A VPDN network security device for highway optical fiber network system

Abstract

The present invention discloses a VPDN network security device for a highway optical fiber network system. The present invention optimizes the ARP protocol and the L2TP protocol, and realizes the linkage of ARP and L2TP to create a VPDN tunnel for the equipment on the roadside system such as the ETC gantry and toll station on the highway; the access device authentication function is completed through the optimized ARP and AAA authentication, and the ARP interaction is realized to track the access device online and offline; the OBU module is integrated on the access device, and before the ARP protocol interaction is performed, the OBU and the ETC gantry system RSU are authenticated. The present invention realizes the linkage of the ARP mechanism in the VPDN scenario in L2TP, the ARP and RADIUS linkage mechanism, and optimizes the existing protocols of ARP, L2TP and RADIUS; realizes the rapid establishment of a service tunnel, and realizes the authentication of Ethernet users to improve the security of the entire system.

Description

Technical Field

[0001] The invention belongs to the technical field of secure communications, and in particular is a VPDN network security device for a highway optical fiber network system. Background Art

[0002] ARP (Address Resolution Protocol) is a protocol that resolves IP addresses to Ethernet MAC addresses. In a network, when a host or other network device has data to send to another host or device, it must know the other party's network layer IP address. IP datagrams must be encapsulated into frames to be sent through the physical network, so the sending station must also have the physical address of the receiving station, so a mapping from IP address to physical address is required. ARP is the protocol that implements this function.

[0003] L2TP (Layer 2 Tunneling Protocol) is the most widely used VPDN tunnel protocol. L2TP establishes a point-to-point L2TP tunnel on the public network, encapsulates the PPP data frame and transmits it through the L2TP tunnel, so that after the remote user accesses the public network using PPP, he can communicate with the enterprise's internal network through the L2TP tunnel and access the enterprise's internal network resources. L2TP is a layer 2 VPN technology that provides a safe, economical and effective way for remote users to access private enterprise networks.

[0004] AAA (Authentication, Authorization, Accounting) is a management mechanism for network security, providing three security functions: authentication, authorization, and accounting. RADIUS (Remote Authentication Dial-In User Service) is a distributed, client / server information exchange protocol that can protect the network from unauthorized access. It is often used in various network environments that require high security and allow remote user access. This article uses the RADIUS protocol to implement the function of linkage with ARP. This solution is also applicable to other AAA protocols such as TACACS.

[0005] OBU (On board Unit) is a microwave device that uses DSRC (Dedicated Short Range Communication) technology to communicate with RSU. In the ETC system, OBU is placed on the vehicle and RSU (Road Side Unit) is set up on the roadside, and they communicate with each other via microwaves.

[0006] ARP is a protocol for learning MAC addresses, L2TP tunnel is the main technology for implementing VPDN, and AAA protocol implements user authentication. The existing ARP protocol and L2TP protocol are independent of each other and have no linkage. ARP and AAA protocols are independent of each other and have no linkage.

[0007] The existing ARP protocol and L2TP protocol are implemented independently and not linked. When a user goes online, the ARP process is processed first. After the process is completed, the L2TP negotiation is triggered through the IP message. That is, the first IP message that meets the L2TP rule will trigger the L2TP negotiation tunnel process. Since the L2TP negotiation process takes time, the first message will have a large delay or even packet loss. More importantly, the identity of the access device is not authenticated in the Ethernet environment. Summary of the invention

[0008] The object of the present invention is to provide a VPDN network security device for a highway optical fiber network system to solve the problems raised in the above background technology.

[0009] In order to reduce latency and packet loss and improve the security of access devices, the solution of the present invention advances the point where L2TP starts negotiation to the ARP negotiation stage. The information that triggers L2TP negotiation is provided by the ARP request message, which is used to improve the efficiency of user online access. At the same time, authentication information is added to the request message in ARP to achieve authentication of access users.

[0010] At the same time, in order to increase the security authorization function of the safety device to access the network, the OBU function is integrated on the device. Before the ARP protocol interaction, the OBU and the ETC gantry system RSU are authenticated. After the authentication is passed, the system opens the Ethernet port. Otherwise, the subsequent ARP negotiation cannot be performed if the Ethernet port is not opened.

[0011] To achieve the above object, the present invention provides the following technical solutions:

[0012] A VPDN network security device for a highway optical fiber network system comprises an access device, an authentication device and an LNS, wherein an OBU module is integrated in the access device, the OBU module is connected to an ETC gantry system, before performing ARP protocol interaction, the OBU and the ETC gantry system RSU perform authentication, after the authentication is passed, the system opens an Ethernet port, otherwise subsequent ARP negotiation cannot be performed without opening the Ethernet port; the access device contains an optimized ARP protocol; the authentication device is an LAC of L2TP, the LAC is connected to the LNS via a public network, and the LNS is connected to an internal network of an enterprise; the LAC is internally provided with an optimized ARP protocol and an optimized L2TP protocol.

[0013] The modification of the ARP protocol includes using the password of the access device to be written into the unused field of ARP to realize the identification of the access device identity; the modification of the L2TP protocol includes triggering the negotiation of the L2TP protocol tunnel through the access device information sent by the ARP protocol; the L2TP realizes the aliveness of the tunnel while realizing the aliveness of the ARP user by linking with ARP; and triggering L2TP to delete the tunnel when all ARP users go offline.

[0014] When the access device is online, the authentication information of the access device is sent to the ARP request message through the ARP protocol. The information includes the "sender MAC" as the user name, and the preset password is written into the "destination MAC". The authentication device extracts the information of the access device, and the device information is authenticated according to the RADIUS protocol. After the authentication is passed, the L2TP protocol is triggered according to the triggering rules and the device information is used to trigger the establishment of the L2TP tunnel; the L2TP tunnel and the ARP are linked through keep-alive messages to achieve tunnel keep-alive and online detection of the access device; the access device goes offline, triggering the ARP protocol to notify the authentication device to go offline. When all ARP users corresponding to the L2TP tunnel are offline, the authentication device notifies the L2TP protocol to delete the L2TP tunnel according to the access device information.

[0015] The optimized ARP and RADIUS protocols write the device description information into the "sender MAC" field in the ARP request message, and when the authentication device receives that the "sender MAC" is not empty, the RADIUS protocol is triggered, and the device description information on the "sender MAC" field is written into the "description" field in the RADIUS protocol, and the device description information is displayed in the device entry on the network management platform.

[0016] Compared with the prior art, the present invention links the ARP mechanism and the ARP and RADIUS linkage mechanism in the L2TP implementation VPDN scenario, and optimizes the existing protocols of ARP, L2TP and RADIUS; after the scheme is implemented, a service tunnel can be quickly established, and Ethernet users can be authenticated to improve the security of the entire system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 The schematic diagram is a structural diagram of a VPDN network security device used in a highway optical fiber network system.

[0018] Figure 2 A schematic diagram of the structure of an existing ARP message.

[0019] Figure 3 The figure is a schematic diagram of the existing ARP interaction process.

[0020] Figure 4 This is a structural diagram of the ARP request message of the present invention.

[0021] Figure 5 This is the ARP interaction flow chart of the present invention.

[0022] Figure 6 The following is a diagram of the existing L2TP network structure.

[0023] Figure 7 The figure is a schematic diagram of the tunnel establishment process of ARP and L2TP linkage in the present invention.

[0024] Figure 8 The diagram is a schematic diagram of the keep-alive process of L2TP and ARP linkage in the present invention.

[0025] Fig. 9 The figure is a schematic diagram of the tunnel deletion process of ARP and L2TP linkage according to the present invention.

[0026] Fig.10 It is the ARP and RADIUS protocol structure diagram of the present invention.

[0027] Fig.11 This is a flow chart of the authentication process of the present invention. DETAILED DESCRIPTION

[0028] The technical solution of this patent is further described in detail below in conjunction with specific implementation methods.

[0029] See also Figure 1 A VPDN network security device for a highway optical fiber network system includes the optimization of the ARP protocol, L2TP and RADIUS protocol to realize the linkage of the three to complete the authentication device's verification of the access device. The specific steps are as follows:

[0030] (I) Optimization of the existing ARP protocol

[0031] like Figure 2 , 3 As shown, the current ARP protocol is implemented as follows:

[0032] Host A first checks its own ARP table to determine whether it contains the ARP table entry corresponding to host B; if the corresponding MAC address is found, host A directly uses the MAC address in the ARP table to frame the IP datagram and send the IP datagram to host B.

[0033] If host A cannot find the corresponding MAC address in the ARP table, it will cache the IP datagram and then send an ARP request message in broadcast mode; the sender IP address and sender MAC address in the ARP request message are the IP address and MAC address of host A, and the target IP address and target MAC address are the IP address and all-0 MAC address of host B. Since the ARP request message is sent in broadcast mode, all hosts on the network segment can receive the request, but only the requested host (i.e. host B) will process the request.

[0034] Host B compares its own IP address with the target IP address in the ARP request message. If the two are the same, it will do the following: store the IP address and MAC address of the sender (i.e. host A) in the ARP request message into its own ARP table. Then it will send an ARP response message to host A in unicast mode, which contains its own MAC address.

[0035] After receiving the ARP response message, host A adds the MAC address of host B to its own ARP table for subsequent message forwarding, and encapsulates the IP datagram and sends it out.

[0036] like Figure 4 , 5 As shown, the "destination MAC" in the ARP request message becomes the "user password" field; the implementation process is as follows:

[0037] Both host A and host B are configured to use the ARP protocol described in this solution. In order to reduce the number of ARP packets triggered by non-L2TP tunnel services to trigger the L2TP process, trigger rules can be set; the rules can be divided into the whole machine level, port level, and host level according to the granularity; for the whole machine level, all ARP request packets will trigger L2TP negotiation; for the port level, only the ARP request packets of the port will trigger L2TP negotiation; for the host level, only the ARP request packets with the specified "sender MAC" address that meets the requirements will trigger L2TP negotiation.

[0038] The password information of host A is written into the "destination MAC" field in the ARP request message and sent to host B. After receiving the message, host B extracts the "sender MAC" as the user name and the password information of host A as the password of the user. After extracting the user password, it decides whether to establish an L2TP tunnel based on the rules triggered by L2TP.

[0039] (II) Optimization of the existing L2TP protocol

[0040] (1) Figure 6 As shown in the figure, the main process of establishing a typical L2TP tunnel is as follows:

[0041] First, the remote system access device initiates a service request and generates an IP message that complies with L2TP rules;

[0042] Then, after receiving the message that meets the rules, the LAC triggers L2TP tunnel negotiation and sends the authentication information defined by the LAC to the LNS.

[0043] Finally, the LNS authenticates the authentication information provided by the LAC. After the authentication is passed, the L2TP tunnel negotiation is completed and a session in the tunnel is established to realize data transmission.

[0044] (2) Figure 7 As shown in the figure, the optimized L2TP tunnel establishment process is as follows:

[0045] 1) The remote system access device initiates a service request, generates an ARP message, and writes the preset password information into the ARP message.

[0046] 2) After receiving the message that meets the rules, LAC triggers L2TP tunnel negotiation. Extract the "sender MAC" of the ARP authentication request message as the L2TP authentication username, extract the "destination MAC" in the ARP request message as the user password, perform authentication locally on the LAC, and trigger L2TP tunnel negotiation after authentication passes.

[0047] 3) LNS authenticates the authentication information provided by LAC and completes the negotiation of L2TP tunnel after the authentication is passed.

[0048] 4) For other ARP users using the same tunnel, use the tunnel to create different sessions to achieve data transmission.

[0049] (3) Figure 8 As shown in the figure, the optimized L2TP tunnel keepalive mechanism is as follows:

[0050] In order to detect the connectivity of the tunnel between LAC and LNS, LAC and LNS will periodically send Hello messages to each other, and the receiver will respond after receiving the Hello message. If LAC or LNS does not receive the Hello response message from the other end within the specified time interval, it will send it repeatedly. If it still does not receive the response information from the other end after repeating it for 5 times, it is considered that the L2TP tunnel has been disconnected.

[0051] The existing L2TP tunnel keepalive mechanism does not consider whether the ARP user is online. This solution improves the L2TP tunnel keepalive mechanism. After the LAC receives the keepalive message from the LNS, it sends an ARP keepalive message to all ARP users in the tunnel. If no ARP user receives a reply within the specified time, its corresponding L2TP session is deleted. If no ARP user responds, the L2TP tunnel is deleted.

[0052] (4) Fig. 9 As shown in the figure, the optimized L2TP tunnel deletion mechanism has the following specific process:

[0053] The LAC device of the L2TP tunnel periodically checks the ARP table entries under the tunnel. When there is no corresponding ARP user for the tunnel, it triggers the L2TP deletion message to delete the L2TP tunnel.

[0054] (III) Optimization of the existing RADIUS protocol

[0055] like Fig.10 As shown in FIG. 1 , the RADIUS protocol has good extensibility. Attribute No. 26 (Vendor-Specific) defined in RFC 2865 is used by device vendors to extend RADIUS to implement functions that are not defined in the standard RADIUS.

[0056] The optimized ARP and RADIUS protocols write the device description information into the "sender MAC" field in the ARP request message, and when the authentication device receives that the "sender MAC" is not empty, the RADIUS protocol is triggered, and the device description information on the "sender MAC" field is written into the "description" field in the RADIUS protocol, and the device description information is displayed in the device entry on the network management platform.

[0057] (IV) Authentication between RSU and OBU

[0058] After the authentication device is powered on, the OBU interacts with the RSU on the gantry to complete the authentication function. If the authentication is successful, the authentication device opens the Ethernet interface, otherwise it does not open the Ethernet interface.

[0059] After the RSU detects the OBU module of the authentication device, it writes a string of random numbers into the OBU. After receiving the string, the OBU generates a HASH value based on the shared key configured in advance on the RSU and OBU and the string. The RSU reads the HASH and compares it with the one it generates. If the authentication is the same, it notifies the OBU module of the authentication device, and the OBU module notifies the device to open the Ethernet interface; otherwise, the Ethernet interface is not opened. After three interactions, the RSU considers the device to be an illegal device and suspends authentication for the device. The suspension time is set to the silent time.

[0060] (V) After OBU and RSU certification, equipment online process

[0061] like Fig.11 As shown, the optimized authentication process of the present invention is as follows:

[0062] The access device sends an ARP request message, and the authentication device obtains the authentication information and performs authentication. If the authentication fails, it returns to the access device to send an ARP request message. If the authentication passes, the authentication device triggers L2TP negotiation, and RADIUS sends a new device description. If the negotiation is successful, the process ends. If the negotiation is unsuccessful, it returns to the access device to send an ARP request message.

[0063] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood by specific circumstances.

[0064] The above describes in detail the preferred implementation of this patent, but this patent is not limited to the above implementation. Various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of this patent.

Claims

1. A VPDN network security device for a highway optical fiber network system, comprising an access device and an authentication device, characterized in that: The access device is connected to the RSU device of the ETC gantry system, the access device is connected to the authentication device through the local area network, the authentication device is connected to the LNS through the public network, and the LNS is connected to the internal network of the enterprise; the access device is integrated with an OBU module, and before the ARP protocol interaction, the OBU and the ETC gantry system RSU are authenticated; the access device contains an optimized ARP protocol; the authentication device is the LAC of L2TP, the LAC is connected to the LNS through the public network, and the LNS is connected to the internal network of the enterprise; the LAC is provided with an optimized ARP protocol and an optimized L2TP protocol; the point at which the L2TP starts negotiation is advanced to the ARP negotiation stage, and the information that triggers the L2TP negotiation is provided by the ARP request message, which is used to improve the efficiency of users going online, and at the same time, authentication information is added to the request message in the ARP to achieve authentication of access users; The modification of the ARP protocol includes using the unused field of ARP to write the information of the access device to realize the identification of the access device identity; The modification of the L2TP protocol includes triggering the negotiation of the L2TP protocol tunnel through the access device information sent by the ARP protocol, where the access device information includes user name information and password information; The L2TP tunnel is linked by keep-alive messages and ARP, so that the tunnel is kept alive and online detection and tunnel deletion functions are realized on the access device. The ARP is linked with the AAA, and the AAA attribute information is written into the device description information provided by the ARP to track the device's online and offline status.

2. A VPDN network security device for a highway optical fiber network system according to claim 1, characterized in that: Mutual authentication between the RSU and the device is achieved through the interaction of authentication information between the OBU and the RSU.

Images