Access method and device based on point-to-point protocol, communication device and storage medium

Abstract

The application relates to an access method and device based on a point-to-point protocol, communication equipment, a storage medium and a computer program product. The method comprises the following steps: initiating a hypertext transfer protocol (HTTP) connection establishment request to a control plane (CP); the HTTP connection establishment request carries a point-to-point protocol (PPP) active discovery initiation (PADI) message on an Ethernet; receiving MAC address information of a user plane (UP) fed back by the CP and a point-to-point protocol (PPP) active discovery offer (PADO) message on the Ethernet sent by the UP; the UP is determined by the CP according to service attribute information of a terminal contained in the PADI message; sending a point-to-point protocol (PPP) active discovery request (PADR) message on the Ethernet to the UP; and receiving a point-to-point protocol (PPP) active discovery session confirmation (PADS) message fed back by the UP. The method can improve the security of the access method based on the point-to-point protocol.

Description

Technical Field

[0001] This application relates to the field of communication security technology, and in particular to an access method, apparatus, communication equipment, storage medium, and computer program product based on a point-to-point protocol. Background Technology

[0002] Under the BRAS (Broadband Access Server) CU (Control Plane and User Plane) separation technology defined in IETF RFC8772 (a voice communication protocol), PPPoE (Point-to-Point Protocol over Ethernet) access is terminated by the user plane (UP). The terminal sends PPPoE packets to the access network via L2 (Link Layer). The access network encapsulates the packets and sends them to the bearer network for routing and forwarding. Finally, the BRAS decapsulates the packets and performs user authentication, connection management, and service activation, thus enabling access and connection management for PPP (Point-to-Point Protocol) services.

[0003] Due to the UP (User Plane) pooling deployment, user plane functions are separated from core devices and centrally deployed as a pool of resources. Control plane (CP) functions are deployed in independent controller devices, treating the control plane as a separate entity to manage various control tasks within the network. A transport network (TN) is deployed between the access network (including the terminal side) and the UP, with the PADI (PPPoE Active Discovery Initiation) for PPPoE access carried in Layer 2 broadcast messages. When attacks such as MAC (Media Access Control Address) flooding or ARP (Address Resolution Protocol) flooding occur on the terminal side, a large number of broadcast messages will exist in the transport network, causing a broadcast storm. Furthermore, MAC address spoofing may occur on the terminal side, introducing Layer 2 (L2) security issues to the transport network. Summary of the Invention

[0004] This application provides an access method, apparatus, communication device, storage medium, and computer program product based on a point-to-point protocol, which controls the number of broadcast messages in the bearer network and solves the problems of MAC address spoofing on the terminal side and the security problems of the bearer network.

[0005] An access method based on a point-to-point protocol, the method being applied to a terminal, the method comprising:

[0006] A Hypertext Transfer Protocol (HTTP) connection establishment request is initiated to the Control Plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet.

[0007] The system receives the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message.

[0008] Send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP;

[0009] Receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on Ethernet fed back by the UP.

[0010] In one embodiment, before initiating the Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP), the method further includes:

[0011] Network configuration information is obtained through Dynamic Host Configuration Protocol (DHCP); the network configuration information includes management address, Domain Name System (DNS) server, and Uniform Resource Locator (URL).

[0012] Based on the URL information of the DNS resolution control plane (CP) in the network configuration information, the Internet Protocol (IP) address of the CP is obtained, and the CP is accessed and interconnected based on the IP address of the CP.

[0013] In one embodiment, initiating a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP) includes:

[0014] An HTTP connection establishment request is initiated to the CP based on the URL information.

[0015] In one embodiment, the method further includes:

[0016] Determine whether the source media access control address (MAC address) in the PADO message is consistent with the UP MAC address fed back by the control plane;

[0017] If the source MAC address in the PADO message matches the MAC address of the UP reported by the control plane, a PADR message is sent to the UP.

[0018] In one embodiment, after receiving the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on the Ethernet network fed back by the UP, the method further includes:

[0019] Negotiate Link Control Protocol (LCP) with the UP and CP;

[0020] The CP is authenticated using either the Password Authentication Protocol (PAP) or the Challenge Handshake Authentication Protocol (CHAP).

[0021] Negotiate the IP Control Protocol (IPCP) with the UP.

[0022] In one embodiment, an access method based on a point-to-point protocol is provided, the method being applied to the control plane, the method comprising:

[0023] The system receives an HTTP connection establishment request from a terminal and determines the UP among each UP based on the terminal service attribute information contained in the PADI information carried in the HTTP connection establishment request.

[0024] Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0025] During the authentication phase, the terminal is authenticated by the Authentication, Authorization and Accounting (AAA) node, and the authentication result is returned.

[0026] An access device based on a point-to-point protocol, the device comprising:

[0027] The first sending module is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet.

[0028] The first receiving module is used to receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message;

[0029] The second sending module is used to send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP.

[0030] The second receiving module is used to receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message fed back by the UP on the Ethernet network.

[0031] An access device based on a point-to-point protocol, characterized in that the device comprises:

[0032] The determination module is used to receive the HTTP connection establishment request sent by the terminal and determine the UP among each UP based on the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request.

[0033] A sending module is used to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0034] The authentication module is used to authenticate the terminal through the Authentication, Authorization and Accounting (AAA) node during the authentication phase and return the authentication result.

[0035] A communication device, characterized in that it comprises: a transmitter and a receiver;

[0036] The transmitter is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet; and sends a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP.

[0037] The receiver is configured to receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message; and to receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message fed back by the UP over Ethernet.

[0038] A communication device, characterized in that it comprises: a transmitter, a processor, and a receiver;

[0039] The receiver is used to receive the HTTP connection establishment request sent by the terminal, and determine the UP among each UP according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request.

[0040] The transmitter is used to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0041] The processor is used to authenticate the terminal through the Authentication, Authorization and Accounting (AAA) node during the authentication phase and return the authentication result.

[0042] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0043] A Hypertext Transfer Protocol (HTTP) connection establishment request is initiated to the Control Plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet.

[0044] The system receives the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message.

[0045] Send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP;

[0046] Receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on Ethernet fed back by the UP.

[0047] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0048] The system receives an HTTP connection establishment request from a terminal and determines the UP among each UP based on the terminal service attribute information contained in the PADI information carried in the HTTP connection establishment request.

[0049] Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0050] During the authentication phase, the terminal is authenticated by the Authentication, Authorization and Accounting (AAA) node, and the authentication result is returned.

[0051] A computer program product includes a computer program, characterized in that, when executed by a processor, the computer program implements the peer-to-peer protocol-based access method provided in the embodiments of this application, the method being:

[0052] A Hypertext Transfer Protocol (HTTP) connection establishment request is initiated to the Control Plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet.

[0053] The system receives the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message.

[0054] Send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP;

[0055] Receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on Ethernet fed back by the UP.

[0056] A computer program product includes a computer program, characterized in that, when executed by a processor, the computer program implements the peer-to-peer protocol-based access method provided in the embodiments of this application, the method being:

[0057] The system receives an HTTP connection establishment request from a terminal and determines the UP among each UP based on the terminal service attribute information contained in the PADI information carried in the HTTP connection establishment request.

[0058] Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP;

[0059] During the authentication phase, the terminal is authenticated by the Authentication, Authorization and Accounting (AAA) node, and the authentication result is returned.

[0060] The aforementioned access method, apparatus, communication equipment, storage medium, and computer program products based on the point-to-point protocol initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP). The HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet. It receives the MAC address information of the user plane (UP) fed back by the CP and a Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane (UP). The user plane (UP) is determined by the CP based on the terminal's service attribute information contained in the PADI message. It sends a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP and receives a Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message over Ethernet fed back by the UP. Using this method, the terminal establishes a direct connection with the CP by sending a connection establishment request and receiving connection establishment information from the CP. The CP directly determines the UP, enabling a direct session establishment between the CP and the terminal. Only unicast occurs throughout the process, keeping the number of packets in the bearer network under control. Furthermore, the CP uniformly controls the entries in the MAC forwarding table and ARP table, solving the MAC address spoofing problem and improving the security of the point-to-point protocol-based access method. Attached Figure Description

[0061] Figure 1 This is an application environment diagram of an access method based on a point-to-point protocol in one embodiment;

[0062] Figure 2 This is a flowchart illustrating the process of a terminal executing an access method based on a point-to-point protocol in one embodiment.

[0063] Figure 3This is a flowchart illustrating the steps of terminal access control plane in one embodiment;

[0064] Figure 4 This is a flowchart illustrating the steps of sending a PADR message to the UP in one embodiment;

[0065] Figure 5 This is a flowchart illustrating the authentication negotiation steps performed by the terminal in one embodiment;

[0066] Figure 6 This is a flowchart illustrating the process of the control plane executing an access method based on a point-to-point protocol in one embodiment.

[0067] Figure 7 This is a signaling interaction flowchart of an access method based on a point-to-point protocol in one embodiment;

[0068] Figure 8 This is a schematic diagram of the device deployment for an access method based on a point-to-point protocol in one embodiment;

[0069] Figure 9 This is a structural block diagram of an access device based on a point-to-point protocol in one embodiment;

[0070] Figure 10 This is a structural block diagram of an access device based on a point-to-point protocol in another embodiment;

[0071] Figure 11 This is an internal structure diagram of an access device based on a point-to-point protocol in one embodiment;

[0072] Figure 12 This is an internal structure diagram of an access device based on a point-to-point protocol in another embodiment. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0074] Figure 1 This diagram illustrates an application scenario 100 of an access method based on a point-to-point protocol, as provided in an embodiment of this application. Figure 1As shown, this application scenario includes a terminal 110, a bearer network 120, a user plane pool (UP pool) 130, a control plane (CP) 140, and an AAA (Authentication, Authorization, Accounting) server 150. The bearer network 120 is deployed between the terminal 110 and the UP pool 130, and is used to transmit data between the terminal 110 and the UP pool 130. The UP pool 130 is formed by pooling multiple user planes (UPs) 131. The UP pool 130 communicates with the CP 140. The CP 140 communicates with the AAA server 150.

[0075] Terminal 110 is a wired terminal.

[0076] The bearer network 120 is located between the terminal 110 and the UP pool 130 and is used to transmit various voice and data services. It usually uses optical fiber as the transmission medium.

[0077] UP pool 130 contains multiple UP131s, which are used to transmit actual data.

[0078] CP140 is a network element; CP carries the data needed to create and control the network.

[0079] AAA server 150 is used to manage which users can access the network server, what services users with access rights can receive, and how to bill users who are using network resources.

[0080] It should be noted that the beneficial effects or technical problems solved by the embodiments of this application are not limited to this one, but may also be other implicit or related problems. For details, please refer to the description of the embodiments below.

[0081] The technical solution of this application and how it solves the above-mentioned technical problems will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0082] In one embodiment, such as Figure 2 As shown, an access method based on a point-to-point protocol is provided, which is then applied to... Figure 1 Taking terminal 110 (hereinafter referred to as "terminal") as an example, the following steps are included:

[0083] Step 202: Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP).

[0084] Among them, the HTTP connection establishment request carries the Point-to-Point Protocol Active Discovery (PADI) message over Ethernet.

[0085] In practice, the terminal powers on and starts up. Then, the terminal obtains network configuration information via Dynamic Host Configuration Protocol (DHCP). The terminal sends a PADI (PPPoE Active Discovery Initiation) message to the control plane CP in unicast form. Specifically, based on the network configuration information, the terminal initiates an HTTP (Hypertext Transfer Protocol) connection establishment request to the control plane CP.

[0086] Step 204: Receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet.

[0087] The User Plane (UP) is determined by the CP based on the terminal's service attribute information contained in the PADI message.

[0088] In implementation, the CP determines the User Plane UP from the UP pool based on the terminal's service attribute information contained in the PADI message. Then, the CP sends the MAC address information of the User Plane UP back to the terminal and also sends the terminal's MAC address information to the User Plane UP. The User Plane UP then sends a PPPoE Active Discovery Offer (PADO) message to the terminal based on the terminal's MAC address information. The terminal receives the User Plane UP's MAC address information from the CP and the PADO message sent by the User Plane UP. This PADO message contains the UP's source MAC address.

[0089] Step 206: Send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP.

[0090] In practice, the terminal initiates a service request to the UP, that is, the terminal sends a Point-to-Point Protocol Active Discovery Request (PADR) message to the target UP so that the target UP can understand the terminal's service request.

[0091] Step 208: Receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message from the UP on the Ethernet network.

[0092] In practice, after receiving the PADR message from the terminal, the UP will send a PADS (PPPoE Active Discovery Session-confirmation) message to the terminal. When the terminal receives the PADS message from the UP, it indicates that the terminal and UP have entered the PPP session phase.

[0093] In the aforementioned point-to-point protocol-based access method, the terminal establishes a direct connection with the CP by sending a connection establishment request to the CP and receiving connection establishment information from the CP. The CP directly determines the UP (Up) state, enabling a direct session between the CP and the terminal. Only unicast occurs throughout the process, keeping the number of packets in the bearer network under control. Furthermore, the CP uniformly controls the entries in the MAC forwarding table and ARP table, resolving the MAC address spoofing problem and improving the security of the point-to-point protocol-based access method.

[0094] In one embodiment, access to the CP is required before initiating an HTTP connection establishment request to the control plane. For example... Figure 3 As shown, before step 202 is executed, the access method based on the point-to-point protocol may further include:

[0095] Step 302: Obtain network configuration information through Dynamic Host Configuration Protocol.

[0096] The network configuration information includes the management address, Domain Name System (DNS) server, and Uniform Resource Locator (URL).

[0097] In practice, the terminal obtains the CP's management address, Domain Name System (DNS) server, and Uniform Resource Locator (URL) through DHCP (Dynamic Host Configuration Protocol).

[0098] Step 304: Based on the URL information of the DNS resolution control plane CP in the network configuration information, obtain the Internet Protocol IP address of the CP, and connect and communicate with the CP based on the CP's IP address.

[0099] In practice, the terminal resolves the URL information of the control plane CP (Content Provider) based on the Domain Name System (DNS) server information in the network configuration information to obtain the CP's IP (Internet Protocol) address. Then, based on the CP's IP address, the terminal accesses the CP for network access and communication control. After completing the connection between the terminal and the CP, the terminal initiates an HTTP connection establishment request to the CP, carrying PADI message information.

[0100] Specifically, the terminal sends a query request to the DNS to resolve the CP's domain name. Upon receiving the query request, the DNS matches the queried CP's domain name with the CP's corresponding IP address. If the configured DNS server has a DNS record related to the CP's domain name, it returns the CP's IP address. Then, based on the management address and the CP's IP address, the terminal accesses the CP for network access and communication control.

[0101] In this embodiment, the IP address of the CP is obtained by acquiring and parsing the network configuration information. Access to the CP based on its IP address enables communication between the terminal and the CP, facilitating subsequent communication with the CP.

[0102] In one embodiment, the specific processing procedure of step 202 may include:

[0103] An HTTP connection establishment request is initiated to the CP based on the URL information.

[0104] In practice, the terminal obtains the CP's URL information. Then, based on the management address and the CP's IP address obtained from the URL resolution, the terminal accesses the control plane for network access and communication control. After the terminal connects to the CP, it sends PADI messages to the CP via HTTP.

[0105] In this embodiment, the terminal first establishes an IP communication connection with the CP. Then, it sends PADI messages to the CP via HTTP, enabling the PADI messages to be transmitted in a unicast manner. This avoids the terminal broadcasting messages, keeping the number of messages in the bearer network under control and improving the security of the point-to-point protocol-based access method.

[0106] In one embodiment, such as Figure 4 As shown, the specific processing steps of this peer-to-peer protocol-based access method may further include:

[0107] Step 402: Determine whether the source media access control address (MAC address) in the PADO message is consistent with the UP MAC address fed back by the control plane.

[0108] In practice, the terminal determines whether the source MAC (Media Access Control Address) address contained in the PADO message is consistent with the MAC address of the selected UP fed back to the terminal by the CP.

[0109] Step 404: If the source MAC address in the PADO message matches the MAC address of the UP fed back from the control plane, send a PADR message to the UP.

[0110] In practice, if the source MAC address contained in the PADO message matches the MAC address of the selected UP fed back to the terminal by the CP, the terminal determines the UP's MAC address. Then, the terminal sends a PADR message to the UP based on the UP's MAC address.

[0111] In this embodiment, the MAC address of the UP is verified by determining whether the source MAC address contained in the PADO message matches the MAC address of the selected UP fed back to the terminal by the CP. Based on the UP's MAC address, a PADR message is sent to request service from the UP.

[0112] In one embodiment, after sending the PADR message, the UP will send a PADS message back to the terminal. Upon receiving the PADS message, the terminal indicates that it has entered the PPP session phase, requiring PPP (Point-to-Point Protocol) negotiation with the target UP and CP. This includes three phases: LCP (Link Control Protocol) negotiation, PAPPASSWORD / CHAP (Challenge Handshake Authentication Protocol) authentication negotiation, and NCP (Network Control Protocol) negotiation. Figure 5 As shown, after step 208 is executed, the specific processing steps of this point-to-point protocol-based access method may further include:

[0113] Step 502: Negotiate the Link Control Protocol (LCP) with UP and CP.

[0114] In implementation, the terminal negotiates LCP (Link Control Protocol) with UP and CP, and negotiates link parameters through LCP message exchange, including MRU (Maximum-Transfer-Unit), authentication protocol, magic word and other parameter information, in order to complete the establishment and configuration of data link layer connection.

[0115] Step 504: Perform password authentication protocol PAP or challenge handshake authentication protocol CHAP authentication with CP.

[0116] In implementation, the terminal and the CP perform authentication using either Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) to verify the terminal's identity and establish a secure connection.

[0117] Step 506: Negotiate the Internet Protocol Control Protocol (IPCP) with the UP.

[0118] IPCP (IP Control Protocol) is a common protocol in the NCP negotiation phase, used to negotiate and configure IP parameters for network interfaces. It is primarily responsible for negotiating IP parameters such as IP addresses, IP packet compression formats, and domain name server IP addresses between the terminal device and the UP device during PPP connection establishment.

[0119] In practice, the terminal and the UP negotiate network layer parameters, including IP address, IP packet compression format, and domain name server IP address, through IPCP message exchange. This completes the negotiation and configuration of the network layer, enabling the terminal to obtain the IP address for accessing the network and complete the online access for the terminal user.

[0120] In this embodiment, by negotiating LCP and IPCP with the target UP, the configuration of the network interface and link parameters are confirmed, enabling communication between the link layer and IP layer between the target UP and the terminal. PAP or CHAP authentication with the CP completes the authentication of the terminal user's identity.

[0121] In one embodiment, an access method based on a point-to-point protocol is provided, which is applied to... Figure 1 Taking CP140 (hereinafter, CP designations are omitted) as an example, for instance... Figure 6 As shown, it includes the following steps:

[0122] Step 602: Receive the HTTP connection establishment request sent by the terminal, and determine the UP among each UP based on the terminal service attribute information contained in the PADI information carried in the HTTP connection establishment request.

[0123] PADI information can be carried via HTTP. PADI messages contain the service attribute information requested by the terminal.

[0124] In implementation, the CP receives PADI messages in unicast format carried by HTTP from the terminal. The CP then determines the UP (UP) from each UP pool based on the terminal's service attribute information.

[0125] Step 604: Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP.

[0126] In implementation, the CP determines the UP's MAC address. Then, the CP sends the UP's MAC address to the terminal. Then, the CP sends the terminal's MAC address to the UP.

[0127] Step 606: During the authentication phase, the terminal is authenticated through the Authentication, Authorization and Accounting (AAA) node, and the authentication result is returned.

[0128] In implementation, the CP sends user authentication information to the Authentication, Authorization and Accounting (AAA) node, which authenticates the user authentication information and feeds back the authentication result to the control plane.

[0129] In this embodiment, the terminal establishes a connection with the CP. The CP receives the PADI information carried by the HTTP connection sent by the terminal. The CP directly selects and determines the UP, enabling a session to be established between the UP and the terminal. Only unicast occurs throughout the entire process, keeping the number of packets in the bearer network under control. Furthermore, the CP uniformly controls the entries in the MAC forwarding table and ARP table, resolving the MAC address spoofing problem and improving the security of the point-to-point protocol-based access method.

[0130] In one embodiment, Figure 7 A signaling interaction flowchart for an access method based on a point-to-point protocol is provided. (Example) Figure 7 As shown, the method includes the following steps.

[0131] 1. Upon powering on, the terminal obtains network configuration information via DHCP. This network configuration information includes the management address, DNS, and URL information.

[0132] 2. The terminal accesses the CP via a URL and initiates an HTTP connection establishment request. The HTTP connection establishment request carries PADI message information.

[0133] 3. The CP selects the target UP based on the terminal service attributes;

[0134] 4. The CP returns a connection establishment message and sends the MAC address of the target UP to the terminal.

[0135] 5. The CP sends the terminal MAC information to the target UP.

[0136] 6. The target UP responds to the terminal with a PADO message.

[0137] 7. The terminal verifies the MAC information of the UP, sends a PADR message to the selected UP, and initiates a service request.

[0138] 8. The target UP returns a PADS message, and the session is established.

[0139] 9. The terminal negotiates LCP with the target UP, and the CP negotiates LCP with the target UP.

[0140] 10. The terminal performs PAP / CHAP authentication with the CP and sends it to the AAA node for authentication.

[0141] 11. The terminal negotiates IPCP with the target UP, and the CP negotiates IPCP with the target UP.

[0142] In one embodiment, Figure 8 This is a schematic diagram illustrating the deployment of a device using a point-to-point protocol-based access method. For example... Figure 8 As shown, traditional home broadband services include internet access and VoIP (Voice over Internet Protocol) services. Currently, the existing network uses pUP (physical User Plane) to carry home broadband internet access services and vUP (virtual User Plane) to carry VoIP services. For new service requests from terminals, PADI message information is sent to the CP (Content Provider) via an HTTP connection. The CP selects the relevant UP based on the service attribute. Therefore, a unified L2VPN (Layer 2 Virtual Private Network) channel can be pre-established on the bearer network, and all services share this L2VPN. When a new service comes in, there is no need to deploy a new VPN on the bearer network. Therefore, the point-to-point protocol-based access method has good service scalability and reduces the deployment difficulty of the bearer network.

[0143] It should be understood that, although Figure 2-6 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2-6 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0144] In one embodiment, such as Figure 9As shown, an access device 900 based on a point-to-point protocol is provided, comprising: a first transmitting module 901, a first receiving module 902, a second transmitting module 903, and a second receiving module 904, wherein:

[0145] The first sending module 901 is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message on the Ethernet.

[0146] The first receiving module 902 is used to receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message.

[0147] The second sending module 903 is used to send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP.

[0148] The second receiving module 904 is used to receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message fed back by the UP on the Ethernet network.

[0149] In one exemplary embodiment, the peer-to-peer protocol-based access device 900 further includes:

[0150] The first acquisition module is used to obtain network configuration information through the Dynamic Host Configuration Protocol (DHCP); the network configuration information includes the management address, Domain Name System (DNS) server, and Uniform Resource Locator (URL).

[0151] The first resolution module is used to obtain the Internet Protocol IP address of the CP based on the URL information of the DNS resolution control plane CP in the network configuration information, and to access and communicate with the CP based on the CP's IP address.

[0152] In one exemplary embodiment, the first transmitting module 901 includes:

[0153] The first sending submodule is used to initiate an HTTP connection establishment request to the CP based on the URL information.

[0154] In one exemplary embodiment, the peer-to-peer protocol-based access device 900 further includes:

[0155] The first judgment module is used to determine whether the source media access control address (MAC address) in the PADO message is consistent with the UP MAC address fed back by the control plane.

[0156] The third sending module is used to send a PADR message to the UP if the source MAC address in the PADO message matches the UP MAC address fed back from the control plane.

[0157] In one exemplary embodiment, the peer-to-peer protocol-based access device 900 further includes:

[0158] The first negotiation module is used to negotiate the Link Control Protocol (LCP) with the UP and CP.

[0159] The first authentication module is used for authentication with CP using either the Password Authentication Protocol (PAP) or the Challenge Handshake Authentication Protocol (CHAP).

[0160] The second negotiation module is used to negotiate the IP Control Protocol (IPCP) with the UP.

[0161] In one embodiment, such as Figure 10 As shown, an access device 1000 based on a point-to-point protocol is provided, including: a determination module 1001, a sending module 1002, and an authentication module 1003, wherein:

[0162] The determination module 1001 is used to receive the HTTP connection establishment request sent by the terminal and determine the UP among each UP based on the terminal service attribute information contained in the PADI information carried in the HTTP connection establishment request.

[0163] The sending module 1002 is used to send the MAC address of the UP to the terminal and send the MAC address of the terminal to the UP.

[0164] The authentication module 1003 is used to authenticate the terminal through the authentication authorization and accounting AAA node during the authentication phase and return the authentication result.

[0165] Specific limitations regarding access devices based on the peer-to-peer protocol can be found in the limitations of access methods based on the peer-to-peer protocol described above, and will not be repeated here. Each module in the aforementioned peer-to-peer protocol-based access device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0166] In one embodiment, a communication device is provided, see [link to previous document]. Figure 11 . Figure 11 This is a schematic diagram of the structure of the terminal device provided in an embodiment of the present invention. Figure 11The terminal device 1100 shown includes at least one processor 1101, a memory 1102, at least one network interface 1104, and a user interface 1103. The various components in the terminal device 1100 are coupled together via a bus system 1105. It is understood that the bus system 1105 is used to implement communication between these components. In addition to a data bus, the bus system 1105 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 11 Various buses are designated as bus system 1105. Additionally, this embodiment of the invention includes a transceiver 1106, which may consist of multiple components, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium.

[0167] The user interface 1103 may include a display, keyboard, or clicking device (e.g., mouse, trackball, touchpad, or touchscreen).

[0168] It is understood that the memory 1102 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 1102 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0169] In some implementations, memory 1102 stores elements, executable modules or data structures, or subsets thereof, or extended sets thereof: operating system 11021 and application program 11022.

[0170] The operating system 11021 includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application program 11022 includes various applications, such as a media player and a browser, used to implement various application functions. The program implementing the method of this embodiment can be included in the application program 11022.

[0171] In this embodiment of the invention, by calling the program or instructions stored in memory 1102, specifically the program or instructions stored in application program 11022, the transmitter is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message on Ethernet; and sends a Point-to-Point Protocol Active Discovery Request (PADR) message on Ethernet to the UP; the receiver is used to receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message on Ethernet sent by the user plane UP; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADI message; and receives the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on Ethernet fed back by the UP.

[0172] The methods disclosed in the above embodiments of the present invention, in part or in all of them, can also be applied to processor 1101, implemented by processor 1101, or implemented by processor 1101 in conjunction with other components (e.g., a transceiver). Processor 1101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above methods can be completed by the integrated logic circuit of the hardware in processor 1101 or by instructions in the form of software. The processor 1101 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 1102. Processor 1101 reads the information in memory 1102 and, in conjunction with its hardware, completes the steps of the above method.

[0173] Figure 12 This is a schematic diagram of the control plane provided in an embodiment of the present invention. Figure 12 The access network device 1200 shown includes at least one processor 1201, a memory 1202, and at least one network interface 1204. The various components in the access network device 1200 are coupled together via a bus system 1205. It is understood that the bus system 1205 is used to implement communication between these components. In addition to a data bus, the bus system 1205 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 12 Various buses are designated as bus system 1205. Additionally, this embodiment of the invention includes a transceiver 1206, which may consist of multiple components, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium.

[0174] It is understood that the memory 1202 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 1202 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0175] In some implementations, memory 1202 stores elements such as executable modules or data structures, or subsets thereof, or extended sets thereof: operating system 12021. Operating system 12021 includes various system programs, such as a framework layer, core library layer, driver layer, etc., used to implement various basic business functions and handle hardware-based tasks.

[0176] In this embodiment of the invention, by calling the program or instructions stored in the memory 1202, the transmitter is configured to send the MAC address of the UP to the terminal and send the MAC address of the terminal to the UP; the processor is configured to authenticate the terminal through the Authentication, Authorization and Accounting (AAA) node during the authentication phase and return the authentication result; the receiver is configured to receive the HTTP connection establishment request sent by the terminal and determine the UP among the UPs according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request.

[0177] The methods disclosed in the above embodiments of the present invention, in part or in all, can also be applied to processor 1201, implemented by processor 1201, or implemented by processor 1201 in conjunction with other components (e.g., transceivers). Processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above methods can be completed by the integrated logic circuit of the hardware in processor 1201 or by instructions in the form of software. The processor 1201 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 1202. The processor 1201 reads the information in memory 1202 and, in conjunction with its hardware, completes the steps of the above method.

[0178] It is understood that the embodiments described in these embodiments of the present invention can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions of this application, or combinations thereof.

[0179] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0180] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0181] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0182] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0183] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An access method based on a point-to-point protocol, characterized in that, The method is applied to a terminal, and the method includes: A Hypertext Transfer Protocol (HTTP) connection establishment request is initiated to the Control Plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet; the PADI message is sent to the CP in unicast form; The system receives the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message. Send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP; Receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on Ethernet fed back by the UP.

2. The method according to claim 1, characterized in that, Before initiating the Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP), the method further includes: Network configuration information is obtained through Dynamic Host Configuration Protocol (DHCP); the network configuration information includes management address, Domain Name System (DNS) server, and Uniform Resource Locator (URL). Based on the URL information of the DNS resolution control plane (CP) in the network configuration information, the Internet Protocol (IP) address of the CP is obtained, and the CP is accessed and interconnected based on the IP address of the CP.

3. The method according to claim 1, characterized in that, The step of initiating a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP) includes: An HTTP connection establishment request is initiated to the CP based on the URL information.

4. The method according to claim 1, characterized in that, The method further includes: Determine whether the source media access control address (MAC address) in the PADO message is consistent with the UP MAC address fed back by the control plane; If the source MAC address in the PADO message matches the MAC address of the UP reported by the control plane, a PADR message is sent to the UP.

5. The method according to claim 1, characterized in that, After receiving the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on Ethernet fed back by the UP, the method further includes: Negotiate Link Control Protocol (LCP) with the UP and CP; The CP is authenticated using either the Password Authentication Protocol (PAP) or the Challenge Handshake Authentication Protocol (CHAP). Negotiate the IP Control Protocol (IPCP) with the UP.

6. An access method based on a point-to-point protocol, characterized in that, The method is applied to the control plane, and the method includes: The system receives an HTTP connection establishment request from a terminal and determines the UP (Uploader) among all UPs based on the terminal service attribute information contained in the PADI (Packet Access Request) information carried in the HTTP connection establishment request; the PADI information is sent by the terminal to the control plane in the form of unicast. Send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP; During the authentication phase, the terminal is authenticated by the Authentication, Authorization and Accounting (AAA) node, and the authentication result is returned.

7. An access device based on a point-to-point protocol, characterized in that, The device is used in a terminal, and the device includes: The first sending module is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP); the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message on the Ethernet; the PADI message is sent to the CP in unicast form. The first receiving module is used to receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet; the user plane UP is determined by the CP based on the service attribute information of the terminal contained in the PADO message; The second sending module is used to send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the UP. The second receiving module is used to receive the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message fed back by the UP on the Ethernet network.

8. An access device based on a point-to-point protocol, characterized in that, The device is applied to a control plane, and the device includes: The determination module is used to receive an HTTP connection establishment request sent by the terminal, and determine the UP among each UP based on the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request; the PADI information is sent by the terminal to the control plane in the form of unicast. A sending module is used to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP; The authentication module is used to authenticate the terminal through the Authentication, Authorization and Accounting (AAA) node during the authentication phase and return the authentication result.

9. A communication device, characterized in that, include: Transmitter and receiver; The transmitter is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP). The HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery (PADI) message over Ethernet. Send a Point-to-Point Protocol Active Discovery Request (PADI) message over Ethernet to the UP; the PADI message is sent to the CP in unicast form; The receiver is used to receive the MAC address information of the user plane UP fed back by the CP and the Point-to-Point Protocol Active Discovery Service (PADO) message sent by the user plane UP over Ethernet. The User Plane (UP) is determined by the CP based on the terminal's service attribute information contained in the PADI message; the CP receives the Point-to-Point Protocol Active Discovery Session Acknowledgment (PADS) message on Ethernet fed back by the UP.

10. A communication device, characterized in that, include: Transmitter, processor, and receiver; The receiver is used to receive the HTTP connection establishment request sent by the terminal, and determine the UP among each UP according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request. The PADI information is sent by the terminal to the control plane in the form of unicast; The transmitter is used to send the MAC address of the UP to the terminal, and send the MAC address of the terminal to the UP; The processor is used to authenticate the terminal through the Authentication, Authorization and Accounting (AAA) node during the authentication phase and return the authentication result.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5 or 6.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5 or 6.

Images