Point-to-point protocol-based access method, apparatus, communication device and storage medium

Abstract

The present application relates to a point-to-point protocol-based access method, an apparatus, a communication device, a storage medium and a computer program product. The method comprises: initiating a hypertext transfer protocol (HTTP) connection establishment request to a control plane (CP), the HTTP connection establishment request carrying a point-to-point protocol over Ethernet active discovery initiation (PADI) message; receiving MAC address information of a user plane (UP) fed back by the control plane (CP) and a point-to-point protocol over Ethernet active discovery offer (PADO) message sent by the user plane (UP), the user plane (UP) being determined by the control plane (CP) on the basis of service attribute information of a terminal contained in the PADI message; sending a point-to-point protocol over Ethernet active discovery request (PADR) message to the user plane (UP); and receiving a point-to-point protocol over Ethernet active discovery session confirmation (PADS) message fed back by the user plane (UP). Using the present method can improve the security of point-to-point protocol-based access methods.

Description

Access method, device, communication equipment and storage medium based on point-to-point protocol

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 202311809569.8, filed on December 26, 2023, entitled “Access method, device, communication equipment and storage medium based on point-to-point protocol,” the entire text of which is hereby incorporated by reference. Technical Field

[0003] The present application relates to the field of communication security technology, and in particular to an access method, apparatus, communication equipment, storage medium, and computer program product based on a point-to-point protocol. Background Art

[0004] Under the separation of the control plane and user plane (CU) of the broadband access server (BRAS), as defined in IETF RFC8772 (a voice communication protocol), Point-to-Point Protocol over Ethernet (PPPoE) access is terminated by the user plane (UP). The terminal sends PPPoE packets to the access network via the link layer (L2). The access network encapsulates the packets and sends them to the bearer network for routing and forwarding. The BRAS decapsulates the packets and performs user authentication, connection management, and service provisioning, enabling access and connection management for Point-to-Point Protocol (PPP) services.

[0005] Due to the UP pooled deployment, user plane functions are separated from core devices and centrally deployed as a pool of resources. The control plane (CP) functions are deployed in an independent controller device, and the control plane is used as an independent entity to manage various control tasks in the network. The transport network (TN) is deployed between the access network (including the terminal side) and the UP, and the PPPoE Active Discovery Initiation (PADI) message for PPPoE access is carried in a Layer 2 broadcast message. When attacks such as Media Access Control Address (MAC) flooding and Address Resolution Protocol (ARP) flooding occur on the terminal side, a large number of broadcast messages will be present in the bearer network, causing a broadcast storm. MAC address spoofing may also occur on the terminal side, which brings Layer 2 network protocol (L2) security issues to the bearer network.

[0006] Summary of the Invention

[0007] In view of this, the embodiments of the present application provide an access method, apparatus, communication equipment, storage medium and computer program product based on a point-to-point protocol, which controls the number of broadcast messages in the bearer network, solves the MAC address spoofing problem on the terminal side and the security problem of the bearer network.

[0008] In a first aspect, the present application provides an access method based on a point-to-point protocol, the method being applied to a terminal, the method comprising:

[0009] Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery (PADI) start message on Ethernet;

[0010] Receiving MAC address information of a user plane UP fed back by the control plane CP and a Point-to-Point Protocol Active Discovery Service (PADO) message over Ethernet sent by the user plane UP; the user plane UP is determined by the control plane CP according to service attribute information of the terminal included in the PADO message;

[0011] Sending a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the user plane UP;

[0012] Receive a Point-to-Point Protocol Active Discovery Session Confirmation PADS message on Ethernet fed back by the user plane UP.

[0013] In one embodiment, before initiating a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP, the method further includes:

[0014] Obtaining network configuration information through the Dynamic Host Configuration Protocol; the network configuration information includes a management address, a domain name system server DNS, and a uniform resource locator URL;

[0015] The URL information of the control plane CP is resolved based on the DNS in the network configuration information to obtain the Internet Protocol IP address of the control plane CP, and the control plane CP is connected and communicated with based on the IP address of the control plane CP.

[0016] In one embodiment, the initiating a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP includes:

[0017] An HTTP connection establishment request is initiated to the control plane CP based on the URL information.

[0018] In one embodiment, the method further comprises:

[0019] Determine whether the source media access control MAC address in the PADO message is consistent with the user plane UP MAC address fed back by the control plane CP;

[0020] If the source MAC address in the PADO message is consistent with the MAC address of the user plane UP fed back by the control plane CP, a PADR message is sent to the user plane UP.

[0021] In one embodiment, after receiving the Point-to-Point Protocol Active Discovery Session Confirmation PADS message fed back by the user plane UP, the method further includes:

[0022] Performing Link Control Protocol (LCP) negotiation with the user plane (UP) and control plane (CP);

[0023] Performing Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the control plane CP;

[0024] Perform IP control protocol IPCP negotiation with the user plane UP.

[0025] In a second aspect, the present application provides a point-to-point protocol-based access method, which is applied to a control plane (CP). The method includes:

[0026] Receive an HTTP connection establishment request sent by a terminal, and determine a user plane UP in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request;

[0027] Sending the MAC address of the user plane UP to the terminal, and sending the MAC address of the terminal to the user plane UP;

[0028] During the authentication phase, the terminal is authenticated by the authentication, authorization, and accounting AAA nodes, and the authentication result is returned.

[0029] In a third aspect, the present application provides an access device based on a point-to-point protocol, the device comprising:

[0030] The first sending module is used to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery (PADI) start message on Ethernet;

[0031] A first receiving module is configured to receive MAC address information of a user plane UP fed back by the control plane CP and a Point-to-Point Protocol Active Discovery Service (PADO) message over Ethernet sent by the user plane UP; the user plane UP is determined by the control plane CP according to service attribute information of the terminal included in the PADO message;

[0032] The second sending module is used to send a Point-to-Point Protocol Active Discovery Request PADR message on Ethernet to the user plane UP;

[0033] The second receiving module is configured to receive a Point-to-Point Protocol Active Discovery Session Confirmation PADS message on Ethernet fed back by the user plane UP.

[0034] In a fourth aspect, the present application provides an access device based on a point-to-point protocol, the device comprising:

[0035] A determination module, configured to receive an HTTP connection establishment request sent by a terminal, and determine a user plane UP in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request;

[0036] a sending module, configured to send the MAC address of the user plane UP to the terminal, and send the MAC address of the terminal to the user plane UP;

[0037] The authentication module is used to authenticate the terminal through the authentication authorization and accounting AAA node during the authentication phase and return the authentication result.

[0038] In a fifth aspect, the present application provides a communication device, comprising: a transmitter and a receiver;

[0039] The transmitter is configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet (PADI) active discovery initiation message; and sends a Point-to-Point Protocol over Ethernet (PADR) active discovery request message to the user plane UP;

[0040] The receiver is configured to receive the MAC address information of the user plane UP fed back by the control plane CP and the Point-to-Point Protocol Active Discovery Service PADO message on Ethernet sent by the user plane UP; the user plane UP is determined by the control plane CP according to the service attribute information of the terminal contained in the PADI message; and receive the Point-to-Point Protocol Active Discovery Session Confirmation PADS message on Ethernet fed back by the user plane UP.

[0041] In a sixth aspect, the present application provides a communication device, including: a transmitter, a processor, and a receiver;

[0042] The receiver is configured to receive an HTTP connection establishment request sent by a terminal, and determine a user plane UP in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request;

[0043] The transmitter is configured to send the MAC address of the user plane UP to the terminal, and send the MAC address of the terminal to the user plane UP;

[0044] The processor is used to authenticate the terminal through the authentication authorization and accounting AAA node during the authentication phase and return the authentication result.

[0045] In a seventh aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0046] Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery (PADI) start message on Ethernet;

[0047] Receiving MAC address information of a user plane UP fed back by the control plane CP and a Point-to-Point Protocol Active Discovery Service (PADO) message over Ethernet sent by the user plane UP; the user plane UP is determined by the control plane CP according to service attribute information of the terminal included in the PADO message;

[0048] Sending a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the user plane UP;

[0049] Receive a Point-to-Point Protocol Active Discovery Session Confirmation PADS message on Ethernet fed back by the user plane UP.

[0050] In an eighth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0051] Receive an HTTP connection establishment request sent by a terminal, and determine a user plane UP in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request;

[0052] Sending the MAC address of the user plane UP to the terminal, and sending the MAC address of the terminal to the user plane UP;

[0053] During the authentication phase, the terminal is authenticated by the authentication, authorization, and accounting AAA nodes, and the authentication result is returned.

[0054] In a ninth aspect, the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the point-to-point protocol-based access method provided in an embodiment of the present application is implemented. The method may include the following steps:

[0055] Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery (PADI) start message on Ethernet;

[0056] Receiving MAC address information of a user plane UP fed back by the control plane CP and a Point-to-Point Protocol Active Discovery Service (PADO) message over Ethernet sent by the user plane UP; the user plane UP is determined by the control plane CP according to service attribute information of the terminal included in the PADO message;

[0057] Sending a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the user plane UP;

[0058] Receive a Point-to-Point Protocol Active Discovery Session Confirmation PADS message on Ethernet fed back by the user plane UP.

[0059] In a tenth aspect, the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the point-to-point protocol-based access method provided in an embodiment of the present application is implemented. The method may include the following steps:

[0060] Receive an HTTP connection establishment request sent by a terminal, and determine a user plane UP in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request;

[0061] Sending the MAC address of the user plane UP to the terminal, and sending the MAC address of the terminal to the user plane UP;

[0062] During the authentication phase, the terminal is authenticated by the authentication, authorization, and accounting AAA nodes, and the authentication result is returned.

[0063] The aforementioned Point-to-Point Protocol (P2P)-based access method, apparatus, communication device, storage medium, and computer program product initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to a control plane (CP). This HTTP connection establishment request carries a Point-to-Point Protocol over Ethernet (PoE) Active Discovery Initiation (PADI) message. The method receives MAC address information of a user plane (UP) and a Point-to-Point Protocol over Ethernet (PoE) Active Discovery Service (PADO) message from the user plane (UP) as feedback from the CP. The user plane (UP) is determined by the CP based on the terminal's service attribute information contained in the PADI message. A Point-to-Point Protocol over Ethernet (PoE) Active Discovery Request (PADR) message is sent to the UP. Finally, a Point-to-Point Protocol over Ethernet (PoE) Active Discovery Session Confirmation (PADS) message is received from the UP as feedback. Using this method, a terminal directly establishes a connection with the CP by sending a connection establishment request to the CP and receiving connection establishment information from the CP. The CP directly determines the PoE, enabling a direct session between the CP and the terminal. Unicast traffic is the only unicast process, keeping the number of messages in the bearer network under control. Furthermore, the CP uniformly controls entries in the MAC forwarding table and ARP table, addressing MAC address spoofing and improving the security of the P2P-based access method. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technology descriptions. Obviously, the drawings described below are only some embodiments of this application. For those of ordinary skill in the art, other drawings can be derived from these drawings without inventive effort.

[0065] FIG1 is a diagram showing an application environment of an access method based on a point-to-point protocol in an embodiment of the present application.

[0066] FIG2 is a flow chart of a terminal executing an access method based on a point-to-point protocol in an embodiment of the present application.

[0067] FIG3 is a flow chart of the steps of terminal accessing the control plane in one embodiment of the present application.

[0068] FIG4 is a flow chart showing the steps of sending a PADR message to a user plane UP in an embodiment of the present application.

[0069] FIG5 is a flow chart of authentication negotiation steps performed by a terminal in an embodiment of the present application.

[0070] FIG6 is a flow chart of a control plane executing an access method based on a point-to-point protocol in an embodiment of the present application.

[0071] FIG7 is a signaling interaction flow chart of an access method based on a point-to-point protocol in an embodiment of the present application.

[0072] FIG8 is a schematic diagram of device deployment of an access method based on a point-to-point protocol in an embodiment of the present application.

[0073] FIG9 is a structural block diagram of an access device based on a point-to-point protocol in an embodiment of the present application.

[0074] FIG10 is a structural block diagram of an access device based on a point-to-point protocol in another embodiment of the present application.

[0075] FIG11 is a diagram showing the internal structure of an access device based on a point-to-point protocol in an embodiment of the present application.

[0076] FIG12 is a diagram showing the internal structure of an access device based on a point-to-point protocol in another embodiment of the present application. DETAILED DESCRIPTION

[0077] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0078] Figure 1 is a schematic diagram of an application scenario of an access method based on a point-to-point protocol provided in an embodiment of the present application. As shown in Figure 1, the application scenario includes a terminal 110, a bearer network 120, a user plane pool (UP pool) 130, a control plane (CP) 140, and an authentication, authorization, and accounting (AAA) server 150. A bearer network 120 is deployed between the terminal 110 and the UP pool 130, and the bearer network 120 is used to transmit data between the terminal 110 and the UP pool 130. The UP pool 130 is obtained by pooling multiple user planes (UP) 131. The UP pool 130 is connected to the CP 140 in communication. The CP 140 is connected to the AAA server 150 in communication.

[0079] Terminal 110 is a wired terminal.

[0080] The bearer network 120 is located between the terminal 110 and the UP pool 130 and is used to transmit various voice and data services. It usually uses optical fiber as a transmission medium.

[0081] The UP pool 130 includes multiple UPs 131 , which are used to transmit actual data.

[0082] CP140 is an element of the network and carries the data required to create and control the network.

[0083] The AAA server 150 is used to manage which users can access the network server, which services the users with access rights can obtain, and how to bill the users who are using network resources.

[0084] It should be noted that the beneficial effects or technical problems solved by the embodiments of the present application are not limited to this one, but may also include other implicit or related problems. For details, please refer to the description of the following embodiments.

[0085] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0086] In one embodiment, as shown in FIG2 , a point-to-point protocol-based access method is provided. The method is described by applying the method to the terminal 110 (hereinafter referred to as the terminal) in FIG1 as an example, including the following steps S202 to S208 .

[0087] Step S202: Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP.

[0088] The HTTP connection establishment request carries the Point-to-Point Protocol Active Discovery (PADI) initiation message over Ethernet.

[0089] During implementation, the terminal is powered on and booted. It then obtains network configuration information through the Dynamic Host Configuration Protocol (DHCP). The terminal then sends a unicast PPPoE Active Discovery Initiation (PADI) message to the control plane (CP). Specifically, based on the network configuration information, the terminal initiates a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP).

[0090] Step S204: receiving the MAC address information of the user plane UP fed back by the control plane CP and the Point-to-Point Protocol Active Discovery Service PADO message on Ethernet sent by the user plane UP.

[0091] The user plane UP is determined by the control plane CP according to the service attribute information of the terminal contained in the PADI message.

[0092] In implementation, the control plane CP determines a user plane UP from the UP pool based on the terminal's service attribute information contained in the PADI message. The control plane CP then feeds back the MAC address information of the user plane UP to the terminal and sends the terminal's MAC address information to the user plane UP. The user plane UP sends a PPPoE Active Discovery Offer (PADO) message to the terminal based on the terminal's MAC address information. The terminal receives the MAC address information of the user plane UP fed back by the control plane CP and the PPPoE Active Discovery Offer (PADO) message sent by the user plane UP. The PADO message contains the source MAC address of the user plane UP.

[0093] Step S206: Sending a Point-to-Point Protocol Active Discovery Request (PADR) message on Ethernet to the user plane UP.

[0094] In implementation, the terminal initiates a service request to the user plane UP, that is, the terminal sends a PPPoE Active Discovery Request (PADR) message to the target user plane UP, so that the target user plane UP knows the service request of the terminal.

[0095] Step S208: Receive a PPPoE Active Discovery Session-confirmation (PADS) message fed back by the user plane UP.

[0096] In practice, after receiving the PADR message from the terminal, the user plane UP sends a Point-to-Point Protocol Active Discovery Session Confirmation (PADS) message to the terminal. Receiving the PADS message from the user plane UP indicates that the terminal and the user plane UP have entered the PPP session phase.

[0097] In the aforementioned point-to-point protocol-based access method, a terminal establishes a direct connection with the control plane CP by sending a connection establishment request to the control plane CP and receiving connection establishment information from the control plane CP. The control plane CP directly determines the user plane UP, enabling a direct session between the control plane CP and the terminal. Unicast traffic is the only mechanism used throughout the process, keeping the number of messages in the bearer network under control. Furthermore, the control plane CP uniformly controls entries in the MAC forwarding table and ARP table, addressing MAC address spoofing and enhancing the security of the point-to-point protocol-based access method.

[0098] In one embodiment, before initiating an HTTP connection establishment request to the control plane CP, it is necessary to first access the control plane CP. As shown in FIG3 , before executing step S202 , the point-to-point protocol-based access method may further include steps S302 to S304 .

[0099] Step S302: Acquire network configuration information through the Dynamic Host Configuration Protocol.

[0100] The network configuration information includes a management address, a domain name system server DNS, and a uniform resource locator URL.

[0101] In implementation, the terminal obtains the management address of the control plane CP, the Domain Name System (DNS) server, and the Uniform Resource Locator (URL) through the Dynamic Host Configuration Protocol (DHCP).

[0102] Step S304: Resolve the URL of the control plane CP based on the DNS in the network configuration information to obtain the Internet Protocol IP address of the control plane CP, and establish access and communication with the control plane CP based on the IP address of the control plane CP.

[0103] In practice, the terminal resolves the control plane CP's URL using the Domain Name System (DNS) server in the network configuration information to obtain the control plane CP's Internet Protocol (IP) address. The terminal then connects to the control plane CP based on the control plane CP's IP address for network access and communication control. After establishing connection with the control plane CP, the terminal initiates an HTTP connection establishment request to the control plane CP, carrying the PADI message information.

[0104] Specifically, the terminal sends a query request to the DNS server, requesting resolution of the control plane CP's domain name. Upon receiving the query, the DNS server matches the queried control plane CP domain name with the CP's corresponding IP address. If the configured DNS server has a resolution record for the control plane CP's domain name, it returns the control plane CP's IP address. The terminal then connects to the control plane CP based on the management address and the control plane CP's IP address for network access and communication control.

[0105] In this embodiment, the IP address of the control plane CP is obtained by acquiring and parsing the network configuration information. The control plane CP is accessed based on the IP address of the control plane CP, enabling intercommunication between the terminal and the control plane CP and facilitating subsequent communication with the control plane CP.

[0106] In one embodiment, step S202 may specifically include:

[0107] Initiate an HTTP connection establishment request to the control plane CP based on the URL information.

[0108] In practice, the terminal obtains the URL of the control plane CP. Then, based on the management address and the IP address of the control plane CP obtained by URL resolution, the terminal accesses the control plane CP for network access and communication control. After accessing the control plane CP, the terminal sends a PADI message to the control plane CP via HTTP.

[0109] In this embodiment, the terminal first establishes an IP communication connection with the control plane CP. Then, a PADI message is sent to the control plane CP via HTTP. This unicast transmission of the PADI message prevents the terminal from broadcasting messages, keeps the number of messages in the bearer network under control, and improves the security of the point-to-point protocol-based access method.

[0110] In one embodiment, as shown in FIG4 , the specific processing procedure of the point-to-point protocol-based access method may further include steps S402 to S404 .

[0111] Step S402: Determine whether the source media access control MAC address in the PADO message is consistent with the MAC address of the user plane UP fed back by the control plane CP.

[0112] In implementation, the terminal determines whether a source Media Access Control (MAC) address included in the PADO message is consistent with the MAC address of the selected user plane UP fed back to the terminal by the control plane CP.

[0113] Step S404: If the source MAC address in the PADO message is consistent with the MAC address of the user plane UP fed back by the control plane CP, a PADR message is sent to the user plane UP.

[0114] In practice, if the source MAC address contained in the PADO message matches the MAC address of the selected user plane UP fed back to the terminal by the control plane CP, the terminal determines the MAC address of the user plane UP and then sends a PADR message to the user plane UP based on the MAC address of the user plane UP.

[0115] In this embodiment, the MAC address of the user plane UP is verified by determining whether the source MAC address contained in the PADO message is consistent with the MAC address of the selected user plane UP fed back to the terminal by the control plane CP. Based on the MAC address of the user plane UP, a PADR message is sent to request service from the user plane UP.

[0116] In one embodiment, after sending the PADR message, the user plane UP can feed back a PADS message to the terminal. After the terminal receives the PADS message, it indicates entering the PPP session stage and needs to carry out point-to-point protocol (PPP) negotiation with the target user plane UP and the control plane CP, including three stages of link control protocol (LCP) negotiation, password authentication protocol (PAP) / challenge handshake authentication protocol (CHAP) authentication negotiation, and network control protocol (NCP) negotiation. As shown in Figure 5, after executing step S208, the specific processing process of the access method based on the point-to-point protocol can also include steps S502 to S506.

[0117] Step S502: performing Link Control Protocol (LCP) negotiation with the user plane (UP) and the control plane (CP).

[0118] During implementation, the terminal conducts Link Control Protocol (LCP) negotiation with the user plane UP and the control plane CP, and negotiates link parameters through LCP message exchange, including parameter information such as the maximum transfer unit (MTU), authentication protocol, and magic word, to complete the establishment and configuration of the data link layer connection.

[0119] Step S504: Perform Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the control plane CP.

[0120] In implementation, the terminal performs Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the control plane CP to verify its identity and establish a secure connection.

[0121] Step S506: Perform Internet Protocol Control Protocol (IPCP) negotiation with the user plane UP.

[0122] The IP Control Protocol (IPCP) is a common protocol used during the NCP negotiation phase to negotiate and configure IP parameters for network interfaces. It is primarily responsible for negotiating IP parameters such as the IP address, IP packet compression format, and domain name server IP address between the terminal device and the user plane UP device during PPP connection establishment.

[0123] During implementation, the terminal and the user plane UP exchange IPCP messages to negotiate network layer parameters, including IP address, IP message compression format, domain name server IP address, etc., to complete network layer negotiation and configuration, so that the terminal obtains the IP address for accessing the network and completes the terminal user's online access.

[0124] In this embodiment, LCP and IPCP negotiation are performed with the target user plane UP to confirm the configuration of the network interface and link parameters, enabling link layer and IP layer communication between the target user plane UP and the terminal. PAP or CHAP authentication is performed with the control plane CP to authenticate the terminal user identity.

[0125] In one embodiment, a point-to-point protocol-based access method is provided. The method is described by applying it to the control plane CP140 (hereinafter, the CP number is omitted) in FIG1 , as shown in FIG6 , including the following steps S602 to S606 .

[0126] Step S602: Receive an HTTP connection establishment request sent by the terminal, and determine a user plane UP in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request.

[0127] The PADI information can be carried in HTTP. The PADI message information includes the service attribute information requested by the terminal.

[0128] In implementation, the CP receives the PADI message information in unicast form sent by the terminal in HTTP. The control plane CP determines the user plane UP in each UP (UP pool) according to the terminal service attribute information.

[0129] Step S604: Send the MAC address of the user plane UP to the terminal, and send the MAC address of the terminal to the user plane UP.

[0130] In implementation, the control plane CP determines the MAC address of the user plane UP, and then the control plane CP sends the MAC address of the user plane UP to the terminal, and sends the MAC address of the terminal to the user plane UP.

[0131] Step S606: In the authentication phase, the terminal is authenticated by the authentication, authorization and accounting AAA node, and the authentication result is returned.

[0132] In implementation, the control plane CP sends the user authentication information to the authentication authorization and accounting node. The AAA node authenticates the user authentication information and feeds back the authentication result to the control plane.

[0133] In this embodiment, a terminal establishes a connection with the control plane CP. The control plane CP receives the PADI information carried by the HTTP connection sent by the terminal and directly selects the user plane UP to establish a session between the user plane UP and the terminal. Unicast traffic is the only method used during this process, keeping the number of messages in the bearer network under control. Furthermore, the control plane CP uniformly controls entries in the MAC forwarding table and ARP table, addressing MAC address spoofing and improving the security of point-to-point protocol-based access methods.

[0134] In one embodiment, Figure 7 provides a signaling interaction flow chart of an access method based on a point-to-point protocol. As shown in Figure 7, the method includes the following steps.

[0135] 1. Power on the terminal and obtain network configuration information through DHCP. The network configuration information includes the management address, DNS, and URL information.

[0136] 2. The terminal accesses the CP through the URL and initiates an HTTP connection establishment request. The HTTP connection establishment request carries the PADI message information.

[0137] 3. The CP selects the target UP based on the terminal service attributes;

[0138] 4. The CP returns a connection establishment message and sends the MAC address of the target UP to the terminal.

[0139] 5. The CP sends the terminal MAC information to the target UP.

[0140] 6. The target UP responds with a PADO message to the terminal.

[0141] 7. The terminal verifies the MAC information of the UP, sends a PADR message to the selected UP, and initiates a service request.

[0142] 8. The target UP returns a PADS message and the session is established.

[0143] 9. The terminal performs LCP negotiation with the target UP, and the CP performs LCP negotiation with the target UP.

[0144] 10. The terminal performs PAP / CHAP authentication with the CP and sends the authentication information to the AAA node for authentication.

[0145] 11. The terminal performs IPCP negotiation with the target UP, and the CP performs IPCP negotiation with the target UP.

[0146] In one embodiment, Figure 8 is a schematic diagram of the device deployment for a point-to-point protocol (P2P)-based access method. As shown in Figure 8, traditional home broadband services include Internet access and Voice over Internet Protocol (VoIP) services. Currently, existing networks deploy a physical User Plane (pUP) in the form of a physical network element to carry home broadband Internet access services, and a virtual User Plane (vUP) in the form of a virtual network element to carry VoIP services. For new service requests from terminals, PADI message information is sent to the control plane (CP) via an HTTP connection. The control plane (CP) selects the relevant user plane UP based on the service attributes. Therefore, a unified Layer 2 Virtual Private Network (L2VPN) channel can be pre-established in the bearer network. All services share this L2VPN, eliminating the need to deploy a new VPN in the bearer network when new services are added. Therefore, the P2P-based access method offers excellent service scalability and reduces the deployment difficulty of the bearer network.

[0147] It should be understood that, although the various steps in the flowcharts of Figures 2-6 are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in Figures 2-6 may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0148] In one embodiment, as shown in FIG9 , a point-to-point protocol-based access device 900 is provided, comprising: a first sending module 901 , a first receiving module 902 , a second sending module 903 , and a second receiving module 904 , wherein:

[0149] The first sending module 901 is configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery (PADI) start message over Ethernet.

[0150] The first receiving module 902 is configured to receive the MAC address information of the user plane UP fed back by the control plane CP and the Point-to-Point Protocol Active Discovery Service PADO message on Ethernet sent by the user plane UP; the user plane UP is determined by the control plane CP based on the service attribute information of the terminal contained in the PADO message.

[0151] The second sending module 903 is configured to send a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the user plane UP.

[0152] The second receiving module 904 is configured to receive a Point-to-Point Protocol Active Discovery Session Confirmation PADS message on Ethernet fed back by a user plane UP.

[0153] In an exemplary embodiment, the point-to-point protocol-based access device 900 further includes:

[0154] The first acquisition module is used to acquire network configuration information through the dynamic host configuration protocol; the network configuration information includes a management address, a domain name system server DNS and a uniform resource locator URL.

[0155] The first parsing module is configured to parse the URL information of the control plane CP based on the DNS in the network configuration information to obtain the Internet Protocol IP address of the control plane CP, and access and communicate with the control plane CP based on the IP address of the control plane CP.

[0156] In an exemplary embodiment, the first sending module 901 includes:

[0157] The first sending submodule is configured to initiate an HTTP connection establishment request to the control plane CP based on the URL information.

[0158] In an exemplary embodiment, the point-to-point protocol-based access device 900 further includes:

[0159] The first judgment module is configured to judge whether the source media access control MAC address in the PADO message is consistent with the user plane UP MAC address fed back by the control plane CP.

[0160] The third sending module is configured to send a PADR message to the user plane UP if the source MAC address in the PADO message is consistent with the MAC address of the user plane UP fed back by the control plane CP.

[0161] In an exemplary embodiment, the point-to-point protocol-based access device 900 further includes:

[0162] The first negotiation module is configured to perform Link Control Protocol (LCP) negotiation with a user plane (UP) and a control plane (CP).

[0163] The first authentication module is configured to perform Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the control plane CP.

[0164] The second negotiation module is configured to perform IP control protocol IPCP negotiation with the user plane UP.

[0165] In one embodiment, as shown in FIG10 , a point-to-point protocol-based access device 1000 is provided, comprising: a determination module 1001 , a construction module 1002 , and a sending module 1003 , wherein:

[0166] The determination module 1001 is configured to receive an HTTP connection establishment request sent by a terminal, and determine a user plane UP in each UP pool according to the terminal service attribute information included in the PADI information carried in the HTTP connection establishment request.

[0167] The sending module 1002 is configured to send the MAC address of the user plane UP to the terminal, and send the MAC address of the terminal to the user plane UP.

[0168] The authentication module 1003 is used to authenticate the terminal through the authentication authorization and accounting AAA node during the authentication phase and return the authentication result.

[0169] For the specific definition of the point-to-point protocol-based access device, please refer to the definition of the point-to-point protocol-based access method above and will not be repeated here. The various modules in the above-mentioned point-to-point protocol-based access device can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of the above-mentioned modules.

[0170] In one embodiment, a communication device is provided, see Figure 11. Figure 11 is a schematic diagram of the structure of a terminal device provided in an embodiment of the present invention. The terminal device 1100 shown in Figure 11 includes: at least one processor 1101, a memory 1102, at least one network interface 1104 and a user interface 1103. The various components in the terminal device 1100 are coupled together through a bus system 1105. It can be understood that the bus system 1105 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1105 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are labeled as bus system 1105 in Figure 11. In addition, in an embodiment of the present invention, a transceiver 1106 is also included. The transceiver can be multiple components, that is, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.

[0171] The user interface 1103 may include a display, a keyboard, or a pointing device, such as a mouse, a trackball, a touchpad, or a touch screen.

[0172] It is understood that the memory 1102 in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 1102 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0173] In some embodiments, the memory 1102 stores the following elements: executable modules or data structures, or a subset thereof, or an extended set thereof, an operating system 11021 , and applications 11022 .

[0174] The operating system 11021 includes various system programs, such as a framework layer, a core library layer, and a driver layer, for implementing various basic services and handling hardware-based tasks. Application programs 11022 include various application programs, such as a media player (MediaPlayer) and a browser (Browser), for implementing various application services. Programs implementing the methods of the embodiments of the present invention may be included in application programs 11022.

[0175] In an embodiment of the present invention, by calling a program or instruction stored in the memory 1102, specifically, a program or instruction stored in the application 11022, the transmitter is configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane CP; the HTTP connection establishment request carries a Point to Point Protocol on Ethernet (PADI) active discovery initiation message; a Point to Point Protocol on Ethernet (PADR) active discovery request message is sent to the UP; the receiver is configured to receive the MAC address information of the user plane UP fed back by the control plane CP and the Point to Point Protocol on Ethernet (PADO) active discovery service message sent by the user plane UP; the user plane UP is determined by the control plane CP based on the service attribute information of the terminal contained in the PADI message; and a Point to Point Protocol on Ethernet (PADS) active discovery session confirmation message is received from the user plane UP.

[0176] Some or all of the methods disclosed in the above embodiments of the present invention may also be applied to the processor 1101, or implemented by the processor 1101, or implemented by the processor 1101 in conjunction with other components (e.g., a transceiver). The processor 1101 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be performed by hardware integrated logic circuits or software instructions in the processor 1101. The above processor 1101 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present invention may be directly implemented as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 1102, and processor 1101 reads information in memory 1102 and, in conjunction with its hardware, completes the steps of the above method.

[0177] FIG12 is a schematic diagram of the structure of the control plane provided by an embodiment of the present invention. The access network device 1200 shown in FIG12 includes: at least one processor 1201, a memory 1202, and at least one network interface 1204. The various components in the access network device 1200 are coupled together via a bus system 1205. It can be understood that the bus system 1205 is used to implement connection and communication between these components. In addition to including a data bus, the bus system 1205 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are labeled as bus system 1205 in FIG12. In addition, in an embodiment of the present invention, a transceiver 1206 is also included. The transceiver can be multiple components, that is, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.

[0178] It is understood that the memory 1202 in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 1202 of the systems and methods described in the embodiments of the present invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0179] In some implementations, the memory 1202 stores the following elements: executable modules or data structures, or subsets thereof, or extensions thereof, and an operating system 12021. The operating system 12021 includes various system programs, such as a framework layer, a core library layer, and a driver layer, for implementing various basic services and processing hardware-based tasks.

[0180] In an embodiment of the present invention, by calling the program or instructions stored in the memory 1202, the transmitter is used to send the MAC address of the user plane UP to the terminal, and send the MAC address of the terminal to the user plane UP; the processor is used to authenticate the terminal through the authentication authorization and accounting AAA node during the authentication phase, and return the authentication result; the receiver is used to receive the HTTP connection establishment request sent by the terminal, and determine the user plane UP in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request.

[0181] Some or all of the methods disclosed in the above embodiments of the present invention may also be applied to the processor 1201, or implemented by the processor 1201, or implemented by the processor 1201 in conjunction with other components (e.g., a transceiver). The processor 1201 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be performed by hardware integrated logic circuits in the processor 1201 or by software instructions. The above processor 1201 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present invention may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in conjunction with the embodiments of the present invention may be directly implemented as being executed by a hardware decoding processor, or may be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 1202, and processor 1201 reads information in memory 1202 and, in conjunction with its hardware, completes the steps of the above method.

[0182] It is understood that the embodiments described in the embodiments of the present invention can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSP devices, DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions of the present application, or a combination thereof.

[0183] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0184] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0185] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0186] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0187] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that variations and improvements are possible within the scope of the present application, as would be apparent to one skilled in the art. These variations and improvements fall within the scope of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A point-to-point protocol-based access method, applied to a terminal, the method comprising: Initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to the Control Plane (CP); The HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet; receiving media access control (MAC) address information of a user plane (UP) fed back by the control plane (CP) and a Point-to-Point Protocol Active Discovery Service (PADO) message over Ethernet sent by the user plane (UP); the user plane (UP) is determined by the control plane (CP) according to service attribute information of the terminal contained in the PADO message; Sending a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the user plane (UP); A Point-to-Point Protocol Active Discovery Session Confirmation (PADS) message over Ethernet fed back by the User Plane (UP) is received.

2. The method according to claim 1, wherein before initiating a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP), the method further comprises: Get network configuration information through Dynamic Host Configuration Protocol; The network configuration information includes a management address, a Domain Name System server (DNS), and a Uniform Resource Locator (URL); Based on the DNS resolution of the URL information of the control plane (CP) in the network configuration information, the Internet Protocol (IP) address of the control plane (CP) is obtained, and based on the IP address of the control plane (CP), access and intercommunication with the control plane (CP) are established.

3. The method according to claim 1, wherein the initiating a Hypertext Transfer Protocol (HTTP) connection establishment request to the control plane (CP) comprises: An HTTP connection establishment request is initiated to the control plane (CP) based on the URL information.

4. The method according to claim 1, further comprising: Determine whether a source media access control (MAC) address in the PADO message is consistent with a user plane (UP) MAC address fed back by the control plane (CP); If the source MAC address in the PADO message is consistent with the MAC address of the user plane (UP) fed back by the control plane (CP), a PADR message is sent to the user plane (UP).

5. The method according to claim 1, wherein after receiving the Point-to-Point Protocol Active Discovery Session Confirmation (PADS) message over Ethernet fed back by the User Plane (UP), the method further comprises: Performing Link Control Protocol (LCP) negotiation with the User Plane (UP) and Control Plane (CP); Performing Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) authentication with the control plane (CP); Perform IP Control Protocol (IPCP) negotiation with the User Plane (UP).

6. A point-to-point protocol-based access method, applied to a control plane (CP), the method comprising: Receive an HTTP connection establishment request sent by a terminal, and determine a user plane (UP) in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request; Sending the MAC address of the user plane (UP) to the terminal, and sending the MAC address of the terminal to the user plane (UP); During the authentication phase, the terminal is authenticated by the Authentication, Authorization, and Accounting (AAA) node and the authentication result is returned.

7. An access device based on a point-to-point protocol, comprising: A first sending module is configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to a control plane (CP); The HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet; A first receiving module is configured to receive the MAC address information of the user plane (UP) fed back by the control plane (CP) and a Point-to-Point Protocol Active Discovery Service (PADO) message on Ethernet sent by the user plane (UP); The use The user plane (UP) is determined by the control plane (CP) according to the service attribute information of the terminal contained in the PADI message; A second sending module is used to send a Point-to-Point Protocol Active Discovery Request (PADR) message on Ethernet to the user plane (UP); The second receiving module is configured to receive a Point-to-Point Protocol Active Discovery Session Confirmation (PADS) message on Ethernet fed back by the User Plane (UP).

8. An access device based on a point-to-point protocol, comprising: A determination module, configured to receive an HTTP connection establishment request sent by a terminal, and determine a user plane (UP) in each UP pool according to the terminal service attribute information contained in the PADI information carried by the HTTP connection establishment request; a sending module, configured to send the MAC address of the user plane (UP) to the terminal, and send the MAC address of the terminal to the user plane (UP); The authentication module is used to authenticate the terminal through the Authentication Authorization and Accounting (AAA) node during the authentication phase and return the authentication result.

9. A communication device comprising: transmitter and receiver; The transmitter is configured to initiate a Hypertext Transfer Protocol (HTTP) connection establishment request to a control plane (CP); The HTTP connection establishment request carries a Point-to-Point Protocol Active Discovery Initiation (PADI) message over Ethernet; Sending a Point-to-Point Protocol Active Discovery Request (PADR) message over Ethernet to the User Plane (UP); The receiver is configured to receive the MAC address information of the user plane (UP) fed back by the control plane (CP) and a Point-to-Point Protocol Active Discovery Service (PADO) message on Ethernet sent by the user plane (UP); the user plane (UP) is determined by the control plane (CP) based on the service attribute information of the terminal contained in the PADI message; and receive a Point-to-Point Protocol Active Discovery Session Confirmation (PADS) message on Ethernet fed back by the user plane (UP).

10. A communication device comprising: transmitter, processor, and receiver; The receiver is configured to receive an HTTP connection establishment request sent by a terminal, and determine a user plane (UP) in each UP pool according to terminal service attribute information contained in PADI information carried by the HTTP connection establishment request; The transmitter is configured to send the MAC address of the user plane (UP) to the terminal, and send the MAC address of the terminal to the user plane (UP); The processor is used to authenticate the terminal through an Authentication Authorization and Accounting (AAA) node during the authentication phase and return an authentication result.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 or 6 are implemented.

12. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 or 6 are implemented.

Images