix (delegated prefix), and BRAS and AAA server, by radius protocol, transmits IP protocol information by Framed-IP-AddressPrefix-Config-Mode attribute.In the present embodiment, in DHCP agreement access way, the logical port number information that user can be accessed on BRAS by IP terminal identifies, frame/groove/port/vlan the information such as accessed on BRAS by IP terminal is identified, and the user ID therefore in the present embodiment is the logical port number information that IP terminal accesses on BRAS.Please refer to Fig. 6, this flow process comprises:
Step 601: during the signing or change business of user, the IP protocol information that user ID and IP terminal are supported is bound by aaa server, and preserves this binding relationship, and so far, this binding relationship is configured on AAA server;
In the present embodiment, IP protocol information is 0x28 by the value of Framed-IP-AddressPrefix-Config-Mode attribute representation, represents that by stateful DHCPv6, DHCPv6PD agreement be IP terminal configuration IP address and delegated prefix.
Step 602:IP terminal asks access authentication by DHCPv6solicit message to BRAS;
Step 603:BRAS, by authentication request (Access-Request) message of radius protocol, carries user ID (user identify) and initiates authentication request to aaa server;
In the present embodiment, user ID is the logical port number information that IP terminal accesses on BRAS.
Step 604:AAA server carries out certification according to the user ID in authentication request message to IP terminal, if certification is passed through, searches IP protocol information corresponding to this IP terminal according to this user ID from the binding relationship preserved before;
Step 605:AAA server is passed through by (Access-Accept) message informing BRAS IP terminal authentication by the certification of radius protocol, and carries IP protocol information in the message.
In the present embodiment, this IP protocol information is 0x28 by the value of Framed-IP-AddressPrefix-Config-Mode attribute representation, represents that by stateful DHCPv6, DHCPv6PD agreement be IP terminal configuration IP address and delegated prefix.
Step 606:BRAS is passed through by DHCPv6 Advertise message informing IP terminal authentication;
Step 607:IP terminal is by DHCPv6 Request message request IPv6 address and delegated prefix;
Step 608:BRAS, by DHCPv6 Reply message, carries IPv6 address, delegated prefix and network parameter configuration of IP terminal.
So far, IP terminal can start the communication with IP network.
By the method provided embodiment illustrated in fig. 6, when user is signing or change business time, the IP protocol information that user ID and IP terminal are supported is bound by aaa server, the follow-up IP protocol information by this IP terminal support is handed down to BRAS, after BRAS receives this IP protocol information, according to request and this IP protocol information of IP terminal, be IP address and/or the IPv6 address prefix of this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
The composition frame chart of a kind of aaa server that Fig. 7 provides for the embodiment of the present invention, please refer to Fig. 7, this aaa server comprises:
Binding unit 71, for according to user signing contract information or customer service changed information, binds the IP protocol information that user ID and IP terminal are supported, and preserves this binding relationship;
Receiving element 72, for receiving the authentication request of the IP terminal that BRAS sends, this authentication request comprises the user ID of this IP terminal;
Authentication ' unit 73, the user ID for this IP terminal received according to receiving element 72 carries out certification to this IP terminal;
Search unit 74, for when the certification of authentication ' unit 73 is passed through, from the binding relationship that binding unit 71 is preserved, search the IP protocol information of this IP terminal support according to the user ID of this IP terminal;
Transmitting element 75, for the IP protocol information searching this IP terminal support that unit 74 finds is returned to BRAS, so that this BRAS is according to this IP protocol information, is IP address and/or the IPv6 address prefix of this IP terminal distribution respective version.
In one embodiment, user ID is user name, then bind unit 71 and bind specifically for IP protocol information user name and IP terminal supported; Search the IP protocol information that unit 74 is supported specifically for searching this IP terminal from this binding relationship according to this user name.
In one embodiment, user ID is the logical port number information that IP terminal accesses on BRAS, and logical port number information here can be frame, groove, port or information of virtual local area network.
In one embodiment, IP protocol information is the IP protocol version supported of IP terminal and/or is IP terminal configuration IP address and prefix protocol type used.Here IP protocol version can comprise: IPv4 version and/or IPv6 version; Can comprise for IP terminal configuration IP address and prefix protocol type used here: IPCP agreement, IPv6CP agreement, DHCPv6 agreement, DHCPv4 agreement, ND agreement and/or DHCP-PD agreement.Transmitting element 75 transmits described IP protocol information specifically for being belonged to by the IP protocol version of radius protocol; Or, transmit described IP protocol information by the IP address of radius protocol and prefix configuration mode attribute; Or, according to the specification of diameter agreement, by expansion attribute value to transmission described IP protocol information.
Each part of the aaa server of the present embodiment is respectively used to each step realizing method embodiment illustrated in fig. 2, due in the embodiment shown in Figure 2, has been described in detail each step, has not repeated them here.
By the aaa server of the embodiment of the present invention, when user is signing or change business time, the IP protocol information that user ID and IP terminal are supported is bound by aaa server, the follow-up IP protocol information by this IP terminal support is handed down to BRAS, so that this BRAS is IP address and/or the IPv6 address prefix of this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
The composition frame chart of a kind of BRAS that Fig. 8 provides for the embodiment of the present invention, please refer to Fig. 8, this BRAS comprises:
Transmitting element 81, for after the access request receiving IP terminal, sends the authentication request of described IP terminal to aaa server;
Receiving element 82, the IP protocol information that the described IP terminal returned for receiving described aaa server is supported;
Allocation units 83, for according to described IP protocol information being IP address and/or the IPv6 address prefix of described IP terminal distribution respective version.
In one embodiment, the certification that receiving element 82 receives, by message, is belonged to by the IP protocol version of radius protocol and transmits described IP protocol information; Or, transmit described IP protocol information by the IP address of radius protocol and prefix configuration mode attribute; Or, according to the specification of diameter agreement, by expansion attribute value to transmission described IP protocol information.
Each part of the BRAS of the present embodiment is respectively used to each step realizing method embodiment illustrated in fig. 3, due in the embodiment shown in fig. 3, has been described in detail each step, has not repeated them here.
By the BRAS that the embodiment of the present invention provides, when user is signing or change business time, the IP protocol information that user ID and IP terminal are supported is bound by aaa server, the follow-up IP protocol information by this IP terminal support is handed down to the BRAS of the present embodiment, after the BRAS of the present embodiment receives this IP protocol information, according to IP address and/or IPv6 address prefix that this IP protocol information is this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
The composition frame chart of a kind of IP terminal network connecting system that Fig. 9 provides for the embodiment of the present invention, please refer to Fig. 9, this IP terminal network connecting system comprises:
Aaa server 91, for according to user signing contract information or customer service changed information, the IP protocol information that user ID and IP terminal are supported is bound, and preserve this binding relationship, receive BRAS send comprise the authentication request of IP terminal of the user ID of IP terminal time, according to described user ID, certification is carried out to described IP terminal, when certification is passed through, from described binding relationship, search the IP protocol information of described IP terminal support according to described user ID, the IP protocol information of the described IP terminal support found is returned to described BRAS;
BRAS 92, for sending the authentication request of described IP terminal after the access request receiving the transmission of IP terminal to described aaa server, after the IP protocol information receiving the described IP terminal support that described aaa server returns, be IP address and/or the IPv6 address prefix of described IP terminal distribution respective version according to described IP protocol information.
Wherein, the aaa server 91 of the present embodiment can be realized by aaa server embodiment illustrated in fig. 7, the BRAS 92 of the present embodiment can be realized by BRAS embodiment illustrated in fig. 8, due in the embodiment shown in Fig. 7 and Fig. 8, aaa server and BRAS are described in detail, have not repeated them here.
The IP terminal network connecting system provided by the embodiment of the present invention, when user is signing or change business time, the IP protocol information that user ID and IP terminal are supported is bound by aaa server, the follow-up IP protocol information by this IP terminal support is handed down to BRAS, after BRAS receives this IP protocol information, according to IP address and/or IPv6 address prefix that this IP protocol information is this IP terminal distribution respective version, make IP terminal correctly can access IP network, facilitate network operation to safeguard.
The software module that the method described in conjunction with embodiment disclosed herein or the step of algorithm can directly use hardware, processor to perform, or the combination of the two is implemented.Software module can be placed in the storage medium of other form any known in random asccess memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable ROM, register, hard disk, moveable magnetic disc, CD-ROM or technical field.
Above-described specific embodiment; object of the present invention, technical scheme and beneficial effect are further described; be understood that; the foregoing is only specific embodiments of the invention; the protection range be not intended to limit the present invention; within the spirit and principles in the present invention all, any amendment made, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.