WO2013037264A1

WO2013037264A1 - Admission control method and system

Info

Publication number: WO2013037264A1
Application number: PCT/CN2012/080649
Authority: WO
Inventors: 尤建洁; 范亮; 袁立权
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-09-16
Filing date: 2012-08-28
Publication date: 2013-03-21
Also published as: CN103002443A

Abstract

An admission control method and system, the method comprising: after an access node (AN) receives an authentication request initiated by a residential gateway (RG) as a client side, or receives an authentication request initiated by a non-broadband forum (BBF) user equipment (UE) and forwarded by the RG, interpolating the digital subscriber line (DSL) parameter of the RG or the UE into the authentication request, and sending the authentication request to a network side; the network side judges whether the authorizable bandwidth of a current link satisfies the contracted bandwidth of the RG or the UE; if yes, then the RG or the UE is authenticated.

Description

Admission control method and system

Technical field

The present invention relates to the field of communications and, in particular, to an admission control method and system.

Background technique

With the development of network technologies and the demand for services from users, terminals are gradually multi-modalized, and they can choose to access different types of access networks to carry diverse services. Different network connections have different characteristics and transmission capabilities to better meet the diverse needs of users. Currently, multimode terminals can implement seamless connections between different types of wireless access networks, such as cellular Universal Mobile Telecommunications System (UMTS), Enhanced Data Rate GSM Evolution (EDGE, Enhanced Data Rate for EDGE). GSM Evolution), a seamless connection between General Packet Radio Service (GPRS) and Wireless Local Area Networks (WLAN) in IEEE 802.11. WLANs provide high data rates in a small range of homes and hotspots, while cellular networks offer greater flexibility and ubiquitous coverage, but at lower data rates; if combined with the advantages of both, users will Benefited from. Within the coverage of WLAN access points, multimode terminals use WLAN for data access and Voice over Internet Protocol (VoIP) applications, while also using overlapping cellular networks for voice calls or media access.

Currently, the International Standards Organization Broadband Forum (BBF) is undergoing FMC

(Standard Mobile Convergence, fixed mobile convergence) standardization work, including mobile terminal users accessing the BBF network through RG (Residential Gateway) and accessing mobile or fixed network services. Due to the heterogeneity of the network, when the mobile terminal user accesses the BBF network, there are differences in user authentication, address allocation, and charging from ordinary BBF users.

As shown in Figures 1 and 2, during the fixed-line RG authentication process, RG passes BNG (Broadband Network).

Gateway, the broadband network gateway, interacts with the BBF AAA for authentication. The BNG can query the link status (such as bandwidth) of the RG to the AN (Access Node) through the Layer 2 protocol, and then report it to the AAA. The AAA determines the current status. Whether the link status can meet the RG subscription information. If not, AAA can reject the RG's authentication. In the FMC scenario, a non-BBF mobile terminal accesses the network through the RG, and also needs to perform bandwidth check on the UE during the authentication process. However, since the UE accesses the network through the RG, the link state of the UE queried by the BNG is the same as that of the RG (in the BNG view, the link identifiers of the two are the same, which are the same link). When the UE performs bandwidth check, the BBF AAA cannot detect that the RG has applied for some bandwidth of the physical link (assuming that the link actually supports 9M, the RG applies for 8M, and when the UE subscribes to 2M, the existing bandwidth check) If the authentication request of the UE is received, the authentication request of the UE may be incorrectly accepted due to the fact that the actual physical link bandwidth cannot meet the subscription bandwidth of the UE.

Summary of the invention

The main purpose of the embodiments of the present invention is to provide an admission control method and system, which avoids mistaking the user when the bandwidth resource is insufficient. An embodiment of the present invention provides an admission control method, including:

The access node (AN) receives the authentication request initiated by the client as the client, or after receiving the authentication request initiated by the user equipment (UE) of the non-broadband forum (BBF) forwarded by the RG, Inserting the digital subscriber line (DSL) parameter of the RG or the UE into the authentication request, and sending the authentication request to the network side;

The network side determines whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE, and if yes, the RG or the UE passes the authentication.

Optionally, the DSL parameter includes a link identifier and a bandwidth, or includes a line identifier and a bandwidth.

Optionally, an initial value of the licensable bandwidth of the current link is a bandwidth in a DSL parameter of the RG or the UE;

The method further includes: after the RG or the UE is authenticated, the network side updates an licensable bandwidth of the current link, and subtracts the RG or UE subscription from the licensable bandwidth of the current link. Bandwidth as the new licensable bandwidth.

Optionally, the network side includes a broadband network gateway (BNG);

Sending, by the AN, the authentication request to the BNG; The step of the network side determining whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE includes: determining, by the BNG, whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE.

Optionally, the subscription bandwidth of the RG is sent by the BBF Authentication and Authorization Accounting (AAA) server to the BNG after the RG passes the identity authentication.

Optionally, the subscription bandwidth of the UE is sent by the home AAA server of the UE to the BBF AAA server after the UE passes the identity authentication, and then sent by the BBF AAA server to the BNG.

Optionally, the network side includes a BNG and a BBF AAA server;

The step of the AN sending the authentication request to the network side includes:

Sending, by the AN, the authentication request to a BNG; the BNG sending the authentication request to a BBF AAA server;

The step of determining, by the network side, whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE includes:

Determining, by the BBF AAA server, whether the licensable bandwidth of the current link satisfies the RG or

The subscription bandwidth of the UE.

Optionally, the subscription bandwidth of the UE is sent by the home AAA server of the UE to the BBF AAA server after the UE passes the identity authentication.

An embodiment of the present invention provides an AN, where the AN is configured to: after receiving a home gateway (RG) as an authentication request initiated by a client, or receiving a non-broadband forum (BBF) user equipment forwarded by the RG (UE) After the authentication request, the digital subscriber line (DSL) parameter of the RG or the UE is inserted into the authentication request, and the authentication request is sent to the network side.

The embodiment of the present invention further provides a network side admission control system, where the network side admission control system is configured to: after receiving the authentication request initiated by the client, the home gateway (RG) sent by the access node (AN) Or, after the authentication request of the user equipment (UE) of the non-broadband forum (BBF) forwarded by the RG, determining whether the licensable bandwidth of the current link satisfies the subscription bandwidth of the RG or the UE, and if yes, the RG or the UE Through authentication, the authentication request includes the DSL parameter of the RG or the UE. Optionally, the DSL parameter includes a link identifier and a bandwidth, or includes a line identifier and a bandwidth.

The network side admission control system is further configured to: after the RG or the UE passes the authentication, update the licensable bandwidth of the current link, and subtract the licable bandwidth of the current link from the RG or the UE The contracted bandwidth is used as the new licensable bandwidth.

Optionally, the system includes a broadband network gateway (BNG), where:

The BNG is configured to: after receiving the authentication request, determine whether the licensable bandwidth of the current link satisfies the subscription bandwidth of the RG or the UE, and if yes, the RG or the UE passes the authentication.

Optionally, the system further includes a BBF Authentication and Authorization Accounting (AAA) server, where: the BNG is further configured to: forward the authentication request to the BBF AAA server; and the BBF AAA server is configured to: receive After the authentication request is received, the RG is authenticated. After the authentication is passed, the RG's subscription bandwidth is sent to the BNG.

Optionally, the system further includes a BBF AAA server and a home AAA server of the UE, where:

The BNG is further configured to: forward the authentication request to the BBF AAA server; the BBF AAA is further configured to: forward the authentication request to the home AAA server, and after receiving the subscription bandwidth of the UE , sent to the BNG;

The home AAA server is further configured to: after receiving the authentication request, perform identity authentication on the UE, and after the authentication is passed, send the subscription bandwidth of the UE to the BBF AAA service.

Optionally, the system includes a BNG and a BBF AAA server;

The BNG is configured to: after receiving the authentication request, send to the BBF AAA server; the BBF AAA server is configured to: determine whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE, if satisfied, Then the RG or UE passes the authentication.

Optionally, the system further includes a home AAA server of the UE, where: The BBF AAA server is further configured to: forward the authentication request to the home AAA; the home AAA server is further configured to: after receiving the authentication request, perform identity authentication on the UE, after the authentication is passed, The subscription bandwidth of the UE is sent to the BBF AAA server.

The method and system provided by the embodiment of the present invention compares the licensable bandwidth and the subscription bandwidth of the link, and accesses the user when the licensable bandwidth meets the subscription bandwidth, thereby avoiding mistaking the user. BRIEF abstract

The drawings are intended to provide a further understanding of the invention, and are intended to be a part of the description of the invention. In the drawings: FIG. 1 is a related art 802.1x-based RG authentication diagram;

2 is a flowchart of related technologies based on PPP RG authentication;

Figure 3 is a flow chart according to an embodiment of the present invention;

Figure 4 is a flow chart according to an embodiment of the present invention;

Figure 5 is a flow chart according to an embodiment of the present invention;

Figure 6 is a flow chart in accordance with an implementation of the present invention.

Preferred embodiment of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

An embodiment of the present invention provides an admission control method, including:

The access node (AN) receives the RG as the authentication request initiated by the client, or after receiving the authentication request initiated by the non-BBF UE forwarded by the RG, inserts the DSL parameter of the RG or the UE into the authentication request, Sending the authentication request to the network side;

The network side determines whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE, and if yes, the RG or the UE passes the authentication. The DSL parameter includes a link identifier and a bandwidth, or includes a line identifier and a bandwidth.

The initial value of the licensable bandwidth of the current link is the bandwidth in the DSL parameter of the RG or the UE; after the RG or the UE passes the authentication, the network side further updates the current link. Authorizing the bandwidth, subtracting the MPLS or UE's subscription bandwidth from the licable bandwidth of the current link as a new licensable bandwidth.

The network side includes a BNG;

Sending, by the AN, the authentication request to the BNG;

The determining, by the network side, whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE includes: determining, by the BNG, whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE, if yes, The RG or UE passes the authentication.

The subscription bandwidth of the RG is sent by the BBF AAA to the BNG after the RG passes the identity authentication.

The subscription bandwidth of the UE is sent by the home AAA of the UE to the BBF AAA after the UE passes the identity authentication, and then sent by the BBF AAA to the BNG.

The network side includes BNG and BBF AAA;

The sending, by the AN, the authentication request to the network side includes:

The AN sends the authentication request to the BNG; the BNG sends the authentication request to the BBF AAA;

The determining, by the network side, whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE includes:

The BBF AAA determines whether the licensable bandwidth of the current link satisfies the signing bandwidth of the RG or the UE, and if yes, the RG or the UE passes the authentication.

The subscription bandwidth of the UE is sent by the home AAA of the UE to the BBF AAA after the UE passes the identity authentication.

The following describes the technical solutions for the RG and the UE to perform authentication respectively. Option One

RG certification

As the 802. lx client, the RG initiates the authentication request. The AN acts as the 802. lx authenticator and the RADIUS client. After receiving the request, the DSL parameters are inserted into the RG and sent to the BNG.

If the RG passes the BBF AAA authentication check, the BBF AAA sends the RG's subscription bandwidth to the BNG;

The BNG determines whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG. If yes, the RG passes the authentication. The BNG update can authorize bandwidth, ie the new licensable bandwidth is the old licensable bandwidth minus the RG's subscription bandwidth. Specifically, the initial value of the licensable bandwidth is the bandwidth in the DSL parameter of the RG.

3GPP UE certification:

When a non-BBF UE accesses the network through the RG, as an 802. lx client, when the authentication request is initiated, the RG acts as an 802. lx authenticator and a RADIUS client, and further sends a request message to the AN, and the AN inserts the DSL parameter of the UE. Sent to BNG.

If the UE passes the authentication check of the home AAA, the home AAA sends the UE's subscription bandwidth to the BNG via the BBF AAA.

The BNG determines whether the licensable bandwidth satisfies the UE's subscription bandwidth. If yes, the UE passes the authentication. The BNG updates the licensable bandwidth, ie the new licensable bandwidth is the old licensable bandwidth minus the UE's subscription bandwidth. Specifically, the initial value of the licensable bandwidth is the bandwidth in the DSL parameters of the UE. Since the UE accesses the network through the RG, the DSL parameters of the UE and the RG are the same.

In the first solution, each link in the BNG corresponds to an licensable bandwidth, and the link identifier or the line identifier is used to distinguish each link, and the corresponding licensable bandwidth is obtained according to the link identifier or the line identifier in the DSL parameter.

Option II

RG certification:

RG acts as an 802. lx client, initiates an authentication request; AN acts as an 802. lx authenticator and RADIUS After receiving the request, the client inserts the DSL DSL parameter and sends it to the BBF AAA via the BNG.

The BBF AAA checks whether the authorized bandwidth meets the RG's subscription bandwidth. If it is satisfied, the RG passes the authentication. The BNG update can authorize bandwidth, ie the new licensable bandwidth is the old licensable bandwidth minus the RG's subscription bandwidth. Specifically, the initial value of the licensable bandwidth is the bandwidth in the DSL parameter of the RG.

3GPP UE certification:

When a non-BBF UE accesses the network through the RG, as an 802. lx client, when the authentication request is initiated, the RG acts as an 802. lx authenticator and a RADIUS client, and further sends a request message to the AN, and the AN inserts the DSL parameter of the UE. Sent to BBF AAA via BNG.

If the UE passes the authentication check of the home AAA, the home AAA sends the subscription bandwidth of the UE to the BBF AAA. The BBF AAA determines whether the licensable bandwidth satisfies the UE's subscription bandwidth. If yes, the UE passes the authentication. The BBF AAA updates the licensable bandwidth, ie the new licensable bandwidth is the old licensable bandwidth minus the UE's subscription bandwidth. Specifically, the initial value of the licensable bandwidth is the bandwidth in the DSL parameter of the RG/UE. Since the UE accesses the network through the RG, the DSL parameters of the UE and the RG are the same.

In the second scheme, each link in the BBF AAA corresponds to an licensable bandwidth. The link identifier or the line identifier is used to distinguish the links, and the corresponding authorized bandwidth is obtained through the link identifier or the line identifier in the DSL parameter.

FIG. 3 is an authentication process of the RG as an 802. lx client according to the embodiment 1 of the present invention. The process includes the AN transmitting the DSL parameter corresponding to the RG to the BNG, and the BNG performs related processing based on the DSL parameter and the RG's subscription bandwidth. The process includes the following steps:

Step 301: The RG acts as an 802.1x client, attaches to the Ethernet, and initiates an EAPoL Start message to request authentication.

Step 302: The AN, as the 802. lx authenticator, sends an EAPoL Start message to the RG, and sends an EAP Identity Request message to the RG to notify the RG to report the user name.

Step 303: After receiving the EAP Identity Request message sent by the AN, the RG returns an authentication protocol ID response (EAP Identity Response) message to the AN, where the message carries the user name.

Step 304: The AN encapsulates the received EAP Identity Response packet into an authentication access request. (RADIUS Access Request) is sent to the BNG in the text.

Step 305: The BNG serves as a RADIUS proxy (RADIUS proxy), and sends the received RADIUS Access Request packet to the BBF AAA.

Step 306: The BBF AAA replies to the RADIUS Access Response packet to the BNG, where the packet carries the EAP Challenge.

Step 307: The BNG sends the received RADIUS Access Response message to the AN. Step 308: The AN unblocks the EAP packet from the received RADIUS Access Response packet, and sends the EAP packet to the RG. After receiving the EAP packet sent by the AN, the RG replies to the AN, and the packet carries the Challenged Password.

Step 309: The AN encapsulates the received EAP 4 message into an authentication access request (RADIUS Access

In the Request message, the DSL parameters corresponding to the RG, such as the line ID (Link ID) and the bandwidth, are inserted at the same time, for example: Line ID (or Line ID) (or Link ID) Link ID ) ) indicates the vlan-id and Layer 2 port number of the switch port to which the RG is connected. Optionally, the DSL parameter corresponding to the RG may also be sent to the BNG in step 304.

Step 310: The BNG reads the DSL parameter corresponding to the RG, and receives the received RADIUS Access.

Request ^艮 is sent to BBF AAA.

Step 311: If the RG passes the authentication, the BBF AAA returns a RADIUS Access Accept message to the BNG, and carries the RG's subscription bandwidth. If the RG fails to pass the authentication, the RADIUS Access Reject is returned. The message is sent to BNG.

Step 312: If the BNG receives the authentication success packet, the BNG reads the RG's subscription bandwidth, checks whether the current licensable bandwidth meets the RG's subscription bandwidth, and if yes, sends a RADIUS Access Accept message to the AN, and the BNG calculation is performed. The new licensable bandwidth, minus the RG's subscription bandwidth for the old licensable bandwidth. The initial licensable bandwidth is the bandwidth in the DSL parameters corresponding to the RG. If not, the BNG sends a RADIUS Access Reject message to the AN or reconfigures the link of the RG. In the case that the RG authentication is successful, the BNG saves the link identifier and the licensable bandwidth in the DSL parameter corresponding to the RG.

Step 313: The AN unblocks the EAP packet. If the RG authentication succeeds, the EAP Success packet is sent to the RG. If the RG authentication fails, the authentication protocol fails to be sent. ( EAP-Failure ) message to RG.

4 is an authentication process of a UE as an 802. lx client according to Embodiment 2 of the present invention. The process includes the AN transmitting a DSL parameter corresponding to the UE to the BNG, and the BNG performs related processing based on the DSL parameter and the UE's subscription bandwidth. The process includes the following steps:

Step 401: The RG performs authentication on the BBF network. For specific steps, refer to Embodiment 1.

Step 402: The UE acts as an 802.1x client, attaches to the network through the RG, and initiates an authentication protocol start (EAPoL Start) message to request authentication.

Step 403: The RG, as the 802. lx authenticator, sends an EAP Identity Request message to the UE after receiving the EAPoL Start message sent by the UE, and is used to notify the UE to report the user name.

Step 404: After receiving the EAP Identity Request message sent by the RG, the UE returns an authentication protocol ID response (EAP Identity Response) message to the RG, where the message carries the user name.

Step 405: The RG is used as a RADIUS client, and the received EAP Identity Response packet is encapsulated into a RADIUS Access Request message and sent to the AN.

Step 406: The AN acts as a RADIUS proxy (RADIUS proxy), and sends the RADIUS Access Request packet to the BNG.

Step 407: The BNG acts as a RADIUS proxy and sends the RADIUS Access Request packet to the BBF AAA.

Step 408: The UE is a non-BBF user, and the Home (Home) AAA of the UE is required to participate in the authentication, and the BBF AAA sends the RADIUS Access Request message to the Home AAA.

Step 409: The Home AAA replies to the RADIUS Access Response to the BBF AAA, where the message carries the EAP Challenge.

Step 410: The BBF AAA forwards the RADIUS Access Response message to the BNG; Step 411, the BNG forwards the RADIUS Access Response message to the AN;

Step 412, the AN forwards the RADIUS Access Response message to the RG;

Step 413: The RG unblocks the EAP from the received RADIUS Access Response packet. The packet is sent to the UE. After receiving the EAP packet sent by the RG, the UE sends a packet to the RG, and the packet carries a Challenged Password.

Step 414: After receiving the 艮 message sent by the UE, the RG encapsulates the EAP 4 到 message into a RADIUS Access Request message and sends the message to the AN.

Step 415: After receiving the RADIUS Access Request message, the AN inserts the DSL parameter corresponding to the UE, such as a line identifier (Link ID) and a bandwidth, for example: a line identifier. (Line ID) (or Link ID) indicates the vlan-id and Layer 2 port number of the switch port to which the RG is connected. The AN sends a RADIUS Access Request packet to the BNG. Optionally, the DSL parameter corresponding to the UE may also be sent to the BNG in step 406.

Step 416: After receiving the RADIUS Access Request message, the BNG reads the DSL parameter corresponding to the UE, and then sends the RADIUS Access Request message to the BBF AAA.

Step 417: The BBF AAA sends the RADIUS Access Request message to the Home AAA. Step 418: If the UE passes the authentication, the Home AAA replies to the RADIUS Access Accept message to the BBF AAA, and carries the subscription bandwidth corresponding to the UE. If the UE does not pass the authentication, the RADIUS Access Reject message is sent to the BBF AAA.

Step 419: The BBF AAA sends the RADIUS Access Accept message or the RADIUS Access Reject message to the BNG.

Step 420: If the UE passes the authentication, the BNG reads the subscription bandwidth of the UE, checks whether the current licensable bandwidth meets the subscription bandwidth of the UE, and if yes, sends a RADIUS Access Accept message to the AN, and the BNG calculates a new licensable. Bandwidth, minus the UE's subscription bandwidth for the old licensable bandwidth. Since the UE accesses the network through the RG, the link identifiers of the RG and the UE are the same, and their DSL parameters are also the same. If not, the BNG reconfigures the UE's link or sends a RADIUS Access Reject to the AN.

Step 421: The AN sends a RADIUS Access Accept message or a RADIUS Access Reject message to the RG.

In step 422, the RG decapsulates the EAP packet. If the UE is successfully authenticated, the UE sends an EAP Success message to the UE. If the UE fails to authenticate, the authentication protocol fails. (EAP-Failure) message to the UE.

5 is an authentication process of an RG as an 802. lx client according to Embodiment 3 of the present invention. The process includes the AN transmitting the DSL parameter corresponding to the RG to the BBF AAA via the BNG, and the BBF AAA is related based on the DSL parameter and the RG's subscription bandwidth. deal with. The process includes the following steps:

Step 501: The RG acts as an 802.1x client, attaches to the Ethernet, and initiates an EAPoL Start message to request authentication.

Step 502: The AN, as an 802. lx authenticator, sends an EAPoL Start message to the RG, and sends an EAP Identity Request message to the RG to notify the RG to report the username.

Step 503: After receiving the EAP Identity Request message sent by the AN, the RG returns an authentication protocol ID response (EAP Identity Response) message to the AN, where the message carries the user name.

Step 504: The AN encapsulates the received EAP Identity Response message into a RADIUS Access Request message and sends the message to the BNG.

Step 505: The BNG acts as a RADIUS proxy (RADIUS proxy) and will receive the RADIUS.

The Access Request message is sent to the BBF AAA.

Step 506: The BBF AAA replies to the RADIUS Access Response packet to the BNG, where the packet carries an EAP Challenge.

Step 507: The BNG sends the received RADIUS Access Response message to the AN. Step 508: The AN unblocks the EAP packet from the received RADIUS Access Response packet, and sends the EAP packet to the RG. After receiving the EAP packet sent by the AN, the RG replies to the AN, and the packet carries the Challenged Password.

Step 509: The AN encapsulates the received EAP 4 到 message into a RADIUS Access Request message, and inserts the DSL parameter corresponding to the RG, such as a line identifier (Line ID) (or a link identifier (Link ID). ) and bandwidth, for example: Line ID (or Link ID) indicates the vlan-id and Layer 2 port number of the switch port to which the RG is connected. Optionally, the DSL parameter corresponding to the RG may also be sent to the BNG in step 504.

Step 510: The BNG sends the received RADIUS Access Request message to the BBF AAA. Step 511: The BBF AAA reads the DSL parameter corresponding to the RG, and determines whether the licensable bandwidth corresponding to the link identifier in the DSL parameter satisfies the RG's subscription bandwidth. If the RG challenge password is also authenticated, the RG passes the authentication. Then, the BBF AAA replies to the RADIUS Access Accept message to the BNG. At the same time, the BBF AAA maintains the licensable bandwidth corresponding to the link identifier of the DSL parameter of the RG, that is, the current licensable bandwidth is the old licensable bandwidth minus the RG's subscription bandwidth, and the initial licensable bandwidth is the bandwidth in the DSL parameter. . If the RG fails to pass the authentication, the RADIUS Access Reject packet is sent to the BNG and the reason for the rejection is carried.

Step 512: The BNG forwards the RADIUS Access Accept message or the RADIUS Access Reject message to the AN.

Step 513: The AN unblocks the EAP packet. If the RG authentication succeeds, the EAP Success packet is sent to the RG. If the RG authentication fails, the EAP-Failure packet is sent to the RG.

FIG. 6 is an authentication process of a UE as an 802. lx client according to Embodiment 4 of the present invention. The process includes the AN transmitting the DSL parameter corresponding to the UE to the BBF AAA via the BNG, and the BBF AAA performs related processing based on the DSL parameter and the UE's subscription bandwidth. . The process includes the following steps:

Step 601: The RG performs authentication on the BBF network. For specific steps, refer to Embodiment 1.

Step 602: The UE acts as an 802.1x client, attaches to the network through the RG, and initiates an authentication protocol start (EAPoL Start) message to request authentication.

Step 603: The RG is used as an 802. lx authenticator, and after receiving the EAPoL Start message sent by the UE, the RG sends an EAP Identity Request message to the UE to notify the UE to report the user name.

Step 604: After receiving the EAP Identity Request message sent by the RG, the UE returns an authentication protocol ID response (EAP Identity Response) message to the RG, where the message carries the user name.

Step 605: The RG is also used as a RADIUS client, and the received EAP Identity Response packet is encapsulated into an authentication access request (RADIUS Access Request) and sent to the AN.

Step 606, the AN acts as a RADIUS proxy (RADIUS proxy), and RADIUS Access Request ^艮 is sent to BNG.

Step 607: The BNG acts as a RADIUS proxy and sends the RADIUS Access Request packet to the BBF AAA.

Step 608: The UE is a non-BBF user, and the Home (Home) AAA of the UE is required to participate in the authentication, and the BBF AAA sends the RADIUS Access Request message to the Home AAA.

Step 609: The Home AAA replies to the RADIUS Access Response packet to the BBF AAA, where the packet carries the EAP Challenge.

Step 610: The BBF AAA forwards the RADIUS Access Response message to the BNG. In step 611, the BNG forwards the RADIUS Access Response message to the AN.

Step 612, the AN forwards the RADIUS Access Response message to the RG;

Step 613: The RG unblocks the EAP packet from the received RADIUS Access Response packet, and sends the EAP packet to the UE. After receiving the EAP packet sent by the RG, the UE sends a packet to the RG, and the packet carries the Challenged Password.

Step 614: After receiving the reply message from the UE, the RG encapsulates the EAP^ message into a RADIUS Access Request message and sends the message to the AN.

Step 615, A, as a RADIUS proxy, after receiving the RADIUS Access Request message, insert the DSL parameter corresponding to the UE, such as a line identifier (Link ID) and a bandwidth, for example: a line identifier. (Line ID) (or Link ID) indicates the vlan-id and Layer 2 port number of the switch port to which the RG is connected. The AN sends a RADIUS Access Request packet to the BNG. Optionally, the DSL parameter corresponding to the UE may also be sent to the BNG in step 606.

Step 616: The BNG sends the RADIUS Access Request message to the BBF AAA.

Step 617: The BBF AAA reads the DSL parameter corresponding to the UE, and sends the RADIUS Access Request message to the Home AAA.

Step 618, if the UE passes the authentication, the Home AAA replies to the authentication access accept (RADIUS)

The Access Accept message is sent to the BBF AAA and carries the subscription bandwidth corresponding to the UE. If the UE fails to pass the authentication, the RADIUS Access Reject message is sent to the BBF AAA. Step 619: If the UE is authenticated, the BBF AAA determines whether the licensable bandwidth corresponding to the link identifier in the DSL parameter meets the subscription bandwidth of the UE. If yes, the BBF AAA sends a RADIUS Access Accept to the BNG. Message. At the same time, the BBF AAA maintains the licensable bandwidth corresponding to the link identifier in the DSL parameter of the UE, that is, the current licensable bandwidth is the old licensable bandwidth minus the subscription bandwidth of the UE, and the initial licensable bandwidth is the bandwidth in the DSL parameter. . If the licensable bandwidth corresponding to the link identifier in the DSL parameter does not satisfy the subscription bandwidth of the UE, the BBF AAA sends a RADIUS Access Reject packet to the BNG, and carries the rejection reason. Note: The UE accesses the network through the RG, and the DSL parameters of the UE and the RG are the same.

Step 620: If the UE is authenticated, the BNG reads the subscription bandwidth of the UE, checks whether the current licensable bandwidth meets the subscription bandwidth of the UE, and if yes, sends a RADIUS Access Accept message to the AN, and the BNG calculates a new licensable Bandwidth, minus the UE's subscription bandwidth for the old licensable bandwidth. Since the UE accesses the network through the RG, the link identifiers of the RG and the UE are the same, and their DSL parameters are also the same. If not, the BNG reconfigures the UE's link or sends a RADIUS Access Reject to the AN.

Step 621: The AN sends a RADIUS Access Accept message or a RADIUS Access Reject message to the RG.

Step 622: The RG decapsulates the EAP packet, and if the UE is successfully authenticated, sends an EAP Success message to the UE. If the UE fails to authenticate, the EAP-Failure packet is sent to the UE.

The embodiment of the present invention further provides an admission control system, including: an AN and a network side, where: the AN is configured to: after receiving an RG as an authentication request initiated by a client, or receiving a non-BBF forwarded by the RG After the authentication request of the UE, insert the DSL parameter of the RG or the UE in the authentication request, and send the authentication request to the network side;

The network side is configured to: determine whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE, and if yes, the RG or the UE passes the authentication.

The DSL parameter includes a link identifier and a bandwidth, or includes a line identifier and a bandwidth. The initial value of the licensable bandwidth of the current link is the bandwidth in the DSL parameter of the RG or the UE. The network side is further configured to: after the RG or the UE passes the authentication, update the current chain. The licensable bandwidth of the path, the licensable bandwidth of the current link is subtracted from the MPLS or UE's subscription bandwidth as a new licensable bandwidth.

The network side includes a BNG,

The AN is further configured to send the authentication request to the BNG;

The BNG is configured to: determine whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE, and if yes, the RG or the UE passes the authentication.

The network side further includes a BBF AAA:

The BNG is further configured to: forward the authentication request to the BBF AAA;

The BBF AAA is configured to perform identity authentication on the RG after receiving the authentication request, and send the subscription bandwidth of the RG to the BNG after the authentication is passed.

The network side further includes a BBF AAA and a home AAA of the UE:

The BBF AAA is further configured to: forward the authentication request to the home AAA, and after receiving the subscription bandwidth of the UE, send the BNG to the BNG;

The home AAA is further configured to: after receiving the authentication request, perform identity authentication on the UE, and after the authentication is passed, send the subscription bandwidth of the UE to the BBF AAA.

The network side includes BNG and BBF AAA;

The AN is further configured to: send the authentication request to the BNG;

The BNG is configured to: send the authentication request to the BBF AAA;

The BBF AAA is configured to: determine whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE, and if yes, the RG or the UE passes the authentication.

The network side further includes a home AAA of the UE, where:

The BBF AAA is further configured to: forward the authentication request to the home AAA;

The home AAA is further configured to: after receiving the authentication request, perform identity authentication on the UE, and after the authentication is passed, send the subscription bandwidth of the UE to the BBF AAA. One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct the associated hardware, such as a read only memory, a magnetic disk, or an optical disk. Optionally, all or part of the steps of the foregoing embodiments may also be implemented by using one or more integrated circuits. Accordingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may use software functions. The form of the module is implemented. The invention is not limited to any specific form of combination of hardware and software.

It is to be understood that the invention may be embodied in various other modifications and changes without departing from the spirit and scope of the invention.

Industrial Applicability The method and system provided by the embodiments of the present invention compares the licensable bandwidth of the link with the subscription bandwidth, and accesses the user when the licensable bandwidth meets the subscription bandwidth, thereby avoiding mistaking the user.

Claims

Claim

1. An admission control method comprising:

2. The method according to claim 1, wherein the DSL parameter includes a link identifier and a bandwidth, or includes a line identifier and a bandwidth.

3. The method of claim 2, wherein

The initial value of the licensable bandwidth of the current link is the bandwidth in the DSL parameter of the RG or the UE;

The method according to any one of claims 1 to 3, wherein the network side comprises a broadband network gateway (BNG);

Sending, by the AN, the authentication request to the BNG;

The step of determining, by the network side, whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE includes: determining, by the BNG, whether the licensable bandwidth of the current link meets the subscription bandwidth of the RG or the UE.

5. The method according to claim 4, wherein the subscription bandwidth of the RG is sent by the BBF Authentication and Authorization Accounting (AAA) server to the BNG after the RG passes the identity authentication.

The method according to claim 4, wherein the subscription bandwidth of the UE is sent by the home AAA server of the UE to the BBF AAA server after the UE passes the identity authentication, and then the BBF AAA server Sent to the BNG.

The method according to any one of claims 1 to 3, wherein the network side comprises a BNG and a BBF AAA server;

Sending, by the AN, the authentication request to the BNG; the BNG sending the authentication request to the BBF AAA server;

The BBF AAA server determines whether the licensable bandwidth of the current link satisfies the subscription bandwidth of the RG or the UE.

8. The method according to claim 7, wherein the subscription bandwidth of the UE is sent by the home AAA server of the UE to the BBF AAA server after the UE passes the identity authentication.

9. An access node (AN),

The AN is configured to: after receiving the authentication request initiated by the client as the client gateway (RG), or after receiving the authentication request of the user equipment (UE) of the non-broadband forum (BBF) forwarded by the RG, A digital subscriber line (DSL) parameter of the RG or the UE is inserted into the authentication request, and the authentication request is sent to the network side.

10. A network side admission control system,

The network side admission control system is configured to: receive a user equipment sent by the access node (AN), the home gateway (RG) as a client initiated authentication request, or a non-broadband forum (BBF) forwarded by the RG After the authentication request of the (UE), it is determined whether the licensable bandwidth of the current link satisfies the subscription bandwidth of the RG or the UE. If yes, the RG or the UE passes the authentication, and the authentication request includes the RG or the UE. DSL parameters.

11. The system of claim 10, wherein the DSL parameter comprises a link identity and a bandwidth, or comprises a line identity and a bandwidth.

12. The system of claim 10, wherein

The initial value of the licensable bandwidth of the current link is the bandwidth in the DSL parameter of the RG or the UE; The network side admission control system is further configured to: after the RG or the UE passes the authentication, update the licensable bandwidth of the current link, and subtract the licable bandwidth of the current link from the RG or the UE The contracted bandwidth is used as the new licensable bandwidth.

The system according to any one of claims 10 to 12, comprising a broadband network gateway (BNG), wherein: the BNG is configured to: determine whether the licensable bandwidth of the current link satisfies after receiving the authentication request The subscription bandwidth of the RG or the UE, if satisfied, the RG or the UE passes the authentication.

14. The system of claim 13 further comprising a BBF Authentication and Authorization Accounting (AAA) server, wherein:

The BNG is further configured to: forward the authentication request to the BBF AAA server; the BBF AAA server is configured to: after receiving the authentication request, perform identity authentication on the RG, and after the authentication is passed, the BNG The subscription bandwidth of the RG is sent to the BNG.

15. The system of claim 13 further comprising a BBF AAA server and a home AAA server of the UE, wherein:

The home AAA server is further configured to: after receiving the authentication request, perform identity authentication on the UE, and after the authentication is passed, send the subscription bandwidth of the UE to the BBF AAA server.

16. The system of any of claims 10 to 12, comprising a BNG and BBF AAA server;

17. The system of claim 16 further comprising a home AAA server of the UE, wherein: The BBF AAA server is further configured to: forward the authentication request to the home AAA; the home AAA server is further configured to: after receiving the authentication request, perform identity authentication on the UE, after the authentication is passed, The subscription bandwidth of the UE is sent to the BBF AAA service crying port