Communication method, apparatus, communication device, storage medium, and computer program product

Abstract

This application relates to a communication method, apparatus, communication device, storage medium, and computer program product. The method includes: a BRAS (Branded Network Assistance System) obtaining a target network request through a private network, the target network request including network request information and user account information; encapsulating the network request information and the user account information into a network tunnel message and establishing a network tunnel for the target network request; sending the network tunnel message through the network tunnel to a target public network device, the target public network device being the last public network device to perform NAT translation during the current communication process; and using the network tunnel message for IP address tracing based on the user account information in the network tunnel message. This method can reduce the difficulty and improve the efficiency of IP address tracing in emergency communication systems.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and in particular to a communication method and device, a communication apparatus, a storage medium and a computer program product. BACKGROUND

[0002] When natural disasters such as floods and earthquakes occur, wired broadband networks are prone to failure, affecting the user's online experience. In this case, an emergency communication system needs to be enabled for emergency communication.

[0003] In the related art, the emergency communication system mainly uses a satellite portable station to provide an Internet portal, the satellite portable station is connected to an OLT (Optical Line Terminal), the OLT is connected to a BRAS (Broadband Remote Access Server) in parallel, and the OLT is connected to an ONU (Optical Network Unit) to connect user equipment.

[0004] However, in the process of communication based on the above emergency communication system, there are often problems of great difficulty in IP address tracing and low efficiency in IP address tracing. SUMMARY

[0005] The embodiments of the present application provide a communication method, device, apparatus, storage medium and computer program product, which can reduce the difficulty of IP address tracing of the emergency communication system and improve the efficiency of IP address tracing.

[0006] In a first aspect, the embodiments of the present application provide a communication method. The communication method is used in a BRAS (Broadband Remote Access Server) in an emergency communication system, and the method comprises:

[0007] Obtaining a target network request through a private network, wherein the target network request comprises network request information and user account information;

[0008] Encapsulating the network request information and the user account information into a network tunnel message, and establishing a network tunnel for the target network request;

[0009] Sending the network tunnel message to a target public network device through the network tunnel, wherein the target public network device is the last public network device performing NAT (Network Address Translation) conversion in the current communication process, and the network tunnel message is used for IP address tracing according to the user account information in the network tunnel message.

[0010] In one of the embodiments, the encapsulating the network request information and the user account information into a network tunnel message, and establishing a network tunnel for the target network request comprises:

[0011] The network request information and the user account information are encapsulated into an IPv6 message, and an IPv6 tunnel is established for the target network request;

[0012] Sending the network tunnel message to the target public network device through the network tunnel includes:

[0013] The IPv6 message is sent to the target public network device through the IPv6 tunnel.

[0014] In one embodiment, encapsulating the network request information and the user account information into an IPv6 packet includes:

[0015] During the encapsulation process, the network request information is encapsulated in the IPv6 basic message portion, and the user account information is encapsulated in the IPv6 segmented extended header portion to obtain the IPv6 message.

[0016] In one embodiment, encapsulating the user account information in the IPv6 segmented extension header segment includes:

[0017] Convert the user account information into a binary identifier stream;

[0018] The binary identifier stream is encapsulated in the IPv6 segmented extension header segment.

[0019] In one embodiment, establishing an IPv6 tunnel for the target network request includes:

[0020] Execute the IPv6 tunnel configuration file to establish the IPv6 tunnel for the target network request.

[0021] In one embodiment, obtaining the target network request through a private network includes:

[0022] The system receives a network request to be verified sent by the optical line terminal (OLT) based on a private network. The network request to be verified includes initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT in sequence through the optical network unit (ONU) and the optical splitter (OBD).

[0023] User authentication is performed based on the user account information. If the user authentication is successful, the target network request is obtained based on the network request to be verified.

[0024] In one embodiment, obtaining the target network request based on the network request to be verified includes:

[0025] Assign a private network IP address to the network request to be verified;

[0026] Perform NAT translation on the private network IP address to obtain the first public IP address corresponding to the private network IP address;

[0027] The first public IP address is added to the initial network request information to obtain the network request information, and the network request information and the user account information are used as the target network request.

[0028] In one embodiment, the user authentication based on the user account information includes:

[0029] The user account information is sent to the identity authentication server, and the user account information is used by the identity authentication server to perform user identity authentication based on the user account information.

[0030] Receive the authentication result sent by the authentication server, the authentication result including authentication passed or authentication failed.

[0031] In one embodiment, the method further includes:

[0032] If the authentication result is that the authentication failed, then the allocation of a private network IP address to the network request to be verified is prohibited.

[0033] Secondly, embodiments of this application also provide a communication method. The communication method is used in a target public network device in an emergency communication system, wherein the target public network device is the last public network device to perform NAT translation during the current communication process, and the method includes:

[0034] The system receives network tunnel messages sent by the BRAS in the emergency communication system based on the network tunnel. The network tunnel messages are obtained by the BRAS by encapsulating network request information and user account information included in the target network request obtained based on the private network.

[0035] The network tunnel message is decapsulated to obtain the network request information and the user account information;

[0036] The user account information is sent to the tracing server, where the user account information is used for IP address tracing.

[0037] In one embodiment, before sending the user account information to the tracing server, the method further includes:

[0038] Determine the first public IP address obtained by decapsulating the network tunnel packet;

[0039] The first public IP address is used as the private network IP address, and NAT translation is performed on the first public IP address to obtain the second public IP address;

[0040] Sending the user account information to the tracing server includes:

[0041] The second public IP address is associated with the user account information and then sent to the tracing server.

[0042] In one embodiment, the network tunnel message is an IPv6 message, and the network tunnel is an IPv6 tunnel.

[0043] In one embodiment, the decapsulation process of the network tunnel packet to obtain the network request information and the user account information includes:

[0044] The IPv6 packet is decapsulated to obtain the network request information encapsulated in the IPv6 basic packet portion of the IPv6 packet, and the binary identifier stream encapsulated in the IPv6 segmented extension header portion of the IPv6 packet.

[0045] The binary identifier stream is format-converted to obtain the user account information.

[0046] Thirdly, embodiments of this application also provide a communication device. The communication device is installed in a BRAS (Brake Emergency Response System) within an emergency communication system, and the device includes:

[0047] The acquisition module is used to acquire a target network request through a private network, wherein the target network request includes network request information and user account information;

[0048] The tunnel processing module is used to encapsulate the network request information and the user account information into a network tunnel message and establish a network tunnel for the target network request.

[0049] The sending module is used to send the network tunnel message to the target public network device through the network tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The network tunnel message is used to trace the IP address based on the user account information in the network tunnel message.

[0050] Fourthly, embodiments of this application also provide a communication device. The communication device is installed in a target public network device within an emergency communication system. The target public network device is the last public network device to perform NAT translation during the current communication process. The device includes:

[0051] The receiving module is used to receive network tunnel messages sent by the BRAS in the emergency communication system based on the network tunnel. The network tunnel messages are obtained by the BRAS by encapsulating network request information and user account information included in the target network request obtained based on the private network.

[0052] The decapsulation module is used to decapsulate the network tunnel packets to obtain the network request information and the user account information;

[0053] The sending module is used to send the user account information to the tracing server, where the user account information is used for IP address tracing.

[0054] Fifthly, embodiments of this application also provide a communication device. The communication device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described in the first or second aspect above.

[0055] Sixthly, embodiments of this application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in the first or second aspect above.

[0056] In a seventh aspect, embodiments of this application also provide a chip. The chip includes programmable logic circuitry and / or program instructions, which, when executed, implement the steps of the methods described in the first or second aspect above.

[0057] Eighthly, embodiments of this application also provide a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the method described in the first or second aspect above.

[0058] The aforementioned communication method, apparatus, communication equipment, storage medium, and computer program product, in the emergency communication system, the BRAS obtains a target network request through a private network. This target network request includes network request information and user account information. Then, the network request information and user account information are encapsulated into a network tunnel message, and a network tunnel is established for the target network request. The network tunnel message is then sent to the target public network device through the network tunnel. The target public network device is the last public network device to perform NAT translation during the current communication process. The network tunnel message is used for IP address tracing based on the user account information in the network tunnel message. Thus, in this embodiment, the BRAS directly sends the network tunnel message to the target public network device through the established network tunnel. The target public network device can obtain the user account information by decapsulating the network tunnel message. This user account information can be directly used for IP address tracing, avoiding the problems of high difficulty and low efficiency in IP address tracing caused by the multiple NAT translations required between the BRAS and the target public network device in traditional technologies. This embodiment reduces the difficulty of IP address tracing and improves its efficiency. Attached Figure Description

[0059] Figure 1 This is a system architecture diagram of an exemplary emergency communication system in one embodiment;

[0060] Figure 2 This is a flowchart illustrating a communication method in one embodiment;

[0061] Figure 3 This is a schematic diagram illustrating the creation of a network tunnel based on an emergency communication system in one embodiment;

[0062] Figure 4 This is a flowchart illustrating the communication method in another embodiment;

[0063] Figure 5 This is a flowchart illustrating step 401 in another embodiment;

[0064] Figure 6 This is a flowchart illustrating step 201 in another embodiment;

[0065] Figure 7 This is a flowchart illustrating the communication method in another embodiment;

[0066] Figure 8 This is a structural block diagram of a communication device in one embodiment;

[0067] Figure 9 This is a structural block diagram of the communication device in another embodiment;

[0068] Figure 10This is an internal structure diagram of a communication device in one embodiment;

[0069] Figure 11 This is a schematic structural diagram of a chip in one embodiment. Detailed Implementation

[0070] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0071] During natural disasters such as floods and earthquakes, wired broadband networks are prone to failure, affecting users' internet experience. In such cases, it is necessary to activate an emergency communication system for emergency communication. The following is a brief introduction to the system architecture of an emergency communication system.

[0072] For example, see Figure 1 , Figure 1 This is a system architecture diagram of an exemplary emergency communication system. Figure 1 As shown, the emergency communication system involves ONU (Optical Line Terminal), BRAS (Broadband Remote Access Server), satellite portable stations, the satellite company's internal network, and the satellite company's local operator network. For a single network access request, the emergency communication system needs to perform multiple NAT (Network Address Translation) conversions.

[0073] For example, please combine Figure 1 When a user terminal sends a network request, the network request passes through the ONU and OBD (including primary OBD and secondary OBD) (Optical Branching Device) to reach the OLT. The OLT is connected to a local BRAS. The OLT is configured with VLAN (Virtual Local Area Network) for isolation. The OLT sends the network request to the local BRAS through the VLAN.

[0074] Next, the local BRAS terminates the VLAN and authenticates the user identity of the network request. If the authentication is successful, it assigns an IP (Internet Protocol) address (private network IP address) to the request, performs NAT translation, and carries the translated address from the local BRAS with the network request to continue transmitting it to the satellite portable station.

[0075] The satellite portable station provides local internet access capabilities. As the network "entry point," the satellite portable station further performs NAT translation on the local BRAS-translated address, converting it into an address within the satellite company's internal network. This results in the satellite portable station's translated address, which is then carried in the network request for further transmission. Ultimately, the request reaches the satellite company's local operator network (in application communication systems, the satellite company's local operator network refers to the network provided by the corresponding operator leased by the satellite company).

[0076] Satellite companies deploy equipment in operator networks (such as...) Figure 1 The satellite company's landing operator (BRAS) will perform NAT translation on the address converted by the satellite portable station again to obtain the final public IP address. The satellite company's landing operator network then responds to the network request.

[0077] When tracing IP addresses (for example, based on network security requirements, relevant departments provide public IP addresses, and operators need to trace the IP addresses to find the original user), it can be seen that multiple NAT translations were performed during the above communication process, and the NAT translation also went through the satellite company's internal NAT translation. For operators, the operability of IP address tracing is low, the difficulty of IP address tracing is high, the time consumption of IP address tracing is long, and the efficiency of IP address tracing is low. In addition, the difficulty of IP address tracing will also make the emergency communication system vulnerable to network security risks.

[0078] In view of this, embodiments of this application provide a communication method for use in a BRAS (such as...) in an emergency communication system. Figure 1 In the local BRAS shown, the BRAS obtains the target network request through a private network. The target network request includes network request information and user account information. Then, it encapsulates the network request information and user account information into a network tunnel message, establishes a network tunnel for the target network request, and sends the network tunnel message to the target public network device through the network tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The network tunnel message is used for IP address tracing based on the user account information in the network tunnel message. In this embodiment, the BRAS directly sends the network tunnel message to the target public network device through the established network tunnel. The target public network device can obtain the user account information by decapsulating the network tunnel message. When performing IP address tracing, it can directly use the user account information, avoiding the problem of the difficulty of IP address tracing caused by the large number of NAT translations between the BRAS and the target public network device in traditional technologies. This embodiment reduces the difficulty of IP address tracing and improves the efficiency of IP address tracing.

[0079] It should be noted that the beneficial effects or technical problems solved by the embodiments of this application are not limited to this one, but may also be other implicit or related problems. For details, please refer to the description of the embodiments below.

[0080] The following is a brief introduction to the implementation environment involved in the communication method of the embodiments of this application.

[0081] Please continue reading Figure 1 The communication method provided in this application embodiment can be used for Figure 1 The emergency communication system shown.

[0082] For example, a communication method provided in this application embodiment can be used for Figure 1 In the emergency communication system shown, the BRAS can be... Figure 1 The local BRAS shown.

[0083] The local BRAS obtains the target network request through the private network. The target network request includes network request information and user account information. The local BRAS encapsulates the network request information and user account information into a network tunnel message and establishes a network tunnel for the target network request. Figure 1 (Not shown); The local BRAS sends network tunnel packets through the network tunnel to the target public network device, which is the last public network device to perform NAT translation in the current communication process. The target public network device could be, for example, the last public network device to perform NAT translation in the current communication process. Figure 1 The satellite company's landing operator BRAS shown uses network tunnel messages to trace IP addresses based on user account information within the network tunnel messages.

[0084] Exemplary, another communication method provided in this application embodiment can be used for Figure 1 In the emergency communication system shown, the target public network device is the last public network device to perform NAT translation during the current communication process. The target public network device could be, for example, the last one to perform NAT translation. Figure 1 The satellite company shown is BRAS, the local operator.

[0085] Satellite companies' local BRAS (Branded Assist System) receives emergency communication system data from local BRAS via network tunnels. Figure 1 The network tunnel message sent by the local BRAS (not shown) is obtained by encapsulating the network request information and user account information included in the target network request obtained based on the private network. The satellite company's landing operator BRAS decapsulates the network tunnel message to obtain the network request information and user account information. The satellite company's landing operator BRAS then sends the user account information to the tracing server (e.g., [example server]). Figure 2The satellite company's local operator billing server shown in the image uses user account information in the tracing server for IP address tracing.

[0086] The local BRAS and the satellite company's landing operator BRAS can be a single server or a server cluster consisting of multiple servers, and there is no limitation here.

[0087] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0088] In one embodiment, such as Figure 1 As shown, a communication method is provided for use in a BRAS (Brand Integrated Remote Access System) in an emergency communication system. The BRAS can be... Figure 1 The local BRAS shown below. This communication method will be used in the following descriptions. Figure 3 The example shown is a local BRAS.

[0089] The communication method includes steps 201, 202, and 203:

[0090] Step 201: The local BRAS obtains the target network request through the private network.

[0091] As mentioned above, the user terminal sends a target network request. This target network request passes through the ONU and OBD (Level 1 OBD and Level 2 OBD) in the emergency communication system and reaches the OLT. The OLT is connected to the local BRAS. The OLT is configured with VLANs for isolation. The OLT sends the target network request to the local BRAS through the VLAN.

[0092] In this way, the local BRAS obtains the target network request through the private network, specifically through the VLAN. The target network request includes network request information and user account information. The network request information may include information such as the resource address requested by the user device, and the user account information is related to the user's local account, such as the user account name.

[0093] Step 202: The local BRAS encapsulates the network request information and user account information into a network tunnel message and establishes a network tunnel for the target network request.

[0094] A network tunnel, also known as an IP tunnel, is a network communication channel between two networks using Internet Protocol (IP) methods, which transmits data using encapsulation.

[0095] In this embodiment of the application, after receiving the target network request, the local BRAS encapsulates the network request information and user account information included in the target network request into a network tunnel message and establishes a network tunnel for the target network request.

[0096] For example, a local BRAS can first use user account information to authenticate the user. If the user authentication is successful, it will trigger the establishment of a network tunnel for the target network request. As one implementation, the local BRAS can execute a locally stored tunnel configuration file to establish the aforementioned network tunnel.

[0097] For example, see Figure 3 ,exist Figure 3 In the emergency communication system shown, the network tunnel established by the local BRAS can terminate at the satellite company's landing operator BRAS. The local BRAS, the satellite company's landing operator BRAS, and all network devices passing through the tunnel can use this network tunnel for data transmission.

[0098] It is understandable that network tunnels established using different tunneling protocols may have different required (i.e., transmission-required) data encapsulation formats. Examples of such protocols include SRV6 (Segment Routing Internet Protocol Version 6) + EVPN (Ethernet Virtual Private Network). In this embodiment, after the local BRAS establishes the aforementioned network tunnel, it can encapsulate network request information and user account information into a network tunnel message based on the data encapsulation format required by the network tunnel. Thus, the network tunnel message meets the data encapsulation format requirements for transmission within the network tunnel.

[0099] Step 203: The local BRAS sends the network tunnel message to the target public network device through the network tunnel.

[0100] The target public network device is the last public network device to perform NAT translation during the current communication process; that is, the last public network device in the satellite company's landing operator network to perform NAT translation during the current communication process. For example, the target public network device could be... Figure 3 The satellite company shown is BRAS, the local operator.

[0101] The local BRAS sends network tunnel packets through the network tunnel. During transmission within the network tunnel, these packets pass through intermediate devices (i.e., devices between the local BRAS and the last public network device to perform NAT translation in the current communication process, such as...). Figure 3The satellite portable station shown does not decapsulate the network tunnel message, but only forwards it. In this way, the network tunnel message is forwarded by various intermediate devices in the network tunnel and finally reaches the target public network device. The network tunnel message is used to trace the IP address based on the user account information in the network tunnel message.

[0102] The target public network device decapsulates the network tunnel packets to obtain the network request information and user account information encapsulated within. The target public network device then sends the user account information to the tracing server, which could be, for example, a... Figure 2 The satellite company's local operator billing server shown in the image uses user account information in the tracing server for IP address tracing.

[0103] The process of tracing IP addresses will be described in the examples below.

[0104] In the communication method described in the above embodiments, the local BRAS in the emergency communication system obtains a target network request through a private network. This target network request includes network request information and user account information. Then, the network request information and user account information are encapsulated into a network tunnel message, and a network tunnel is established for the target network request. The network tunnel message is then sent through the network tunnel to the target public network device, which is the last public network device to perform NAT translation during the current communication process. The network tunnel message is used for IP address tracing based on the user account information within it. Thus, in this embodiment, the local BRAS establishes a network tunnel and directly sends the network tunnel message to the last public network device to perform NAT translation, thus protecting the local user... Account information is encapsulated in network tunnel packets. The last public network device to perform NAT translation decapsulates these packets to obtain the user account information. This user account information is then sent to the tracing server. During tracing, the tracing server directly locates the original user corresponding to the user account information. This avoids the problems of multiple NAT translations required between the local BRAS and the target public network device in traditional technologies, which lead to high difficulty and low efficiency in IP address tracing due to the large number of NAT translations. This embodiment of the application reduces the difficulty of IP address tracing, allowing the original user to be found in a single tracing, greatly shortening the tracing time, improving the efficiency of IP address tracing, and significantly enhancing the operability of tracing.

[0105] In one embodiment, based on Figure 4 The illustrated embodiment can be found in [reference]. Figure 4 This embodiment describes how a local BRAS encapsulates network request information and user account information into a network tunnel message and establishes a network tunnel for the target network request. For example... Figure 4As shown, step 202 includes Figure 4 Step 401 shown:

[0106] Step 401: The local BRAS encapsulates the network request information and user account information into an IPv6 packet and establishes an IPv6 tunnel for the target network request.

[0107] Accordingly, step 203 may include Figure 5 Step 402 shown:

[0108] Step 402: The local BRAS sends the IPv6 packet to the target public network device through the IPv6 tunnel.

[0109] IPv6 (Internet Protocol Version 6) is the next-generation IP protocol designed to replace IPv4 (Internet Protocol Version 4). In this embodiment, the local BRAS can establish an IPv6 tunnel and encapsulate network request information and user account information into IPv6 packets according to the data encapsulation format required for IPv6 tunnel transmission.

[0110] In one possible implementation of step 401, see [link to step 401]. Figure 5 The local BRAS can execute Figure 5 Step 4011 shown implements the process of encapsulating network request information and user account information into an IPv6 packet in step 401:

[0111] Step 4011: During the encapsulation process, the local BRAS encapsulates the network request information in the IPv6 basic message portion and the user account information in the IPv6 segmented extended header portion to obtain the IPv6 message.

[0112] After the local BRAS obtains the target network request, it encapsulates the network request information and user account information included in the target network request into an IPv6 packet. The IPv6 packet includes the basic IPv6 packet part and the IPv6 segmented extension header part.

[0113] In this embodiment of the application, during the encapsulation process, the local BRAS encapsulates the network request information in the IPv6 basic message portion and the user account information in the IPv6 segmented extension header portion. For example, the local BRAS can encapsulate the user account information in the empty space (i.e., the undefined position) in the IPv6 segmented extension header portion to obtain the IPv6 message.

[0114] It should be noted that, after clarifying the technical problem to be solved by the communication method of the embodiments of this application, the inventors of this application discovered through extensive research and experiments that there are idle spaces in the IPv6 segmented extension header portion of the IPv6 message, that is, there is customizable space in the IPv6 segmented extension header portion. Therefore, the design encapsulates additional user account information in the IPv6 segmented extension header portion, while encapsulating basic network request information in the IPv6 basic message portion. In this way, network request information and user account information can be encapsulated together without additional configuration.

[0115] In one possible implementation, the local BRAS can perform steps A1 and A2 to encapsulate user account information in the IPv6 segmented extension header portion:

[0116] Step A1: The local BRAS converts the user account information into a binary identifier stream.

[0117] In step A2, the local BRAS encapsulates the binary identifier stream in the IPv6 segmented extension header segment.

[0118] When the local BRAS encapsulates user account information in the IPv6 segmented extension header, it first converts the user account information into a binary identifier stream. This binary identifier stream has a preset character length, for example, the binary identifier stream can be 35 bits, in order to represent 11 bits of user account information.

[0119] Next, the local BRAS encapsulates the binary identifier stream in the free space of the IPv6 segmented extension header segment, thus realizing the process of encapsulating user account information in the IPv6 segmented extension header segment.

[0120] Please continue reading Figure 5 The local BRAS can execute Figure 3 Step 4012 shown implements the process of establishing an IPv6 tunnel for the target network request in step 401:

[0121] Step 4012: The local BRAS executes the IPv6 tunnel configuration file to establish an IPv6 tunnel for the target network request.

[0122] The IPv6 tunnel configuration file can be pre-configured in the local BRAS. The local BRAS can initiate an IPv6 tunnel by executing the IPv6 tunnel configuration file. The IPv6 tunnel terminates at the last public network device that performs NAT translation in the current communication process, i.e., the target public network device.

[0123] The above is one possible implementation of step 401. In other possible implementations, the local BRAS can also directly encapsulate the network request information and user account information into the IPv6 basic message part, and execute the IPv6 tunnel configuration file to establish an IPv6 tunnel, etc.

[0124] Thus, through the above implementation process, after the local BRAS obtains the target network request, it encapsulates the network request information included in the target network request in the IPv6 basic message part, converts the user account information included in the target network request into a binary identifier stream, and encapsulates the binary identifier stream in the IPv6 segmented extension header message part to obtain the IPv6 message.

[0125] The local BRAS sends IPv6 packets through an IPv6 tunnel. During transmission within the IPv6 tunnel, the intermediate devices that the IPv6 packets pass through (i.e., the devices between the local BRAS and the last public network device to perform NAT translation in the current communication process, such as...) Figure 3 The satellite portable station shown does not decapsulate the IPv6 packets, but only forwards them. In this way, the IPv6 packets are forwarded by various intermediate devices in the IPv6 tunnel and finally reach the target public network device. The IPv6 packets are used to trace the IP address based on the user account information in the IPv6 packets.

[0126] The target public network device decapsulates the IPv6 packet, obtaining the network request information encapsulated in the IPv6 basic packet portion and the binary identifier stream encapsulated in the IPv6 segmented header portion. The target public network device then performs format conversion on the binary identifier stream to obtain the user account information. The target public network device responds to the network request information and sends the user account information to the source tracing server (e.g., [example server]). Figure 6 The satellite company's local operator billing server shown in the image uses user account information in the tracing server for IP address tracing.

[0127] The process of converting the binary identifier stream by the target public network device can be implemented according to the corresponding format conversion rules.

[0128] In the above embodiment, the local BRAS establishes an IPv6 tunnel, directly sending IPv6 packets to the last public network device performing NAT translation. Local user account information is encapsulated within the IPv6 packets. The last public network device performing NAT translation decapsulates the IPv6 packets to obtain the user account information. This user account information is then sent to the tracing server. During tracing, the tracing server directly locates the original user corresponding to the user account information. This avoids the problems of multiple NAT translations between the local BRAS and the target public network device in traditional technologies, which lead to high difficulty and low efficiency in IP address tracing due to numerous NAT translations. This embodiment reduces the difficulty of IP address tracing, allowing the original user to be found in a single tracing, significantly shortening the tracing time, improving IP address tracing efficiency, and greatly enhancing the operability of tracing.

[0129] In one embodiment, based on the above embodiments, see Figure 6 This embodiment describes how a local BRAS obtains a target network request through a private network, such as... Figure 6 As shown, step 201 includes Figure 1 Steps 601 and 602 are shown below:

[0130] Step 601: The local BRAS receives a network request to be verified sent by the optical line terminal (OLT) based on the private network.

[0131] The network request to be verified includes initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT in sequence through the optical network unit (ONU) and optical splitter (OBD).

[0132] As mentioned above, please combine Figure 3 or Figure 1 After the user terminal sends a network request to be verified, the network request passes through the ONU, the secondary BD, and the primary BD in sequence before reaching the OLT. The OLT is connected to the local BRAS. The OLT does not perform account authentication, but only establishes a logical channel to connect to the local BRAS. That is, the OLT is configured with a VLAN (Virtual Local Area Network) and sends the network request to the local BRAS through the VLAN.

[0133] Step 602: The local BRAS performs user authentication based on the user account information. If the user authentication is successful, the target network request is obtained based on the network request to be verified.

[0134] For example, a local BRAS can perform local account authentication by executing the following steps B1 and B2 to implement the user authentication process based on user account information:

[0135] In step B1, the local BRAS sends the user account information to the identity authentication server. The user account information is used by the identity authentication server to authenticate the user's identity.

[0136] Step B2: The local BRAS receives the authentication result sent by the authentication server. The authentication result includes whether the authentication is successful or unsuccessful.

[0137] The local BRAS sends user account information to the identity authentication server. The identity authentication server performs user authentication based on the user account information, and the authentication result includes authentication success or authentication failure.

[0138] For example, combined Figure 3 or Figure 7 The identity authentication server can be a local billing server. The local BRAS interacts with the local billing server through the Internet channel provided by the satellite portable station to authenticate user account information.

[0139] The authentication server sends the authentication result to the local BRAS. If the authentication result is unsuccessful, the local BRAS will prohibit the allocation of a private network IP address to the network request to be authenticated, that is, it will reject the user device's request to access the Internet.

[0140] If the user's identity is successfully authenticated, the user's account is allowed to go online, and the local BRAS obtains the target network request based on the network request to be verified.

[0141] The following describes the process by which a local BRAS obtains the target network request based on the network request to be verified:

[0142] Step C1: The local BRAS assigns a private network IP address to the network request to be verified.

[0143] Once authentication is successful, the local BRAS assigns a private network IP address to the network request to be authenticated according to the IP address allocation rules.

[0144] In step C2, the local BRAS performs NAT translation on the private network IP address to obtain the first public IP address corresponding to the private network IP address.

[0145] Since the local BRAS needs to continue transmitting the network request upwards, the local BRAS performs NAT translation on the private network IP address according to its local NAT translation rules to obtain the first public IP address corresponding to the private network IP address.

[0146] In step C3, the local BRAS adds the first public IP address to the initial network request information to obtain the network request information, and uses the network request information and user account information as the target network request.

[0147] After the local BRAS obtains the target network request, it encapsulates the network request information included in the target network request in the IPv6 basic message part, converts the user account information included in the target network request into a binary identifier stream, and encapsulates the binary identifier stream in the IPv6 segmented extension header part to obtain the IPv6 message. The local BRAS sends the IPv6 message through the IPv6 tunnel, and the IPv6 message finally reaches the target public network device.

[0148] The target public network device decapsulates the network tunnel packet to obtain the network request information and user account information encapsulated within. This network request information includes a first public IP address. The target public network device then determines the first public IP address obtained from the decapsulation process. It uses this first public IP address as its private network IP address and performs NAT translation to obtain a second public IP address. Simultaneously, the target public network device sends the second public IP address to the tracing server along with the user account information; that is, it associates the second public IP address with the user account information before sending it to the tracing server.

[0149] In this way, when tracing IP addresses, it is only necessary to query the second public IP address on the tracing server to obtain the user account information. The original user can be obtained in one tracing, avoiding the need for multiple tracings due to multiple NAT translations, which greatly improves the efficiency and operability of tracing.

[0150] In this embodiment of the application, when performing IP address tracing, it is only necessary to complete the connection between the local BRAS and the last public network device that performs NAT translation. No additional devices are needed, no additional costs are incurred, the number of devices that need to be coordinated in the middle is reduced, and it has high feasibility.

[0151] In one embodiment, such as Figure 3 As shown, this application also provides a communication method for use in a target public network device in an emergency communication system, where the target public network device is the last public network device to perform NAT translation during the current communication process. For example, see [link to relevant documentation]. Figure 3 The target public network device is the satellite company's local network operator (BRAS). The method includes:

[0152] Step 701: The target public network device receives network tunnel messages sent by the BRAS in the emergency communication system based on the network tunnel.

[0153] The network tunnel message is obtained by the BRAS encapsulating the network request information and user account information included in the target network request obtained based on the private network. The above embodiments all assume that the BRAS in the emergency communication system is... Figure 7 The following is an introduction using a local BRAS as an example.

[0154] Step 702: The target public network device decapsulates the network tunnel packets to obtain network request information and user account information.

[0155] Step 703: The target public network device sends the user account information to the tracing server.

[0156] User account information in the tracing server is used for IP address tracing.

[0157] based on Figure 7 In one embodiment, prior to step 703, the target public network device may determine the first public network IP address obtained by decapsulating the network tunnel packet, then use the first public network IP address as the private network IP address, and perform NAT translation on the first public network IP address to obtain the second public network IP address. Then, the process of step 703 is implemented by associating the second public network IP address with user account information and sending it to the traceability server.

[0158] based on Figure 3 In one embodiment shown, the network tunnel message is an IPv6 message, the network tunnel is an IPv6 tunnel, and the target public network device can decapsulate the IPv6 message to obtain the network request information of the IPv6 basic message portion encapsulated in the IPv6 message, and the binary identifier stream of the IPv6 segmented extension header portion encapsulated in the IPv6 message. The binary identifier stream is then converted to obtain the user account information, thus implementing the process of step 702.

[0159] For the implementation methods and beneficial effects of the communication methods used in target public network devices in emergency communication systems, please refer to the relevant description of the communication methods in the local BRAS used in emergency communication systems mentioned above, which will not be repeated here.

[0160] In one embodiment, a communication method is provided for use in an emergency communication system, wherein the emergency communication system serves as... Figure 3 Taking the emergency communication system shown as an example, the method includes the following steps:

[0161] 1) The local BRAS receives the network request to be verified sent by the OLT based on the private network. The network request to be verified includes the initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT after passing through the ONU and OBD in sequence.

[0162] 2) The local BRAS sends user account information to the identity authentication server. The user account information is used by the identity authentication server to authenticate the user's identity.

[0163] 3) The local BRAS receives the authentication result sent by the authentication server, which includes whether the authentication is successful or unsuccessful;

[0164] 4) If the authentication result is that the authentication failed, the local BRAS shall prohibit the allocation of private network IP addresses to the network requests to be authenticated;

[0165] 5) If user authentication is successful, the local BRAS will assign a private network IP address to the network request to be authenticated.

[0166] 6) The local BRAS performs NAT translation on the private network IP address to obtain the first public IP address corresponding to the private network IP address;

[0167] 7) The local BRAS adds the first public IP address to the initial network request information to obtain the network request information, and uses the network request information and user account information as the target network request;

[0168] 8) The local BRAS encapsulates the network request information included in the target network request in the IPv6 basic message portion and converts the user account information included in the target network request into a binary identifier stream;

[0169] 9) The local BRAS encapsulates the binary identifier stream in the IPv6 segmented extension header portion to obtain the IPv6 packet;

[0170] 10) The local BRAS executes the IPv6 tunnel configuration file to establish an IPv6 tunnel for the target network request;

[0171] 11) The local BRAS sends IPv6 packets to the target public network device (e.g., ...) through an IPv6 tunnel. Figure 8 The satellite company (BRAS) shown is the landing operator, and the target public network device is the last public network device to perform NAT translation in the current communication process.

[0172] 12) The target public network device receives IPv6 packets sent by the local BRAS based on the IPv6 tunnel;

[0173] 13) The target public network device decapsulates the IPv6 packet to obtain the network request information of the IPv6 basic packet part encapsulated in the IPv6 packet, and the binary identifier stream of the IPv6 segmented extension header part encapsulated in the IPv6 packet.

[0174] 14) The target public network device performs format conversion on the binary identifier stream to obtain user account information;

[0175] 15) The target public network device determines the first public IP address obtained by decapsulating the network tunnel packets;

[0176] 16) The target public network device uses the first public network IP address as its private network IP address and performs NAT translation on the first public network IP address to obtain the second public network IP address;

[0177] 17) The target public network device associates the second public network IP address with the user account information and sends it to the tracing server. The user account information in the tracing server is used for IP address tracing.

[0178] It should be understood that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0179] In one embodiment, such as Figure 9 As shown, a communication device is provided, which is installed in a BRAS of an emergency communication system. The device includes:

[0180] The acquisition module 801 is used to acquire a target network request through a private network, wherein the target network request includes network request information and user account information;

[0181] The tunnel processing module 802 is used to encapsulate the network request information and the user account information into a network tunnel message and establish a network tunnel for the target network request.

[0182] The sending module 803 is used to send the network tunnel message to the target public network device through the network tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The network tunnel message is used to trace the IP address based on the user account information in the network tunnel message.

[0183] In one embodiment, the tunnel processing module 802 includes:

[0184] The tunnel processing unit is used to encapsulate the network request information and the user account information into an IPv6 packet and establish an IPv6 tunnel for the target network request.

[0185] Correspondingly, the sending module 803 includes:

[0186] The sending unit is used to send IPv6 packets to the target public network device through the IPv6 tunnel.

[0187] In one embodiment, the tunnel processing unit is specifically used to encapsulate the network request information in the IPv6 basic message portion and the user account information in the IPv6 segmented extended header portion during the encapsulation process, thereby obtaining the IPv6 message.

[0188] In one embodiment, the tunnel processing unit is specifically used to convert the user account information into a binary identifier stream; and to encapsulate the binary identifier stream in the IPv6 segmented extension header segment.

[0189] In one embodiment, the tunnel processing unit is specifically configured to execute an IPv6 tunnel configuration file to establish the IPv6 tunnel for the target network request.

[0190] In one embodiment, the acquisition module 801 includes:

[0191] The receiving unit is used to receive a network request to be verified sent by the optical line terminal (OLT) based on the private network. The network request to be verified includes initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT in sequence through the optical network unit (ONU) and the optical splitter (OBD).

[0192] The acquisition unit is used to perform user identity authentication based on the user account information. If the user identity authentication is successful, the target network request is obtained according to the network request to be verified.

[0193] In one embodiment, the acquisition unit is specifically used to allocate a private network IP address to the network request to be verified; perform NAT translation on the private network IP address to obtain a first public IP address corresponding to the private network IP address; add the first public IP address to the initial network request information to obtain the network request information, and use the network request information and the user account information as the target network request.

[0194] In one embodiment, the acquisition unit is further configured to send the user account information to an identity authentication server, the user account information being used by the identity authentication server to perform user identity authentication based on the user account information; and to receive the identity authentication result sent by the identity authentication server, the identity authentication result including authentication passed or authentication failed.

[0195] In one embodiment, the acquisition unit is further configured to prohibit the allocation of a private network IP address to the network request to be verified if the identity authentication result is that the authentication failed.

[0196] Specific limitations regarding the communication devices installed in the BRAS of the emergency communication system can be found in the above description of the communication methods used in the BRAS of the emergency communication system (the above embodiment uses a local BRAS as an example), and will not be repeated here. Each module in the above communication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the communication device, or stored in software in the memory of the communication device, so that the processor can call and execute the operations corresponding to each module.

[0197] In one embodiment, such as Figure 10 As shown, a communication device is provided, which is installed in a target public network device in an emergency communication system. The target public network device is the last public network device to perform NAT translation during the current communication process. The device includes:

[0198] The receiving module 901 is used to receive network tunnel messages sent by the BRAS in the emergency communication system based on the network tunnel. The network tunnel messages are obtained by the BRAS by encapsulating network request information and user account information included in the target network request obtained based on the private network.

[0199] The decapsulation module 902 is used to decapsulate the network tunnel packet to obtain the network request information and the user account information;

[0200] The sending module 903 is used to send the user account information to the tracing server, where the user account information is used for IP address tracing.

[0201] In one embodiment, the device further includes:

[0202] The determination module is used to determine the first public IP address obtained by decapsulating the network tunnel packet;

[0203] The NAT translation module is used to treat the first public IP address as a private network IP address and perform NAT translation on the first public IP address to obtain the second public IP address.

[0204] The sending module 903 is specifically used to associate the second public IP address with the user account information and then send it to the tracing server.

[0205] In one embodiment, the network tunnel message is an IPv6 message, and the network tunnel is an IPv6 tunnel.

[0206] In one embodiment, the decapsulation module 902 includes:

[0207] The decapsulation unit is used to decapsulate the IPv6 packet to obtain the network request information encapsulated in the IPv6 basic packet portion of the IPv6 packet, and the binary identifier stream encapsulated in the IPv6 segmented extension header portion of the IPv6 packet.

[0208] The format conversion unit is used to convert the format of the binary identifier stream to obtain the user account information.

[0209] Specific limitations regarding the communication devices installed in target public network equipment within the emergency communication system can be found in the limitations on communication methods used in target public network equipment described above, and will not be repeated here. Each module in the aforementioned communication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the communication device, or stored in software in the memory of the communication device, so that the processor can call and execute the corresponding operations of each module.

[0210] In one embodiment, a communication device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 10As shown, the communication device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data related to the communication method. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a communication method.

[0211] Those skilled in the art will understand that Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the communication device to which the present application is applied. Specific communication devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0212] In one embodiment, a network device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps:

[0213] The target network request is obtained through a private network, and the target network request includes network request information and user account information.

[0214] The network request information and the user account information are encapsulated into a network tunnel message, and a network tunnel is established for the target network request;

[0215] The network tunnel message is sent to the target public network device through the network tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The network tunnel message is used to trace the IP address based on the user account information in the network tunnel message.

[0216] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0217] The network request information and the user account information are encapsulated into an IPv6 message, and an IPv6 tunnel is established for the target network request;

[0218] Sending the network tunnel message to the target public network device through the network tunnel includes:

[0219] The IPv6 message is sent to the target public network device through the IPv6 tunnel.

[0220] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0221] During the encapsulation process, the network request information is encapsulated in the IPv6 basic message portion, and the user account information is encapsulated in the IPv6 segmented extended header portion to obtain the IPv6 message.

[0222] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0223] Convert the user account information into a binary identifier stream;

[0224] The binary identifier stream is encapsulated in the IPv6 segmented extension header segment.

[0225] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0226] Execute the IPv6 tunnel configuration file to establish the IPv6 tunnel for the target network request.

[0227] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0228] The system receives a network request to be verified sent by the optical line terminal (OLT) based on a private network. The network request to be verified includes initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT in sequence through the optical network unit (ONU) and the optical splitter (OBD).

[0229] User authentication is performed based on the user account information. If the user authentication is successful, the target network request is obtained based on the network request to be verified.

[0230] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0231] Assign a private network IP address to the network request to be verified;

[0232] Perform NAT translation on the private network IP address to obtain the first public IP address corresponding to the private network IP address;

[0233] The first public IP address is added to the initial network request information to obtain the network request information, and the network request information and the user account information are used as the target network request.

[0234] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0235] The user account information is sent to the identity authentication server, and the user account information is used by the identity authentication server to perform user identity authentication based on the user account information.

[0236] Receive the authentication result sent by the authentication server, the authentication result including authentication passed or authentication failed.

[0237] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0238] If the authentication result is that the authentication failed, then the allocation of a private network IP address to the network request to be verified is prohibited.

[0239] In one embodiment, a network device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to perform the following steps:

[0240] The system receives network tunnel messages sent by the BRAS in the emergency communication system based on the network tunnel. The network tunnel messages are obtained by the BRAS by encapsulating network request information and user account information included in the target network request obtained based on the private network.

[0241] The network tunnel message is decapsulated to obtain the network request information and the user account information;

[0242] The user account information is sent to the tracing server, where the user account information is used for IP address tracing.

[0243] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0244] Determine the first public IP address obtained by decapsulating the network tunnel packet;

[0245] The first public IP address is used as the private network IP address, and NAT translation is performed on the first public IP address to obtain the second public IP address;

[0246] Sending the user account information to the tracing server includes:

[0247] The second public IP address is associated with the user account information and then sent to the tracing server.

[0248] In one embodiment, the network tunnel message is an IPv6 message, and the network tunnel is an IPv6 tunnel.

[0249] In one embodiment, the processor, when executing the computer program, further performs the following steps:

[0250] The IPv6 packet is decapsulated to obtain the network request information encapsulated in the IPv6 basic packet portion of the IPv6 packet, and the binary identifier stream encapsulated in the IPv6 segmented extension header portion of the IPv6 packet.

[0251] The binary identifier stream is format-converted to obtain the user account information.

[0252] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0253] The target network request is obtained through a private network, and the target network request includes network request information and user account information.

[0254] The network request information and the user account information are encapsulated into a network tunnel message, and a network tunnel is established for the target network request;

[0255] The network tunnel message is sent to the target public network device through the network tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The network tunnel message is used to trace the IP address based on the user account information in the network tunnel message.

[0256] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0257] The network request information and the user account information are encapsulated into an IPv6 message, and an IPv6 tunnel is established for the target network request;

[0258] Sending the network tunnel message to the target public network device through the network tunnel includes:

[0259] The IPv6 message is sent to the target public network device through the IPv6 tunnel.

[0260] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0261] During the encapsulation process, the network request information is encapsulated in the IPv6 basic message portion, and the user account information is encapsulated in the IPv6 segmented extended header portion to obtain the IPv6 message.

[0262] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0263] Convert the user account information into a binary identifier stream;

[0264] The binary identifier stream is encapsulated in the IPv6 segmented extension header segment.

[0265] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0266] Execute the IPv6 tunnel configuration file to establish the IPv6 tunnel for the target network request.

[0267] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0268] The system receives a network request to be verified sent by the optical line terminal (OLT) based on a private network. The network request to be verified includes initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT in sequence through the optical network unit (ONU) and the optical splitter (OBD).

[0269] User authentication is performed based on the user account information. If the user authentication is successful, the target network request is obtained based on the network request to be verified.

[0270] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0271] Assign a private network IP address to the network request to be verified;

[0272] Perform NAT translation on the private network IP address to obtain the first public IP address corresponding to the private network IP address;

[0273] The first public IP address is added to the initial network request information to obtain the network request information, and the network request information and the user account information are used as the target network request.

[0274] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0275] The user account information is sent to the identity authentication server, and the user account information is used by the identity authentication server to perform user identity authentication based on the user account information.

[0276] Receive the authentication result sent by the authentication server, the authentication result including authentication passed or authentication failed.

[0277] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0278] If the authentication result is that the authentication failed, then the allocation of a private network IP address to the network request to be verified is prohibited.

[0279] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0280] The system receives network tunnel messages sent by the BRAS in the emergency communication system based on the network tunnel. The network tunnel messages are obtained by the BRAS by encapsulating network request information and user account information included in the target network request obtained based on the private network.

[0281] The network tunnel message is decapsulated to obtain the network request information and the user account information;

[0282] The user account information is sent to the tracing server, where the user account information is used for IP address tracing.

[0283] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0284] Determine the first public IP address obtained by decapsulating the network tunnel packet;

[0285] The first public IP address is used as the private network IP address, and NAT translation is performed on the first public IP address to obtain the second public IP address;

[0286] Sending the user account information to the tracing server includes:

[0287] The second public IP address is associated with the user account information and then sent to the tracing server.

[0288] In one embodiment, the network tunnel message is an IPv6 message, and the network tunnel is an IPv6 tunnel.

[0289] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0290] The IPv6 packet is decapsulated to obtain the network request information encapsulated in the IPv6 basic packet portion of the IPv6 packet, and the binary identifier stream encapsulated in the IPv6 segmented extension header portion of the IPv6 packet.

[0291] The binary identifier stream is format-converted to obtain the user account information.

[0292] Figure 11 This is a schematic structural diagram of the chip according to an embodiment of this application. Figure 11 The chip 900 shown includes a processor 910, which can call and run computer programs from memory to implement the methods in the embodiments of this application.

[0293] Optionally, such as ​ As shown, chip 900 may further include memory 920. Processor 910 can retrieve and run computer programs from memory 920 to implement the methods described in this embodiment.

[0294] The memory 920 can be a separate device independent of the processor 910, or it can be integrated into the processor 910.

[0295] Optionally, the chip 900 may also include an input interface 930. The processor 910 can control the input interface 930 to communicate with other devices or chips; specifically, it can acquire information or data sent by other devices or chips.

[0296] Optionally, the chip 900 may also include an output interface 940. The processor 910 can control the output interface 940 to communicate with other devices or chips, specifically, to output information or data to other devices or chips.

[0297] Optionally, the chip 900 can be applied to the communication device in the embodiments of this application, and the chip 900 can implement the corresponding processes implemented in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0298] It should be understood that the chip 900 mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0299] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the following steps:

[0300] The target network request is obtained through a private network, and the target network request includes network request information and user account information.

[0301] The network request information and the user account information are encapsulated into a network tunnel message, and a network tunnel is established for the target network request;

[0302] The network tunnel message is sent to the target public network device through the network tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The network tunnel message is used to trace the IP address based on the user account information in the network tunnel message.

[0303] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0304] The network request information and the user account information are encapsulated into an IPv6 message, and an IPv6 tunnel is established for the target network request;

[0305] Sending the network tunnel message to the target public network device through the network tunnel includes:

[0306] The IPv6 message is sent to the target public network device through the IPv6 tunnel.

[0307] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0308] During the encapsulation process, the network request information is encapsulated in the IPv6 basic message portion, and the user account information is encapsulated in the IPv6 segmented extended header portion to obtain the IPv6 message.

[0309] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0310] Convert the user account information into a binary identifier stream;

[0311] The binary identifier stream is encapsulated in the IPv6 segmented extension header segment.

[0312] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0313] Execute the IPv6 tunnel configuration file to establish the IPv6 tunnel for the target network request.

[0314] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0315] The system receives a network request to be verified sent by the optical line terminal (OLT) based on a private network. The network request to be verified includes initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT in sequence through the optical network unit (ONU) and the optical splitter (OBD).

[0316] User authentication is performed based on the user account information. If the user authentication is successful, the target network request is obtained based on the network request to be verified.

[0317] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0318] Assign a private network IP address to the network request to be verified;

[0319] Perform NAT translation on the private network IP address to obtain the first public IP address corresponding to the private network IP address;

[0320] The first public IP address is added to the initial network request information to obtain the network request information, and the network request information and the user account information are used as the target network request.

[0321] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0322] The user account information is sent to the identity authentication server, and the user account information is used by the identity authentication server to perform user identity authentication based on the user account information.

[0323] Receive the authentication result sent by the authentication server, the authentication result including authentication passed or authentication failed.

[0324] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0325] If the authentication result is that the authentication failed, then the allocation of a private network IP address to the network request to be verified is prohibited.

[0326] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the following steps:

[0327] The system receives network tunnel messages sent by the BRAS in the emergency communication system based on the network tunnel. The network tunnel messages are obtained by the BRAS by encapsulating network request information and user account information included in the target network request obtained based on the private network.

[0328] The network tunnel message is decapsulated to obtain the network request information and the user account information;

[0329] The user account information is sent to the tracing server, where the user account information is used for IP address tracing.

[0330] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0331] Determine the first public IP address obtained by decapsulating the network tunnel packet;

[0332] The first public IP address is used as the private network IP address, and NAT translation is performed on the first public IP address to obtain the second public IP address;

[0333] Sending the user account information to the tracing server includes:

[0334] The second public IP address is associated with the user account information and then sent to the tracing server.

[0335] In one embodiment, the network tunnel message is an IPv6 message, and the network tunnel is an IPv6 tunnel.

[0336] In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0337] The IPv6 packet is decapsulated to obtain the network request information encapsulated in the IPv6 basic packet portion of the IPv6 packet, and the binary identifier stream encapsulated in the IPv6 segmented extension header portion of the IPv6 packet.

[0338] The binary identifier stream is format-converted to obtain the user account information.

[0339] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0340] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0341] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A communication method, characterized in that, In a broadband access server (BRAS) used in an emergency communication system, the emergency communication system includes a satellite portable station, the method includes: The target network request is obtained through a private network. The target network request includes network request information and user account information. The target network request passes through the optical network unit (ONU) and optical splitter (OBD) in the emergency communication system and reaches the optical line terminal (OLT). The OLT sends the target network request to the BRAS through the VLAN. User authentication is performed using the user account information. If the user authentication is successful, the network request information is encapsulated in the IPv6 basic message portion, and the user account information is converted into a binary identifier stream. The binary identifier stream is then encapsulated in the IPv6 segmented extended header portion to obtain an IPv6 message, and an IPv6 tunnel is established for the target network request. The IPv6 message is sent to the target public network device through the IPv6 tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The IPv6 message is used to trace the IP address based on the user account information in the IPv6 message.

2. The method according to claim 1, characterized in that, The establishment of the IPv6 tunnel for the target network request includes: Execute the IPv6 tunnel configuration file to establish the IPv6 tunnel for the target network request.

3. The method according to claim 1, characterized in that, The step of obtaining the target network request through the private network includes: The system receives a network request to be verified sent by the OLT based on a private network. The network request to be verified includes initial network request information and user account information. The network request to be verified is sent by the user terminal and transmitted to the OLT after passing through the ONU and the OBD in sequence. User authentication is performed based on the user account information. If the user authentication is successful, the target network request is obtained based on the network request to be verified.

4. The method according to claim 3, characterized in that, The step of obtaining the target network request based on the network request to be verified includes: Assign a private network IP address to the network request to be verified; Perform NAT translation on the private network IP address to obtain the first public IP address corresponding to the private network IP address; The first public IP address is added to the initial network request information to obtain the network request information, and the network request information and the user account information are used as the target network request.

5. The method according to claim 3, characterized in that, The user identity authentication based on the user account information includes: The user account information is sent to the identity authentication server, and the user account information is used by the identity authentication server to perform user identity authentication based on the user account information. Receive the authentication result sent by the authentication server, the authentication result including authentication passed or authentication failed.

6. The method according to claim 5, characterized in that, The method further includes: If the authentication result is that the authentication failed, then the allocation of a private network IP address to the network request to be verified is prohibited.

7. A communication method, characterized in that, In the target public network device used in the emergency communication system, the target public network device is the last public network device to perform NAT translation during the current communication process. The emergency communication system includes a satellite portable station. The method includes: The system receives IPv6 packets sent by the BRAS (Brand Integrated Server Assurance) in the emergency communication system via an IPv6 tunnel. These IPv6 packets are obtained by the BRAS by encapsulating network request information and user account information included in a target network request acquired from a private network. The BRAS uses the user account information to authenticate the user. If authentication is successful, the network request information is encapsulated in the IPv6 basic packet portion, and the user account information is converted into a binary identifier stream. This binary identifier stream is then encapsulated in the IPv6 segmented extension header portion. The target network request passes through the Optical Network Unit (ONU) and Optical Splitter (OBD) in the emergency communication system and reaches the Optical Line Terminal (OLT). The OLT then sends the target network request to the BRAS via a VLAN. The IPv6 packet is decapsulated to obtain the network request information and the user account information; The user account information is sent to the tracing server, where the user account information is used for IP address tracing.

8. The method according to claim 7, characterized in that, Before sending the user account information to the tracing server, the method further includes: Determine the first public IP address obtained by decapsulating the IPv6 packet; The first public IP address is used as the private network IP address, and NAT translation is performed on the first public IP address to obtain the second public IP address; Sending the user account information to the tracing server includes: The second public IP address is associated with the user account information and then sent to the tracing server.

9. The method according to claim 8, characterized in that, The process of decapsulating the IPv6 packet to obtain the network request information and the user account information includes: The IPv6 packet is decapsulated to obtain the network request information encapsulated in the IPv6 basic packet portion of the IPv6 packet, and the binary identifier stream encapsulated in the IPv6 segmented extension header portion of the IPv6 packet. The binary identifier stream is format-converted to obtain the user account information.

10. A communication device, characterized in that, The device is installed in a BRAS (Body Brake System) within an emergency communication system, which includes a satellite portable station. The acquisition module is used to acquire a target network request through a private network. The target network request includes network request information and user account information. The target network request passes through the optical network unit (ONU) and optical splitter (OBD) in the emergency communication system and reaches the optical line terminal (OLT). The OLT sends the target network request to the BRAS through a VLAN. The tunnel processing module is used to perform user authentication using the user account information. If the user authentication is successful, the network request information is encapsulated in the IPv6 basic message part, the user account information is converted into a binary identifier stream, the binary identifier stream is encapsulated in the IPv6 segmented extended header message part to obtain an IPv6 message, and an IPv6 tunnel is established for the target network request. The sending module is used to send the IPv6 packet to the target public network device through the IPv6 tunnel. The target public network device is the last public network device to perform NAT translation in the current communication process. The IPv6 packet is used to trace the IP address based on the user account information in the IPv6 packet.

11. A communication device, characterized in that, The device is installed in the target public network device of the emergency communication system, which is the last public network device to perform NAT translation during the current communication process. The emergency communication system includes a satellite portable station. The device includes: The receiving module is used to receive IPv6 packets sent by the BRAS in the emergency communication system based on an IPv6 tunnel. The IPv6 packets are obtained by the BRAS by encapsulating network request information and user account information included in the target network request obtained based on the private network. The IPv6 packets are used by the BRAS to authenticate the user identity using the user account information. If the user identity authentication is successful, the network request information is encapsulated in the IPv6 basic packet part, and the user account information is converted into a binary identifier stream. The binary identifier stream is then encapsulated in the IPv6 segmented extension header part. The target network request passes through the optical network unit (ONU) and optical splitter (OBD) in the emergency communication system and arrives at the optical line terminal (OLT). The OLT sends the target network request to the BRAS through the VLAN. The decapsulation module is used to decapsulate the IPv6 packet to obtain the network request information and the user account information; The sending module is used to send the user account information to the tracing server, where the user account information is used for IP address tracing.

12. A communication device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 9.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

Images