NETWORK SESSION CONTROL

• US 20150381739A1
• Filed: 02/13/2014
• Published: 12/31/2015
• Est. Priority Date: 02/17/2013
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: H3C Technologies Co., Limited (Hewlett-Packard Enterprise Company)
• Inventors: CHAI, Yongfu
• Application Number:
  US14/768,194
• Publication Number:
  US 20150381739A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 61/59 using proxies for addressing
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

According to an example, a proxy device receives a request packet sent by the session management device, determines a target access device corresponding to the request packet, modifies the destination IP address of the request packet to be the IP address of the target access device while keeping the source IP address of the request packet unchanged, and sends the modified request packet to the target access device.

Claims

1. A network session control method wherein a network includes access devices capable of performing access authentication of users and a session management device capable of communicating session information to the access devices and, the method comprising:

receiving, by a proxy device, a request packet from the session management device, the request packet including information of a user;

determining a target access device of the access devices corresponding to the request packet by using the information of the user in the request packet;

modifying a destination IP address of the request packet to be an IP address of the target access device while keeping a source IP address of the request packet unchanged; and

sending the modified request packet to the target access device.

2. The method of claim 1, further comprising:

the target access device returning a response packet to the session management device by using an IP address of the proxy device stored in advance and the source IP address of the request packet.

3. The method of claim 2, wherein returning the response packet to the session management device comprises:

setting a source IP address of the response packet to be the IP address of the proxy device; and

setting a destination IP address of the response packet to be the source IP address of the request packet.

4. The method of claim 1, further comprising:

sending, by the target access device, information of the user to the proxy device after performing access authentication for the user; and

storing, by the proxy device, a relation which associates the information of the user with the access device,

wherein the determining of the target access device comprises identifying the access device associated with the information of the user in the stored relation as the target access device corresponding to the request packet.

5. The method of claim 1, wherein

when the network is an access network, the session management device is an authentication, authorization and accounting (AAA) server, and the request packet is a session control packet for an authenticated user sent by the session management device, and the method comprises:

obtaining from each of the access devices, by the proxy device, access information of users authenticated at the access device;

access information of a user including information of the user and information of an access device the user is connected to, and wherein

the determining of the target access device corresponding to the request packet comprises;

identifying an access device the user is connected to as the target access device corresponding to the request packet by using information of the user in the request packet and access information of users authenticated at each of the access devices obtained in advance from all of the access devices.

6. The method of claim 1, wherein

when the network is a portal network, each of the access devices is a network access server (NAS), the session management device is a portal server, and the request packet is an access request sent by the portal server after the portal server received user authentication information submitted by a not-yet-logged-in user through a logon interface provided by a web server, and the method comprises:

obtaining from the access devices, by the proxy device, access information of users having visited the logon interface provided by the web server via each of the access devices; and

accessing information of a user including information of the user and information of the access device via which the user visited the logon interface provided by the web server,

wherein the determining of the target access device corresponding to the request packet comprises;

identifying an access device via which the user visited the logon interface provided by the web server as the target access device corresponding to the request packet by using information of the user in the request packet and accessing information of users obtained previously from all of the access devices.

7. A proxy device to facilitate network session control in a network, the network including access devices capable of performing access authentication of users and a session management device capable of communicating session information with the access devices, wherein the proxy device is deployed between the access devices and the session management device, and comprises:

a receiving module, a processing module and a sending module; and

wherein;

—

the receiving module is to receive a request packet sent by the session management device;

the processing module is to determine a target access device corresponding to the request packet, and modify a destination IP address of the request packet to be an IP address of the target access device while keeping a source IP address of the request packet unchanged; and

the sending module is to send the modified request packet to the target access device to cause the target access device to return a response packet to the session management device by using an IP address of the proxy device stored in advance and a source IP address of the request packet.

8. The proxy device of claim 7, wherein the receiving module is further to store a relation which associates information of the user with an access device of the access devices after receiving information of the user sent by the access device which has performed access authentication for the user;

and

the processing module is to identify the access device associated with the information of the user in the stored relation as the target access device corresponding to the request packet.

9. The proxy device of claim 7, further comprising an obtaining module,

wherein when the network is an access network, the session management device is an authentication, authorization and accounting (AAA) server, and the request packet is a session control packet for an authenticated user sent by the session management device,

the obtaining module is to obtain from each of the access devices access information of users authenticated at the access devices, and access information of a user including information of the user and information of an access device the user is connected to;

and

the processing module is to determine the target access device corresponding to the request packet by identifying an access device of the access devices the user is connected to as the target access device corresponding to the request packet by using information of the user in the request packet and access information of users authenticated by each of the access devices obtained in advance from all of the access devices.

10. The proxy device of claim 7, further comprising an obtaining module,

wherein when the network is a portal network, the access device is a network access server (NAS), the session management device is a portal server, and the request packet is an access request sent by the portal server after the portal server received user authentication information submitted by a not-yet-logged-in user through a logon interface provided by a web server,

the obtaining module is to obtain from the access devices access information of users having visited the logon interface provided by the web server via each of the access devices, and the access information of a user including information of the user and information of the access device via which the user visited the logon interface provided by the web server;

and

the processing module is to determine the target access device corresponding to the request packet by identifying an access device of the access devices via which the user visited the logon interface provided by the web server as the target access device corresponding to the request packet by using information of the user in the request packet and user access information obtained previously from the access devices.

11. An access device to facilitate network session control in a network, the network including access devices, a proxy device and a session management device, the access device comprising:

a storage module, a receiving module, a processing module and a sending module;

wherein the storage module is to store an IP address of the proxy device in advance;

the receiving module is to receive from the proxy device a request packet initiated by the session management device, wherein a source IP address of the request packet is an IP address of the session management device, and the request packet includes information of a session control procedure to be performed for a user;

the processing module is to perform the session control procedure for the user according to the request packet; and

the sending module is to generate a response packet and send the response packet to the session management device, wherein a source IP address of the response packet is set to be an IP address of the proxy device stored in the access device in advance, and a destination IP address of the response packet is set to be the source IP address of the request packet.