Method, unit and device for isolating wireless network user

Abstract

The invention provides a method, a unit and a device for isolating a wireless network user. The method comprises the following steps of: acquiring forward information from a forward result after receiving a wireless data packet; judging whether a source interface and a destination interface carried in the forward information belong to the same access point (AP) or not when judging that the access point user isolation is started; and discarding the wireless data packet when judging that the source interface and the destination interface belong to the same access point. In the method, the AP user isolation is realized by judging whether the destination interface belongs to the same access point or not based on the forward information, such as six-tuple information, without using the virtual local area network (VLAN) isolation function and three-layer authentication; therefore, the method can be used for both two-layer exchange process and three-layer routing process with simple and convenient operation and implementation. In addition, the method has substantially no influence on the conventional data storage structure and data exchange and forwarding performance.

Description

technical field [0001] The invention relates to the technical field of wireless network security, in particular to a wireless network user isolation method, unit and equipment. Background technique [0002] In an existing wireless network, such as a wireless local area network (Wireless Local Area Network, WLAN for short), due to mobility and uncertainty of wireless users, mutual access between users needs to be isolated. User isolation includes user isolation under the same access point (Access Point, AP for short) and user isolation under the same access controller (Access Controller, AC for short). There are mainly three ways to implement user isolation in the prior art: [0003] Method 1: The same AP internally uses the mutual access control principle of the Media Access Control (MAC) layer to isolate users, so as to ensure that different users under the same AP cannot communicate at Layer 2; [0004] Method 2: Use MAC address access control or layer-2 isolation techno...

AI Technical Summary

Problems solved by technology

[0006] However, some of the existing user isolation technologies are limited to MAC address control, while others require the use of VLAN isolation and Layer 3 authentication, which is complex to implement

Images