Method system and server for implementing dhcp address security allocation

The present invention relates to the field of network communication technologies, and in particular, to a method, system, and server for implementing DHCP (Dynamic Host Configuration Protocol) address security allocation.

Background technique

With the maturity of access technologies such as ADSL (Asymmetric Digital Subscriber Line) and Ethernet, broadband access is becoming more and more popular, and at the same time, IPTV (Internet Protocol Television) is being implemented on the broadband access network. , IP TV) Video and VoIP (voice over Internet protocol) services are also growing. The implementation of each service needs to be implemented by a dedicated terminal. For example, the video service needs to use STB (Set Top Box), the voice service needs to use IAD (Integrated Access Device), and so on. Each dedicated terminal needs to obtain the address information of the local end before starting the service. After that, the local terminal can use the address information of the local end to carry out various services.

In a communication network, the manner in which each terminal obtains an IP (Internet Protocol) address is usually based on the DHCP protocol. The traditional Internet access service usually uses PPPoE (Point-to-Point Protocol over Ethernet). The point-to-point protocol is implemented, and the AAA (Authentication Authorization, Accounting, Authentication, and Accounting) server needs to complete authentication for the access user and assign an IP address. The AAA server is generally a RADIUS (Remote Authentication Dial In User Service) or other authentication server.

The structure of the network communication system that is authenticated by the RADIUS server and obtains the IP address information through the DHCP server is as shown in FIG. 1 , where:

DHCP server: A server for managing an IP address, responding to a computer's address allocation request, and assigning a suitable IP address to the computer;

DHCP client: A terminal that obtains network parameters such as an IP address using a DHCP protocol, including a computer, an STB, an IAD, and the like;

RADIUS server: The remote dial-in user authentication server is used to manage the user's account and password and complete the authentication of the access user.

BRAS: Broadband remote access server for access management of broadband users. For PPPoE users, BRAS acts as a RADIUS client and initiates an authentication request to the RADIUS server. For DHCP users, the BRAS completes the DHCP relay function.

Access network: from the user's home to the network in the middle of the BRAS;

Access node: A device directly connected to a subscriber line in an access network, such as an ADSL access device DSLAM (Digital Subscriber Line Access Multiplexer);

OSS (Operations Support Systems) System: A system for carrier service delivery and business management.

In FIG. 1, as a DHCP client STB, IAD, etc., a DHCP server can be deployed through a network to assign a corresponding IP address using a DHCP protocol.

Figure 2 shows the process of obtaining the address of each DHCP client as shown in Figure 2: Step 21: The DHCP client is powered on, sends a DHCP discovery packet, and finds a server that can provide DHCP service.

Step 22: The BRAS acts as a DHCP relay and relays the DHCP discovery message to the designated DHCP server.

Step 23: The DHCP server returns a DHCP-provided message, indicating that it can assign an IP address to the client.

Step 24: The DHCP client sends a DHCP request message, and the BRAS relays the DHCP request message to the DHCP server.

Step 25: The DHCP server allocates an appropriate IP address and returns a DHCP response message. In this way, the DHCP client obtains an IP address and can access the network to obtain network services.

From the above DHCP address allocation process, it can be seen that during the process of obtaining the IP address by the DHCP client through the DHCP method, the illegal user can easily obtain the corresponding IP address and obtain the network service. In this way, it is easy for a hacker to maliciously exhaust the IP address resource and attack the network. Moreover, after the hacker attacks the network, it cannot be tracked.

In addition, the operator needs to use a DHCP server to manage the IP address of the DHCP client user, and the RADIUS server manages the IP address of the PPPoE client user. There are two sets of IP address resource management mechanisms, data is dispersed, and management costs are high.

Summary of the invention

In view of the above problems in the prior art, an object of the present invention is to provide a method, system and server for implementing secure allocation of a DHCP address, so that the security of the process of address allocation by the DHCP server can be effectively ensured.

The object of the invention is achieved by the following technical solutions:

The present invention provides a method for implementing secure allocation of a DHCP address, including:

A. The dynamic host configuration protocol DHCP client sends a DHCP discovery message through the access network;

B. The access network side acquires the identification information of the DHCP client, and authenticates the DHCP client based on the identification information;

C. For the DHCP client that passes the authentication, the DHCP server assigns address information to it.

The identification information includes:

Port number, circuit number, and connection number of the DHCP client.

The step B described includes:

The access node or the access server in the access network determines its identification information according to the ingress port/circuit/connection information of the DHCP discovery message.

The step B described includes:

The client's legality authentication is performed by the access node or the access server in the access network according to the identification information of the DHCP client and the identification information of the pre-configured legal user.

The step B described includes:

Bl. The access node or the access server in the access network initiates an authentication request to the authentication server by using the identification information of the client;

B2. The authentication server authenticates the legality of the client according to the saved identification information of the legal user.

The present invention also provides a DHCP authentication server for implementing secure allocation of a DHCP address, including:

The DHCP server module: receives a DHCP request message sent by the DHCP client via the access node or the access server, and allocates the client that is authenticated by the AAA server and is returned by the authentication and accounting AAA client module. The address information is responsive to the DHCP client;

The protocol conversion module is configured to obtain the information required for AAA authentication, generate an AAA authentication packet, and perform authentication according to the AAA client module in the DHCP discovery packet of the corresponding DHCP client sent from the access node or the access server. Responding to the packet, generating a DHCP-provided packet, and sending the packet;

AAA client module: used for authentication packets generated by the DHCP protocol conversion module

The AAA server communicates with the authentication result of the DHCP client, and submits the result to the protocol conversion module and the DHCP server module.

The present invention also provides a DHCP authentication server for implementing secure allocation of a DHCP address, including:

The authentication processing module is configured to obtain the identification information of the client that initiates the DHCP process, and perform legality authentication on the client according to the saved identification information of the legal user, and the authentication is performed.

The DHCP server receives the DHCP discovery packet sent by the authentication processing module, and sends a DHCP provisioning packet to the DHCP client. When the DHCP client sends a DHCP request packet, it is the corresponding DHCP client in the address pool. The end assigns an address.

The invention also provides a system for implementing secure allocation of a DHCP address, comprising: a DHCP client, an access network and a DHCP authentication server, and the DHCP client communicates with the DHCP authentication server to obtain address information through the access network, and at the same time, the DHCP authentication server It is used to authenticate the DHCP discovery packets of the DHCP client that is obtained by the access network, and assign the DHCP client to the address.

The present invention also provides a method for implementing DHCP address security allocation based on the foregoing system, including:

C. The access node or the access server receives the DHCP discovery packet sent by the DHCP client, and inserts the identification information of the client into the packet and sends it to the DHCP authentication service to cry.

D. The DHCP authentication server obtains the identification information of the client from the packet.

E. The DHCP authentication server authenticates the legality of the client by using the identification information, and performs address allocation processing only on the client that passes the authentication.

The step E described includes:

The DHCP authentication server authenticates the DHCP client according to the saved identification information of the legal user, and sends the DHCP discovery packet of the client that has passed the authentication to the DHCP server. The DHCP server performs address allocation processing.

The present invention also provides a method for implementing secure allocation of a DHCP address, including:

The access node or the access server receives the DHCP discovery packet sent by the DHCP client, and inserts the identification information of the client into the packet and sends the packet to the DHCP authentication server.

G. The DHCP authentication server acquires the identification information of the client from the packet.

H. The DHCP authentication server sends the authentication request message to the AAA server by using the identification information, and the AAA server authenticates the identification information of the client, and allocates address information to the client that passes the authentication;

By,

The DHCP authentication server sends the authentication request message to the AAA server by using the identification information, and the AAA server authenticates the identification information of the client. After receiving the authentication pass information, the DHCP authentication server allocates address information for the authenticated client. .

It can be seen from the technical solution provided by the present invention that the present invention can perform access authentication on the user according to the location information, and only assign an IP address to the legal user and the terminal, thereby greatly enhancing the security of assigning the address through the DHCP method. Sex

Moreover, in the present invention, the address can be uniformly managed by the RADIUS server, that is, the DHCP server and the RADIUS server uniformly manage the IP address, thereby reducing the cost of network management; and the original security measures of the RADIUS server can be utilized to control the number of IP addresses obtained by the user. Effectively prevent malicious exhaustion of address attacks; even if a network attack or other network security problem occurs, the physical location of the user can be tracked according to the IP address, and the hacker attack behavior can be effectively shocked!

At the same time, the present invention has good compatibility, that is, in the implementation process, no new interfaces and commands are added to the OSS system, and the service management process of the DHCP client user and the service delivery management process of the original PPPoE client are completely completed. Consistent, protecting the investment of operators.

BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a schematic structural diagram of a broadband access system;

2 is a schematic diagram of a process of obtaining an address through a DHCP server;

3 is a schematic structural diagram of a DHCP authentication server according to the present invention; FIG. 4 is another schematic structural diagram of a DHCP authentication server according to the present invention; FIG. 5 is a schematic structural diagram of a system according to the present invention;

6 is a schematic diagram of a DHCP address allocation process based on the system shown in FIG. 5. FIG. 7 is a schematic diagram of another DHCP address allocation process based on the system shown in FIG. 5. FIG. 8 is another schematic diagram of the system according to the present invention. Schematic;

FIG. 9 is a schematic diagram of a DHCP address allocation process based on the system shown in FIG.

Detailed ways

The core of the present invention is to increase the process of authenticating the authenticity of the DHCP client in the process of obtaining the address information from the DHCP client, so as to prevent the attack of the DHCP server by the illegal user. In addition, based on the above core ideas, The address management of the DHCP server and the authentication server are unified to facilitate address management. The authentication server includes an AAA server such as a RADIUS server. Of course, other authentication functions may be used for other functions.

The present invention provides a method for implementing secure allocation of a DHCP address, which mainly includes:

(1) The DHCP client sends a DHCP Discovery message through the access network;

(2) The access server (such as the BRAS, the access node, etc.) on the network side determines the identification information of the DHCP client according to the ingress port information of the DHCP discovery message, such as the port number of the DHCP client, VPI (Virtual path) Identifiers, virtual channel identifiers, virtual channel identifiers, virtual local area network IDs, etc., based on the identification information and pre-configured identification of legitimate users The information is authenticated by the DHCP client;

Taking the RADIUS server as the authentication server as an example, the access node or the access server in the access network may use the identification information of the client to initiate an authentication request to the remote dial-up authentication RADIUS server, and the RADIUS server saves the legitimate user according to the The identification information authenticates the legality of the client;

Of course, it is also possible to set a gateway dedicated to authentication, which performs corresponding authentication processing according to the configured information.

(3) DHCP discovery of the DHCP client that passes authentication ^ ¹The message is sent to the DHCP server, and the DHCP server assigns address information to it. The specific address allocation process is the same as the existing address allocation process, so it is not detailed.

In addition, a corresponding DHCP server with an authentication function can be set in the network, so that after receiving the DHCP discovery message sent by the DHCP client, the authentication process can be performed first. After the authentication is passed, the corresponding authentication is performed. Address information.

The present invention provides two DHCP authentication servers having authentication functions, which will be separately described below with reference to the accompanying drawings.

The first DHCP authentication server with authentication function needs to authenticate the DHCP client through an authentication server, such as a RADIUS server. The specific structure is shown in Figure 3. The RADIUS server is used as the authentication server as an example, including the DHCP server module. , protocol conversion module and RADIUS client module:

The DHCP server module is configured to allocate an IP address to the DHCP client that passes the authentication, specifically to receive a DHCP request message sent by the DHCP client via the access node or the access server, and allocate corresponding IP address information to the DHCP client. The IP address information is the IP address information returned by the RADIUS client module and returned by the RADIUS server for authentication.

The protocol conversion module is configured to obtain the information required for the RADIUS authentication in the DHCP discovery packet of the corresponding DHCP client sent from the access node or the access server, and generate a RADIUS authentication packet for authenticating the DHCP client. At the same time, the protocol conversion module needs to respond to the DHCP client according to the authentication response message received by the RADIUS client module. Specifically, the protocol conversion module needs to generate a corresponding DHCP provisioning packet and send the response packet to the DHCP client that passes the authentication. The corresponding DHCP client is configured to be assigned a corresponding IP address. The RADIUS client module is configured to communicate with the RADIUS server based on the authentication packet generated by the DHCP protocol conversion module, thereby implementing authentication for the DHCP client. The specific authentication rule can be authenticated according to the rules set in the RADIUS server, and then the authentication result of the DHCP client is obtained. The authentication result includes the IP address assigned by the RADIUS server to the client, and the IP address. Need to be handed over to the DHCP server module; By DHCP client terminal response packet processed by the protocol converting module needs subsequent processing, ie DHCP client sends a DHCP offer message.

At this time, the DHCP authentication server works in the gateway mode, and the DHCP authentication server supports the DHCP protocol and the RADIUS protocol. From the perspective of the DHCP client and the BRAS, the DHCP authentication server is a DHCP server; from the perspective of the RADIUS server, DHCP The authentication server is a RADIUS client.

The specific processing procedure includes: the DHCP authentication server processes the DHCP message forwarded by the DHCP relay, and generates a RADIUS packet to the RADIUS server according to the identification information of the client carried in the packet, and the RADIUS server determines according to the user data configured in advance. The user's legality is completed, and the user is assigned an IP address. After receiving the authentication response packet from the RADIUS server, the DHCP authentication server returns a DHCP packet to the DHCP client, carrying the IP address assigned by the RADIUS server, and finally the DHCP client. Get the IP address.

The second DHCP authentication server with authentication function sets the authentication function locally and implements authentication processing. The specific structure is shown in Figure 4, including the authentication processing module and the DHCP server module:

The authentication processing module is configured to obtain the identification information of the DHCP client that initiates the DHCP process, and perform legality authentication on the client according to the identification information of the legal user that is saved, and then send the authentication result to the DHCP server module. The identification information of the legitimate user can be saved by the corresponding storage module (not shown);

The DHCP server module: obtains the authentication result of the DHCP client by the authentication processing module, and sends a DHCP-provided packet to the DHCP client that passes the authentication result, indicating that the DHCP server can assign a corresponding IP address to it, and can send the DHCP client. When a DHCP request packet is sent, it is assigned a corresponding IP address, which implements the function of the DHCP server. At this time, the DHCP authentication server works in the server mode, which is equivalent to a DHCP server with security authentication function, and can independently perform authentication and address allocation for the client.

The above two authentication authentication DHCP authentication servers can be set in any network that needs to apply the DHCP server to implement the corresponding address allocation function.

The present invention also provides a system for implementing DHCP address security allocation with a DHCP address allocation authentication function. The structure of the system is as shown in FIG. 5 and FIG. 8 respectively, and specifically includes: a DHCP client, an access network, and a DHCP. The authentication server is configured to perform legality authentication on the DHCP client's DHCP discovery packet obtained by the access network, and perform address allocation processing on the authenticated DHCP client.

In the system of the present invention, the DHCP authentication server can authenticate the DHCP client in the following two ways, and allocate the corresponding IP address, specifically:

As shown in Figure 5, the identification information of the DHCP client is sent to the RADIUS server through the authentication request packet, and is authenticated by the RADIUS server, and the RADIUS server allocates the corresponding IP address, or the RADIUS server only performs the authentication. The authentication process is performed, and the corresponding IP address is still allocated by the DHCP server; here, only the RADIUS server is used as the authentication server to describe a specific application example of the present invention, and is not limited thereto;

As shown in FIG. 8, the identification information of the DHCP client is authenticated according to the identification information of the legal user saved locally, and the DHCP server allocates a corresponding IP address for the DHCP client that passes the authentication.

In the system, the access node and the BRAS support the capture of the DHCP message, and the Qption 82 option is inserted, so that the DHCP authentication server can obtain the identification information of the corresponding DHCP client after receiving the DHCP message. The Option 82 option identifies the location information of the user as the identification information, including port information, VPI/VCI information, and VLAN ID. The Option 82 option can be inserted into the DHCP packet at the access node. Insert the Option82 option.

Based on the above system, the present invention also provides a corresponding method for implementing DHCP address security allocation, which will be described in detail below.

First, the DHCP authentication server works in gateway mode, and the authentication server is 33.

-10-

The RADIUS server is used as an example to describe the method. As shown in Figure 5, Figure 6, and Figure 7, the detailed description is as follows:

As shown in FIG. 5 and FIG. 6, when the method is specifically implemented, the method includes the following steps:

Step 61: When the user opens the account, the operator adds a user data to the ADIUS server, and the account is the location information of the user. The coding mode is the same as the Option 82 option inserted by the access node and the BRAS, and the recording terminal (STB, IAD) can be selected. MAC (Media Access Control) address.

Step 62: When the DHCP client needs to obtain the IP address information, the DHCP client needs to send a DHCP discovery packet to the BRAS.

Step 63: The BRAS acts as a DHCP relay, captures the DHCP message, and inserts the Option 82 option in the packet, and then sends the DHCP discovery packet carrying the user location information to the DHCP authentication server, where the Option 82 option identifies the location of the user. Information, such as port information, VPI/VCI, VLAN ID, etc.

Step 64: The DHCP authentication server receives the DHCP message from the BRAS, and then extracts the Option 82 option and the MAC address of the terminal, generates a RADIUS protocol packet, and sends the packet to the RADIUS server. The account number in the packet is the content of option 82. Calling- The Station-ID (call site identity) attribute is the MAC address of the terminal;

The RADIUS server receives the authentication request, performs authentication based on the information in the database, determines the validity of the user based on the account, and determines the legality of the terminal based on the MAC address. If the authentication succeeds, the IP address is assigned to the user, and the authentication response is returned. Text, see step 65;

Step 65: After the authentication is passed, the RADIUS server returns an authentication response packet to the DHCP authentication server, and the packet carries an IP address assigned to the client.

After receiving the authentication response packet, the DHCP authentication server extracts the IP address assigned by the RADIUS server and assigns an IP address to the DHCP client using the standard DHCP procedure. See the following steps:

Step 66: After receiving the response packet, the DHCP authentication server sends a DHCP provisioning packet to the DHCP client.

Step 67: After receiving the DHCP provisioning message, the DHCP client sends a DHCP request message to the DHCP authentication server.

Step 68: The DHCP authentication server sends the IP address information sent from the RADIUS server to the DHCP client through the DHCP response packet.

In the foregoing step 63, the BRAS is inserted into the Option 82 option. In the actual application process, as shown in FIG. 7, the DSLAM can also be inserted into the Option 82 option by the access node, and the BRAS only performs DHCP relay, and other processing procedures are performed. It is exactly the same as the process described above.

In the above process, if the RADIUS server performs only the authentication process and the corresponding IP address is still assigned by the DHCP server, the process of steps 65 to 68 is as follows: When the RADIUS server returns the authentication pass message to the DHCP server, the DHCP server sends the message to the DHCP server. The DHCP client sends a DHCP-provided message and assigns the corresponding IP address to the DHCP client through subsequent processing identical to the existing address allocation process.

After that, the DHCP authentication server works in the server mode as an example, and the method is described. As shown in FIG. 8 and FIG. 9, the specific description is as follows:

Step 91: When the user opens the account, the operator adds a piece of data to the DHCP authentication server, and records the location information of the user. The coding mode is the same as the Option 82 option inserted by the access node and the BRAS, and the MAC of the recording terminal (STB, IAD) can be selected. address.

Step 92: When the DHCP client needs to obtain the IP address information, the DHCP client needs to send a DHCP discovery packet to the BRAS.

Step 93: The BRAS acts as a DHCP relay, captures the DHCP message, and inserts the Option 82 option in the message, and then sends the DHCP discovery message carrying the user location information to the DHCP authentication server. The Option 82 option identifies the user. Location information, such as port information, VPI/VCI, VLAN ID, etc.

The DHCP authentication server receives the DHCP message from the BRAS, extracts the Option 82 option as the identification information and the MAC address of the terminal, and queries the local database to authenticate the identification information of the DHCP client according to the identification information of the legal user saved locally. If the authentication succeeds, the DHCP client sends a DHCP-provided packet to the DHCP client. Step 94: The DHCP authentication server sends a DHCP-provided packet to the DHCP client. Step 95: After receiving the DHCP-provided packet, the DHCP client receives the DHCP-provided packet. Sending a DHCP request message to the DHCP authentication server;

Step 96: The DHCP authentication server allocates IP address information to the DHCP client, and sends the DHCP response message to the DHCP client.

Similarly, in step 93 of FIG. 9, the BRAS is inserted into the Option 82 option. In the actual application process, the Option 82 option can also be inserted by the access node DSLAM, and the BRAS is only used as a DHCP relay. The other processes are identical.

In summary, the present invention greatly enhances the security of the address allocation in the DHCP mode, and can perform access authentication on the user according to the location information, and only assigns an IP address to the legal user and the legal terminal, so as to effectively prevent maliciousness. Exhausted address attack. Moreover, in the event of a network attack or other network security problem, the physical location of the user can also be tracked according to the IP address, and the hacker attack behavior can be effectively shocked.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope disclosed by the present invention. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.