Abnormal session clearing method and apparatus

Abstract

The application provides an abnormal session clearing method and device, relates to the technical field of communication, and can solve the problem that abnormal sessions occupy firewall resources. The method comprises the following steps: a remote authentication dial-in user service (RADIUS) Stop message is acquired, the RADIUS Stop message is used for indicating an abnormal session; and according to the RADIUS Stop message, a session connection corresponding to the abnormal session in a firewall is released. The embodiment of the application is used in the scene of clearing abnormal sessions.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method and apparatus for clearing abnormal sessions. Background Technology

[0002] Currently, in order to ensure the normal operation of mobile Internet users' services, firewalls are generally configured to keep Transmission Control Protocol (TCP) sessions open for a preset duration of 1 (e.g., 600 seconds) and User Datagram Protocol (UDP) sessions open for a preset duration of 2 (e.g., 120ms).

[0003] If a user goes offline abnormally or switches from 5G to Wi-Fi, the User Plane Function (UPF) will deactivate the user. However, the UPF does not notify the firewall that the user has gone offline. As a result, the firewall continues to maintain the session connection for the offline user according to the TCP / UDP session persistence duration. This may lead to a waste of network resources. Summary of the Invention

[0004] This application provides a method and apparatus for clearing abnormal sessions, which can solve the problem of abnormal sessions occupying firewall resources.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] In a first aspect, this application provides a method for clearing abnormal sessions, the method comprising: obtaining a RADIUS Stop message from a user's remote authentication system, the RADIUS Stop message being used to indicate an abnormal session;

[0007] Based on the RADIUS Stop message, the session connection corresponding to the abnormal session in the firewall is released.

[0008] Based on the above technical solution, the abnormal session clearing method provided in this application embodiment can avoid the firewall providing session connections to abnormal sessions because the firewall can obtain RADIUS Stop messages and release the session connections corresponding to the abnormal sessions in the firewall according to the RADIUS Stop messages, thereby saving network resources and improving device performance.

[0009] In a first possible implementation of the first aspect, obtaining the RADIUS Stop message includes:

[0010] Receive the RADIUS Stop message sent by the Service Management Function (SMF) or the User Plane Function (UPF).

[0011] In a second possible implementation of the first aspect, releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message includes:

[0012] Parse the RADIUS Stop message to obtain the IP address information corresponding to the abnormal session carried in the RADIUS Stop message;

[0013] Based on the IP address information, release the session connection corresponding to the abnormal session in the firewall.

[0014] In a third possible implementation of the first aspect, after releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message, the method further includes:

[0015] Update the number of session connections in the firewall.

[0016] In a fourth possible implementation of the first aspect, after releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message, the method further includes:

[0017] Send target information to the log server. The target information includes at least one of the following: the sending time of the target information, the IP address information corresponding to the abnormal session, the Internet Protocol prefix corresponding to the abnormal session, the number of abnormal sessions cleared, and the number of session connections of the firewall after clearing the abnormal session.

[0018] Secondly, this application provides an abnormal session clearing device, which includes: a communication unit and a processing unit;

[0019] The communication unit is used to acquire a RADIUS Stop message from the user's remote authentication system, which is used to indicate an abnormal session.

[0020] The processing unit is configured to release the session connection corresponding to the abnormal session in the firewall based on the RADIUS Stop message obtained by the communication unit.

[0021] In a first possible implementation of the second aspect, the communication unit is specifically used for:

[0022] Receive the RADIUS Stop message sent by SMF or UPF.

[0023] In a second possible implementation of the second aspect, the processing unit is specifically configured to: parse the RADIUS Stop message to obtain the IP address information corresponding to the abnormal session carried in the RADIUS Stop message; and release the session connection corresponding to the abnormal session in the firewall according to the IP address information.

[0024] In a third possible implementation of the second aspect, the processing unit is further configured to update the number of session connections of the firewall after releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message.

[0025] In a fourth possible implementation of the second aspect, the apparatus further includes a transmitting unit;

[0026] The sending unit is configured to send target information to the log server after the processing unit releases the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message;

[0027] The target information includes at least one of the following: the sending time of the target information, the IP address information corresponding to the abnormal session, the Internet Protocol prefix corresponding to the abnormal session, the number of abnormal sessions cleared, and the number of session connections of the firewall after clearing the abnormal session.

[0028] Thirdly, this application provides an abnormal session clearing apparatus, which includes: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is used to run computer programs or instructions to implement the abnormal session clearing method as described in the first aspect and any possible implementation of the first aspect.

[0029] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a terminal, cause the terminal to perform an abnormal session clearing method as described in the first aspect and any possible implementation thereof.

[0030] Fifthly, embodiments of this application provide a computer program product containing instructions that, when the computer program product is run on an abnormal session clearing device, cause the abnormal session clearing device to perform the abnormal session clearing method as described in the first aspect and any possible implementation thereof.

[0031] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run computer programs or instructions to implement the abnormal session clearing method as described in the first aspect and any possible implementation thereof.

[0032] Specifically, the chip provided in this application embodiment also includes a memory for storing computer programs or instructions. Attached Figure Description

[0033] Figure 1 This is one of the flowcharts for an abnormal session clearing method provided in the embodiments of this application;

[0034] Figure 2 The second flowchart of the abnormal session clearing method provided in the embodiments of this application;

[0035] Figure 3 The third flowchart of the abnormal session clearing method provided in the embodiments of this application;

[0036] Figure 4 This is a schematic diagram of the firewall structure provided in an embodiment of this application;

[0037] Figure 5 The fourth flowchart of the abnormal session clearing method provided in the embodiments of this application;

[0038] Figure 6 This is one of the schematic diagrams of the UPF session inspection window;

[0039] Figure 7 This is the second illustration of the UPF session check window;

[0040] Figure 8 This is a schematic diagram of the session inspection window of a firewall in related technologies;

[0041] Figure 9 This diagram illustrates a comparison of the number of session connections in firewalls of this application and existing technologies after a UE switches from a 5G network to a WiFi network.

[0042] Figure 10 This is a schematic diagram of the structure of an abnormal session clearing device provided in an embodiment of this application;

[0043] Figure 11 This is a schematic diagram of another abnormal session clearing device provided in an embodiment of this application;

[0044] Figure 12 This is a schematic diagram of the chip structure provided in an embodiment of this application. Detailed Implementation

[0045] The abnormal session clearing method and apparatus provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0046] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0047] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0048] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0049] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0050] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0051] The following explanations of the terms used in the embodiments of this application are provided to facilitate the reader's understanding.

[0052] (1) Session Management Function (SMF): Responsible for tunnel maintenance, IP address allocation and management, uplink function selection, policy implementation and quality of service (QoS) control, billing data collection, roaming, etc.

[0053] UPF: Responsible for packet routing and forwarding, policy enforcement, traffic reporting, and QoS processing.

[0054] Firewall: Abbreviated as FW, full English name is FireWall.

[0055] WIFI: Wireless Local Area Network technology;

[0056] Remote Authentication System (RADIUS): Abbreviation: RADIUS. The full English name is Remote Authentication Dial In User Service.

[0057] The RADIUS message format is shown in Table 1:

[0058] Table 1 RADIUS Message Format

[0059]

[0060]

[0061] In live network operations, to ensure normal mobile internet user services, firewalls typically set the Transmission Control Protocol (TCP) session hold-through time to 600 seconds and the User Datagram Protocol (UDP) session hold-through time to 120 seconds. When a user's mobile phone actively releases a TCP or UDP connection, the firewall will clear the relevant session. If a user abnormally goes offline or switches from 5G to Wi-Fi, the User Plane Function (UPF) will deactivate the user, and the firewall will still maintain the session connection for the user according to the TCP / UDP session hold-through time.

[0062] It is evident that after a Service Management Function (SMF) / UPF user goes offline abnormally, the firewall cannot know that the user has gone offline and continues to use the TCP / UDP session persistence method to maintain the session connection for the user, resulting in a large number of abnormal sessions on the firewall.

[0063] Statistics show that with each UPF supporting 500,000 users, 110,000 users are deactivated every 10 minutes. In a current 5G network with 10 million users, each firewall pair connects to approximately 3-5 UPFs, supporting about 2 million users. On average, each user has 13 session connections on the firewall. Based on this network scale and the number of sessions per user on the firewall, each firewall has approximately 25 million normal sessions and approximately 6 million abnormal session connections. This means abnormal session connections account for about a quarter of the total sessions. Abnormal sessions are invalid, have no value, and severely waste network resources, impacting device performance.

[0064] To address the aforementioned technical problems in the prior art, this application provides a method for clearing abnormal sessions. This method utilizes the RADIUS Stop message sent to the firewall when a user is deactivated by the SMF to notify the firewall of the user's offline behavior, thereby enabling the firewall to release the abnormal session synchronously. For example, the firewall can clear the session connection corresponding to the IPv4 or IPv6 address based on the Framed-IP-Address and Framed-IPv6-Prefix fields in the received RADIUS STOP message, thus releasing the abnormal session.

[0065] In this solution, the firewall adds an N4 interface IP address and a new Virtual Private Network (VPN), such as APN_RADIUS_JT, and binds the corresponding N4 interface IP address to the newly added VPN instance. The N4 interface IP address is used to receive RADIUS STOP messages sent by the SMF. The firewall parses the user-configured IP address (e.g., Framed-IP-Address), user-configured IP address prefix (e.g., Framed-IPv6-Prefix), and other fields carried in the RADIUS STOP message, clears the sessions corresponding to the source IP address, and refreshes the current firewall session count.

[0066] The abnormal session clearing method provided in this application is applied to a communication system so that the firewall can release abnormal (or offline) sessions in a timely manner.

[0067] like Figure 1 The diagram shows a flowchart of an abnormal session clearing method provided in an embodiment of this application. The method includes the following steps S101 and S102.

[0068] S101, Firewall obtains RADIUS Stop message.

[0069] The RADIUS Stop message is used to indicate an abnormal session.

[0070] It is understandable that the sessions currently provided by the firewall include those corresponding to abnormal sessions.

[0071] In this embodiment of the application, the firewall sets the N4 interface IP address, adds a new VPN instance, and binds the N4 interface IP address to the newly added VPN instance.

[0072] The firewall can obtain RADIUS STOP messages through the N4 interface IP address.

[0073] Optionally, the VPN instance can be: APN_RADIUS_JT.

[0074] S102. The firewall releases the session connection corresponding to the abnormal session based on the RADIUS Stop message.

[0075] It should be noted that when a firewall releases a session connection for an abnormal session, it can be understood as the firewall no longer providing service support for that abnormal session, that is, the firewall disconnects the session connection between the firewall and the user equipment (UE) corresponding to the abnormal session.

[0076] Thus, since the firewall can obtain RADIUS Stop messages and release the session connection corresponding to the abnormal session based on the RADIUS Stop messages, it can avoid providing session connections to the abnormal session, thereby saving network resources and improving device performance.

[0077] Optionally, combined Figure 1 ,like Figure 2 As shown, step 101 can be implemented by the following S101a. Before S101a, the abnormal session clearing method provided in this application embodiment may also include the following S103.

[0078] S103, SMF, or UPF send a RADIUS Stop message to the firewall.

[0079] S101a, the firewall receives RADIUS Stop messages.

[0080] It is understandable that after clearing a session, the SMF or UPF can send a RADIUS Stop message corresponding to that session to the firewall so that the firewall knows that the session has gone offline, and thus the firewall can release the session connection corresponding to that session.

[0081] In this embodiment of the application, when the UE performs a network handover, such as switching from a mobile network to a WiFi network, the SMF senses the change in the UE's state through signaling interaction messages with the UE, thereby actively activating the session connection corresponding to the UE, and notifying the UPF to release the user's session connection through the N4 interface.

[0082] Furthermore, the following configurations can be added to SMF:

[0083] (1)ADD L3VPNINST: VRFNAME="APN_RADIUS_JT", VRFDESCRIPTION="RADIUS";

[0084] (2)ADD RDSSVRGRP:RDSSVRGRPNAME="RADIUS",MODE=MASTER_SLAVE,SIGOPTACCTMSG=DISABLE,ACCTTOAUTH=DISABLE,DSCPV=255,ACCTTIMEOUT= 3,ACCTRETRANSMIT=0,AUTHTIMEOUT=3,AUTHRETRANSMIT=3,ACCTSVRTOUT=12,ACCTSVRDTIME=180,AUTHSVRTOUT=12,AUTHSVRDTIME=180;

[0085] (3)ADD RDSSVR:RDSSVRGRPNAME="RADIUS",SERVERIPV4="10.214.34.3",PORT=1813,

[0086] VPNINSTANCE="APN_RADIUS_JT",SERVERTYPE=ACCOUNTING,

[0087] CIPHERKEY="*****",CONGESTION=DISABLE,PRIFLAG=CARBON_COPY,WALVALUE=0,CIPHERKEYCNFM="*****",IPVERSION=IPV4,UDPCHECKSUMSW=DISABLE;

[0088] (4)ADD APNRDSSVRGRP:APN="3gnet",RDSSVRGRPNAME="RADIUS",COPYINTERIMUPD="ENABLE;

[0089] (5)ADD RADIUSCLIENTIP:RDSSVRGRPNAME="RADIUS",AUTHORACCT=ACCOUNTING,INTFNAME="giif1 / 0 / 1".

[0090] Then, the SMF can send a RADIUS STOP message to the firewall via the N4 interface.

[0091] In this way, since the firewall can receive RADIUS Stop messages from the SMF, it can release the session connection corresponding to the abnormal session in a timely manner based on the RADIUS Stop message, thereby saving network resources and improving device performance.

[0092] Optionally, the release of the session connection corresponding to the abnormal session according to the RADIUS Stop message can be specifically implemented through S1 and S2 as described below.

[0093] S1. The firewall parses the RADIUS Stop message to obtain the IP address information corresponding to the abnormal session carried in the RADIUS Stop message.

[0094] Optionally, the RADIUS STOP message may carry the Framed-IP-Address and / or Framed-IPv6-Prefix fields.

[0095] The firewall can parse the RADIUS STOP message to find that the RADIUS STOP message may carry the Framed-IP-Address and / or Framed-IPv6-Prefix fields. Based on the parsed Framed-IP-Address and Framed-IPv6-Prefix, the IP address information of the UE corresponding to the abnormal session can be determined, that is, the IP address information corresponding to the abnormal session.

[0096] It can be understood that "IP address information corresponding to the abnormal session" can be understood as: the IP address information of the UE corresponding to the abnormal session.

[0097] S2. The firewall releases the session connection corresponding to the abnormal session based on the IP address information corresponding to the abnormal session.

[0098] Thus, since the RADIUS Stop message carries the IP address information corresponding to the abnormal session, the firewall can accurately release the session connection corresponding to the abnormal session.

[0099] Optionally, the session connection corresponding to the abnormal session can be an IPv4 session connection or an IPv6 session connection. Thus, since the firewall can disconnect both IPv4 and IPv6 session connections, its ability to clear abnormal sessions can be improved.

[0100] Optionally, the IP address information corresponding to the abnormal session carried in the RADIUS Stop message may specifically include at least one of the following: Framed-IP-Address, Framed-IPv6-Prefix.

[0101] Optionally, combined Figure 1 ,like Figure 3 As shown, after S102 above, the abnormal session clearing method provided in this application embodiment may further include S104 and S105 as described below.

[0102] S104. The firewall sends target information to the log server.

[0103] S105. The log server receives the target information.

[0104] The target information includes at least one of the following: the time the target information was sent, the IP address information corresponding to the abnormal session, the Internet protocol prefix corresponding to the abnormal session, the number of abnormal sessions cleared, and the number of session connections after the firewall update.

[0105] Optionally, in practice, firewalls can also store target information in a cache.

[0106] Thus, since the firewall can send information such as the sending time of the target information, the IP address information corresponding to the abnormal session, the Internet Protocol prefix corresponding to the abnormal session, the number of abnormal sessions cleared, and / or the number of session connections after the firewall is updated to the log server, the log server can record the real-time session connection status of the firewall.

[0107] Optionally, after S102 above, the abnormal session clearing method provided in this application embodiment may further include S106 below.

[0108] S106. Firewall update: Total number of session connections.

[0109] In this embodiment of the application, the total number of session connections of the firewall can be updated after the firewall releases a session connection.

[0110] It is understandable that S106 can be executed before S104.

[0111] Thus, since the firewall can update the total number of session connections after releasing the session connection corresponding to the abnormal session, the firewall can monitor the number of valid session connections in real time.

[0112] Optionally, such as Figure 4 As shown, the firewall may include a bus 401, and a data acquisition module 402, a session release module 403, a log sending module 404, a message parsing module 405, and a data verification module 406, which are respectively connected to the bus.

[0113] The firewall uses data acquisition module 402 to receive RADIUS STOP messages.

[0114] The firewall uses the message parsing module 405 to analyze the received RADIUS STOP message and obtain the Framed-IP-Address and Framed-IPv6-Prefix fields carried in the message.

[0115] The firewall calls session release module 403 to query the local IPv4 session table for session connections with the source address of the Framed-IP-Address and release them, and queries the local IPv6 session table for session connections with the source address of the Framed-IPv6-Prefix and releases them.

[0116] The data verification module 406 confirms that the corresponding session connection has been cleared and refreshes the current total number of session connections of the firewall.

[0117] The firewall sends the execution result (i.e., the first information mentioned above) to the cache and log server via the log sending module 404. This includes the current time, the content of the Framed-IP-Address field, the content of the Framed-IPv6-Prefix field, the number of abnormal sessions cleared, and the total number of current firewall session connections. The operation is recorded.

[0118] Bus 401 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 401 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0119] like Figure 5 As shown in the embodiments of this application, an abnormal session clearing method is also provided, which may include:

[0120] S501, UE sends the first information to SMF.

[0121] The first message indicates that the UE is switching from the mobile network to the Wi-Fi network or that the UE has encountered an abnormality.

[0122] S502 and SMF send a first notification to the UE, which is used to instruct the UE to activate the UE.

[0123] S503, SMF sends a second notification to UPF, which is used to notify UPF to activate UE.

[0124] S504, SMF clears the UE's Packet Data Protocol (PDP) session.

[0125] S505, UPF clears the UE's PDP session.

[0126] It is understandable that the UPF can clear the UE's PDP session after receiving the first notification.

[0127] S506 and SMF send a RADIUS Stop message to the firewall.

[0128] The RADIUS Stop message includes the UE's IPv4 or IPv6 address information.

[0129] It is understandable that the order in which the SMF clears the UE's PDP session and the RADIUS Stop messages are not restricted.

[0130] S507: The firewall clears the session connection corresponding to the UE's PDP session based on the RADIUS Stop message.

[0131] For other descriptions in S501 to S507, please refer to the relevant descriptions in the above embodiments.

[0132] The abnormal session clearing method provided in this application embodiment will be further explained below with specific examples.

[0133] For example, such as Figure 6 As shown, the statement in the UPF session check window 60 indicates that a session connection is included on the UPF;

[0134] So, when the UE corresponding to this session connection switches from a 5G network to a WiFi network, as follows: Figure 7 As shown, the statement in the session check window 70 of the UPF can indicate that the UE's session has been cleared on the UPF.

[0135] After the UPF clears the UE's session, from Figure 8 As can be seen from the statements in the session inspection window 80 of the firewall in the related technology, the firewall in the related technology can still maintain the session connection corresponding to the UE's session.

[0136] like Figure 8 As shown, in related technologies, from the perspective of the firewall, the UE's session is viewed as follows: TTL:00:10:00 represents a total session duration of 10 minutes, and Left:00:08:37 represents a remaining session duration of 8 minutes and 37 seconds. Although the UPF has released the session, the firewall continues to maintain the invalid session because the UPF has not notified the firewall that the UE has gone offline and released the session, thus consuming firewall performance and resources.

[0137] In the abnormal session release method provided in this application embodiment, the firewall releases the abnormal session based on the UE offline message (i.e., RADIUS Stop message) sent by the UPF. The number of firewall session connections before and after implementation is compared as follows: Figure 9 As shown. From Figure 9As can be seen, after adopting the abnormal session release method provided in this application embodiment, the number of firewall session connections decreased by 28%, effectively reducing system resource consumption.

[0138] It is understood that in the abnormal session clearing method provided in the embodiments of this application:

[0139] 1. After the UPF releases the UE's PDP session, it actively sends a RADIUS Stop message to the firewall.

[0140] 2. The firewall recognizes RADIUS Stop messages and retrieves the Framed-IP-Address and Framed-IPv6-Prefix fields carried in the message.

[0141] 3. The firewall releases sessions whose source address in the corresponding IPv4 session table is the aforementioned field, based on the Framed-IP-Address field.

[0142] 4. The firewall releases sessions whose source address in the corresponding IPv6 session table is the aforementioned field, based on the Framed-IPv6-Prefix field.

[0143] It should be noted that the above embodiment is illustrated by the firewall directly obtaining RADIUS Stop messages. In actual implementation, a third-party server can be used to obtain RADIUS Stop messages. For example, a third-party server can be used to receive RADIUS Stop messages sent by SMF or UPF. After being parsed by relevant programs, the firewall can be logged into through the third-party server to execute commands to clear abnormal sessions of the corresponding source address.

[0144] This application embodiment can divide the abnormal session clearing device into functional modules or functional units according to the above method example. For example, each function can be divided into a separate functional module or functional unit, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or in software functional modules or functional units. The module or unit division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0145] like Figure 10 The diagram shown is a structural schematic of an abnormal session clearing device provided in an embodiment of this application. The device includes:

[0146] Communication unit 1001 is used to acquire a user remote authentication system RADIUS Stop message, the RADIUS Stop message being used to indicate an abnormal session;

[0147] The processing unit 1002 is used to release the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message obtained by the communication unit.

[0148] Optionally, the communication unit 1001 is specifically used to receive the RADIUS Stop message sent by the SMF or UPF.

[0149] Optionally, the processing unit 1002 is specifically configured to: parse the RADIUS Stop message to obtain the IP address information corresponding to the abnormal session carried in the RADIUSStop message; and release the session connection corresponding to the abnormal session in the firewall according to the IP address information.

[0150] Optionally, the processing unit 1002 is further configured to update the number of session connections of the firewall after releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message.

[0151] Optionally, the abnormal session clearing device further includes a sending unit;

[0152] The sending unit is configured to send target information to the log server after the processing unit releases the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message;

[0153] The target information includes at least one of the following: the sending time of the target information, the IP address information corresponding to the abnormal session, the Internet Protocol prefix corresponding to the abnormal session, the number of abnormal sessions cleared, and the number of session connections of the firewall after clearing the abnormal session.

[0154] Thus, since the abnormal session clearing device can obtain RADIUS Stop messages and release the session connections corresponding to the abnormal sessions in the firewall according to the RADIUS Stop messages, it can avoid the firewall providing session connections to abnormal sessions, thereby saving network resources and improving device performance.

[0155] When implemented in hardware, the communication unit 1001 in this embodiment can be integrated onto the communication interface, and the processing unit 1002 can be integrated onto the processor. Specific implementation methods are as follows: Figure 11 As shown.

[0156] Figure 11A schematic diagram of another possible structure of the abnormal session clearing device involved in the above embodiments is shown. The abnormal session clearing device includes a processor 302 and a communication interface 303. The processor 302 is used to control and manage the operation of the abnormal session clearing device, for example, executing the steps performed by the processing unit 1002, and / or performing other processes of the technology described herein. The communication interface 303 is used to support communication between the abnormal session clearing device and other network entities, for example, executing the steps performed by the communication unit 1001. The abnormal session clearing device may also include a memory 301 and a bus 304, the memory 301 being used to store the program code and data of the abnormal session clearing device.

[0157] The memory 301 may be the memory in the abnormal session clearing device, etc. The memory may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as read-only memory, flash memory, hard disk or solid-state drive; the memory may also include a combination of the above types of memory.

[0158] The processor 302 described above can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0159] Bus 304 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 304 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 11 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0160] Figure 12 This is a schematic diagram of the structure of chip 170 provided in an embodiment of this application. Chip 170 includes one or more (including two) processors 1710 and communication interfaces 1730.

[0161] Optionally, the chip 170 also includes a memory 1740, which may include read-only memory and random access memory, and provides operation instructions and data to the processor 1710. A portion of the memory 1740 may also include non-volatile random access memory (NVRAM).

[0162] In some implementations, memory 1740 stores elements such as execution modules or data structures, or subsets thereof, or extended sets thereof.

[0163] In this embodiment of the application, the corresponding operation is executed by calling the operation instructions stored in the memory 1740 (the operation instructions can be stored in the operating system).

[0164] The processor 1710 described above can implement or execute various exemplary logic blocks, units, and circuits described in conjunction with the disclosure of this application. The processor can be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, units, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0165] The memory 1740 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as read-only memory, flash memory, hard disk or solid-state drive; the memory may also include combinations of the above types of memory.

[0166] The Bus 1720 can be an Extended Industry Standard Architecture (EISA) bus, etc. The Bus 1720 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 12 The symbol is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0167] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0168] This application provides a computer program product containing instructions that, when run on a computer, cause the computer to execute the abnormal session clearing method in the above method embodiments.

[0169] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the abnormal session clearing method in the method flow shown in the above method embodiments.

[0170] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections having one or more wires; portable computer disks; hard disks; random access memory (RAM); read-only memory (ROM); erasable programmable read-only memory (EPROM); registers; hard disks; optical fibers; portable compact disc read-only memory (CD-ROM); optical storage devices; magnetic storage devices; or any suitable combination thereof; or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0171] Embodiments of the present invention provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform the abnormal session clearing method as described in the above method embodiments.

[0172] Since the abnormal session clearing device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above method, the technical effects obtained can also be referred to the above method embodiments. The embodiments of the present invention will not be repeated here.

[0173] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0174] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0175] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0176] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for clearing abnormal sessions, characterized in that, The method includes: Obtain a RADIUS Stop message from the user's remote authentication system, which indicates an abnormal session; According to the RADIUS Stop message, release the session connection corresponding to the abnormal session in the firewall; The firewall is configured with an N4 interface IP address, which is bound to a Virtual Private Network (VPN) instance, namely APN_RADIUS_JT; obtaining the RADIUS Stop message includes: The firewall receives the RADIUS Stop message sent by the Service Management Function (SMF) or the User Plane Function (UPF) through the N4 interface IP address; The step of releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message includes: Parse the RADIUS Stop message to obtain the IP address information corresponding to the abnormal session carried in the RADIUS Stop message; Based on the IP address information, release the session connection corresponding to the abnormal session in the firewall; After releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message, the method further includes: The firewall's data verification module confirms that the corresponding session connection has been cleared and refreshes the firewall's current total number of session connections.

2. The method according to claim 1, characterized in that, After releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message, the method further includes: Send target information to the log server. The target information includes at least one of the following: the sending time of the target information, the IP address information corresponding to the abnormal session, the Internet Protocol prefix corresponding to the abnormal session, the number of abnormal sessions cleared, and the number of session connections of the firewall after clearing the abnormal session.

3. An abnormal session clearing device, characterized in that, The device includes: a communication unit and a processing unit; The communication unit is used to acquire a RADIUS Stop message from the user's remote authentication system, which is used to indicate an abnormal session. The processing unit is configured to release the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message obtained by the communication unit. The firewall is configured with an N4 interface IP address, which is bound to a Virtual Private Network (VPN) instance, namely APN_RADIUS_JT. The communication unit is specifically used to receive the RADIUS Stop message sent by the SMF or UPF; The processing unit is specifically used to parse the RADIUS Stop message to obtain the IP address information corresponding to the abnormal session carried in the RADIUS Stop message; and release the session connection corresponding to the abnormal session in the firewall according to the IP address information. The processing unit is further configured to, after releasing the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message, confirm through the data verification module in the firewall that the corresponding session connection has been cleared, and refresh the current total number of session connections of the firewall through the data verification module.

4. The apparatus according to claim 3, characterized in that, The device also includes a transmitting unit; The sending unit is configured to send target information to the log server after the processing unit releases the session connection corresponding to the abnormal session in the firewall according to the RADIUS Stop message; The target information includes at least one of the following: the sending time of the target information, the IP address information corresponding to the abnormal session, the Internet Protocol prefix corresponding to the abnormal session, the number of abnormal sessions cleared, and the number of session connections of the firewall after clearing the abnormal session.

5. An abnormal session clearing device, characterized in that, include: A processor and a communication interface; the communication interface is coupled to the processor, the processor being used to run computer programs or instructions to implement the abnormal session clearing method as described in claim 1 or 2.

6. A computer-readable storage medium storing instructions, characterized in that, When the computer executes the instruction, the computer performs the abnormal session clearing method as described in claim 1 or 2 above.

Images