BRAS Port Authentication via VXLAN ID Mapping

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In a BRAS architecture with separated forwarding and control functions, the BRAS CP device cannot obtain port information of the user access port, preventing access restriction for users, and the use of a private header affects processing efficiency when a switch chip is employed.

Innovation Solution

A method where the BRAS DP device determines the VXLAN ID associated with the user access port, encapsulates control packets, and sends them through a VXLAN tunnel to the BRAS CP device, allowing the BRAS CP device to authenticate the port information and user identity, eliminating the need for a private header by using standard VXLAN encapsulation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If a private header is added to carry port information in control packets, then the BRAS CP device can obtain port information for user authentication, but the processing efficiency deteriorates when using switch chips

Engineering Contradiction:

Improveport informationVSAvoidprocessing efficiency

Core Design Contradiction:

Loss of informationVSProductivity

Solution Approach 1:

The patent uses the VXLAN ID as a copy or representation of the port information. Instead of adding a private header with actual port information, the VXLAN ID encapsulates the port identification implicitly. When the BRAS DP device performs VXLAN encapsulation, it uses the VXLAN ID corresponding to the user access port, which the BRAS CP device can then use to identify the port without receiving actual port information in the packet header.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent changes the parameter representation from explicit port information in a private header to an implicit VXLAN ID. The VXLAN ID serves as a parameter that indirectly represents the port information. The BRAS CP device obtains port information by mapping the received VXLAN ID to the corresponding port, rather than extracting it directly from the packet header.

Inventive Principle:

Principle #35Parameter changes

2Device complexity

If the BRAS CP device cannot obtain port information, then processing is simpler, but user authentication and access restriction cannot be performed

Engineering Contradiction:

Improveprocessing complexityVSAvoidauthentication capability

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The VXLAN ID acts as an intermediary between the BRAS DP device and the BRAS CP device for port information transmission. Instead of directly transmitting port information or maintaining complex private headers, the VXLAN ID serves as a mediator that carries the necessary port identification information in a standardized format that both devices can handle efficiently.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentEP3664403B1User authentication of BRAS under architecture of mutually separated forwarding and control

Publication Date: 2022.10.12 NEW H3C TECH CO LTD

Figure 1~2
Figure 3
Figure 3A~3B

AI summary

A method and device for authenticating a user in a BRAS architecture with forwarding and control separated are provided. Based on an example of the method, information of a user access port on a BRAS DP device is implicitly identified by a VXLAN ID, so that a BRAS CP device can combine the information of the user access port with user identity information carried in an authentication packet and send them together to an authentication server for authentication. In this way, since the information of the user access port is also involved in the authentication of the user, an access restriction for a user can be realized.