WO2009089773A1

WO2009089773A1 - Multi-host access authentication method and system for wimax network

Info

Publication number: WO2009089773A1
Application number: PCT/CN2009/070035
Authority: WO
Inventors: Wenliang Liang; Wei Zhang; Liang Gu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2008-01-08
Filing date: 2009-01-05
Publication date: 2009-07-23
Also published as: CN101483521A; CN101483521B

Abstract

A multi-host access authentication method and system for WiMAX network, the method includes that: after an access request message from a host is received, a label information of the host which is carried in an authentication start message is sent to an authentication network element; according to the received label information carried in an authentication response message which is from the authentication network element, the authentication response message is transmitted to the host corresponding to the label information, in order to the host performs access authentication with an authentication server after it receives the authentication response message, and the authentication server sends an authentication result to the authentication network element; and the authentication result sent by the authentication network element is received. The system includes a node of network element, a base station, a NAS, and an authentication server. Application of the present invention enables the node of network element to acquire the authentication result of the host, and decide whether an authorization port will be opened or closed according to the authentication result, application of the present invention also can avoid the lawless access of a lawless user, and improve the security of the system.

Description

Multi-master authentication method and system for WiMAX network This application claims to be submitted to the Chinese Patent Office on January 8, 2008, application number 200810055741.4, and the Chinese patent entitled "Multi-host Access Authentication Method and System for WiMAX Network" Priority of the application, the entire contents of which are incorporated herein by reference. Technical field

The present invention relates to the field of communications technologies, and in particular, to a global interoperability for microwave access.

( Worldwide Interoperability Microwave Access, Cartridge: WiMAX) Multi-host access authentication method and system for the network. Background technique

The WiMAX system is an Internet wireless access system. With the rapid development of Internet services and the widespread use of wireless networks, existing WiMAX systems can be divided into multi-host scenarios and non-multi-host scenarios in the form of networking.

As shown in FIG. 1 , it is a flow chart of access authentication signaling for a non-multi-host scenario. The Supplicant mobile station (Mobile Station, the so-called: MS) carries the Extensible Authentication Protocol (EAP) message on the air interface in the private key management (Privacy Key Management). PKM) v2 protocol message; access service network (Access Service Network, ASN) internal base station (Base Station, cartridge: BS) and gateway (gateWay, cartridge: GW) carry EAP messages between The authentication delay (Auth. Relay) protocol message; the ESN message is carried in the RADIUS message between the ASN and the Connective Service Network (CSN). PKMv2 is a set of private key management protocol version 2 defined in the 802.16e protocol, used for key security association management on the air interface, and carries EAP data; the authentication delay protocol is a set defined by the WiMAX access network. Protocol for EAP data. LAN Extensible Authentication Protocol (Extensible Authentication Protocol over LAN, EAPoL is an authentication bearer protocol on the LAN. It is mainly used to encapsulate EAP data through Ethernet packets.

In a non-multi-host scenario, when a WiMAX network access process is selected, different ASNs broadcast the network service provider (Network Service Provider, NSP) information to which they are connected, including the directly connected NSP and the roaming protocol. Arrived NSP. Then, the mobile station selects an ASN/NAP to access according to its own subscription information, and gives a network selection result on the network access identifier (NAI) in the access authentication message.

Multi-host scenarios are another form of networking for WiMAX systems that can be deployed in multiple locations at different locations, such as at airports, coffee bars or trains. As shown in Figure 2, it is a schematic diagram of the WiMAX system networking structure in a multi-host scenario. The ASN is composed of one or more wireless base stations and an Access Service Network GateWay (ASN-GW). The ASN acts as a logical entity to manage the IEEE 802.16 air interface and provides wireless access for WiMAX users. The CSN is composed of an accounting server, such as an Authentication Authorization and Accounting (AAA) server, a Home Agent (HA), and an IP Multimedia Subsystem (Internet Protocol Multimedia Subsystem). IMS) The core component for providing IP connectivity, services and management.

Due to the price advantage of wireless Fidelity (Wireless Fidelity) and Ethernet access, and the high market share, WiFi and Ethernet can be used at the end of the layout. HOST) and the gateway mobile station (Gateway MS, cartridge: GMS) can be connected by WiMAX access. The connection between the GMS and the ASN can be via a WiMAX wireless connection. The GMS can access the ASN/CSN network before the HOST access; it can also access the ASN/CSN network after the HOST access.

A disadvantage of the prior art is that when an existing WiMAX system performs access authentication for a host in a multi-host scenario, the EAP message is transmitted as data on the air interface, which is transparent to the BS/GMS. Therefore, neither BS nor GMS knows the results of HOST certification. In some scenarios, GMS needs to know the result of HOST authentication. For example, GMS needs to decide whether to open or close the port according to the authentication result of HOST to avoid illegal access by illegal users. Summary of the invention

The problem to be solved by the present invention is to provide a multi-host access authentication method and system for a WiMAX network capable of enabling the GMS to obtain an authentication result when performing host access authentication.

In order to solve the above problem, an embodiment of the present invention provides a multi-host access authentication method for a WiMAX network, including:

After receiving the access request message from a host, the identifier information of the host is carried in the authentication start message and sent to the authentication network element;

And forwarding, according to the identifier information that is received in the authentication response message from the authentication network element, the authentication response message to a host corresponding to the identifier information, where the host receives the authentication After receiving the response message, the authentication server receives the authentication result sent by the authentication network element.

In order to solve the above problem, another embodiment of the present invention provides a network element node, including:

a first network element module, configured to: after receiving an access request message from a host, carry the identifier information of the host in an authentication start message for sending;

The second network element module is configured to forward the authentication response message to the host corresponding to the identifier information according to the identifier information carried in the received first authentication response message.

In order to solve the above problem, another embodiment of the present invention provides a multi-host access authentication system for a WiMAX network, including a network element node, a base station, a NAS, and an authentication server, where:

The network element node includes:

a first network element module, configured to: after receiving an access request message from a host, carry the identifier information of the host in an authentication start message for sending; The second network element module is configured to forward the authentication response message to the host corresponding to the identifier information according to the identifier information carried in the received first authentication response message; the base station includes:

a first base station module, configured to send a first authentication request message after receiving an authentication start message from the network element node;

a second base station module, configured to send the received first authentication response message to the network element node;

The NAS includes:

a first network module, configured to: after receiving the first authentication request message from the base station, reply to the first authentication response message;

a second network module, configured to send, by the base station, a first authentication confirmation message from the authentication server to the network element node;

The authentication server includes:

a first authentication module, configured to perform access authentication with the host after receiving the first authentication response message by the host;

The second authentication module is configured to send the authentication result of the first authentication module to the NAS in the first authentication confirmation message.

Through the invention, the network element node obtains the authentication result of the host, and according to the authentication result, the network element node can decide whether to open or close the authorized port, avoid illegal access by the illegal user, and improve the security of the system.

In order to solve the above problem, another embodiment of the present invention further provides a multi-host access authentication system for a WiMAX network, including a host, a network element node, an authentication network element, and an authentication server, where:

The host is configured to send an access request message to the network element node;

The network element node is configured to: after receiving the access request message from a host, the identifier information of the host is carried in the authentication start message and sent to the authentication network element; according to the received authentication network The identifier information carried in the authentication response message is forwarded to the host corresponding to the identifier information, so that the host receives the authentication response message and accesses the authentication server. Certification, and by The result of the certification sent;

The authentication network element is configured to: after receiving an authentication start message from the network element node, reply an authentication response message to the network element node;

The authentication server is configured to perform access authentication with the host, and send the authentication result to the authentication network element.

The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. DRAWINGS

FIG. 1 is a flow chart of access authentication signaling of a WiMAX system in an existing non-multi-host scenario;

2 is a schematic structural diagram of a WiMAX system networking in an existing multi-host scenario; FIG. 3 is a flowchart of a multi-host access authentication method for a WiMAX network according to Embodiment 1 of the present invention;

4A is a flowchart of a multi-host access authentication method for a WiMAX network according to Embodiment 2 of the present invention;

4B is a signaling diagram of a multi-host access authentication method for a WiMAX network according to Embodiment 2 of the present invention;

5A is a flowchart of a multi-host access authentication method for a WiMAX network according to Embodiment 3 of the present invention;

5B is a signaling diagram of a multi-host access authentication method for a WiMAX network according to Embodiment 3 of the present invention;

5C is another signaling diagram of a multi-host access authentication method for a WiMAX network according to Embodiment 3 of the present invention;

5D is a signaling diagram of a tunnel establishment process according to Embodiment 3 of the method of the present invention; FIG. 5E is a diagram illustrating a data plane protocol stack of a tunnel establishment process according to Embodiment 3 of the present invention;

6 is a multi-host access authentication of the WiMAX network according to Embodiment 1 of the system of the present invention; Schematic diagram of the structure of the certificate system;

7 is a schematic structural diagram of a multi-host access authentication system of a WiMAX network according to Embodiment 2 of the present invention;

FIG. 8 is a schematic structural diagram of a multi-host access authentication system of another WiMAX network according to Embodiment 2 of the present invention. detailed description

Method embodiment 1

This embodiment provides a multi-host access authentication method for a WiMAX network, as shown in FIG. 3, including:

Step 101: After receiving the access request message from a host, the network element node carries the identifier information of the host in the authentication start message and sends it to the base station (Base Station, BS: BS) of the network side.

It should be noted that the network element node may be a node having a gateway access function or the like, such as a GMS. For the convenience of the description, in the embodiment and the following embodiments, only the GMS is used as an example. For other types of network element nodes, the corresponding method or structure is similar to that of the GMS, and details are not described herein again.

The above host refers to a host in the WiMAX system in a multi-host scenario. Specifically, when the access authentication is requested, the host may send the EAPoL/EAP-START signaling as an access request message, and after the GMS detects that the EAPoL/EAP-START signaling is an EAPoL format data packet, the EAPoL may be used. /EAP-START signaling is converted into PKMv2/EAP-START signaling, and the identifier information of the host is carried in the PKMv2/EAP-START signaling and sent to the base station, where the identifier information may be media access control with the host (Media Access Control, cartridge: MAC) Address associated information.

Step 102: After receiving the authentication start message, the base station sends an authentication request message to the authentication network element.

The authentication NE is the network element used to authenticate the host. The specific network architecture of WiMAX varies. For example, a network dedicated to authenticating a host can be given to a network authentication server (NAS), or a remote broadband access server ( Broadband) connected to a back-end network. Remote Access Server, cartridge: BRAS).

Step 103: The authentication network element returns an authentication response message to the GMS.

Specifically, the authentication response message may be first replied to the base station, and then the base station encapsulates the authentication response message into a corresponding signaling format and forwards the message to the GMS.

Step 104: The GMS forwards the authentication response message to the host corresponding to the identifier information according to the identifier information carried in the authentication response message.

Specifically, the authentication response message may be first converted into a corresponding signaling format and then forwarded to the host.

Step 105: After receiving the authentication response message, the host performs access authentication with the authentication server, and the authentication server carries the authentication result in the authentication confirmation message and sends the authentication result to the authentication network element.

Step 106: The authentication network element sends the authentication confirmation message to the GMS by using the base station.

In the host authentication process, the authentication request is sent to the authentication server by the authentication network element after the signaling format is converted in the uplink direction. In the downlink direction, the authentication confirmation message is converted to the signaling format by the authentication network element, and then sent to the GMS. .

Step 107: In addition, the GMS may forward the authentication confirmation message to the host corresponding to the identifier information according to the identifier information carried in the authentication confirmation message when needed.

Through the method in this embodiment, the network element node obtains the authentication result of the host. According to the authentication result, the network element node can determine whether to open or close the authorized port, thereby avoiding illegal access by the illegal user, and improving the security of the system. .

Method embodiment 2

The embodiment provides a multi-host access authentication method when the authentication network element in the WiMAX network is a NAS. As shown in FIG. 4A, the method includes:

Step 201: After receiving the access request message from a host, the GMS: The identification information of the machine is carried in the authentication start message and sent to the base station.

The above host refers to a host in the WiMAX system in a multi-host scenario. Specifically, when the access authentication is requested, the host may send the EAPoL/EAP-START signaling as an access request message, and after the GMS detects that the EAPoL/EAP-START signaling is an EAPoL format data packet, the EAPoL may be used. /EAP-START signaling is converted into PKMv2/EAP-START signaling, and the identity information of the host is carried in the PKMv2/EAP-START signaling and sent to the base station.

Step 202: The base station sends a first authentication request message to the NAS after receiving the authentication start message.

Among them, in the multi-host scenario, GMS is the first authentication control point; therefore, the NAS at this time actually plays the role of accessing the AAA proxy on the network, and may also have some control functions. Specifically, the NAS may be a default NAS configured for the BS in advance, and the access terminal under the BS uses the NAS.

Specifically, the first authentication request message may be AR-EAP-START signaling. Step 203: The NAS returns a first authentication response message to the GMS.

Specifically, the AR-EAP-Transfer/Identity-Req signaling may be replied to the base station; and the AR-EAP-Transfer/Identity-Req signaling is encapsulated by the base station into a PKM-RSP/EAP Letter. The order is forwarded to the GMS.

Step 204: The GMS forwards the first authentication response message to the host corresponding to the identifier information according to the identifier information carried in the first authentication response message.

Specifically, the received PKM-RSP/EAP Transfer signaling may be converted into EAPoL-Request signaling and sent to the host.

Step 205: After receiving the first authentication response message, the host performs access authentication with the authentication server, and the authentication server carries the authentication result in the first authentication confirmation message and sends the authentication result to the NAS.

Specifically, in the host authentication process, the authentication data packet includes the foregoing first authentication confirmation message, and the authentication data packet is sent to the authentication server after being converted by the NAS. The signaling format conversion includes conversion from R4/R6 signaling AR-EAP-Transfer to an IP-based RADIUS or DIAMETER authentication protocol on the R3 interface. Step 206: The NAS sends the first authentication confirmation message to the GMS by using the base station.

Specifically, the NAS converts the authentication data packet of the IP-based RADIUS or DIAMETER authentication protocol on the R3 interface into R4/R6 signaling, and then sends the authentication data packet to the PKM message through the base station on the air interface. Send to GMS.

Step 207: In addition, the GMS may further forward the first authentication confirmation message to the host corresponding to the identification information according to the identifier information carried in the first authentication confirmation message. As shown in FIG. 4B, it is a signaling diagram of the method in this embodiment.

Through the method in this embodiment, the host is authenticated, and the GMS is informed of the authentication result of the host. According to the authentication result, the GMS can determine whether to open or close the authorized port, thereby avoiding illegal access by the illegal user. , improve the security of the system.

Method embodiment 3

The embodiment provides a multi-host access authentication method when the authentication network element in the WiM AX network is a BRAS. As shown in FIG. 5A, the method includes:

Step 301: After receiving the access request message from a host, the GMS carries the identifier information of the host in the authentication start message and sends the message to the base station.

Step 302: After receiving the authentication start message, the base station sends a second authentication request message to the BRAS.

Specifically, the sending the second authentication request message may be in various forms. For example, as shown in FIG. 5B, the base station first converts the authentication start message into a second authentication request message in an EAPoL format, and then sends the message to the BRAS. . The second authentication request message may be EAPoL-START signaling. It should be noted that, when the message format is converted, the authentication start message may be sent to the NAS first, and then the NAS converts the authentication start message into a second authentication request message in the EAPoL format, and then sends the message to the BRAS.

Alternatively, as shown in FIG. 5C, after establishing a PPP over Ethernet (PPPoE) session connection with the BRAS, the second authentication request message is forwarded to the BRAS. At this time, the second authentication request message may be EAPoPPP (EAP over Point to Point Protocol, EAP based on peer-to-peer ten) -START Signaling.

Step 303: The BRAS replies to the GMS with a second authentication response message. Specifically, in the signaling process shown in FIG. 5B, the second authentication response message may be EAPoL-Request/Identity signaling; in the signaling process shown in FIG. 5C, the second authentication response message may be EAPoPPP-Request/Identity Signaling.

Step 304: The GMS forwards the second authentication response message to the host corresponding to the identifier information according to the identifier information carried in the second authentication response message.

Step 305: After receiving the second authentication response message, the host performs access authentication with the authentication server, and the authentication server carries the authentication result in the second authentication confirmation message and sends the authentication result to the BRAS.

Specifically, in the host authentication process, the authentication data packet includes the foregoing second authentication confirmation message, and the authentication data packet is converted to a signaling format by the BRAS, and then sent to the authentication server. The signaling format conversion includes: an IP-based RADIUS or DIAMETER authentication protocol converted from EAPoL or EAPoPPP signaling to an R3 interface (an interface between the BRAS and the AAA); or in the opposite direction, based on the R3 interface The authentication data packet of the RADIUS or DIAMETER authentication protocol of the IP is converted into EAPoL or EAPoPPP signaling and sent to the base station, and then encapsulated into a PKM message on the air interface by the base station and sent to the GMS.

It should be specially pointed out here that in order to further improve the efficiency of data transmission, when the authentication is passed, the tunnel establishment process can be started. Specifically, the tunnel between the BRAS and the HA and the tunnel between the HA and the ASN are established. The tunnel between the BRAS and the HA may be a Mobile IP (Mobile IP: MIP) tunnel; the tunnel between the HA and the ASN may be a Proxy Mobile IP (PMIP) tunnel. After the tunnel is established, the host is notified of the authentication result. After the host obtains the result of the authentication, the Ethernet tunnel can be directly used to transmit the Ethernet packet. Specifically, the host may first send the Ethernet packet to the GMS; the GMS sends the Ethernet Convergence Sublayer (Eth-CS) through the air interface. To the foreign agent (Foreign Agent, called FA); FA encapsulates the MIP data, and then forwards it to the HA, and finally forwards it to the BRAS by the HA package.

The specific tunnel establishment process, as shown in the signaling diagram 5D, mainly includes the following steps: After the authentication server obtains the successful authentication result, the HA is notified to establish a tunnel to the BRAS and the key information required for the HA to establish the MIP tunnel, and the authentication is also performed. The successful result is returned to the ASN. After the NAS in the ASN receives the successful authentication result returned by the authentication server, it sends a MIP request (memory: MIP-RRQ) to establish a PMIP tunnel. Its specific data plane protocol stack is shown in Figure 5E.

Step 306: The BRAS sends the second authentication confirmation message to the GMS by using the base station.

Step 307: In addition, the GMS may further forward the second authentication confirmation message to the host corresponding to the identification information according to the identifier information carried in the second authentication confirmation message.

In addition, if the host also informs the ASN of the network layer configuration information during the execution of the above steps, the ASN can continue to perform the Point-to-Point Protocol (PPP) network core protocol (the Point-to-Point Protocol). Network Core Protocol, the process is called: NCP), and then the result is informed to the host; or the host uses the established PPP channel to obtain the high-level configuration information through the dynamic host configuration protocol (Dynamic Host Configuration Protocol). .

Through the method in this embodiment, the host is authenticated by the BRAS, and the GMS is informed of the authentication result of the host. According to the authentication result, the GMS can determine whether to open or close the authorized port, thereby avoiding the illegality of the illegal user. Access improves the security of the system.

System embodiment 1

The embodiment provides a multi-host access authentication system for a WiM AX network. As shown in FIG. 6, the network element includes a network element node 10, a base station 20, a NAS 30, and an authentication server 40. The network element node 10 includes a first network element. Module 11 and second network element module 12; the base station 20 includes a first base station module 21 and a second base station module 22; the NAS 30 includes a first network The network module 31 and the second network module 32; the authentication server 40 includes a first authentication module 41 and a first authentication module 42. The network element node 10 may specifically be a node having a gateway access function or the like, such as a GMS. Its working principle is as follows:

The first network element module 11 of the network element node 10, after receiving the access request message from a host, carries the identifier information of the host in the authentication start message for transmission; the first base station module 21 in the base station 20 Receiving the first authentication request message after receiving the authentication start message from the network element node 10; the first network module 31 of the NAS 30, after receiving the first authentication request message sent by the base station 20, replying to the first authentication response The second base station module 22 in the base station 20 sends the received first authentication response message from the NAS 30 to the network element node 10; the second network element module 12 of the network element node 10 receives the received from the base station 20 And the identifier information carried in the first authentication response message is forwarded to the host corresponding to the identifier information;

After receiving the first authentication response message, the host performs access authentication with the first authentication module 41 of the authentication server 40; the second authentication module 42 of the authentication server 40 carries the authentication result of the first authentication module 41 The first authentication confirmation message is sent to the NAS 30; the second network module 32 of the NAS 30 sends the first authentication confirmation message from the authentication server 40 to the network element node 10 through the 20 base stations.

Through the system in this embodiment, the host is authenticated by the NAS, and the GMS is informed of the authentication result of the host. According to the authentication result, the GMS can determine whether to open or close the authorized port, thereby avoiding the illegality of the illegal user. Access improves the security of the system.

System embodiment 2

This embodiment is improved on the basis of the system embodiment 1, and provides a multi-host access authentication system of another WiMAX network, as shown in FIG. 7, except that each module described in the system embodiment 1 is included. The BRAS 50 includes a first remote module 51 and a second remote module 52. In addition, the base station 20 further includes: a third base station module 23. Its working principle is as follows:

After receiving the authentication start message from the network element node 10, the third base station module 23 of the base station 20 converts the authentication start message into the second authentication request cancellation in the EAPoL format. And transmitting to the BRAS 50; the first remote module 51 in the BRAS 50, after receiving the second authentication request message from the base station 20, replies to the base station 20 with a second authentication response message.

The second base station module 22 in the base station 20 sends the received second authentication response message from the BRAS 50 to the network element node 10; the second network element module 12 of the network element node 10 receives the second from the base station 20 according to the received And the identifier information carried in the authentication response message is forwarded to the host corresponding to the identifier information;

After the host receives the second authentication response message, the first authentication module 41 of the authentication server 40 performs access authentication; the second authentication module 42 of the authentication server 40 carries the authentication result of the first authentication module 41. The second authentication confirmation message is sent to the BRAS 50; the second remote module 52 of the BRAS 50 sends the second authentication confirmation message from the authentication server to the network element node 10 through the base station 20.

The above-mentioned NAS and BRAS can exist at the same time on the physical level. When the method provided by the embodiment of the present invention is actually implemented, one of them can be selected to implement the function of the authentication network element.

dagger.

In addition, as shown in FIG. 8, the multi-host access authentication system of the WiMAX network in this implementation may further include an HA 60, where the authentication server carries the authentication result in the second authentication confirmation message. After the BRAS is sent to the BRAS, a tunnel is established with the BRAS. Specifically, a MIP tunnel can be established. The tunnel is established with the ASN where the NAS is located. Specifically, a PMIP tunnel can be established to further improve data transmission efficiency.

Through the system in this embodiment, the host is authenticated by the BRAS, and the GMS is informed of the authentication result of the host. According to the authentication result, the GMS can determine whether to open or close the authorized port, thereby avoiding the illegality of the illegal user. Access improves the security of the system.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is a better implementation. the way. Based on such understanding, the technical solution of the present invention can contribute in essence or to the part that contributes to the prior art. The form of a software product is stored in a storage medium, comprising instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the embodiments of the present invention. method.

The above disclosure is only a few specific embodiments of the present invention, but the present invention is not limited thereto, and any changes that can be made by those skilled in the art should fall within the protection scope of the present invention.

Claims

Rights request

A multi-host access authentication method for a microwave access global interworking WiMAX network, which is characterized by comprising:

The multi-host access authentication method of the WiMAX network according to claim 1, wherein the identifier information of the host is carried in the authentication start message and sent to the authentication network element, including:

After receiving the authentication start message, the base station in the network side sends an authentication request message to the authentication network element.

The authentication request message carries identification information of the host.

The multi-host access authentication method of the WiMAX network according to claim 2, wherein the authentication network element is a network authentication server NAS, and the sending, by the base station, the authentication request message to the authentication network element includes: The NAS sends a first authentication request message.

The multi-host access authentication method of the WiMAX network according to claim 2, wherein the authentication network element is a remote broadband access server BRAS, and the base station sends an authentication request message to the authentication network element, including : Send a second authentication request message to the BRAS.

The multi-host access authentication method of the WiMAX network according to claim 4, wherein the sending, by the base station, the second authentication request message to the BRAS comprises: converting the authentication start message into a local area network scalable authentication protocol EAPoL The formatted second authentication request message is sent to the BRAS.

The multi-host access authentication method of the WiMAX network according to claim 4, wherein the sending, by the base station, the second authentication request message to the BRAS comprises:

Sending the authentication start message to the NAS;

The NAS converts the authentication start message into a second authentication request message in the EAPoL format and sends the message to the BRAS.

The multi-host access authentication method of the WiMAX network according to claim 4, wherein the sending, by the base station, the second authentication request message to the BRAS comprises: after establishing a PPPoE session connection on the Ethernet on the BRAS, Forwarding a second authentication request message to the BRAS.

The multi-host access authentication method of the WiMAX network according to claim 6, wherein, when the authentication network element is a BRAS, the authentication server sends the authentication result to the authentication network element, including:

The authentication server sends an authentication confirmation message carrying the authentication result to the BRAS; the method further includes:

Establishing a tunnel between the BRAS and the home agent HA;

A tunnel is established between the HA and the ASN where the NAS is located.

The multi-host access authentication method of the WiMAX network according to claim 1, wherein in the authentication process of the host and the authentication server, the authentication network element pair carries the authentication result. The authentication data packet is converted into a signaling format.

The multi-host access authentication method of the WiMAX network according to claim 1, wherein after receiving the authentication result sent by the authentication network element, the method further includes: authenticating according to the carrying the authentication result The identification information in the confirmation message is forwarded to the host corresponding to the identification information.

11. A network element node, comprising:

12. A multi-host access authentication system for a WiMAX network, including a network element node, Base station, NAS, and authentication server, characterized by:

The network element node includes:

The second network element module is configured to forward the authentication response message to the host corresponding to the identifier information according to the identifier information carried in the received first authentication response message; the base station includes:

The NAS includes:

The authentication server includes:

13. The multi-host access authentication system for a WiMAX network according to claim 12, further comprising a BRAS,

The base station further includes:

a third base station module, configured to convert the authentication start message from the network element node into a second authentication request message in an EAPoL format, and send the message to the BRAS;

The BRAS includes:

a first remote module, configured to: after receiving the second authentication request message from the base station, reply to the second authentication response message; And a second remote module, configured to send, by the base station, a second authentication confirmation message from the authentication server to the network element node.

The multi-host access authentication system of the WiMAX network according to claim 13, wherein the base station further comprises: a fourth base station module, configured to establish a PPPoE session connection with the BRAS.

The multi-host access authentication system of the WiMAX network according to claim 14, further comprising: HA, configured to establish a tunnel with the BRAS; and establish a tunnel with the ASN where the NAS is located.

A multi-host access authentication system for a WiMAX network, comprising a host, a network element node, an authentication network element, and an authentication server, wherein:

The network element node is configured to: after receiving the access request message from a host, the identifier information of the host is carried in the authentication start message and sent to the authentication network element; according to the received authentication network The identifier information carried in the authentication response message is forwarded to the host corresponding to the identifier information, so that the host receives the authentication response message and accesses the authentication server. Certification, and the result of the certification sent;