Access method and device based on point-to-point protocol, communication equipment and storage medium

Abstract

The invention relates to an access method and device based on a point-to-point protocol, communication equipment, a storage medium and a computer program product. The method comprises the following steps: initiating a hyper text transfer protocol (HTTP) connection establishment request to a control plane (CP); the HTTP connection establishment request carries a point-to-point protocol active discovery start PADI message on the Ethernet; receiving MAC address information of a user plane UP fed back by the CP and a point-to-point protocol active discovery service PADO message on the Ethernet sent by the user plane UP; the user plane UP is determined by the CP according to the service attribute information of the terminal contained in the PADI message; a point-to-point protocol active discovery request PADR message on the Ethernet is sent to the UP; and receiving a point-to-point protocol active discovery session acknowledgement (PADS) message on the Ethernet fed back by the UP. By adopting the method, the security of the access method based on the point-to-point protocol can be improved.

Description

Technical Field

[0001] This application relates to the field of communication security technologies, and in particular, to an access method, device, communication equipment, storage medium, and computer program product based on the Point-to-Point Protocol (PPP). Background Art

[0002] Under the BRAS (Broadband Remote Access Server) CU (Control Plane and User Plane) separation technology regime defined in IETF RFC8772 (a voice communication protocol), PPPoE (Point-to-Point Protocol Over Ethernet) access is terminated by the User Plane (UP). The terminal sends PPPoE packets to the access network in an L2 (Link Layer) manner, and the access network encapsulates the packets and sends them to the bearer network for routing and forwarding. Finally, the BRAS performs decapsulation and completes functions such as user authentication, connection management, and service activation, to achieve the access and connection management of PPP (Point to Point Protocol) services.

[0003] Due to the high-hanging deployment of the UP pool, that is, the user plane function is separated from the core device and centrally deployed as a pooled resource. The function of the Control Plane (CP) is deployed in an independent controller device, and the control plane is regarded as an independent entity to manage various control tasks in the network. A bearer network (TN, Transport Network) is deployed between the access network (including the terminal side) and the UP, and the PADI (PPPOE Active Discovery Initiation) of the PPPPoE access is carried in a layer-2 broadcast packet. When attacks such as MAC (Media Access Control Address) address flooding and ARP (Address Resolution Protocol) flooding occur on the terminal side, there will be a large number of broadcast packets in the bearer network, causing a broadcast storm, and there may be a MAC address spoofing problem on the terminal side, which brings L2 (Layer 2) security problems to the bearer network. Summary of the Invention

[0004] Embodiments of this application provide an access method, device, communication equipment, storage medium, and computer program product based on the Point-to-Point Protocol, which controls the number of broadcast packets in the bearer network and solves the MAC address spoofing problem on the terminal side and the security problem of the bearer network.

[0005] An access method based on the Point-to-Point Protocol, the method is applied to a terminal, and the method includes:

[0006] Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the Control Plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet Active Discovery Initiation (PADI) message;

[0007] Receive the Media Access Control (MAC) address information of the User Plane (UP) fed back by the CP and a Point-to-Point Protocol over Ethernet Active Discovery Offer (PADO) message sent by the UP; the User Plane (UP) is determined by the CP according to the service attribute information of the terminal included in the PADI message;

[0008] Send a Point-to-Point Protocol over Ethernet Active Discovery Request (PADR) message to the UP;

[0009] Receive a Point-to-Point Protocol over Ethernet Active Discovery Session Confirmation (PADS) message fed back by the UP.

[0010] In one embodiment, before initiating the Hypertext Transfer Protocol (HTTP) connection establishment request to the Control Plane (CP), the method further includes:

[0011] Obtain network configuration information through the Dynamic Host Configuration Protocol; the network configuration information includes a management address, a Domain Name System (DNS) server, and a Uniform Resource Locator (URL);

[0012] Based on the DNS in the network configuration information, resolve the URL information of the Control Plane (CP) to obtain the Internet Protocol (IP) address of the CP, and access and communicate with the CP based on the IP address of the CP.

[0013] In one embodiment, initiating the Hypertext Transfer Protocol (HTTP) connection establishment request to the Control Plane (CP) includes:

[0014] Initiate an HTTP connection establishment request to the CP based on the URL information.

[0015] In one embodiment, the method further includes:

[0016] Determine whether the source Media Access Control (MAC) address in the PADO message is the same as the MAC address of the UP fed back by the Control Plane;

[0017] If the source MAC address in the PADO message is the same as the MAC address of the UP fed back by the Control Plane, send a PADR message to the UP.

[0018] In one embodiment, after receiving the Point-to-Point Protocol over Ethernet Active Discovery Session Confirmation (PADS) packet on the Ethernet for the UP feedback, the method further includes:

[0019] Performing Link Control Protocol (LCP) negotiation with the UP and CP;

[0020] Performing Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the CP;

[0021] Performing Internet Protocol Control Protocol (IPCP) negotiation with the UP.

[0022] In one embodiment, an access method based on the Point-to-Point Protocol is provided. The method is applied to the control plane and includes:

[0023] Receiving an HTTP connection establishment request sent by a terminal, and determining a UP among multiple UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request;

[0024] Sending the MAC address of the UP to the terminal, and sending the MAC address of the terminal to the UP;

[0025] In the authentication phase, authenticating the terminal through an Authentication, Authorization, and Accounting (AAA) node and returning an authentication result.

[0026] An access device based on the Point-to-Point Protocol, the device includes:

[0027] A first sending module, configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to a Control Plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet Active Discovery Initiation (PADI) packet;

[0028] A first receiving module, configured to receive the MAC address information of a User Plane (UP) fed back by the CP and a Point-to-Point Protocol over Ethernet Active Discovery Offer (PADO) packet sent by the UP; the User Plane (UP) is determined by the CP according to the terminal service attribute information included in the PADI packet;

[0029] A second sending module, configured to send a Point-to-Point Protocol over Ethernet Active Discovery Request (PADR) packet to the UP;

[0030] A second receiving module, configured to receive the Point-to-Point Protocol over Ethernet Active Discovery Session Confirmation (PADS) packet fed back by the UP.

[0031] An access device based on the Point-to-Point Protocol, characterized in that the device includes:

[0032] A determination module, configured to receive an HTTP connection establishment request sent by a terminal, and determine a User Plane (UP) from among multiple UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request;

[0033] A sending module, configured to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0034] An authentication module, configured to, during the authentication phase, authenticate the terminal through an Authentication, Authorization, and Accounting (AAA) node and return an authentication result.

[0035] A communication device, characterized by comprising: a transmitter and a receiver;

[0036] The transmitter is configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to a Control Plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet Active Discovery Initiation (PADI) message; and send a Point-to-Point Protocol over Ethernet Active Discovery Request (PADR) message to the UP;

[0037] The receiver is configured to receive the MAC address information of a User Plane (UP) fed back by the CP and a Point-to-Point Protocol over Ethernet Active Discovery Offer (PADO) message sent by the UP; the User Plane (UP) is determined by the CP according to the terminal service attribute information included in the PADI message; and receive a Point-to-Point Protocol over Ethernet Active Discovery Session Confirmation (PADS) message fed back by the UP.

[0038] A communication device, characterized by comprising: a transmitter, a processor, and a receiver;

[0039] The receiver is configured to receive an HTTP connection establishment request sent by a terminal, and determine a User Plane (UP) from among multiple UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request;

[0040] The transmitter is configured to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0041] The processor is configured to, during the authentication phase, authenticate the terminal through an Authentication, Authorization, and Accounting (AAA) node and return an authentication result.

[0042] A computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0043] Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Initiation (PADI) message.

[0044] Receive the MAC address information of the user plane UP feedback by the CP and the Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Offer (PADO) message sent by the user plane UP; the user plane UP is determined by the CP according to the service attribute information of the terminal included in the PADI message.

[0045] Send a Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Request (PADR) message to the UP.

[0046] Receive the Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Session Confirmation (PADS) message feedback by the UP.

[0047] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0048] Receive the HTTP connection establishment request sent by the terminal, and determine the UP among the UPs according to the terminal service attribute information included in the PADI information carried by the HTTP connection establishment request.

[0049] Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP.

[0050] In the authentication phase, authenticate the terminal through an Authentication, Authorization, and Accounting (AAA) node and return the authentication result.

[0051] A computer program product includes a computer program, and is characterized in that when the computer program is executed by a processor, it implements the access method based on the Point-to-Point Protocol provided in the embodiments of the present application, and the method may be:

[0052] Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Initiation (PADI) message.

[0053] Receive the MAC address information of the user plane UP feedback by the CP and the Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Offer (PADO) message sent by the user plane UP; the user plane UP is determined by the CP according to the service attribute information of the terminal included in the PADI message.

[0054] Send a Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Request (PADR) message to the UP.

[0055] Receive the Point-to-Point Protocol Active Discovery Session Confirmation PADS message on the Ethernet that receives the UP feedback.

[0056] A computer program product includes a computer program, characterized in that when the computer program is executed by a processor, it implements the access method based on the Point-to-Point Protocol provided by the embodiments of the present application. The method may be as follows:

[0057] Receive the HTTP connection establishment request sent by the terminal, and determine the UP among each UP according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request;

[0058] Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0059] In the authentication phase, authenticate the terminal through the Authentication, Authorization, and Accounting AAA node and return the authentication result.

[0060] The above access method, device, communication device, storage medium, and computer program product based on the Point-to-Point Protocol initiate a Hypertext Transfer Protocol HTTP connection establishment request to the Control Plane CP; the HTTP connection establishment request carries the Point-to-Point Protocol Active Discovery Initiation PADI message on the Ethernet; receive the MAC address information of the User Plane UP feedback by the CP and the Point-to-Point Protocol Active Discovery Service PADO message sent by the User Plane UP; the User Plane UP is determined by the CP according to the service attribute information of the terminal included in the PADI message; send the Point-to-Point Protocol Active Discovery Request PADR message to the UP; receive the Point-to-Point Protocol Active Discovery Session Confirmation PADS message feedback by the UP. By using this method, the terminal directly establishes a connection with the CP by sending a connection establishment request to the CP and receiving the connection establishment information sent by the CP. The CP directly determines the UP, enabling a direct session to be established between the CP and the terminal. Only unicast exists throughout the process, and the number of messages in the bearer network is in a controllable state. Moreover, the CP uniformly controls the entries of the MAC forwarding table and the ARP table, solving the MAC address spoofing problem and improving the security of the access method based on the Point-to-Point Protocol. Description of the Drawings

[0061] Figure 1 It is an application environment diagram of the access method based on the Point-to-Point Protocol in an embodiment;

[0062] Figure 2 It is a schematic flowchart of the terminal executing the access method based on the Point-to-Point Protocol in an embodiment;

[0063] Figure 3Schematic diagram of the process of a terminal accessing the control plane in an embodiment;

[0064] Figure 4 Schematic diagram of the process of sending a PADR message to the UP in an embodiment;

[0065] Figure 5 Schematic diagram of the process of a terminal performing authentication negotiation in an embodiment;

[0066] Figure 6 Schematic diagram of the process of the control plane executing an access method based on the Point-to-Point Protocol in an embodiment;

[0067] Figure 7 Schematic diagram of the signaling interaction process of an access method based on the Point-to-Point Protocol in an embodiment;

[0068] Figure 8 Schematic diagram of the device deployment of an access method based on the Point-to-Point Protocol in an embodiment;

[0069] Figure 9 Block diagram of the structure of an access device based on the Point-to-Point Protocol in an embodiment;

[0070] Figure 10 Block diagram of the structure of an access device based on the Point-to-Point Protocol in another embodiment;

[0071] Figure 11 Internal structure diagram of an access device based on the Point-to-Point Protocol in an embodiment;

[0072] Figure 12 Internal structure diagram of an access device based on the Point-to-Point Protocol in another embodiment. Detailed implementation manners

[0073] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0074] Figure 1 Schematic diagram of application scenario 100 of an access method based on the Point-to-Point Protocol provided by an embodiment of the present application. As Figure 1As shown in the figure, in this application scenario, it includes a terminal 110, a bearer network 120, a user plane pool (UP pool) 130, a control plane (CP) 140, and an AAA (Authentication Authorization Accounting) server 150. A bearer network 120 is deployed between the terminal 110 and the UP pool 130, and the bearer network 120 is used to transmit data between the terminal 110 and the UP pool 130. The UP pool 130 is obtained by pooling multiple user planes (UP) 131. The UP pool 130 and the CP 140 are communicatively connected. The CP 140 and the AAA server 150 are communicatively connected.

[0075] The terminal 110 is a wired terminal.

[0076] The bearer network 120 is located between the terminal 110 and the UP pool 130 and is a network for transmitting various voice and data services, usually using optical fiber as the transmission medium.

[0077] The UP pool 130 contains multiple UPs 131, and the UPs 131 are used to transmit actual data.

[0078] The CP 140 is an element of the network, and the CP bears the data required to create and control the network.

[0079] The AAA server 150 is used to manage which users can access the network server, what services users with access rights can obtain, and how to charge users who are using network resources.

[0080] It should be noted that the beneficial effects or technical problems solved by the embodiments of the present application are not limited to this one, and there may also be other implicit or related problems. For specific details, please refer to the descriptions of the following embodiments.

[0081] The following uses specific embodiments to elaborate in detail on the technical solutions of the present application and how the technical solutions of the present application solve the above technical problems. These several specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The following will describe the embodiments of the present application in conjunction with the accompanying drawings.

[0082] In one embodiment, as Figure 2 shown, an access method based on the Point-to-Point Protocol is provided. Taking the method applied to Figure 1 the terminal 110 (hereinafter, the label of the terminal is omitted) as an example for illustration, it includes the following steps:

[0083] Step 202, initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP.

[0084] The HTTP connection establishment request carries the Point-to-Point Protocol Active Discovery Initiation PADI message on Ethernet.

[0085] In the implementation, the terminal is powered on and started. Then, the terminal obtains network configuration information through the Dynamic Host Configuration Protocol (DHCP). The terminal sends a PADI (PPPoE Active Discovery Initiation) message to the CP in unicast form. Specifically, the terminal initiates an HTTP (Hypertext Transfer Protocol) connection establishment request to the control plane CP based on the network configuration information.

[0086] Step 204: Receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service PADO message on Ethernet sent by the user plane UP.

[0087] The user plane UP is determined by the CP according to the service attribute information of the terminal contained in the PADI message.

[0088] In implementation, the CP determines the user plane UP in the UP pool according to the service attribute information of the terminal contained in the PADI message. Then, the CP feeds back the MAC address information of the user plane UP to the terminal and sends the MAC address information of the terminal to the user plane UP. The user plane UP sends a PPPoE Active Discovery Offer (PADO) message on Ethernet to the terminal according to the MAC address information of the terminal. The terminal receives the MAC address information of the user plane UP fed back by the CP and the PADO message on Ethernet sent by the user plane UP. The PADO message contains the source MAC address of the UP.

[0089] Step 206: Send a Point-to-Point Protocol Active Discovery Request (PADR) message on Ethernet to the UP.

[0090] In implementation, the terminal initiates a service request to the UP, that is, the terminal sends a PPPoE Active Discovery Request (PADR) message to the target UP, so that the target UP can understand the service request of the terminal.

[0091] Step 208: Receive the PADS message of the Point-to-Point Protocol Active Discovery Session Confirmation on Ethernet fed back by the UP.

[0092] In implementation, after the UP receives the PADR message sent by the terminal, it will send a PADS (PPPoE Active Discovery Session-confirmation) message to the terminal. When the terminal receives the PADS message fed back by the UP, it indicates that the terminal and the UP enter the PPP session stage.

[0093] In the above access method based on the Point-to-Point Protocol, the terminal directly establishes a connection with the CP by sending a connection establishment request to the CP and receiving the connection establishment information sent by the CP. The CP directly determines the UP, enabling a direct session to be established between the CP and the terminal. Throughout the process, only unicast exists, and the number of messages in the bearer network is in a controllable state. Moreover, the CP uniformly controls the entries of the MAC forwarding table and the ARP table, solving the MAC address spoofing problem and enhancing the security of the access method based on the Point-to-Point Protocol.

[0094] In one embodiment, before initiating an HTTP connection establishment request to the control plane, it is necessary to first access the CP. As Figure 3 shown, before step 202 is executed, the access method based on the Point-to-Point Protocol may further include:

[0095] Step 302, obtaining network configuration information through the Dynamic Host Configuration Protocol.

[0096] Among them, the network configuration information includes a management address, a Domain Name System (DNS) server, and a Uniform Resource Locator (URL).

[0097] In implementation, the terminal obtains the management address of the CP, the Domain Name System (DNS) server, and the Uniform Resource Locator (URL) through the DHCP (Dynamic Host Configuration Protocol).

[0098] Step 304, resolving the URL information of the control plane CP based on the DNS in the network configuration information to obtain the Internet Protocol (IP) address of the CP, and accessing and communicating with the CP based on the IP address of the CP.

[0099] In implementation, the terminal resolves the URL information of the control plane CP based on the Domain Name System server in the network configuration information to obtain the IP (Internet Protocol) address of the CP. Then, based on the IP address of the CP, the terminal accesses the CP for network access and communication control. After the access between the terminal and the CP is completed, the terminal initiates an HTTP connection establishment request to the CP, carrying PADI message information.

[0100] Specifically, the terminal sends a query request to the DNS to request resolution of the domain name of the CP. After the DNS receives the query request from the terminal, it matches the queried domain name of the CP with the corresponding IP address of the CP. If the configured DNS server has a resolution record related to the domain name of the CP, it will return the IP address of the CP. Then, based on the management address and the IP address of the CP, the terminal accesses the CP for network access and communication control.

[0101] In this embodiment, by obtaining the network configuration information and parsing the network configuration information, the IP address of the CP is obtained. Based on the IP address of the CP, the terminal accesses the CP, realizing the intercommunication between the terminal and the CP, which facilitates subsequent communication with the CP.

[0102] In one embodiment, the specific processing procedure of step 202 may include:

[0103] Initiate an HTTP connection establishment request to the CP based on the URL information.

[0104] In practice, the terminal obtains the URL information of the CP. Then, based on the management address and the IP address of the CP obtained by URL parsing, the terminal accesses the control plane for network access and communication control. After the terminal accesses the CP, the terminal sends the PADI message to the CP in the form of HTTP.

[0105] In this embodiment, the terminal first establishes an IP communication connection with the CP. Then, the PADI message is sent to the CP in the form of HTTP, so that the PADI message is transmitted in a unicast form, avoiding the terminal from broadcasting messages, making the number of messages in the bearer network controllable, and improving the security of the access method based on the point-to-point protocol.

[0106] In one embodiment, as Figure 4 shown, the specific processing procedure of this access method based on the point-to-point protocol may further include:

[0107] Step 402, determine whether the source Media Access Control (MAC) address in the PADO message is the same as the MAC address of the UP fed back by the control plane.

[0108] In practice, the terminal determines whether the source MAC (Media Access Control Address) address included in the PADO message is the same as the MAC address of the selected UP fed back by the CP to the terminal.

[0109] Step 404, if the source MAC address in the PADO message is the same as the MAC address of the UP fed back by the control plane, send a PADR message to the UP.

[0110] In implementation, if the source MAC address included in the PADO message is the same as the MAC address of the selected UP fed back by the CP to the terminal, the terminal determines the MAC address of the UP. Then, based on the MAC address of the UP, the terminal sends a PADR message to the UP.

[0111] In this embodiment, by determining whether the source MAC address included in the PADO message is the same as the MAC address of the selected UP fed back by the CP to the terminal, the verification of the MAC address of the UP is completed. Based on the MAC address of the UP, a PADR message is sent to request services from the UP.

[0112] In one embodiment, after sending the PADR message, the UP will feed back a PADS message to the terminal. After receiving the PADS message, the terminal indicates that it enters the PPP session phase and needs to perform PPP (Point-to-Point Protocol) negotiation with the target UP and CP, including three phases: LCP (Link Control Protocol) negotiation, PAP (Password Authentication Protocol) / CHAP (Challenge Handshake Authentication Protocol) authentication negotiation, and NCP (Network Control Protocol) negotiation. As Figure 5 shown, after step 208 is executed, the specific processing procedure of this access method based on the point-to-point protocol may further include:

[0113] Step 502, perform Link Control Protocol (LCP) negotiation with the UP and CP.

[0114] In implementation, the terminal performs LCP (Link Control Protocol) negotiation with the UP and CP, and negotiates link parameters through LCP message interaction, including parameters such as MRU (Maximum-Transfer-Unit), authentication protocol, and magic word, to complete the establishment and configuration of the data link layer connection.

[0115] Step 504, perform Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the CP.

[0116] In implementation, the terminal performs authentication with the CP using the Password Authentication Protocol (PAP) or the Challenge Handshake Authentication Protocol (CHAP) to verify its identity and establish a secure connection.

[0117] Step 506: Negotiate the Internet Protocol Control Protocol (IPCP) with the UP.

[0118] Among them, IPCP (IP Control Protocol) is a common protocol in the NCP negotiation phase, used to negotiate and configure the IP parameters of network interfaces. It is mainly responsible for negotiating IP parameters such as the IP address, IP packet compression format, and Domain Name System (DNS) server IP address between the terminal device and the UP device during the PPP connection establishment process.

[0119] In implementation, the terminal and the UP negotiate network layer parameters through IPCP message interaction, including the IP address, IP packet compression format, DNS server IP address, etc., to complete the negotiation and configuration of the network layer, enabling the terminal to obtain an IP address for accessing the network and completing the online access of the terminal user.

[0120] In this embodiment, through LCP negotiation and IPCP negotiation with the target UP, the confirmation of configuring network interfaces and link parameters is completed, enabling communication between the link layer and the IP layer between the target UP and the terminal. Through PAP or CHAP authentication with the CP, the authentication of the terminal user's identity is completed.

[0121] In one embodiment, an access method based on the Point-to-Point Protocol is provided. Taking the method applied to Figure 1 CP140 (the label of CP is omitted hereinafter) as an example for illustration, as Figure 6 shown, it includes the following steps:

[0122] Step 602: Receive the HTTP connection establishment request sent by the terminal, and determine the UP among the UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request.

[0123] Among them, the PADI information can be carried in the HTTP manner. The PADI message information includes the service attribute information requested by the terminal.

[0124] In implementation, the CP receives the PADI message information in the form of a unicast carried by HTTP sent by the terminal. The CP determines the UP among the UPs (UP pool) according to the terminal service attribute information.

[0125] Step 604: Send the MAC address of the UP to the terminal and send the MAC address of the terminal to the UP.

[0126] In implementation, the CP determines the MAC address of the UP. Then, the CP sends the MAC address of the UP to the terminal. Then, the MAC address of the terminal is sent to the UP.

[0127] Step 606: In the authentication phase, authenticate the terminal through the Authentication, Authorization, and Accounting (AAA) node and return the authentication result.

[0128] In implementation, the CP sends the user authentication information to the Authentication, Authorization, and Accounting node. The AAA node authenticates the user authentication information and feeds back the authentication result to the control plane.

[0129] In this embodiment, the terminal establishes a connection with the CP. The CP receives the PADI information carried in the HTTP connection sent by the terminal and directly selects and determines the UP by the CP, so that a session is established between the UP and the terminal. Only unicast exists throughout the process, and the number of packets in the bearer network is in a controllable state. Moreover, the CP uniformly controls the entries of the MAC forwarding table and the ARP table, solves the MAC address spoofing problem, and improves the security of the Point-to-Point Protocol-based access method.

[0130] In one embodiment Figure 7 Provide a signaling interaction flowchart of a Point-to-Point Protocol-based access method. As Figure 7 shown, the method includes the following steps.

[0131] 1. The terminal powers on and obtains network configuration information through DHCP. Among them, the network configuration information includes the management address, DNS, and URL information.

[0132] 2. The terminal accesses the CP through the URL and initiates an HTTP connection establishment request. The HTTP connection establishment request carries PADI message information.

[0133] 3. The CP selects the target UP according to the terminal service attributes;

[0134] 4. The CP returns a connection establishment message and sends the MAC address of the target UP to the terminal at the same time.

[0135] 5. The CP sends the terminal MAC information to the target UP.

[0136] 6. The target UP responds to the terminal with a PADO message.

[0137] 7. The terminal verifies the MAC information of the UP and sends a PADR message to the selected UP to initiate a service request.

[0138] 8. The target UP returns a PADS message and the session is established.

[0139] 9. The terminal negotiates with the target UP for LCP, and the CP negotiates with the target UP for LCP.

[0140] 10. The terminal authenticates with the CP for PAP / CHAP and sends it to the AAA node for authentication.

[0141] 11. The terminal negotiates with the target UP for IPCP, and the CP negotiates with the target UP for IPCP.

[0142] In one embodiment, Figure 8 is a schematic diagram of the deployment of the device for the access method based on the Point-to-Point Protocol. As Figure 8 shown, traditional home broadband services include two types: Internet access services and VoIP (Voice over Internet Protocol, voice transmission based on IP) services. Currently, in the existing network, pUP (physical User Plane, the user plane in the form of a physical network element) bears the home broadband Internet access service, and vUP (virtual User Plane, the user plane in the form of a virtualized network element) bears the VoIP service. For a new service request from a terminal, the PADI message information will be carried through an HTTP connection and sent to the CP, and the CP selects the relevant UP according to the service attributes. Therefore, a unified L2VPN (Layer 2 Virtual Private Network) channel can be pre-opened in the bearer network, and all services share this L2VPN. When a new service comes up, there is no need to deploy a new VPN in the bearer network. Therefore, the access method based on the Point-to-Point Protocol has good service scalability and reduces the deployment difficulty of the bearer network.

[0143] It should be understood that although Figure 2 - 6 the steps in the flowchart of Figure 2 - 6 are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover,

[0144] In one embodiment, as Figure 9As shown, an access device 900 based on the Point-to-Point Protocol is provided, including: a first sending module 901, a first receiving module 902, a second sending module 903, and a second receiving module 904, where:

[0145] The first sending module 901 is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet Active Discovery Initiation (PADI) message.

[0146] The first receiving module 902 is used to receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol over Ethernet Active Discovery Offer (PADO) message sent by the user plane UP; the user plane UP is determined by the CP according to the service attribute information of the terminal included in the PADI message.

[0147] The second sending module 903 is used to send a Point-to-Point Protocol over Ethernet Active Discovery Request (PADR) message to the UP.

[0148] The second receiving module 904 is used to receive the Point-to-Point Protocol over Ethernet Active Discovery Session Confirmation (PADS) message fed back by the UP.

[0149] In an exemplary embodiment, the access device 900 based on the Point-to-Point Protocol further includes:

[0150] A first obtaining module, used to obtain network configuration information through the Dynamic Host Configuration Protocol; the network configuration information includes a management address, a Domain Name System (DNS) server, and a Uniform Resource Locator (URL).

[0151] A first parsing module, used to parse the URL information of the control plane CP based on the DNS in the network configuration information to obtain the Internet Protocol (IP) address of the CP, and access and communicate with the CP based on the IP address of the CP.

[0152] In an exemplary embodiment, the first sending module 901 includes:

[0153] A first sending sub-module, used to initiate an HTTP connection establishment request to the CP based on the URL information.

[0154] In an exemplary embodiment, the access device 900 based on the Point-to-Point Protocol further includes:

[0155] A first judgment module, used to judge whether the source Media Access Control (MAC) address in the PADO message is the same as the MAC address of the UP fed back by the control plane.

[0156] A third sending module, used to send a PADR message to the UP if the source MAC address in the PADO message is the same as the MAC address of the UP fed back by the control plane.

[0157] In an exemplary embodiment, the point-to-point protocol-based access device 900 further includes:

[0158] A first negotiation module for performing Link Control Protocol (LCP) negotiation with the UP and CP.

[0159] A first authentication module for performing Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the CP.

[0160] A second negotiation module for performing Internet Protocol Control Protocol (IPCP) negotiation with the UP.

[0161] In one embodiment, as Figure 10 shown, a point-to-point protocol-based access device 1000 is provided, including a determination module 1001, a construction module 1002, and a sending module 1003, where:

[0162] The determination module 1001 is configured to receive an HTTP connection establishment request sent by a terminal, and determine a UP among the UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request.

[0163] The sending module 1002 is configured to send the MAC address of the UP to the terminal and send the MAC address of the terminal to the UP.

[0164] The authentication module 1003 is configured to authenticate the terminal through an Authentication, Authorization, and Accounting (AAA) node during the authentication phase and return an authentication result.

[0165] For the specific limitations on the point-to-point protocol-based access device, reference can be made to the limitations on the point-to-point protocol-based access method in the foregoing text, which will not be elaborated here. Each module in the above-mentioned point-to-point protocol-based access device can be implemented in whole or in part by software, hardware, and their combination. The above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or stored in a memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above-mentioned modules.

[0166] In one embodiment, a communication device is provided. Refer to Figure 11 . Figure 11 is a schematic structural diagram of a terminal device provided by an embodiment of the present invention. Figure 11The terminal device 1100 shown includes: at least one processor 1101, a memory 1102, at least one network interface 1104, and a user interface 1103. Each component in the terminal device 1100 is coupled together through a bus system 1105. It can be understood that the bus system 1105 is used to implement the connection and communication between these components. In addition to the data bus, the bus system 1105 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clear illustration, in Figure 11 all kinds of buses are labeled as the bus system 1105. Additionally, in the embodiments of the present invention, a transceiver 1106 is further included. The transceiver can be multiple components, that is, including a transmitter and a receiver, and provides a unit for communicating with various other devices on the transmission medium.

[0167] Among them, the user interface 1103 may include a display, a keyboard, or a pointing device (for example, a mouse, a trackball, a touchpad, or a touch screen, etc.).

[0168] It can be understood that the memory 1102 in the embodiments of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchlink dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM). The memory 1102 of the systems and methods described in the embodiments of the present invention is intended to include but not be limited to these and any other suitable types of memories.

[0169] In some embodiments, the memory 1102 stores the following elements, executable modules, or data structures, or subsets thereof, or extended sets thereof: an operating system 11021 and application programs 11022.

[0170] Among them, the operating system 11021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks. The application programs 11022 include various application programs, such as a MediaPlayer, a Browser, etc., for implementing various application services. The program for implementing the method of the embodiment of the present invention may be included in the application programs 11022.

[0171] In the embodiment of the present invention, by invoking the program or instruction stored in the memory 1102, specifically, the program or instruction stored in the application programs 11022, wherein, a transmitter is configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to a control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Initial (PADI) message; send a PPPoE Active Discovery Request (PADR) message to a user plane UP; a receiver is configured to receive the MAC address information of the user plane UP fed back by the CP and a PPPoE Active Discovery Offer (PADO) message sent by the user plane UP; the user plane UP is determined by the CP according to the service attribute information of the terminal included in the PADI message; receive a PPPoE Active Discovery Session Confirmation (PADS) message fed back by the UP.

[0172] Some or all of the methods disclosed in the embodiments of the present invention can also be applied to the processor 1101, or implemented by the processor 1101, or implemented in cooperation with other components (such as a transceiver) by the processor 1101. The processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the above method can be completed by the integrated logic circuit in the hardware of the processor 1101 or the instructions in the form of software. The above-mentioned processor 1101 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present invention can be directly embodied as being executed and completed by the hardware decoding processor, or executed and completed by the combination of the hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. This storage medium is located in the memory 1102, and the processor 1101 reads the information in the memory 1102 and combines its hardware to complete the steps of the above method.

[0173] Figure 12 It is a schematic structural diagram of the control plane provided by the embodiment of the present invention. Figure 12 The access network device 1200 shown includes: at least one processor 1201, a memory 1202, and at least one network interface 1204. Each component in the access network device 1200 is coupled together through a bus system 1205. It can be understood that the bus system 1205 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clear description, in Figure 12 all kinds of buses are labeled as the bus system 1205. In addition, in the embodiments of the present invention, there is also a transceiver 1206. The transceiver may be multiple components, that is, including a transmitter and a receiver, and provides a unit for communicating with various other devices on the transmission medium.

[0174] It can be understood that the memory 1202 in the embodiments of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchlink dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM). The memory 1202 of the systems and methods described in the embodiments of the present invention is intended to include but not be limited to these and any other suitable types of memory.

[0175] In some embodiments, the memory 1202 stores the following elements, executable modules, or data structures, or subsets or supersets thereof: an operating system 12021. Among them, the operating system 12021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks.

[0176] In the embodiments of the present invention, by invoking the programs or instructions stored in the memory 1202, a transmitter is used to send the MAC address of the UP to the terminal and send the MAC address of the terminal to the UP; a processor is used to authenticate the terminal through an authentication, authorization, and accounting (AAA) node during the authentication phase and return an authentication result; a receiver is used to receive an HTTP connection establishment request sent by the terminal and determine a UP among multiple UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request.

[0177] Some or all of the methods disclosed in the embodiments of the present invention may also be applied to the processor 1201, or implemented by the processor 1201, or implemented in cooperation with other components (such as a transceiver) by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by the integrated logic circuit in the hardware of the processor 1201 or by instructions in the form of software. The above-mentioned processor 1201 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in combination with the embodiments of the present invention may be directly embodied as being executed and completed by a hardware decoding processor, or completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a mature storage medium in the art such as a random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, register, etc. This storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and combines its hardware to complete the steps of the above method.

[0178] It can be understood that these embodiments described in the embodiments of the present invention can be implemented by hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions of this application, or a combination thereof.

[0179] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0180] In one embodiment, a computer program product is provided, including a computer program which, when executed by a processor, implements the steps in the above method embodiments.

[0181] Those of ordinary skill in the art can understand that all or part of the processes in the above method embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it may include the processes of the above method embodiments. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided in the present application may include at least one of non-volatile and volatile memories. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0182] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0183] The above-described embodiments merely represent several implementation manners of the present application. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the appended claims.

Claims

1. An access method based on the Point-to-Point Protocol, characterized in that, The method is applied to a terminal, and the method includes: Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to a control plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Initiation (PADI) message; Receive the MAC address information of a user plane (UP) fed back by the CP and a PPPoE Active Discovery Offer (PADO) message sent by the UP; the user plane (UP) is determined by the CP according to the service attribute information of the terminal included in the PADI message; Send a PPPoE Active Discovery Request (PADR) message to the UP; Receive a PPPoE Active Discovery Session Confirmation (PADS) message fed back by the UP.

2. The method according to claim 1, wherein Before initiating the HTTP connection establishment request to the control plane (CP), the method further includes: Obtain network configuration information through the Dynamic Host Configuration Protocol (DHCP); the network configuration information includes a management address, a Domain Name System (DNS) server, and a Uniform Resource Locator (URL); Resolve the URL information of the control plane (CP) based on the DNS in the network configuration information to obtain the Internet Protocol (IP) address of the CP, and access and communicate with the CP based on the IP address of the CP.

3. The method according to claim 1, characterized in that Initiating the HTTP connection establishment request to the control plane (CP) includes: Initiate an HTTP connection establishment request to the CP based on the URL information.

4. The method according to claim 1, wherein The method further includes: Determine whether the source Media Access Control (MAC) address in the PADO message is the same as the MAC address of the UP fed back by the control plane; If the source MAC address in the PADO message is the same as the MAC address of the UP fed back by the control plane, send a PADR message to the UP.

5. The method according to claim 1, wherein After receiving the PPPoE Active Discovery Session Confirmation (PADS) message fed back by the UP, the method further includes: Conduct Link Control Protocol (LCP) negotiation with the UP and the CP; Conduct Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the CP; Conduct Internet Protocol Control Protocol (IPCP) negotiation with the UP.

6. An access method based on the Point-to-Point Protocol, characterized in that, The method is applied to a control plane, and the method includes: Receive an HTTP connection establishment request sent by a terminal, and determine a UP among multiple UPs according to the terminal service attribute information included in the PADI information carried by the HTTP connection establishment request; Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP; During the authentication phase, authenticate the terminal through an Authentication, Authorization, and Accounting (AAA) node and return an authentication result.

7. An access device based on the Point-to-Point Protocol, characterized in that, The device includes: A first sending module, configured to initiate an HTTP connection establishment request to a control plane (CP); the HTTP connection establishment request carries a PPPoE Active Discovery Initiation (PADI) message; A first receiving module, configured to receive the MAC address information of the user plane (UP) fed back by the CP and the Point-to-Point Protocol over Ethernet Active Discovery Offer (PADO) packet sent by the UP; the user plane UP is determined by the CP according to the service attribute information of the terminal included in the PADI packet. A second sending module, configured to send a Point-to-Point Protocol over Ethernet Active Discovery Request (PADR) packet to the UP. A second receiving module, configured to receive the Point-to-Point Protocol over Ethernet Active Discovery Session Confirmation (PADS) packet fed back by the UP.

8. An access device based on the Point-to-Point Protocol, characterized in that, The apparatus includes: A determination module, configured to receive an HTTP connection establishment request sent by a terminal, and determine a UP among multiple UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request. A sending module, configured to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP. An authentication module, configured to authenticate the terminal through an Authentication, Authorization, and Accounting (AAA) node during the authentication phase, and return an authentication result.

9. A communication device, characterized in that, It includes: A transmitter and a receiver; The transmitter is configured to initiate an HTTP connection establishment request to a control plane (CP). The HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet Active Discovery Initiation (PADI) packet. Send a Point-to-Point Protocol over Ethernet Active Discovery Request (PADR) packet to the UP. The receiver is configured to receive the MAC address information of the user plane (UP) fed back by the CP and the Point-to-Point Protocol over Ethernet Active Discovery Offer (PADO) packet sent by the UP. The user plane UP is determined by the CP according to the service attribute information of the terminal included in the PADI packet; receive the Point-to-Point Protocol over Ethernet Active Discovery Session Confirmation (PADS) packet fed back by the UP.

10. A communication device, characterized in that, It includes: A transmitter, a processor, and a receiver; The receiver is configured to receive an HTTP connection establishment request sent by a terminal, and determine a UP among multiple UPs according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request. The transmitter is configured to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP. The processor is configured to authenticate the terminal through an Authentication, Authorization, and Accounting (AAA) node during the authentication phase, and return an authentication result.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5 or 6.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5 or 6.

Images