CN1248447C - Broadband network access method - Google Patents

Abstract

The invention discloses a broadband network access method. In the method, when a user terminal sends out a DHCP request message, after receiving the DHCP request message from the user terminal, the DHCP relay server performs authentication and legality on the user according to the message. Check, if the inspection is passed, the DHCP request message of the user terminal is forwarded to the DHCP server, and the DHCP server assigns an IP address for the user terminal, and records the network initialization information such as the IP address in the DHCP response message, and the The DHCP relay server forwards the DHCP response message to the user terminal, and the user terminal obtains an IP address and then accesses the network; otherwise, the DHCP request message of the user terminal is discarded, and the network access of the user is terminated; the invention can restrict illegal users Access to the network improves the security of network access.

Description

A broadband network access method

technical field

The invention relates to a wireless network access method, in particular to a broadband wireless network access method.

Background technique

In a broadband network, if a user terminal sends a network access request, the server responsible for IP address allocation in the network will assign an Internet (IP) address to the user terminal that sends the network access request, so that the user terminal can access the network. At present, the server responsible for IP address allocation in the broadband network, that is, the DHCP server adopts the standard Dynamic Host Configuration Protocol (DHCP, Dynamic Host Configuration Protocol), so that the user terminal can automatically obtain the IP address from the DHCP server and other network initialization when accessing the network. information. When a user terminal accesses the network, the user terminal first sends a DHCP request message to apply for access to the network. After receiving the request message, the DHCP relay server forwards it to the DHCP server, and the DHCP server receives the DHCP request message from the user terminal. After the request message, record the network initialization information such as the IP address assigned to the user in the DHCP response message, and send it to the DHCP relay server, and then the DHCP relay server will transfer the received DHCP response message of the DHCP server to the DHCP server. User terminal, the user terminal obtains an IP address, so that the user terminal accesses the network. As can be seen from the above process, with the existing network access method, as long as the user terminal initiates a DHCP request, no matter whether it is an illegal user or a legal user, the DHCP server will assign an IP address to the user, which not only causes a waste of IP addresses, but also creates a problem for illegal users. It provides an opportunity to surf the Internet without authentication and billing. What is more serious is that if illegal users continuously initiate DHCP requests maliciously, all IP addresses in the DHCP server address pool will be exhausted and cannot be controlled. Therefore, the existing network The access method is less secure.

Contents of the invention

The purpose of the present invention is to provide a broadband network access method with better security, which can restrict illegal users from accessing the network.

In order to achieve the above object, the secure access method of the broadband network provided by the present invention includes:

(1) The user terminal sends a DHCP request message to the DHCP relay server;

(2) After the DHCP relay server receives the DHCP request message of the user terminal, the user is authenticated and checked according to the message. If the check is passed, the DHCP request message of the user terminal is forwarded to the DHCP server, and then Step (3), otherwise the DHCP request message of the user terminal is discarded, and the network access of the user is terminated;

(3) After the DHCP server receives the DHCP request message of the user terminal, it distributes an IP address for the user terminal, and records network initialization information such as the IP address in the DHCP response message, and sends it to the DHCP relay server;

(4) The DHCP relay server forwards the received DHCP response message from the DHCP server to the user terminal, and the user terminal obtains its own IP address and then accesses the network.

Described step (1) is finished by following steps:

(A1) The user terminal sends a DHCP request message to the Layer 2 access device in the network;

(A2) The Layer 2 access device in the network forwards the DHCP request message to the DHOP relay server.

The Layer 2 access device described in the above step (A1) is a network switch.

The above step (A1) further includes: adding a virtual network (VLAN) tag to the DHCP request message by the layer 2 access device, and the VLAN tag identifies the virtual network identifier (VLANID) of the user port accessed by the layer 2 access device.

According to the message in the above step (2), the user is authenticated and legality checked through the VLANID in the DHCP request message.

Since the present invention sends a network access request message through the user terminal at the DHCP relay server to perform authentication and legality checks on it, and filters the DHCP request message of the user terminal according to the check result, and only reports the DHCP request message of the legal user. The text is forwarded to the DHCP server. In this way, the security loopholes of the DHCP protocol itself are made up. In actual implementation, there is no need to change the existing DHCP server software. It is only necessary to modify and expand the DHCP relay, which is convenient for application; The invention can restrict illegal users from accessing the network, and improves the security of network access.

Description of drawings

Fig. 1 is the flow chart of the first embodiment of the method of the present invention;

Fig. 2 is the flow chart of the second embodiment of the method of the present invention;

Figure 3 is an Ethernet frame with an 802.1Q tag header;

Figure 4 is an 802.1Q tag header containing tag protocol identification and tag control information.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings.

At present, in broadband access, user terminals generally access the network through Layer 2 switching equipment, and the most common Layer 2 switching equipment supports the 802.1Q protocol (which is formulated by the IEEE (Institute of Electrical and Electronics Realize a standard protocol of virtual local area network) Ethernet Layer 2 switch (LANSWITCH, Local Area Network Switch). All the messages sent by the user terminals connected by LANSWITCH can be added with a special tag for user terminal identification. In practice, the tag can be a VLAN (Virtual Local Area Network: virtual local area network) tag. A specific physical interface through which the user terminal accesses the LANSWITCH can be uniquely identified. Therefore, the DHCP relay server in the network can use this VLAN tag to implement user authentication and legitimacy check.

Fig. 1 is a flow chart of the first embodiment of the method of the present invention, which is realized by layer 2 network devices in the network, namely network switch, DHCP relay server and DHCP server. As shown in Figure 1, in step 1, the user terminal sends a DHCP request message to the network switch LANSWITCH in the network. The existing LANSWITCH usually supports the 8021.Q protocol, and the message in Ethernet format sent by the user from the access port After passing through the switch, a VLAN header will be added to identify the port position that the user accesses. The packet format encapsulated according to the 802.1Q protocol is to add an 802.1Q frame header after the source address in the original Ethernet frame header, followed by the length or type field of the original Ethernet, refer to Figure 3. The 802.1Q tag header includes a tag protocol identifier (TPID-TagProtocol Identifier), indicating that this is a message with an 802.1Q tag added, and also includes tag control information (TCI-Tag Control Information), the above tag protocol identifier and tag control Refer to Figure 4 for information. The information of the tag header described in Figure 4 includes:

Virtual network identification (VLAN Identified, VLANID), which is a 12-bit domain, indicates the ID of the VLAN, and is used to indicate which VLAN the message belongs to, and is an identification based on port authentication.

Canonical Format Indicator (CFI: Canonical Format Indicator), used for the frame format when bus-type Ethernet exchanges data with FDDI and Token Ring.

Priority (Priority), the bit indicates the priority of the frame, which is used to send the data packet first when the switch is blocked.

Due to the addition of the 802.1Q tag header, even if the user interrupt does not support 802.1Q, that is, the Ethernet frame header of the data packet sent by the computer does not contain this information, as long as the LANSWITCH passes through the LANSWITCH, the VLAN header can be added by the LANSWITCH. Legitimacy verification.

Based on step 1, the LANSWITCH device in the network in step 2 forwards the DHCP request message to the DHCP relay server. In this way, the DHCP relay server receives the DHCP request message of the user terminal in step 3, and then authenticates and checks the validity of the user through the VLANID in the DHCP request message in step 4. If the check is passed, the DHCP request message of the user terminal is passed. The message is forwarded to the DHCP server, and then step 6 is performed. The DHCP server receives the DHCP request message of the user terminal, allocates an IP address for the user terminal, and records network initialization information such as the IP address in the DHCP response message, and sends it to the DHCP server. relay server. Finally in step 7, the DHCP relay server forwards the received DHCP response message from the DHCP server to the user terminal, and the user terminal obtains the IP address assigned to itself and then accesses the network; if the legality check in step 4 fails , the DHCP request message of the user terminal is discarded in step 5, and the network access of the user is terminated.

Fig. 2 is a flow chart of the second embodiment of the method of the present invention, which is realized by a DHCP relay server and a DHCP server in the network. At first in step 11, the user terminal sends a DHCP request message to the DHCP relay server; after the DHCP relay server receives the DHCP request message of the user terminal in step 12, the user is authenticated and checked according to the message, if the check Pass, the DHCP request message of this user terminal is forwarded to the DHCP server; The DHCP server receives the DHCP request message of the user terminal in step 14, distributes the IP address for the user terminal, and records network initialization information such as the IP address in the DHCP response In the message, it is sent to the DHCP relay server; finally in step 15, the DHCP relay server forwards the received DHCP response message of the DHCP server to the user terminal, and the user terminal obtains the IP address assigned to itself and then accesses the network. If in step 12 the authentication and validity check for the user fails, then in step 13 the DHCP request message of the user terminal is discarded, and the user's network access is terminated.

It should be noted that if the embodiment in Figure 2 is adopted, in order to authenticate and check the validity of the user in step 12, it is necessary to add user identification information to the message sent by the user terminal in step 11. The method determines the information, so that the user can be authenticated and legally checked by the DHCP relay server in step 12, thereby isolating illegal users.

Claims (2)

1, a kind of broadband network access method comprises:

(1) the two layer access device of user terminal in network send the DHCP request message, and two layers of access device in the network are transmitted to the DHCP relay server with the DHCP request message: described DHCP is a DHCP;

(2) after the DHCP relay server is received the DHCP request message of user terminal, according to message the user is authenticated and validity checking, pass through if check, be given to Dynamic Host Configuration Protocol server in the DHCP request message with this user terminal, change step (3) then, otherwise abandon the DHCP request message of this user terminal, stop this user's network insertion;

(3) after Dynamic Host Configuration Protocol server is received the DHCP request message of user terminal, be this user terminal distributing IP address, and netinit information such as IP address are documented in the dhcp response message, issue the DHCP relay server;

(4) the DHCP relay server is transmitted to user terminal with the dhcp response message of the Dynamic Host Configuration Protocol server received, and user terminal obtains to distribute to IP address and then the access network of oneself;

It is characterized in that: when the two layer access device of user terminal in network send the DHCP request message, two layers of access device add virtual network (VLAN) label in the DHCP request message, two layers of access device of this VLAN tag identifier insert the virtual network sign (VLANID) of user port.

2, the cut-in method of broadband network according to claim 1 is characterized in that: the described user authentication with validity checking according to message of step (2) undertaken by the VLANID in the DHCP request message.