A trusted WLAN integrated network management method and network management platform based on WAPI

Abstract

The invention relates to the technical field of integrated network management, and in particular to a trusted WLAN integrated network management method and a network management platform based on WAPI. The method comprises the following steps: formulating a unified MIB library, and obtaining network element equipment data of different manufacturers according to the unified MIB library; obtaining an LLDP neighbor relationship table, and generating a topology map according to the LLDP neighbor relationship table and using a topology generation algorithm; communicating with the network element equipment by using an SNMP standard communication protocol according to the obtained network element equipment data; formulating a unified network element equipment side interface, and configuring and networking the network element equipment by using the unified network element equipment side interface. The invention builds a trusted WLAN integrated network management platform through four technical routes, solves the problem that different brands cannot be uniformly managed due to inconsistent MIB styles and inconsistent configuration interfaces, and completely breaks the problems of inflexible original networking mode, inability to collaborate with different brand equipment, repeated configuration of multiple equipment, switching of multiple platforms, high learning cost, etc.

Description

Technical Field

[0001] The present invention relates to the technical field of integrated network management, and in particular to a trusted WLAN integrated network management method and a network management platform based on WAPI. Background Art

[0002] At present, the integrated network management platforms of various brands only manage equipment operation and maintenance (equipment maintenance), operation efficiency, and overall monitoring (equipment health), and the self-managed network management platforms of various brands only manage all network element devices under their own brands. There is no integrated network management for high security or unified management of a large number of different brands of equipment, which has many problems:

[0003] 1. Multiple sets of network management are required to manage all network element devices in one scenario; 2. The versions of existing equipment are inconsistent, and some new network management functions cannot be applied to old equipment, and the logic is inconsistent; 3. The new network management platform does not support the automation of the configuration of old equipment, and the MIB standards customized by each brand are inconsistent, and the functions of each brand are inconsistent, resulting in the inability to adapt the functions and performance collection. Therefore, it is urgent to use the underlying logic of various network element devices and the universal SNMP protocol to unify communication management with the equipment, and formulate a unified technical standard northbound interface, a unified alarm interface, and a unified MIB node access logic. Summary of the invention

[0004] In order to solve the above-mentioned problems, the present invention provides a trusted WLAN integrated network management method based on WAPI.

[0005] In a first aspect, the present invention provides a trusted WLAN integrated network management method based on WAPI, which adopts the following technical solution:

[0006] A trusted WLAN integrated network management method based on WAPI, comprising:

[0007] Develop a unified MIB library and obtain network element equipment data from different manufacturers based on the unified MIB library;

[0008] Obtaining the LLDP neighbor relationship table, and generating a topology map according to the LLDP neighbor relationship table and using a topology generation algorithm;

[0009] Based on the acquired network element device data, use the SNMP standard communication protocol to communicate with the network element device;

[0010] Formulate a unified network element device side interface and use it to configure and network the network element devices;

[0011] Establish a unified AS-side interface, and authenticate network element devices through the unified AS-side interface based on the topology diagram;

[0012] Develop a unified terminal automatic certificate renewal interface to perform automatic certificate renewal for network element equipment access buttons.

[0013] Furthermore, the formulation of a unified MIB library includes defining objects and attribute parameters according to device types and interfaces, constraining data types and access rights, deploying the MIB library into a production environment, and testing and accepting the MIB library.

[0014] Furthermore, the use of the SNMP standard communication protocol to communicate with the network element device includes using the Trap port 162 of the SNMP standard communication protocol to send device alarms to the network element device, wherein the MIB data in the network element device is obtained through the SNMP GET, GET-Next, Get-Bulk, Get-Subtree or Walk method.

[0015] Furthermore, a unified network element device side is formulated, and the network element device side is used to configure and network the network element devices, including formulating a unified network element device side based on the RESTFul style HTTP request interface, and through the unified HTTP request interface, the configuration of network element devices of various manufacturers is sent down to complete the device configuration networking.

[0016] Furthermore, a unified AS side interface is formulated, and certificate authentication of network element devices is performed through the unified AS side interface, including formulating a unified AS side RESTFul-style HTTP request interface, and integrating various AS services into the trusted WLAN integrated network management through the unified style HTTP interface to realize AC certificate issuance, terminal automatic certificate renewal, certificate management and authentication alarm.

[0017] Furthermore, a unified terminal automatic certificate renewal interface is formulated, and automatic certificate renewal of network element equipment access is performed through the unified terminal automatic certificate renewal interface, including formulating a unified RESTFul-style-based HTTP request interface, which includes linked SSID acquisition and certificate replacement application, and automatically initiating the certificate renewal process after the network element equipment is accessed, realizing the replacement of the terminal service certificate, and completing the network access authentication.

[0018] In a second aspect, a trusted WLAN integrated network management platform based on WAPI includes:

[0019] Network element equipment and AS, including network element equipment from various network element equipment manufacturers;

[0020] Unified MIB library, connect to network element devices and obtain network data of network element devices;

[0021] SNMP standard communication protocol module, connects to MIB library and reads network data;

[0022] Furthermore, the SNMP standard communication protocol module includes a Trap port 162, and the Trap port 162 is used to send alarms of network element devices.

[0023] Furthermore, the network element device side is provided with a RESTFul-style HTTP request interface for issuing configurations to the network element device.

[0024] Furthermore, the AS side includes a WAPI authentication server, and the AS side is provided with a RESTFul-style-based HTTP request interface, and various AS services are integrated into the trusted WLAN integrated network management through a unified HTTP interface.

[0025] In summary, the present invention has the following beneficial technical effects:

[0026] The present invention builds a trusted WLAN integrated network management platform through four technical routes to solve the problem that different brands cannot be uniformly managed due to inconsistent MIB styles and configuration interfaces. It completely breaks the problems of inflexible original networking methods, inability to collaborate with different brands of equipment, repeated configuration of multiple devices, switching between multiple platforms, and high learning costs.

[0027] When a large number of terminals, such as hundreds or thousands of terminals, are connected, the traditional method is to manually download the certificate, copy it to the terminal device through a mobile transmission medium, and then perform certificate-related configuration on the device and connect to the trusted network to complete terminal access. This involves a lot of labor costs and cannot guarantee the security of the mobile transmission medium. The above problems can be solved by automatic terminal certificate renewal. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 The present invention is a flowchart of a WAPI-based trusted WLAN integrated network management method according to an embodiment of the present invention.

[0029] Figure 2 This is an application scenario diagram of a trusted WLAN integrated network management platform based on WAPI in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0031] MIB library: Management Information Base, management information base.

[0032] SNMP: Simple Network Management Protocol.

[0033] REST: Representational State Transfer, referred to as REST, is a software architecture style.

[0034] Example 1

[0035] Reference Figure 1 , a trusted WLAN integrated network management method based on WAPI in this embodiment includes:

[0036] Develop a unified MIB library and obtain network element equipment data from different manufacturers based on the unified MIB library;

[0037] Obtaining the LLDP neighbor relationship table, and generating a topology map according to the LLDP neighbor relationship table and using a topology generation algorithm;

[0038] Based on the acquired network element device data, use the SNMP standard communication protocol to communicate with the network element device;

[0039] Formulate a unified network element device side interface and use it to configure and network the network element devices;

[0040] Establish a unified AS-side interface, and authenticate network element devices through the unified AS-side interface based on the topology diagram;

[0041] Develop a unified terminal automatic certificate renewal interface to perform automatic certificate renewal for network element equipment access buttons.

[0042] Specifically,

[0043] S1. Develop a unified MIB library, including developing a unified style MIB library protocol (the Management Information Base (MIB) is one of the contents of the TCP / IP network management protocol standard framework. MIB defines the data items that must be saved by the managed device, the operations allowed for each data item and its meaning, that is, the data variables such as the control and status information of the managed devices accessible to the management system are all stored in the MIB library). The network element equipment of network element equipment manufacturers such as Huawei, H3C, and Ruijie will be uniformly managed, and the network element equipment data of different manufacturers can be obtained through the unified style MIB library, so as to realize the management of multiple network element equipment.

[0044] Among them, the R&D teams of current mainstream brand network equipment manufacturers are convened to discuss and formulate a list of MIB design node requirements, define objects and attribute parameters according to device types and interfaces, and constrain data types and access rights. After reaching an agreement with each brand manufacturer, rectification opinions, R&D plans and other documents are formed, and a special R&D team is set up to carry out R&D for this work content. After the development work is completed, before the MIB library is deployed to the production environment, it needs to be tested and accepted, including unit testing, integration testing and system testing, to ensure that the MIB library can communicate correctly with the SNMP manager and provide accurate device information.

[0045] How to unify management: According to the defined unified MIB library, unified northbound interface specifications, and unified alarm interface, establish communication with the device through the SNMP protocol, use SNMP-GET to obtain the corresponding information and data of the MIB node device, manage and configure devices of various brands through the unified northbound interface specifications, and obtain emergency exception information of the device through the unified alarm interface to achieve full-dimensional management of the device.

[0046] As a further embodiment,

[0047] Obtain the LLDP neighbor relationship table and generate a topology map based on the LLDP neighbor relationship table and using the topology generation algorithm, including:

[0048] (1) Obtain the neighbor relationship of all switches at the current site through the LLDP interface (including the MAC addresses of all devices connected to the switch, the interfaces connected to each other, etc.), and query the devices managed by the trusted WLAN platform based on the obtained MAC addresses to confirm the devices included in the current site topology map and their respective connection relationships.

[0049] (2) The hierarchy between devices is determined based on the device type and connection relationship. Each device will record its parent device.

[0050] (3) Calculate the coordinates of each device in the topology map from top to bottom according to the hierarchy. The vertical coordinate of the device is determined according to the hierarchy, and the horizontal coordinate is determined according to the horizontal coordinate of the parent device (a), the index of the device in its sibling node (x), the number of sibling nodes (b), and the unit horizontal axis distance (c) (y = a - (b-1) * c / 2 + c * x).

[0051] (4) If the current site has generated a topology map, the new and old data are compared to update the topology map. Finally, the data is persisted. When there are a large number of devices, the backend can complete all processes in milliseconds.

[0052] (5) Render the device to the page based on the generated topological device data. The front-end uses SVG.js to draw the topological devices and connections, and all front-end logic is implemented manually to ensure scalability. In addition, the front-end introduces the VueDraggableResizable component as the topological canvas to achieve the effect of overall canvas movement.

[0053] (6) Aggregate the AP devices under the same switch into an AP group. When you right-click the switch, the AP group will be expanded to display all the APs connected to it.

[0054] (7) Generate regular lines based on the connection relationship. Three-segment lines are often generated between devices at different levels. It is necessary to generate two inflection points between two devices, and then connect the devices and the inflection points with a straight line to achieve the effect of a three-segment line.

[0055] (8) Add events to devices (left-click to drag, right-click to expand APs and terminals, double-click to view details). When you move a switch or AP, its subordinate nodes will be moved synchronously.

[0056] (9) Add events to the connection (when the mouse is placed on the connection, the connected interfaces will be displayed below the two devices connected in the connection).

[0057] S2. Use the SNMP standard communication protocol to communicate with the network element device, including using the Trap port 162 of the SNMP standard communication protocol to send device alarms to the network element device.

[0058] After obtaining the network element device data, the SNMP (Simple Network Management Protocol, an application layer protocol for network element device management) standard communication protocol is used to communicate with the network element device, such as: Token acquisition, AC key distribution and other business communications. The MIB data in the device is obtained through SNMP methods such as GET, GET-Next, Get-Bulk, Get-Subtree, and Walk.

[0059] Use the SNMP standard Trap port 162 to send device alarms (SNMP trap is a message about abnormal conditions of the device that is actively sent by the managed device to the management server, which can be seen as a process in which the management server passively receives the message. Therefore, many tools will integrate snmp trap into their own tools to monitor the alarms of network element devices. SNMP trap is transmitted using the UDP protocol).

[0060] S3. Develop a unified network element device side, and use the network element device side to configure the network element device, including developing a unified network element device side based on the RESTFul style HTTP request interface.

[0061] Among them, a unified HTTP request interface based on the RESTFul style (REST stands for Representational State Transfer, a software architecture style for short. It is a design and development method for network applications that can reduce the complexity of development and improve the scalability of the system) is formulated for the network element device side. Through the unified style HTTP interface, the configuration of network element devices of various manufacturers is issued to complete the device configuration networking. For example: AP restart, radio frequency configuration, terminal forced offline and other configuration commands.

[0062] Among them, the network equipment is configured and networked using the network element device side: 1. Power on the equipment; 2. Configure the equipment IP address; 3. Configure a unified MIB library style library; 4. Set SNMP read-write community words and read-only community words, and enable SNMP-V2 communication version; 5. Register and manage AP equipment, configure the upstream AC address, and establish a link; 5. Set the alarm communication address, interface, etc.; 4. Register through the integrated network management system and manage the equipment in a unified manner; 5. Create an AC service policy template; 5. Configure AP radio frequency, bandwidth, power and other parameters; 6. Bind the service policy release signal.

[0063] S4. The unified AS side interface is formulated, and certificate authentication of network element equipment is performed through the unified AS side interface, including formulating a unified AS side HTTP request interface based on RESTFul style, integrating various AS services into the trusted WLAN integrated network management through the unified style HTTP interface, and realizing AC certificate issuance, terminal automatic certificate renewal, certificate management and authentication alarm.

[0064] Among them, a unified AS side (WAPI authentication server) is formulated based on the RESTFul style HTTP request interface. Through the unified style HTTP interface, various AS services are integrated into the trusted WLAN integrated network management to realize AC certificate issuance, terminal automatic certificate renewal, certificate management, authentication alarm and other functional applications.

[0065] VAP: Based on the technical route, Huawei brand VAP service templates are created through the network management side. VAP templates are wireless configuration templates used to virtualize different service function entities on AP devices, namely virtual access points (Virtual Access Points). By configuring the VAP template, after applying the VAP template in the AP group or AP, the corresponding VAP will be generated on the AP. The VAP template contains parameters such as SSID, AS authentication address, and certificate signature to support differentiated WLAN services. Through the network management side, multiple AP devices in the network can be bound to applications, which can be batch-delivered to achieve efficient configuration of devices. Terminal devices can connect to the AP signal bound to the VAP template and use the authentication address and AC certificate set by the VAP for network authentication. Usually, different service certificates are used to isolate services using VAP templates.

[0066] PKI: PKI (Public Key Infrastructure) is a system that uses public key technology and digital certificates to ensure system information security and is responsible for verifying the identity of digital certificate holders. Similar to Huawei VAP domains, PKI domains contain parameters such as AS authentication addresses and certificate signatures. The SSID service policies of multiple AP devices in the network can be bound to PKI domains through the network management side to achieve terminal service isolation.

[0067] AP batch configuration: Based on the technical route, create an AP batch configuration template. The template includes the channel, bandwidth, power, etc. of the AP's RADIO radio for unified configuration. Through the AP's unique identifier SN (serial number), the network management side automatically sends batch configurations to the selected APs to achieve simplified configuration of devices of different brands.

[0068] The network management side creates PKI and VAP service templates to bind APs in batches when they go online (the network management side automatically processes and configures AP devices in batches). By creating AP batch configuration templates, the network management side can configure and maintain devices in batches, greatly improving work efficiency.

[0069] S5. The unified terminal automatic certificate renewal interface is developed, and the automatic certificate renewal of the network element device access button is performed through the unified terminal automatic certificate renewal interface, including the development of a unified HTTP request interface based on the RESTFul style, which includes the linked SSID acquisition and certificate replacement application, which is used to temporarily burn the engineering certificate when the terminal leaves the factory, and automatically initiate the certificate renewal process after the network element device is connected, so as to realize the replacement of the terminal business certificate and complete the network access authentication.

[0070] Among them, a unified terminal automatic certificate renewal interface is formulated, which is based on the RESTFul-style HTTP request interface. The unified-style HTTP interface includes linked SSID acquisition, certificate replacement application, etc., to achieve temporary burning of engineering certificates when the terminal leaves the factory, and automatically initiate the certificate renewal process after the device is connected. Without manual intervention, the terminal business certificate can be replaced and the network access authentication can be completed.

[0071] Specifically, the original application scenario: In the WAPI-based security authentication system, when a large number of terminal devices (cameras, inspection robots, protective pressure plates, etc.) need to be put into use in substations:

[0072] ① First, you need to generate an engineering certificate in the AS server

[0073] ② Manually download the engineering certificate and store it in the transmission medium (U disk, mobile hard disk, etc.)

[0074] ③ Single import terminal device

[0075] ④ Terminal device selects engineering SSID network authentication

[0076] ⑤ Debug terminal equipment

[0077] ⑥ After debugging is completed, generate a formal certificate in the AS server

[0078] ⑦ Manually download the official certificate and store it in the transmission medium (U disk, mobile hard disk, etc.)

[0079] ⑧ Single import terminal device

[0080] ⑨ The terminal device selects the service SSID for network authentication

[0081] There are serious security risks in steps ② and ③. If the certificate is leaked or stolen by illegal terminals, the system cannot recognize it. Moreover, when a large number of terminals are connected, it is necessary to manually generate, download, and import certificates for each terminal device one by one, which makes the work efficiency extremely low.

[0082] Existing application scenarios: Based on the general technical route, the equipment communication barriers are broken, and the fifth technical route is to formulate a standard protocol interface for terminal manufacturers to access, so as to realize automatic terminal renewal without manual intervention (the overall process refers to the terminal renewal business process diagram):

[0083] ① The manufacturer provides the MAC address and terminal information of the access terminal device and imports it into the trusted WLAN integrated network management.

[0084] ② Users generate engineering certificates in batches according to the number of accesses (one certificate for each terminal, and only the number needs to be filled in when generating)

[0085] ③ The user submits the project certificate and the project SSID to be connected to the manufacturer, and the manufacturer burns it into the terminal device

[0086] ④ When the device is powered on, it automatically uses the engineering certificate and engineering SSID for network authentication

[0087] ⑤ Debug terminal equipment

[0088] ⑥ After completion, the network management automatically verifies whether the terminal has a legal engineering certificate, and automatically issues the official SSID and official certificate to the terminal device.

[0089] ⑦ The terminal device automatically switches to the official SSID and uses the official certificate to authenticate and access the network.

[0090] Example 2

[0091] The difference between this embodiment and Embodiment 1 is that this embodiment provides a trusted WLAN integrated network management platform based on WAPI, including: network element devices, including network element devices from various network element device manufacturers; a unified MIB library, connected to the network element devices and obtaining the network data of the network element devices; an SNMP standard communication protocol module, connected to the MIB library and reading the network data; a network element device side and an AS side. The SNMP standard communication protocol module includes a Trap port 162, and the Trap port 162 is used to send network element device alarms. The network element device side is provided with a RESTFul-style HTTP request interface for configuring and issuing network element devices. The AS side includes a WAPI authentication server, and the AS side is provided with a RESTFul-style HTTP request interface, which integrates various AS services into the trusted WLAN integrated network management through a unified HTTP interface. Figure 2 The figure shows an application scenario of a trusted WLAN integrated network management platform based on WAPI.

[0092] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A trusted WLAN integrated network management method based on WAPI, characterized in that: include: Develop a unified MIB library and obtain network element equipment data from different manufacturers based on the unified MIB library; Obtaining the LLDP neighbor relationship table, and generating a topology map according to the LLDP neighbor relationship table and using a topology generation algorithm; Based on the acquired network element device data, use the SNMP standard communication protocol to communicate with the network element device; Formulate a unified network element device side interface and use it to configure and network the network element devices; Establish a unified AS-side interface, and authenticate network element devices through the unified AS-side interface based on the topology diagram; Formulate a unified terminal automatic certificate renewal interface to perform automatic certificate renewal for network element device access; The formulation of a unified MIB library includes defining objects and attribute parameters according to device types and interfaces, constraining data types and access rights, deploying the MIB library to a production environment, and testing and accepting the MIB library; The communication with the network element device using the SNMP standard communication protocol includes sending device alarms to the network element device using the Trap port 162 of the SNMP standard communication protocol, wherein the MIB data in the network element device is obtained through the GET, GET-Next, Get-Bulk, Get-Subtree or Walk method of SNMP; The unified network element device side interface is formulated, and the network element device is configured and networked using the unified network element device side interface, including formulating a unified network element device side HTTP request interface based on RESTFul style, and implementing the configuration of network element devices of various manufacturers through the unified HTTP request interface to complete the device configuration networking; The unified AS side interface is formulated, and the certificate authentication of the network element device is performed through the unified AS side interface, including formulating a unified AS side HTTP request interface based on RESTFul style, integrating various AS services into the trusted WLAN integrated network management through the unified style HTTP interface, and realizing the issuance of AC certificates and STA certificates; The unified terminal automatic certificate renewal interface is formulated, and the automatic certificate renewal of network element equipment access is performed through the unified terminal automatic certificate renewal interface, including the formulation of a unified RESTFul-style HTTP request interface, which includes the linked SSID acquisition and certificate replacement application, and automatically initiates the certificate renewal process after the network element equipment is accessed, realizes the replacement of the terminal service certificate, and completes the network access authentication.

2. A trusted WLAN integrated network management platform based on WAPI, based on a trusted WLAN integrated network management method based on WAPI as claimed in claim 1, characterized in that: include: Network element equipment and AS, including network element equipment from various network element equipment manufacturers; Unified MIB library, connect to network element devices and obtain network data of network element devices; SNMP standard communication protocol module, connects to MIB library and reads network data.

3. A trusted WLAN integrated network management platform based on WAPI according to claim 2, characterized in that: The SNMP standard communication protocol module includes a Trap port 162, and the Trap port 162 is used to send alarms of network element devices.

4. A trusted WLAN integrated network management platform based on WAPI according to claim 3, characterized in that: The network element device side is provided with a RESTFul-style HTTP request interface for issuing configurations to the network element device.

5. A trusted WLAN integrated network management platform based on WAPI according to claim 4, characterized in that: The AS side includes a WAPI authentication server, and the AS side is provided with a RESTFul-style HTTP request interface, and various AS services are integrated into the trusted WLAN integrated network management through a unified HTTP interface.

Images