CN101355578A - Compatible method and system for mobile IP application based on RADIUS and DIAMETER protocols - Google Patents

Abstract

The invention discloses a compatible method and system for mobile IP applications based on RADIUS and DIAMETER protocols. The method includes the following steps: communication between the mobile node and the access server; communication between the access server and the translation proxy server, the translation proxy server translates the message formats of the RADIUS and DIAMETER protocols mutually; the translation proxy server Communication with the authentication server; wherein, one of the access server and the authentication server runs the RADIUS protocol, and the other runs the DIAMETER protocol. The invention not only enables network entities running different AAA protocols to work together, but also integrates the registration and authentication processes of network entities based on RADIUS protocol by adopting the registration process of mobile IP applications based on DIAMETER protocol, thereby improving efficiency.

Description

Compatible method and system for mobile IP application based on RADIUS and DIAMETER protocols

technical field

The present invention relates to the mobile IP extension application of the network authentication, authorization, accounting (Authentication, Authorization, Accounting, AAA) system based on the DIAMETER protocol and the mobile IP extension application of the AAA system based on the RADIUS protocol, in particular to the mobile IP extension application based on the RADIUS and DIAMETER protocols A compatible method and system for mobile IP applications.

Background technique

Mobile IP is a solution that provides mobile functions on the Internet based on the network layer. Mobile IP enables the mobile node (Mobile Node, MN) to maintain the continuity of communication with other mobile nodes or nodes without mobile IP functions without changing the IP address during the process of moving between different networks.

The mobile IP system mainly includes a mobile node (MN), a foreign agent server (Foreign Agent, FA), and a home agent server (Home Agent, HA). Each mobile node has a home address (Home of Address, HoA), when the mobile node leaves the home network and enters the foreign network, it needs to obtain a care of address (Care of Address, CoA), and through the foreign agent server (or directly ) register with the home agent server, and create an association between HoA and CoA on the home agent server. The data packets sent by the mobile node to the mobile node are routed to the home network of the mobile node through the normal IP route, and the home agent server intercepts these data packets and sends them to the current location of the mobile node through tunnel technology.

The security problems in the mobile IP system mainly exist in the registration process and communication process. On the one hand, during the registration process of the mobile node, if no security measures are adopted, malicious users can send false registration requests to the local agent, causing all data packets to be forwarded to the malicious users. On the other hand, in the normal communication process after registration, attackers can eavesdrop on sessions and intercept data packets. Therefore, security is an important factor to ensure the function of mobile IP technology, and the authentication of mobile users, message integrity and confidentiality in the registration process are one of the core issues of mobile IP security. In order to solve the security problem in the registration process, security protocols need to be introduced, and the AAA protocol is one of them.

AAA refers to Authentication (authentication), Authorization (authorization), Accounting (accounting). Among them, authentication refers to authenticating users by verifying some pre-registered information to determine the legitimacy of users and prevent illegal users from using network resources; authorization refers to deciding whether to grant users access to specific network resources or The right to obtain a certain service; bookkeeping refers to the network system recording and storing information on the use of network resources and various services by users, and billing and auditing user behavior according to predetermined rules.

The RADIUS protocol is one of the most commonly used AAA protocols at present, and can be used to solve the registration security problem of mobile IP. Its network topology is as shown in accompanying drawing 1, and it comprises mobile node 11, foreign agent server 12, home agent server 13, foreign place authentication server (Foreign AAA server, AAAF) 14 and local authentication server (Home AAA server, AAAH) 15 . In the network topology shown in Figure 1, the registration process of the mobile node 11 is:

Step S11, start. Before the mobile node 11 boots up and registers, the mobile node 11 only has the network access identifier (Network Access Identifier, NAI) and the mobile security association (Mobility Security Association, MSA) of the mobile node 11 and the foreign authentication server 15 (Home AAA server, AAAH). Security Information.

Step S12, after the mobile node 11 is turned on, the mobile node 11 sends a registration request message (Registration Request, RRQ) to the foreign proxy server 12.

Step S13, foreign agent server 12 receives the registration request (RRQ) of mobile node 11, does not have mobile security association (MSA) between foreign agent server 12 and mobile node 11 and home agent server 13 this moment, for this reason then foreign agent server 12 Send an access request (RADIUS Access Request, AR) message to the foreign authentication server 14 (Foreign AAAserver, AAAF), wherein the MIP-Feature-Vector attribute sets FA-HA-Key-Request and MN-FA-Key-Nonce-Request bit.

In step S14, the foreign authentication server 14 forwards the AR message to the foreign authentication server 15 after receiving the AR message.

Step S15, after foreign authentication server 15 receives AR, at first verify the identity of mobile node 11, if pass verification, then distribute the key information (MN-FA-Key) between mobile node 11 and foreign agent server 12, foreign agent The key information (FA-HA-Key) between server 12 and home agent server 13, and send access to allow (RADIUS Access-Accept, AA) message to foreign agent server 12, be used for foreign agent server 12 to set up foreign agent The MSA between the server 12 and the mobile node 11 and the home agent server 13; the Access Allow message (AA) needs to pass through the foreign authentication server 14 to reach the foreign agent server 12.

Step S16, the AA message reaches the foreign proxy server 12 via the foreign authentication server 14, indicating that the mobile node 11 has passed the authentication. The foreign agent server 12 obtains the security information used to establish the MSA between the foreign agent server 12 and the mobile node 11 and the home agent server 13 from the AA message, and then sends a registration request message (RRQ) message to the home agent server 13.

Step S17, the home agent server 13 receives the RRQ from the foreign agent server 12, and judges that if the MSA of the foreign agent server 12 and the home agent server 13 already exists on the home agent server 13, then the home agent server 13 can send the foreign agent in the RRQ Server 12 and mobile node 11 information are verified; Otherwise, home agent server 13 will verify foreign agent server 12 and mobile node 11 information in the RRQ by foreign authentication server 15, and this verification process is that home agent server 13 at first sends authentication server to foreign place 15 sends an AR message, and the foreign authentication server 15 sends an AR message to the home proxy server 13 after passing the verification.

Home agent server 13 after the foreign agent server 12 and mobile node 11 information verification in RRQ is passed, home agent server 13 handles the registration request of mobile node 11, then sends registration reply (Mobile IP Registration Reply, RRP) message to the foreign place proxy server 12.

In step S18, the foreign agent server 12 forwards the RRP message to the mobile node 11 to complete the registration process.

The above is the main flow of the RADIUS protocol applied to the mobile IP registration process. RADIUS can meet the needs of mobile IP for security issues to a certain extent.

In recent years, various Internet services have emerged continuously, and the number of users accessing the Internet in various ways has continued to increase, making it difficult for routers and network access servers based on the original AAA technology to cope. AAA protocols such as RADIUS cannot meet the requirements in the new situation. After discussion, the AAA working group of IETF agreed to use the DIAMETER protocol as the next-generation AAA protocol standard. The DIAMETER protocol has greater advantages than the RADIUS protocol in terms of end-to-end security, capacity expansion, transmission reliability, roaming support, failover and scalability, and can meet the needs of the current stage.

The DIAMETER protocol provides support for mobile IP. Using the DIAMETER basic protocol, the mobile IP application based on the DIAMETER protocol solves many problems in the mobile IP relatively well. In the mobile IP application based on the DIAMETER protocol, the AAA authentication server acts as a key distribution center to create and distribute session keys for the mobile node, foreign agent server and home agent server, so that the mobile node can obtain access services in the external network. Its network topology is shown in Figure 2. According to the network topology shown in Figure 2, the registration process of the mobile node 21 is:

Step S21, start. Before the mobile node 21 powers on and registers, the mobile node 21 only has the information of the NAI and the mobile security association (MSA) between the mobile node 21 and the local authentication server 25 .

Step S22, after the mobile node 21 is turned on, the mobile node 21 sends a registration request (Registration Request, RRQ) message to the foreign proxy server 22.

Step S23 , after receiving the registration request message, the foreign proxy server 22 generates an AA-Mobile-Node-Request (AMR) message and sends it to the foreign authentication server 24 according to the information therein.

In step S24, the foreign authentication server 24 forwards the AMR to the local authentication server 25 after receiving the AMR.

Step S25, after the local authentication server 25 receives the AMR, distribute the key information between the mobile node 21 and the home agent server 23, between the mobile node 21 and the foreign agent server 22, and the foreign agent server 22 and the home agent server for the mobile node 21. The key information between agent servers 23, and send home agent mobile IP request (Home-Agent-MIP-Request, HAR) message to home agent server 23, wherein MIP-Reg-Request AVP comprises mobile IP registration request information.

Step S26, home agent server 23 receives HAR, processes MIP-Reg-Request AVP, generates MIP-Reg-Reply AVP, and MIP-Reg-Reply AVP is included in local agent mobile IP response (Home-Agent-MIP-Answer, HAA) message to the local authentication server 25.

In step S27, after receiving the HAA, the local authentication server 25 generates a mobile node response (AA-Mobile-Node-Answer, AMA) message and sends it to the foreign authentication server 24.

Step S28 , the foreign authentication server 24 forwards the AMA to the foreign proxy server 22 .

Step S29, after receiving the AMA, the foreign agent server 22 retains the key information between the foreign agent server 22 and the home agent server 23, and connects between the foreign agent server 22 and the mobile node 21, and between the home agent server 23 and the mobile node 21. The key information is included in the Registration Reply (Registration-Reply, RRP) message and sent to the mobile node 21 to complete the registration.

As a new generation of AAA protocol, DIAMETER has obvious advantages compared with RADIUS. In the future, when the mobile communication network gradually transitions to all-IP, the DIAMETER protocol will be widely used. But from the current point of view, the use of the RADIUS protocol is still the main way, almost all network access servers support the RADIUS protocol, so the smooth promotion and application of the new AAA protocol depends to a large extent on whether the new protocol is compatible RADIUS protocol. The DIAMETER protocol adopts some mechanisms to be compatible with the RADIUS protocol. However, due to the differences in message formats, attribute values, and registration procedures between the mobile IP applications of the RADIUS and DIAMETER protocols, there is currently no specific method to implement the mobile IP of the RADIUS protocol. The application is compatible with the mobile IP application of the DIAMETER protocol.

Contents of the invention

It is an object of the present invention to provide message format compatible methods of RADIUS and DIAMETER protocols. Since the DIAMETER and RADIUS protocols have different message formats, different attribute formats are also introduced in the mobile IP application, so in order to make the two mobile IP applications compatible, it is necessary to make the messages based on the two protocols mutually compatible. convert.

Another object of the present invention is to provide a compatible method for mobile IP applications based on RADIUS and DIAMETER protocols. Since the registration processes of mobile IP applications of the RADIUS and DIAMETER protocols are very different, a method is needed to enable the access server and authentication server running the two protocols to work together under a common process.

Another object of the present invention is to provide a kind of compatible system based on the mobile IP application of RADIUS and DIAMETER agreement, make the access server of DIAMETER (or RADIUS) agreement and the authentication server of RADIUS (or DIAMETER) agreement in mobile IP application Compatible, and does not change the original network structure and functions of network entities.

For the above purpose, the present invention provides the following technical solutions;

A kind of compatible method based on the mobile IP application of RADIUS and DIAMETER agreement, comprises the steps:

Step S1, communication between the mobile node and the access server;

Step S2, communication between the access server and the translation proxy server, the translation proxy server translates the message formats of the RADIUS and DIAMETER protocols to each other;

Step S3, communication between the translation proxy server and the authentication server;

Wherein, one of the access server and the authentication server runs the RADIUS protocol, and the other runs the DIAMETER protocol.

Further, the access server in step S1 is a foreign proxy server, and correspondingly the authentication server in step S3 is a foreign authentication server; or, the access server in step S1 is a home proxy server, correspondingly The authentication server in step S3 is a local authentication server.

Further, the above-mentioned compatible method for mobile IP applications based on RADIUS and DIAMETER protocols, when the access server in step S1 is a foreign proxy server, and correspondingly when the authentication server in step S3 is a foreign authentication server, include:

Step S4, communication between the foreign authentication server and the local authentication server;

Step S5, communication between the local authentication server and the second translation proxy server, the second translation proxy server translates the message formats of RADIUS and DIAMETER protocols;

Step S6, communication between the second translation proxy server and the home proxy server;

Wherein, one of the local authentication server and the home proxy server runs the RADIUS protocol, and the other runs the DIAMETER protocol.

Further, when the home agent server and the foreign agent server run the DIAMETER protocol, and the foreign authentication server and the local authentication server run the RADIUS protocol, the step S3 also includes:

communication between the translation proxy server and the second translation proxy server.

Further, the described compatible method of mobile IP application based on RADIUS and DIAMETER protocol also includes:

In step S4, the foreign authentication server communicates with the local authentication server through a third translation proxy server, and the third translation proxy server translates the message formats of the RADIUS and DIAMETER protocols; wherein the foreign One of the authentication server and the local authentication server runs the RADIUS protocol, and the other runs the DIAMETER protocol.

Further, the described compatible method of mobile IP application based on RADIUS and DIAMETER protocol also includes:

Step S7, process the registration reply message sent by the home agent server and send it back to the mobile node, completing the registration of the mobile node.

Further, in the compatible method of the mobile IP application based on the RADIUS and DIAMETER protocols, in step S2, the method for the translation proxy server to translate the message formats of the RADIUS and DIAMETER protocols to each other includes:

Translate the mobile node request message of the DIAMETER protocol and the access request message of RADIUS;

The mobile node response message of the DIAMETER protocol and the access permission and rejection message and the registration reply message of the RADIUS protocol are mutually translated; wherein the MIP-MA-Type attribute setting in the access permission and rejection message is used to indicate the corresponding It is a DIAMETER protocol message between the local authentication server or the foreign authentication server and the foreign proxy server;

The home agent request message of the DIAMETER protocol and the registration request message of the RADIUS protocol are mutually translated;

The Home Agent Response message of the DIAMETER protocol and the Access Allow/Reject message and Registration Reply message of the RADIUS protocol are mutually translated; wherein the MIP-MA-Type attribute setting in the Access Allow and Reject message is used to indicate the corresponding It is a DIAMETER protocol message between the home proxy server and the local authentication server.

The present invention also provides a compatible system for mobile IP applications based on RADIUS and DIAMETER protocols, including:

Access to the server, communicate with the mobile node, and use it to access the network on behalf of the mobile node;

A translation proxy server is arranged between the access server and the authentication server, and is used for mutually translating the message formats of the RADIUS and DIAMETER protocols;

an authentication server, configured to communicate with the access server through the translation proxy server;

Wherein, one of the access server and the authentication server runs the RADIUS protocol, and the other runs the DIAMETER protocol.

Further, the access server is a foreign proxy server, and the authentication server is a foreign authentication server; or, the access server is a home proxy server, and the authentication server is a local authentication server.

Further, the compatible system for mobile IP applications based on RADIUS and DIAMETER protocols, when the access server is a foreign proxy server, and correspondingly when the authentication server is a foreign authentication server, it also includes: a local authentication server, and The foreign authentication server communicates.

Further, the described compatible system for mobile IP applications based on RADIUS and DIAMETER protocols also includes: a home proxy server communicating with the local authentication server through a second translation proxy server; the second translation proxy server is used for The message formats of the RADIUS and DIAMETER protocols are mutually translated, wherein one of the home agent server and the local authentication server runs the RADIUS protocol, and the other runs the DIAMETER protocol.

Further, when the foreign proxy server and the home proxy server are servers running the DIAMETER protocol, and the foreign authentication server and the local authentication server are servers running the RADIUS protocol, the translation proxy server and the first Two translation proxy servers communicate.

Further, the compatible system for mobile IP applications based on RADIUS and DIAMETER protocols further includes: when one of the foreign authentication server and the local authentication server runs the RADIUS protocol, and the other runs the DIAMETER protocol, The local authentication server communicates with the foreign authentication server through a third translation proxy server; the third translation proxy server is used to translate message formats of RADIUS and DIAMETER protocols to each other.

Further, the compatible system of the mobile IP application based on RADIUS and DIAMETER protocol is characterized in that, the translation proxy server mutually translates the message formats of RADIUS and DIAMETER protocol including:

Translate the mobile node request message of the DIAMETER protocol and the access request message of RADIUS;

The mobile node response message of the DIAMETER protocol and the access permission and rejection message and the registration reply message of the RADIUS protocol are mutually translated; wherein the MIP-MA-Type attribute setting in the access permission and rejection message is used to indicate the corresponding It is a DIAMETER protocol message between the local authentication server or the foreign authentication server and the foreign proxy server;

The home agent request message of the DIAMETER protocol and the registration request message of the RADIUS protocol are mutually translated;

The Home Agent Response message of the DIAMETER protocol and the Access Allow/Reject message and Registration Reply message of the RADIUS protocol are mutually translated; wherein the MIP-MA-Type attribute setting in the Access Allow and Reject message is used to indicate the corresponding It is a DIAMETER protocol message between the home proxy server and the local authentication server.

The beneficial effects of the present invention are:

By adopting the solution described in the present invention, not only can network entities running different AAA protocols work together, but also because the registration process of mobile IP applications based on DIAMETER protocol is adopted, the registration and authentication processes of network entities based on RADIUS protocol are combined. For one, the efficiency is improved.

The technical scheme of the present invention fully conforms to the network structure described by the mobile IP application based on RADIUS and DIAMETER protocols, and can realize the network structure based on The compatibility of the network entities of the RADIUS and DIAMETER protocols makes the transition from the RADIUS protocol to the DIAMETER protocol more stable in mobile IP applications.

Description of drawings

Fig. 1 is a topological structure diagram of a mobile IP application network based on the RADIUS protocol;

Figure 2 is a topological structure diagram of a mobile IP application network based on the DIAMETER protocol;

FIG. 3 is a network topology diagram of Embodiment 1 of the present invention;

FIG. 4 is a flow chart of message interaction in Embodiment 1 of the present invention;

FIG. 5 is a network topology diagram of Embodiment 2 of the present invention;

FIG. 6 is a flow chart of message interaction in Embodiment 2 of the present invention;

FIG. 7 is a network topology diagram of Embodiment 4 of the present invention;

FIG. 8 is a flow chart of message interaction in Embodiment 4 of the present invention.

in:

11, 21, 31, 51, 71---Mobile Node (MN);

12, 22, 32, 52 --- foreign agent server (FA);

13, 23, 33, 53, 72---home agent server (HA);

14, 24, 34, 54 --- foreign authentication server (AAAF);

15, 25, 35, 55, 74---local authentication server (AAAH);

36, 56---the first translation proxy server (TA);

37, 57---the second translation proxy server (TA);

73---Translation proxy server (TA)

RRQ---Registration Request message (Registration Request);

AR---Access Request message (Access Request);

AMR---Mobile Node Request Message (AA-Mobile-Node-Request);

HAR---home agent request message (Home Agent Reguest);

RRP---Registration Reply message (Registration-Reply);

HAA---home agent response message (Home Agent Answer);

AMA --- mobile node response message (AA-Moblie-Node-Answer);

AA/AR---Access Accept/Reject message (Access Accept/Reject);

RRP---Registration Reply.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, the RADIUS and DIAMETER protocol-based mobile IP application compatible method and system of the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Example 1

The invention makes the mobile IP applications of the two AAA protocols of RADIUS and DIAMETER compatible with each other by introducing the network entity of the translation proxy server, specifically including the compatibility of message formats and protocol flows of different protocols between the network entities.

In order to realize the compatibility of message formats between network entities, the present invention introduces a translation proxy server and uses a certain message format conversion method (i.e. translation method), so that the network entity running the RADIUS protocol and the network entity running the DIAMETER protocol can perform communication.

In order to achieve protocol flow compatibility between network entities, the present invention uses the above-mentioned translation proxy server to enable the incompatible network entities running the RADIUS protocol and the network entities running the DIAMETER protocol to work together.

Translation proxy server (Translation-Agent, TA) network entity in the present invention is responsible for the conversion of message format (that is, the mutual translation of the message format of different agreements), and this network entity is positioned at the network entity of operation RADIUS agreement and the network entity of operation DIAMETER agreement Between, the main functions are:

Translate DIAMETER AVP (DIAMETER attribute value pair) into RADIUSAttribute (RADIUS attribute) with the same or similar function;

Translate RADIUS Attribute into DIAMETER AVP with the same or similar function;

Convert DIAMETER messages to RADIUS messages;

Convert RADIUS messages to DIAMETER messages.

The message conversion scheme of the DIAMETER basic protocol and the RADIUS protocol has been clearly described in the DIAMETER Network Access Server Application (DIAMETER Network Access Server Application, RFC4005), and the present invention only involves messages and attributes relevant to mobile IP applications.

The messages involved in the mobile IP application of the AAA protocol mainly include the following six types:

In the DIAMETER protocol: Home Agent Reguest (HAR), Home Agent Response (Home Agent Answer, HAA), Mobile Node Request (AA-Moblie-Node-Request, AMR), Mobile Node Response (AA-Moblie-Node -Answer, AMA);

In the RADIUS protocol: Access Request (AR), Access Allow/Reject (AccessAccept/Reject, AA/AR), Registration Request (RRQ), Registration Reply (RRP).

As an implementable way, the mutual translation method of the above 8 kinds of messages is as follows:

Mutual translation between DIAMETER AMR and RADIUS Access Request;

DIAMETER AMA is translated into two RADIUS messages of RADIUS Access Accept/Reject (MIP-MA-Type＝0) and Registration Reply, and the two RADIUS messages of RADIUS Access Accept/Reject (MIP-MA-Type＝0) and Registration Reply are translated into DIAMETER AMA news;

Mutual translation between DIAMETER HAR and Registration Request;

DIAMETER HAA is translated into two RADIUS messages of RADIUS Access Accept/Reject (MIP-MA-Type＝1) and Registration Reply, and the two RADIUS messages of RADIUS Access Accept/Reject (MIP-MA-Type＝1) and Registration Reply are translated into DIAMETER HAA message.

Wherein, the MIP-MA-Type attribute of the RADIUS protocol message is used to indicate whether the RADIUS message corresponds to the DIAMETER message between the home agent server and the local authentication server or the DIAMETER message between the local authentication server, the foreign authentication server, and the foreign agent server, As a specific implementation, here MIP-MA-Type=0 indicates that the RADIUS message corresponds to the DIAMETER message between the local authentication server or the foreign authentication server and the foreign proxy server, and MIP-MA-Type=1 indicates that the RADIUS message corresponds to is the DIAMETER message between the home proxy server and the local authentication server.

The translation method of the attributes related to Mobile IP involved in the above message is as follows: Table 1:

Table 1

The protocol flow of the mobile IP application based on the RADIUS protocol and the mobile IP application based on the DIAMETER protocol are quite different. The most important difference is that in the RADIUS protocol, the identity authentication and registration of the mobile node are divided into two processes, while in the DIAMETER protocol it is completed in one process. Therefore, a method needs to be adopted to enable the network entity running the RADIUS protocol and the network entity running the DIAMETER protocol to work together.

The network structure involved in the present invention complies with the network structure in the DIAMETER MobileIPv4 Application (RFC4004) of the Internet Engineering Task Force (InternetEngineering Task Force, IETF), in which there are home domain, foreign area, mobile node (MN ), foreign agent server (FA), home agent server (HA), foreign authentication server (AAAF), local authentication server (AAAH), where the mobile node is located in a foreign region, the home agent server and the foreign agent server are clients of the AAA system , is the network access server, the foreign authentication server and the local authentication server are servers of the AAA system, and the network access server and the authentication server run different AAA protocols. In order to realize the flow compatibility of the two protocols, the present invention introduces a translation agent server (Translation-Agent, TA) network entity into the network structure. By translating the role of the proxy server, both the network entity running the RADIUS protocol and the network entity running the DIAMETER protocol can follow the flow of the DIAMETER protocol.

In order to realize the purpose of the present invention, the translation proxy server needs to be deployed between network entities running different AAA protocols (there is no need to deploy between the foreign proxy server and the home proxy server, because according to the mobile IP application process based on the DIAMETER protocol, the foreign proxy server do not communicate directly with the home proxy server).

As shown in Fig. 3, the present invention introduces translation proxy server between AAA clients (foreign proxy server 32 and home proxy server 33) and AAA server (foreign place authentication server 34 and local authentication server 35) running different AAA protocols, namely When foreign proxy server 32 and foreign authentication server 34 run different AAA agreements respectively, introduce translation proxy server between foreign proxy server 32 and foreign authentication server 34; When using different AAA protocols, a translation proxy server is also introduced between the home proxy server 33 and the local authentication server 35.

Accompanying drawing 3 is the network topological diagram of an embodiment of the compatible method that realizes the mobile IP application based on RADIUS and DIAMETER agreement of the present invention, wherein network access server (foreign proxy server 32) is the client of operation RADIUS agreement, authentication server (foreign authentication server 34 ) is a server running the DIAMETER protocol, and a first translation proxy server 36 is introduced between the foreign agent server 32 and the foreign authentication server 34 . The message flow of this embodiment is shown in Fig. 4 . With reference to accompanying drawing 3 and 4, the compatible method of the mobile IP application based on RADIUS and DIAMETER agreement of the present invention comprises the steps:

Step S101, communication between the mobile node 31 and the access server;

That is, the mobile node 31 sends an RRQ message to the foreign agent server 32 (access server);

Step S102, communication between the access server and the first translation proxy server 36, and the first translation proxy server 36 translates the message formats of the RADIUS and DIAMETER protocols to each other;

Foreign proxy server 32 is the client of operation RADIUS agreement, after receiving the RRQ message in the above-mentioned steps S101, according to the flow process of RADIUS agreement, should send AR message to foreign local authentication server 34, for this other local proxy server 32 at first sends AR message to A first translation proxy server 36 . The first translation proxy server 36 translates and generates an AMR message according to the AR message sent by the foreign proxy server 32 .

Step S103, communication between the first translation proxy server 36 and the authentication server; specifically includes:

The first translation proxy server 36 sends the AMR message to the foreign authentication server 34 .

When the home proxy server 33, the foreign authentication server 34 and the local authentication server 35 run the same AAA protocol, the communication between them operates according to the prior art, and there is no need to introduce a translation proxy server.

Preferably, in the embodiment shown in Figure 3, wherein the network access server (foreign proxy server 32 and home proxy server 33) is a client of the RADIUS protocol, and the authentication server (foreign authentication server 34 and local authentication server 35) is The server of DIAMETER agreement; Since home proxy server 33 and local authentication server 35 operate different AAA agreements respectively, present embodiment also introduces the second translation proxy server 37 between home proxy server 33 and local authentication server 35, message flow sees appendix Fig. 4, therefore compatible method of the present invention also comprises the following steps:

Step S104, communication between the foreign authentication server 34 and the local authentication server; specifically, the foreign authentication server 34 forwards the AMR message to the local authentication server 35;

Step S105, the local authentication server 35 communicates with the second translation proxy server 37, and the second translation proxy server 37 translates the message formats of the RADIUS and DIAMETER protocols to each other;

The local authentication server 35 is a server running the DIAMETER protocol. After receiving the AMR, the mobile node 31 will be verified according to the information in the AMR. After the verification is passed, a HAR message should be generated and sent to the home agent server 33. For this reason, the local authentication server 35 first The HAR message is sent to the second translation proxy server 37 .

After receiving the HAR message, the second translation proxy server 37 translates and generates an RRQ message according to the information therein.

Step S106 , communication between the second translation proxy server 37 and the home proxy server 33 . Specifically, the second translation proxy server 37 sends the RRQ message generated by translation to the home proxy server 33 .

The home agent server 33 will send a registration reply message, the message will be processed in the reverse direction of steps S101-S106 and send the registration reply message back to the MN 31 to complete the registration. The inverse process is described in detail below.

Preferably, the compatible method of the present invention also includes the step of processing the registration reply message of the home agent server 33:

Step S107, process the registration reply message sent by the home agent server and send it back to the mobile node to complete the registration. Specifically include the following steps, these steps are opposite to the message sending direction of the above-mentioned steps S101-S106, for the convenience of reading, the sequence description of steps S106'-S101' is adopted:

Step S106 ', the home proxy server 33 is the client that runs RADIUS protocol, after receiving the RRQ message in the step 106, the registration request therein is processed, and then the registration reply (RRP) message is sent to the second translation proxy server 37.

Step S105', after receiving the RRP message from the home agent server 33, the second translation proxy server 37 generates an HAA message according to the information in the RRP and the previously obtained HAR message, and sends it to the local authentication server 35.

Step S104', after receiving the HAA, the local authentication server 35 generates an AMA message and sends it to the foreign authentication server 34.

In step S103', the foreign authentication server 34 should send the AMA message to the foreign proxy server 32. For this reason, the foreign authentication server 34 first sends the AMA message to the first translation proxy server 36.

Step S102', after the first translation proxy server 36 receives the AMA message, it translates and generates an RRP message and an AA message according to the information therein, and sends them to the foreign proxy server 32.

Step S101', the foreign agent server 32 receives the RRP message and the AA message, sets up the MSA between the foreign agent server 32, the mobile node 31 and the home agent server 33 according to the information in the AA message, and forwards the RRP message to the mobile node 31, and completes Registration of the mobile node 31.

As shown in Figure 3, a mobile IP application system based on RADIUS and DIAMETER protocols includes:

The foreign agent server 32 communicates with the mobile node 31, and is used to act as an agent for the mobile node 31 to access the network;

The first translation proxy server 36 is arranged between the foreign proxy server 32 and the foreign authentication server 34, and is used to translate the message formats of the RADIUS and DIAMETER protocols mutually;

The foreign authentication server 34 communicates with the foreign agent server 32 through the first translation agent server 36, and is used to transfer messages between the foreign agent server 32 and the local authentication server 35;

The local authentication server 35 communicates with the foreign authentication server 34 .

Preferably, the system also includes: a second translation proxy server 37, which is used to translate the message formats of the RADIUS and DIAMETER protocols mutually; The server communicates.

The foreign proxy server 32 and the home proxy server 33 are client servers running the RADIUS protocol, and the foreign authentication server 34 and the local authentication server are servers running the DIAMETER protocol.

Example 2

Accompanying drawing 5 is the network topological diagram of another embodiment of the compatible method that realizes the mobile IP application based on RADIUS and DIAMETER protocol of the present invention, wherein foreign agent server 52 and home agent server 53, these two access servers are running DIAMETER The client side of the protocol, the foreign authentication server 54 and the local authentication server 55 are servers running the RADIUS protocol, and a translation proxy server (TA) network entity is introduced between the client terminal of the AAA system and the server of the AAA system, that is, the proxy server 52 in the foreign region A first translation proxy server 56 is introduced between the foreign authentication server 54 and a second translation proxy server 57 is introduced between the home proxy server 53 and the local authentication server 55 . The message flow of this embodiment is shown in Fig. 6 . In conjunction with accompanying drawing 5 and 6, the compatible method of the mobile IP application based on RADIUS and DIAMETER agreement of the present invention comprises the steps:

Step S201, communication between the mobile node 51 and the access server;

That is, the mobile node 51 sends an RRQ message to the foreign proxy server 52 .

Step S202, the access server communicates with the first translation proxy server 56, and the first translation proxy server 56 translates the message formats of the RADIUS and DIAMETER protocols to each other;

The foreign proxy server 52 is a client running the DIAMETER protocol. After receiving the RRQ message, it should generate an AMR message and send it to the foreign authentication server 54. For this reason, the foreign proxy server 52 first sends the AMR message to the first translation proxy server 56. The first translation proxy server 56 translates the AMR message into an AR message of the RADIUS protocol according to the AMR message sent by the foreign proxy server 52 .

Step S203, communication between the first translation proxy server 56 and the authentication server; specifically includes:

The first translation proxy server 56 sends the AR message of the RADIUS protocol to the foreign authentication server 54; preferably, step S203 also includes: the first translation proxy server 56 sends the information related to registration in the AMR sent by the foreign proxy server 52, namely The MIP-Reg-Request AVP in the AMR is sent to the second translation proxy server 57.

Step S204, communication between the foreign authentication server 54 and the local authentication server; specifically, the foreign authentication server 54 forwards the AR message to the local authentication server 55;

Step S205, communication between the local authentication server 55 and the second translation proxy server 57, and the second translation proxy server 57 translates the message formats of the RADIUS and DIAMETER protocols to each other;

The local authentication server 55 is a server running the RADIUS protocol, and verifies the mobile node 51 and the foreign agent server 52 information in the AR message, and sends the AA message to the second translation proxy server 57 after passing the verification (this can be done by the second translation proxy server 57). The proxy server 57 is deployed at the network access point of the local authentication server 55 to realize);

The second translation proxy server 57 generates a HAR message by using the registration-related information (ie MIP-Reg-Request AVP) obtained in the above step S203 and the AA message.

Preferably, step S205 also includes: when the local authentication server 55 sends the AA message to the second translation proxy server 57, it also sends the AA message to the foreign authentication server 54; after receiving the AA message, the foreign authentication server 54 sends it Forwarded to the first translation proxy server 56.

Step S206 , communication between the second translation proxy server 57 and the home proxy server 53 . Specifically, the second translation proxy server 57 sends the HAR message generated by translation to the home proxy server 53 .

The home agent server 53 will send a registration reply message, which will be sent back to the mobile node 51 to complete the registration. This process is described in detail below.

Preferably, the compatible method of the present invention also includes the step of processing the registration reply message of the home agent server 53:

Step S207, process the registration reply message sent by the home agent server and send it back to the mobile node to complete the registration. Concretely include the following steps, for the convenience of reading, adopt the sequential description of steps S205'-S201':

Step S205', the home agent server 53 is a client running the DIAMETER protocol, it processes the registration request of the mobile node 51 according to the HAR message, and then replies the HAA message to the second translation proxy server 57.

Step S204', the second translation proxy server 57 forwards the MIP-Reg-Reply AVP in the HAA message to the first translation proxy server 56 after receiving the HAA message.

Step S203', after the first translation proxy server 56 receives the MIP-Reg-Reply AVP, use the MIP-Reg-Reply AVP and the AA message received in the previous step S205 to generate an AMA message, and send it to the foreign proxy server 52.

Step S202', after receiving the AMA message, the foreign agent server 52 uses the security-related information therein to set up the MSA between the foreign agent server 52 and the mobile node 51, the foreign agent server 52 and the home agent server 53 and sends an RRP message to the mobile node 51.

In step S201', the mobile node 51 receives the RRP message and completes the registration.

As shown in Figure 5, a mobile IP application system based on RADIUS and DIAMETER protocols includes:

The foreign agent server 52 communicates with the mobile node 51, and is used to access the network on behalf of the mobile node 51;

The first translation proxy server 56 is arranged between the foreign proxy server 52 and the foreign authentication server 54, and is used for mutual translation of the message formats of the RADIUS and DIAMETER protocols;

The foreign authentication server 54 is configured to communicate with the foreign proxy server 52 through the first translation proxy server 56 .

Preferably, the system further includes a local authentication server 55 communicating with the foreign authentication server 54 for authenticating the mobile node 51 .

Preferably, the system also includes: a second translation proxy server 57, which is used to translate the message formats of the RADIUS and DIAMETER protocols; communication between servers; communication between said first and second translation proxy servers.

The foreign proxy server 52 and the home proxy server 53 are client servers running the DIAMETER protocol, and the foreign authentication server 54 and the local authentication server are servers running the RADIUS protocol.

The method for the first and second translation proxy servers to translate the message formats of the RADIUS and DIAMETER protocols is the same as that in Embodiment 1.

Example 3

For the purposes of the present invention, the present invention provides embodiment 3 when the foreign authentication server (AAAF) and the home authentication server (AAAH) run different AAA protocols. Embodiment 3 of the present invention is on the basis of Embodiment 1 (or 2) to set up a third translation proxy server between the foreign authentication server and the local authentication server, which is used to translate the two translations between the foreign authentication server and the local authentication server. The AAA protocol messages are mutually translated, and other steps are the same as those in Embodiment 1 (or 2).

Corresponding to the compatible method of this implementation, a system of mobile IP applications based on RADIUS and DIAMETER protocols, including:

The foreign agent server communicates with the mobile node and is used to act as an agent for the mobile node to access the network;

The foreign authentication server communicates with the foreign proxy server;

The local authentication server communicates with the foreign authentication server through a third translation proxy server; the third translation proxy server is used to translate message formats of RADIUS and DIAMETER protocols to each other.

Preferably, the system further includes: a home proxy server communicating with the local authentication server.

Preferably, if the foreign proxy server and the foreign authentication server run different AAA protocols, the system further includes: a first translation proxy server, and the foreign proxy server communicates with the The foreign authentication server communicates; the first translation proxy server is used for mutual translation of message formats of RADIUS and DIAMETER protocols.

Preferably, if the home agent server and the local authentication server run different AAA protocols, the system further includes: a second translation proxy server, and the home agent server communicates with the local authentication server through the second translation proxy server The authentication server communicates, and the second translation proxy server is used for mutually translating message formats of the RADIUS and DIAMETER protocols.

The method for the first, second and third translation proxy servers to translate the message formats of the RADIUS and DIAMETER protocols is the same as that in Embodiment 1.

Example 4

Accompanying drawing 7 is the network topology diagram of another embodiment of the compatible method for implementing the mobile IP application based on the RADIUS and DIAMETER protocols of the present invention. The scene of this embodiment is that the mobile node 71 is located in the home domain and directly registers with the home proxy server 72 . Wherein, the home agent server 72 is a client running the RADIUS protocol, and the local authentication server 74 is a server running the DIAMETER protocol, between the client (i.e. the home agent server 72) of the AAA system and the server (local authentication server 74) of the AM system A translation proxy server (TA) network entity is introduced, that is, a translation proxy server 73 is introduced between the home proxy server 72 and the home authentication server 74 . The message flow of this embodiment is shown in Fig. 8 . In conjunction with accompanying drawing 7 and 8, the compatible method of the mobile IP application based on RADIUS and DIAMETER agreement of the present invention comprises the steps:

Step S401, communication between the mobile node 71 and the access server 72;

That is, the mobile node 71 sends an RRQ message to the home agent server 72 .

Step S402, communication between the access server 72 and the translation proxy server 73, and the translation proxy server 73 translates the message formats of the RADIUS and DIAMETER protocols to each other;

The home proxy server 72 is a client running the RADIUS protocol. After receiving the RRQ message, it should generate an AR message and send it to the local authentication server 74. For this reason, the home proxy server 72 first sends the AR message to the translation proxy server 73. The translation proxy server 73 translates the AR message into an AMR message of the DIAMETER protocol according to the AR message sent by the home proxy server 72 .

Step S403, communication between the translation proxy server 73 and the authentication server 74;

That is, the translation proxy server 73 sends the AMR message to the local authentication server 74 . The local authentication server 74 is a server running the DIAMETER protocol. After receiving the AMR, it will verify the mobile node 71 according to the information in the AMR. After the verification is passed, it should generate an AMA message to reply to the home agent server 72. In order to reply the generated AMA message to the home agent server 72, and complete the registration, the method of this embodiment also includes:

Step S404, the authentication server 74 sends a message to the translation proxy server 73;

That is, the local authentication server 74 sends the generated AMA message to the translation proxy server 73, and the translation proxy server 73 translates the message formats of the RADIUS and DIAMETER protocols mutually;

Since the home agent server 72 is a client running the RADIUS protocol, the translation proxy server 73 translates the received AMA message into a corresponding RADIUS message AA.

Step S405, the translation proxy server 73 communicates with the home proxy server 72;

The translation proxy server sends the generated AA message to the home proxy server 72 . The home agent server is a client running the RADIUS protocol, and needs to generate an RRP message and send it to the mobile node 71 after receiving the AA message.

Step S406, communication between the home agent server 72 and the mobile node 71;

The home agent server 72 sends an RRP message to the mobile node 71 to complete the registration process of the mobile node.

As shown in Figure 7, a mobile IP application system based on RADIUS and DIAMETER protocols includes:

The home agent server 72 communicates with the mobile node 71 and is used to access the network on behalf of the mobile node 71;

The translation proxy server 73 is arranged between the home proxy server 72 and the local authentication server 74, and is used for mutually translating the message formats of the RADIUS and DIAMETER protocols;

The local authentication server 74 communicates with the home proxy server 32 through the translation proxy server 73 .

One of the home proxy server 72 and the local authentication server 74 runs the RADIUS protocol, and the other runs the DIAMETER protocol. For example, the home proxy server 72 is a client server running the RADIUS protocol, and the local authentication server 74 is a server running the DIAMETER protocol.

It can be seen from the detailed description of the above embodiments that the present invention can achieve a mobile IP application compatible with RADIUS and DIAMETER protocols without changing the original network structure and functions of the network entity by setting the translation proxy server network entity in the network the goal of.

Beneficial effects of the present invention:

By adopting the solution described in the present invention, not only can network entities running different AAA protocols work together, but also because of the use of the DIAMETER protocol mobile IP process, the registration and authentication processes of the network entities of the RADIUS protocol are combined into one, improving the efficiency.

The technical scheme of the present invention fully conforms to the network structure described by the mobile IP application of the RADIUS and DIAMETER protocols. On the premise of not changing the original network structure and network entity functions, RADIUS and DIAMETER can be realized only by introducing a few network entities. The compatibility of the network entities of the protocol makes the transition from the RADIUS protocol to the DIAMETER protocol more stable.

The above-mentioned content is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present invention. , should be covered within the protection scope of the present invention.

Claims (14)

1, a kind of compatibility method of using based on the mobile IP of RADIUS and DIAMETER agreement is characterized in that, comprises the steps:

Step S1, communication between mobile node and the access server;

Step S2, communication between access server and the translation acting server, described translation acting server is translated the message format of RADIUS and DIAMETER agreement mutually;

Step S3, communication between described translation acting server and the certificate server;

Wherein, one of them operation radius protocol of described access server and described certificate server, another operation DIAMETER agreement.

2, the compatibility method of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 1, it is characterized in that, described access server among the step S1 is the foreign agent services device, and correspondingly the described certificate server among the step S3 is nonlocal certificate server; Perhaps, the described access server among the step S1 is the home agent services device, and correspondingly the described certificate server among the step S3 is the local authentication server.

3, the compatibility method of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 2, it is characterized in that, described access server in step S1 is the foreign agent services device, when correspondingly the described certificate server among the step S3 is nonlocal certificate server, also comprises:

Step S4, communication between described nonlocal certificate server and the local authentication server;

Step S5, communication between the described local authentication server and the second translation acting server, the described second translation acting server is translated the message format of RADIUS and DIAMETER agreement mutually;

Step S6, communication between described second translation acting server and the home agent services device;

Wherein, one of them operation radius protocol of described local authentication server and described home agent services device, another operation DIAMETER agreement.

4, the compatibility method of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 3, it is characterized in that, when described home agent services device and described foreign agent services device operation DIAMETER agreement, when described nonlocal certificate server and described local authentication server operation radius protocol, described step S3 also comprises:

Communication between described translation acting server and the described second translation acting server.

5, the compatibility method of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 3 is characterized in that, also comprises:

In step S4, carry out communication by the 3rd translation acting server between described nonlocal certificate server and the described local authentication server, described the 3rd translation acting server is translated the message format of RADIUS and DIAMETER agreement mutually; One of them operation radius protocol of wherein said nonlocal certificate server and described local authentication server, another operation DIAMETER agreement.

6, according to the described compatibility method of using based on the mobile IP of RADIUS and DIAMETER agreement of claim 3 to 5, it is characterized in that, also comprise:

Step S7 handles and sends back to mobile node to the registration answer message that the home agent services device sends, and finishes the mobile node registration.

7, the compatibility method of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 1, it is characterized in that, in step S2, the method that described translation acting server is translated the message format of RADIUS and DIAMETER agreement mutually comprises:

The mobile node request message of DIAMETER agreement and the access request message of RADIUS are translated mutually;

The mobile node response message of DIAMETER agreement and the access permission of radius protocol and refuse information and registration are replied message and are translated mutually; MIP-MA-Type attribute in wherein said access permission and the refuse information is provided with, and what be used to represent this message correspondence is DIAMETER protocol message between local authentication server or nonlocal certificate server and the foreign agent services device;

The home agent request message of DIAMETER agreement and the login request message of radius protocol are translated mutually;

The home agent response message of DIAMETER agreement and the access permission/refuse information of radius protocol and registration are replied message and are translated mutually; MIP-MA-Type attribute in wherein said access permission and the refuse information is provided with, and what be used to represent this message correspondence is DIAMETER protocol message between home agent services device and the local authentication server.

8, a kind of compatible system of using based on the mobile IP of RADIUS and DIAMETER agreement is characterized in that, comprises

Access server carries out communication with mobile node, is used for the proxy mobile node access network;

The translation acting server is arranged between described access server and the certificate server, is used for the message format of RADIUS and DIAMETER agreement is translated mutually;

Certificate server is used for carrying out communication by described translation acting server and described access server;

Wherein, one of them operation radius protocol of described access server and described certificate server, another operation DIAMETER agreement.

9, the compatible system of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 8 is characterized in that described access server is the foreign agent services device, and correspondingly described certificate server is nonlocal certificate server; Perhaps, described access server is the home agent services device, and correspondingly described certificate server is the local authentication server.

10, the compatible system of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 9, it is characterized in that, when described access server is the foreign agent services device, when correspondingly described certificate server is nonlocal certificate server, also comprise: the local authentication server, carry out communication with described nonlocal certificate server.

11, the compatible system of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 10 is characterized in that, also comprises: the home agent services device, carry out communication by the second translation acting server and described local authentication server; The described second translation acting server is used for the message format of RADIUS and DIAMETER agreement is translated mutually, one of them operation radius protocol of wherein said home agent services device and described local authentication server, another operation DIAMETER agreement.

12, the compatible system of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 11, it is characterized in that, when described foreign agent services device and described home agent services device is the server of operation DIAMETER agreement, when described nonlocal certificate server and described local authentication server were the server of operation radius protocol, the described translation acting server and the second translation acting server carried out communication.

13, the compatible system of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 10, it is characterized in that, also comprise: when one of them operation radius protocol of described nonlocal certificate server and described local authentication server, during another operation DIAMETER agreement, described local authentication server carries out communication by the 3rd translation acting server and described nonlocal certificate server; Described the 3rd translation acting server is used for the message format of RADIUS and DIAMETER agreement is translated mutually.

14, the compatible system of using based on the mobile IP of RADIUS and DIAMETER agreement according to claim 8 is characterized in that described translation acting server is translated the message format of RADIUS and DIAMETER agreement mutually and comprised:

The mobile node request message of DIAMETER agreement and the access request message of RADIUS are translated mutually;

The mobile node response message of DIAMETER agreement and the access permission of radius protocol and refuse information and registration are replied message and are translated mutually; MIP-MA-Type attribute in wherein said access permission and the refuse information is provided with, and what be used to represent this message correspondence is DIAMETER protocol message between local authentication server or nonlocal certificate server and the foreign agent services device;

The home agent request message of DIAMETER agreement and the login request message of radius protocol are translated mutually;

The home agent response message of DIAMETER agreement and the access permission/refuse information of radius protocol and registration are replied message and are translated mutually; MIP-MA-Type attribute in wherein said access permission and the refuse information is provided with, and what be used to represent this message correspondence is DIAMETER protocol message between home agent services device and the local authentication server.

Images