Access control method and device, computer readable medium and electronic equipment

Abstract

The embodiment of the invention provides an access control method and device, a computer readable medium and electronic equipment. The access control method comprises the following steps: acquiring equipment information of access equipment provided by a network access party, and acquiring information of a private network requested to be accessed by the network access party; sending a tunnel creation instruction to an access gateway corresponding to the proprietary network to instruct the access gateway to establish a transmission tunnel with the access device; generating configuration information for the access equipment, wherein the configuration information is used for indicating the access equipment to establish a transmission tunnel with the access gateway; and if it is detected that the access device is online, sending the configuration information to the access device, so that the access device establishes a transmission tunnel with the access gateway according to the configuration information, and accesses the private network based on the established transmission tunnel. According to the technical scheme provided by the embodiment of the invention, the dependence on the traditional private network when the private network is accessed can be reduced, and the network access speed is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer and communication technology, and in particular to an access control method, device, computer-readable medium and electronic device. Background Art

[0002] In related technologies, if cloud users want to connect local IDC (Internet Data Center) or network equipment with VPC (Virtual Private Cloud, also known as proprietary network) in the cloud and enjoy low latency, high bandwidth, and secure network quality, they can only access the nearest POP (Point-of-Presence) point of the local operator through the operator's dedicated line, and then connect to the cloud VPC through the operator's dedicated line. This method is not only costly, but the dedicated line opening time is affected by the operator's construction, and it is very inconvenient for users who move frequently or need to deploy in multiple locations. Summary of the invention

[0003] The embodiments of the present application provide an access control method, device, computer-readable medium and electronic device, which can reduce the dependence on traditional dedicated line networks when accessing private networks and effectively improve the network access speed.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] In a first aspect, an embodiment of the present application provides an access control method, comprising: obtaining device information of an access device provided by a network access party, and obtaining information of a private network that the network access party requests to access; sending a tunnel creation instruction to an access gateway corresponding to the private network based on the information of the private network, to instruct the access gateway to establish a transmission tunnel with the access device; generating configuration information for the access device, the configuration information being used to instruct the access device to establish a transmission tunnel with the access gateway; if it is detected that the access device is online, sending the configuration information to the access device, so that the access device establishes a transmission tunnel with the access gateway based on the configuration information, and accesses the private network based on the established transmission tunnel.

[0006] In a second aspect, an embodiment of the present application provides an access control device, comprising: an acquisition unit, configured to acquire device information of an access device provided by a network access party, and acquire information of a private network that the network access party requests to access; a sending unit, configured to send a tunnel creation instruction to an access gateway corresponding to the private network based on the information of the private network, so as to instruct the access gateway to establish a transmission tunnel with the access device; a generation unit, configured to generate configuration information for the access device, wherein the configuration information is used to instruct the access device to establish a transmission tunnel with the access gateway; a processing unit, configured to send the configuration information to the access device if it is detected that the access device is online, so that the access device establishes a transmission tunnel with the access gateway based on the configuration information, and accesses the private network based on the established transmission tunnel.

[0007] In a third aspect, an embodiment of the present application provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processor, the access control method as described in the above embodiment is implemented.

[0008] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, wherein when the one or more computer programs are executed by the one or more processors, the electronic device implements the access control method as described in the above embodiments.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, the computer program product including a computer program, the computer program being stored in a computer-readable storage medium. A processor of an electronic device reads and executes the computer program from the computer-readable storage medium, so that the electronic device executes the access control method provided in the above-mentioned various optional embodiments.

[0010] In the technical solutions provided in some embodiments of the present application, a tunnel creation instruction is sent to an access gateway corresponding to the private network according to information of the private network requested to be accessed by the network access party, so as to instruct the access gateway to establish a transmission tunnel with the access device; at the same time, configuration information for the access device is generated, and after detecting that the access device is online, the configuration information is sent to the access device, so that the access device establishes a transmission tunnel with the access gateway according to the configuration information, and accesses the private network based on the established transmission tunnel, so that the access device can access the private network by sending tunnel creation instructions and configuration information (by the controller), thereby reducing the dependence on the traditional dedicated line network when accessing the private network, and at the same time, after the access device is online, it can automatically access the private network according to the configuration information, effectively improving the network access speed.

[0011] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A schematic diagram showing an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied;

[0013] Figure 2 A flow chart of an access control method according to an embodiment of the present application is shown;

[0014] Figure 3 A schematic diagram showing an exemplary system architecture to which the access control solution of the embodiment of the present application can be applied;

[0015] Figure 4 A schematic diagram showing an exemplary system architecture to which the access control solution of the embodiment of the present application can be applied;

[0016] Figure 5 A schematic diagram showing a connection relationship between a CPE and an access gateway according to an embodiment of the present application is shown;

[0017] Figure 6 A schematic diagram showing an exemplary system architecture to which the access control solution of the embodiment of the present application can be applied;

[0018] Figure 7 A schematic diagram showing the connection relationship between the UPF and the access gateway according to an embodiment of the present application is shown;

[0019] Figure 8 A schematic diagram showing the connection relationship between an access gateway and a dedicated line gateway according to an embodiment of the present application is shown;

[0020] Fig. 9 An interactive flow chart of an access control method according to an embodiment of the present application is shown;

[0021] Fig.10 A schematic diagram showing processing by a cloud network controller according to an embodiment of the present application according to a heartbeat message;

[0022] Fig.11 An interactive flow chart of an access control method according to an embodiment of the present application is shown;

[0023] Fig.12 A block diagram of an access control device according to an embodiment of the present application is shown;

[0024] Fig.13 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0025] The exemplary embodiments are now described in a more comprehensive manner with reference to the accompanying drawings. However, the exemplary embodiments can be implemented in various forms and should not be understood as being limited to these examples; on the contrary, the purpose of providing these embodiments is to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0026] In addition, the features, structures or characteristics described in the present application may be combined in one or more embodiments in any suitable manner. In the following description, there are many specific details so that the embodiments of the present application can be fully understood. However, those skilled in the art will appreciate that when implementing the technical scheme of the present application, all the detailed features in the embodiments may not be needed, one or more specific details may be omitted, or other methods, elements, devices, steps, etc. may be adopted.

[0027] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0028] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0029] It should be noted that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0030] The technical solution of the embodiment of the present application involves the field of cloud technology, wherein cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network within a wide area network or a local area network to achieve data calculation, storage, processing, and sharing.

[0031] Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which is used on demand and is flexible and convenient. The backend services of the cloud technology network system require a large amount of computing and storage resources, such as video websites, image websites and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, which needs to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data require strong system backing support, which can only be achieved through cloud computing.

[0032] In related technologies, if cloud users want to connect local IDC or network equipment with cloud VPC and enjoy low latency, high bandwidth, and secure network quality, they can only access the nearest POP point of the local operator through the operator's dedicated line, and then connect to the cloud VPC through the operator's dedicated line. This method is not only costly, but the dedicated line opening time is affected by the operator's construction, and it is very inconvenient for users who move frequently or need to deploy in multiple locations.

[0033] Based on the problems existing in the related technology, the embodiment of the present application proposes a new network access control solution, which can enable the network access party to access the private network by sending configuration information through the controller, reducing the dependence on the traditional dedicated network when accessing the private network. At the same time, after the access device is online, it can automatically access the private network according to the configuration information, effectively improving the network access speed.

[0034] Specifically, in a specific application scenario of the present application, such as Figure 1 As shown, the system architecture includes a controller 101, a network access party 102, a mobile network core network element 103, a private network 106, and an access gateway (GateWay, GW for short) 104 and a forwarding device 105 corresponding to the private network 106. At least one access device 1021 is deployed in the network access party 102.

[0035] Optionally, the controller 101 may be a server, which may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The access device 1021 may be a local CPE (Customer premises equipment) or a terminal device that can access the network, such as a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a vehicle terminal, an aircraft, etc., but is not limited thereto.

[0036] In one embodiment of the present application, the controller 101 may obtain device information of the access device 1021 provided by the network access party 102, and obtain information of the private network that the network access party 102 requests to access. The device information of the access device 1021 may be, for example, a unique identifier of the device, a network address of the device, port information of the device, etc.; the information of the private network may be, for example, identification information, network address information, port information, etc. of the private network.

[0037] In one embodiment of the present application, after acquiring the information of the private network that the network access party 102 requests to access, the controller 101 sends a tunnel creation instruction to the access gateway 104 corresponding to the private network according to the information of the private network, so as to instruct the access gateway 104 to establish a transmission tunnel with the access device 1021. At the same time, the controller 101 can generate configuration information for the access device 1021, and the configuration information is used to instruct the access device 1021 to establish a transmission tunnel with the access gateway 104. Then, after detecting that the access device 1021 is online, the controller 101 can send the configuration information to the access device 1021, so that the access device 1021 establishes a transmission tunnel with the access gateway 104 according to the configuration information, and accesses the private network based on the established transmission tunnel.

[0038] In some optional embodiments, since the transmission tunnel between the access device 1021 and the access gateway 104 is established through the mobile network core network element 103, the controller 101 can send a Generic Routing Encapsulation (GRE) tunnel establishment instruction to the access gateway 104 and the core network element 103 to instruct the core network element 103 to establish a GRE tunnel with the access gateway 104; and the transmission tunnel established between the access device 1021 and the access gateway 104 can be loaded onto the GRE tunnel.

[0039] In some optional embodiments, the controller 101 may also send a tunnel creation instruction to the access gateway 104 and the forwarding device 105 connected between the access gateway 104 and the private network to instruct the access gateway 104 to establish a transmission tunnel with the forwarding device 105. The transmission tunnel between the access gateway 104 and the forwarding device 105 is used to transmit the traffic of the access device 1021 to the forwarding device 105, so that the forwarding device 105 routes the traffic of the access device 1021 to the private network.

[0040] Optionally, in order to ensure data security, the transmission tunnel established between the access device 1021 and the access gateway 104 may be an IPSec (Internet Protocol Security) tunnel. Optionally, since the access gateway 104 and the forwarding device 105 may be deployed inside the network provider, there is no need for encrypted transmission, so the IPSec tunnel may be decapsulated on the access gateway 104, and then the user traffic may be transferred to a more lightweight VXLAN (Virtual Extensible Local Area Network) tunnel, that is, the transmission tunnel between the access gateway 104 and the forwarding device 105 may be a VXLAN tunnel.

[0041] Optionally, the core network element 103 may be a UPF (User Plane Function), which is an important part of the 3GPP 5G core network system architecture and is mainly responsible for the routing and forwarding related functions of user plane data packets in the 5G core network. The forwarding device 105 may be a NGW (Next Generation GateWay), which is mainly used in scenarios such as hybrid cloud dedicated line access, inter-domain interconnection, and public cloud interconnection, to achieve high-performance forwarding, support multi-tenant access, support TGRE (Tunnel-GRE), VXLAN tunnel protocol, etc., and also support features such as fragmentation, reorganization, and speed limit.

[0042] exist Figure 1 In the system architecture shown, the access device can access the private network by sending tunnel creation instructions and configuration information through the controller 101, reducing the dependence on the traditional dedicated network when accessing the private network. At the same time, after the access device is online, it can automatically access the private network according to the configuration information, effectively improving the network access speed.

[0043] The implementation details of the technical solution of the embodiment of the present application are described in detail below:

[0044] Figure 2A flow chart of an access control method according to an embodiment of the present application is shown. The access control method can be executed by a controller, which can be Figure 1 The controller 101 shown in FIG. Figure 2 As shown, the access control method at least includes S210 to S230, which are described in detail as follows:

[0045] In S210, device information of an access device provided by a network access party is obtained, and information of a private network to which the network access party requests to access is obtained.

[0046] In some optional embodiments, the network access party may send the device information of the access device and the information of the private network requested to be accessed to the controller through a configuration interface or a console. The network access party may be a lessee of the private network, and the access device may be a CPE or a terminal device capable of accessing the network. The device information of the access device 1021 may be, for example, a unique identifier of the device, a network address of the device, and port information of the device; the information of the private network may be, for example, identification information, network address information, and port information of the private network.

[0047] In S220, a tunnel creation instruction is sent to an access gateway corresponding to the private network according to information of the private network that the network access party requests to access, so as to instruct the access gateway to establish a transmission tunnel with the access device.

[0048] In some optional embodiments, the transmission tunnel between the access gateway and the access device may be an IPSec tunnel, so that the data of the access device can be guaranteed to be secure during transmission to the access gateway. In this case, the controller may obtain the tunnel encryption key provided by the network access party to the access device, and then add the tunnel encryption key to the tunnel creation instruction, so that an encrypted transmission tunnel is established between the access device and the access network gateway based on the tunnel encryption key.

[0049] Optionally, the process of the controller sending a tunnel creation instruction to the access gateway corresponding to the private network can specifically be to execute the following processes in sequence: sending VRF (Virtual Routing Forwarding) creation information to the access gateway, sending IPSec tunnel creation information to the access gateway, sending interface IP creation information to the access gateway, configuring IKE (a hybrid encryption protocol) encryption information to the access gateway, configuring BGP (Border Gateway Protocol) information to the access gateway, etc.

[0050] In S230, configuration information for the access device is generated, where the configuration information is used to instruct the access device to establish a transmission tunnel with the access gateway.

[0051] Optionally, the configuration information for the access device may include: IPSec tunnel creation information, interface IP creation information, and configured IKE encryption information.

[0052] It should be noted that Figure 2 The execution order between S220 and S230 shown in the figure is not specifically limited. For example, Figure 2 In the order shown in FIG, S220 is first executed, and then S230 is executed; or S230 may be executed first, and then S220; or S220 and S230 may be executed simultaneously.

[0053] In S240, if it is detected that the access device is online, the configuration information is sent to the access device, so that the access device establishes a transmission tunnel with the access gateway according to the configuration information, and accesses the private network based on the established transmission tunnel.

[0054] In some optional embodiments, the access device can periodically send a heartbeat message to the controller after going online, and the controller can determine that the access device is online when receiving the heartbeat message sent by the access device. In this way, after the access device goes online, the controller can directly send configuration information to the access device, and then the access device can automatically establish a transmission tunnel with the access gateway.

[0055] In some optional embodiments, the heartbeat message periodically sent by the access device after it goes online may also include the most recent startup time of the access device. Then, the controller can obtain the most recent startup time of the access device from the heartbeat message sent by the access device on the one hand, and can also obtain the most recent startup time recorded for the access device from the database on the other hand; if the most recent startup time contained in the heartbeat message is inconsistent with the most recent startup time recorded in the database, it means that the access device has been restarted, and the current configuration information of the access device can be obtained. If the current configuration information of the access device does not match the configuration information for the access device stored in the database, the configuration information stored in the database can be sent to the access device. The technical solution of this embodiment enables the controller to promptly send the configuration information in the database to the access device after the access device is restarted or when the local configuration information is lost, so as to ensure that the access device can obtain the latest configuration information and establish a transmission tunnel with the access gateway based on the latest configuration information.

[0056] In some optional embodiments, the process in which the controller sends the configuration information stored in the database to the access device may specifically be to search the database for configuration information that is different from the current configuration information based on the current configuration information and the configuration information for the access device stored in the database, and then send the configuration information that is different from the current configuration information in the database to the access device. The technical solution of this embodiment enables only differential configuration information to be sent to the access device, so as to reduce the bandwidth and transmission time occupied by sending the configuration information, thereby ensuring that the access device can obtain the latest configuration information as soon as possible.

[0057] In some optional embodiments, after sending the configuration information stored in the database to the access device, the controller can update the most recent startup time recorded for the access device in the database according to the most recent startup time contained in the heartbeat message, so as to subsequently determine whether the access device has been restarted based on the updated most recent startup time in the database.

[0058] In some optional embodiments, the private network may correspond to at least two access gateways, and the controller may send configuration information to the access device to instruct the access device to establish transmission tunnels with at least two access gateways respectively, and instruct the transmission tunnel established between the access device and at least two access gateways to be an equal cost multi-path routing (ECMP for short). Therefore, when any access gateway fails, the business traffic can be seamlessly replaced through other access gateways, thereby ensuring the continuity and stability of business traffic transmission.

[0059] In some optional embodiments, the transmission tunnel between the access device and the access network element may be established by the access device through the core network element and the access gateway. In this case, the controller may send a GRE tunnel establishment instruction to the access gateway and the core network element to instruct the core network element to establish a GRE tunnel with the access gateway. In this case, the transmission tunnel between the access device and the access gateway may be loaded onto the GRE tunnel. For example, if the transmission tunnel between the access device and the access gateway is an IPSec tunnel, then in the transmission tunnel established between the access device and the access gateway, the transmission tunnel between the core network element and the access gateway is an IPSec over GRE tunnel.

[0060] In some optional embodiments, the private network may correspond to at least two access gateways. In this case, the controller may send a GRE tunnel establishment instruction to the at least two access gateways and at least two core network elements to instruct each core network element to establish a GRE tunnel with the at least two access gateways respectively, and to instruct each core network element to establish a GRE tunnel with the at least two access gateways in an equal-cost multipath routing manner. The technical solution of this embodiment makes it possible to efficiently utilize the forwarding capabilities between the access gateway and the core network element, and can also ensure the reliability and stability of network transmission through ECMP when some core network elements or some access gateways are abnormal.

[0061] In some optional embodiments, a forwarding device may be connected between the access gateway and the private network. The forwarding device may be a gateway device, for example, the forwarding device may be an NGW device. After receiving the user traffic forwarded by the access gateway, the forwarding device may forward the user traffic to the private network.

[0062] In some optional embodiments, the controller may send a tunnel creation instruction to the access gateway and the forwarding device connected between the access gateway and the private network to instruct to establish a transmission tunnel between the access gateway and the forwarding device. The transmission tunnel between the access gateway and the forwarding device is used to transmit the traffic of the access device to the forwarding device, so that the forwarding device routes the traffic of the access device to the private network.

[0063] In some optional embodiments, the private network may correspond to at least two access gateways and at least two forwarding devices, and the controller may send a tunnel creation instruction to the at least two access gateways and at least two forwarding devices to instruct each access gateway to establish a transmission tunnel with the at least two forwarding devices, and to instruct each access gateway to establish a transmission tunnel with the at least two forwarding devices in an equal-cost multipath routing manner. The technical solution of this embodiment makes it possible to efficiently utilize the forwarding capabilities between the access gateway and the forwarding device, and can also ensure the reliability and stability of network transmission through ECMP when some forwarding devices or some access gateways are abnormal.

[0064] In some optional embodiments, since the access gateway and the forwarding device are inside the network provider, there is no need for encrypted transmission, so the transmission tunnel between the access gateway and the forwarding device can be a lightweight VXLAN tunnel. If the transmission tunnel between the access device and the access gateway is an IPSec tunnel, the access gateway can decapsulate the IPSec tunnel, and then transfer the user traffic to the VXLAN tunnel, which is then routed to the forwarding device and transmitted to the private network by the forwarding device.

[0065] The technical solutions of the above-mentioned embodiments of the present application enable access devices to access private networks by means of (controller) issuing tunnel creation instructions and configuration information, thereby reducing dependence on traditional dedicated networks when accessing private networks. At the same time, after the access device goes online, it can automatically access the private network according to the configuration information, effectively improving the network access speed.

[0066] The following combination Figures 3 to 11 , the network access solution of the embodiment of the present application is described in detail again with a specific application scenario:

[0067] exist Figure 3 In the application scenario shown, the cloud network controller is used to implement the functions of the controller described in the above embodiments. The user side can be a user who rents a private network VPC, that is, the network access party in the above embodiments, the UPF is the core network element in the above embodiments, and the dedicated line network management is the forwarding device in the above embodiments. Figure 3 The technical solution of the embodiment shown mainly adopts the design idea of ​​separation of control and transfer in NFV (Network Functions Virtualization), which is divided into a cloud network controller deployed on the cloud and lower-level network devices. The cloud network controller is responsible for the management and control of the equipment, configuration distribution, status detection, etc. The network equipment includes the mobile CPE for accessing the network on the user side; base stations, UPF, etc. on the operator side; access gateways, dedicated line gateways, etc. on the cloud provider side.

[0068] based on Figure 3 In the application scenario shown, when the CPE device on the user side accesses the network, the user side can connect its own CPE device (or the private IDC room mounted under the CPE) to the network closest to the user side, such as a mobile network, specifically a 4G or 5G network, etc. The UPF on the operator side and the access gateway on the cloud provider side can be connected via a dedicated line.

[0069] Since the air interface network is carried on the public network, user data needs to be encrypted. Figure 4 As shown, an IPSec tunnel can be used between the user CPE device and the access gateway. The encrypted tunnel directly passes through the operator network to reach the access gateway, so that the operator's public network and intranet links cannot perceive the tunnel, which can maximize the security of user data.

[0070] In some optional embodiments, in the cloud provider network, two (or more) dual-active access gateways may be deployed for network reliability. The two access gateways work simultaneously, each carrying a portion of the network traffic. If any one fails, the other can take over all service traffic without switching. Figure 5As shown in the figure, the user CPE can establish IPSec tunnels with both gateways, and configure ECMP on the CPE to make the two IPSec tunnels equally routed. The process of tunnel establishment and fault link switching is automatically completed by the network equipment, and the user is completely unaware, which can provide users with a good experience.

[0071] In some optional embodiments, such as Figure 6 As shown in the figure, in the connection between the cloud provider and the operator network, the operator usually provides a universal GRE tunnel for network encapsulation to distinguish its different users. One end of the GRE tunnel is the operator's UPF, and the other end is the cloud vendor's access gateway. The GRE tunnel is used to carry the IPSec tunnel established by the user's CPE. At this time, the underlay GRE tunnel is invisible to the user. The IPSec tunnel established by the user's CPE will be automatically loaded onto the GRE tunnel when passing through the UFP, that is, the gateway on the cloud is accessed in the form of IPSec over GRE.

[0072] Alternatively, if Figure 7 As shown, operators usually provide more than two UPFs (two are used as an example below) as access. At this time, a full mesh GRE tunnel can be established between the two UPFs and the two access gateways through the cloud network controller, and the two tunnels on their respective devices are ECMP. This can efficiently utilize the forwarding capabilities of network devices and ensure high reliability and stability of the network under abnormal circumstances. For example, if a UPF device is unavailable, due to the characteristics of ECMP scheduling, the traffic will be forwarded through another UPF. When the abnormal device is back online, the distribution of traffic will be automatically restored. The same is true for the access gateway. As long as there is at least one UPF and access gateway left in the network, the user's traffic will not be affected, which improves the availability of link quality.

[0073] In some optional embodiments, after user traffic reaches the access gateway, it needs to reach the VPC via a dedicated gateway. A VXLAN tunnel can be used between the access gateway and the dedicated gateway. The VNI (VXLAN Network Identifier) ​​of VXLAN has 24 bits, which can support up to 16 million+ user accesses, far more than the 12 bits of VLAN (Virtual Local Area Network). Therefore, the VXLAN tunnel is very suitable for dividing tenants when cloud providers access. And because the network traffic has already entered the cloud provider, it does not need to be encrypted for transmission, so the IPSec tunnel can be decapsulated on the access gateway to transfer the user traffic to the lighter VXLAN tunnel.

[0074] Alternatively, if Figure 8As shown in the figure, the cloud provider can provide more than two access gateways and dedicated line gateways (two gateways are used as an example below) as access. At this time, the cloud network controller can establish VXLAN tunnels between the two access gateways and the two dedicated line gateways, and the two tunnels on their respective devices are ECMP. This can efficiently utilize the forwarding capabilities of network devices and ensure high reliability and stability of the network under abnormal circumstances.

[0075] In one embodiment of the present application, when a user purchases a CPE device, the cloud network controller can configure a tunnel to connect the CPE device to the cloud provider, and then the cloud network controller orchestrates the network tunnel instructions to the devices at both ends, and the CPE device can complete the access. Fig. 9 As shown, the following steps are included:

[0076] S901, after purchasing the CPE device, the user activates the CPE cloud access function through the cloud network controller and configures the encryption key.

[0077] S902, the cloud network controller starts to orchestrate the IPSec tunnel for the CPE to access, and then prepares to send instructions for creating the tunnel to the CPE and the access gateway.

[0078] Afterwards, the cloud network controller executes S903a to S903e, that is, sends VRF creation information, IPSec tunnel creation information, interface IP creation information, IKE encryption configuration information, BGP configuration information, etc. to the access gateway in sequence. Then, the cloud network controller executes S904a to S904c, that is, sends IPSec tunnel creation information, interface IP creation information, IKE encryption configuration information, etc. to the CPE in sequence.

[0079] After the CPE and access gateway are configured, the CPE can automatically connect to the access gateway to connect the local IDC and the VPC network on the cloud.

[0080] In one embodiment of the present application, since the user CPE is in its own network environment, unlike the access gateway deployed as a server, the instructions arranged by the cloud network controller may not be sent to the CPE at any time (for example, the CPE may not be turned on). After the user configures the cloud network controller, he expects the CPE to automatically access the private network once it goes online, which requires the cloud network controller to provide CPE status detection and configuration re-issuance functions.

[0081] Optionally, each CPE can have a record in the database table of the cloud network controller, as shown in Table 1, which can record the identification information and configuration information of the CPE, and also store the most recent startup time of the CPE. After the CPE goes online, it can periodically report heartbeat information to the cloud network controller, and the message body carries the most recent startup time of the CPE.

[0082]

[0083] Table 1

[0084] When the cloud network controller receives the heartbeat message reported by the CPE, it checks whether the most recent startup time in the heartbeat message is consistent with that stored in the database. If there is an update, it means that the CPE has been restarted. During the CPE restart, there may be new configuration information, or the CPE may fail and cause the locally stored configuration information to be lost. Therefore, the cloud network controller will perform a configuration check on the CPE when it determines that the CPE has been restarted. For example, the cloud network controller can obtain the current configuration of the CPE through the CPE's management interface, and then compare it with the configuration in the database, and send the difference configuration to the CPE. In this way, for newly purchased equipment, after the user performs the initial configuration through the cloud network controller, the cloud network controller will complete the configuration information for it when the CPE is powered on and automatically connected, and then the CPE will automatically establish an encrypted tunnel with the cloud provider's private network. The user is unaware of this process. During the use of the CPE, at any time when there is a power outage, restart, or unexpected downtime, the cloud network controller will automatically check and repair the device configuration. At the same time, the cloud network controller also needs to promptly update the most recent startup time information stored in the database, such as Fig.10 As shown, the CPE periodically reports heartbeat messages to the cloud network controller, and then the cloud network controller updates the information stored in the database accordingly, such as the most recent startup time, the current configuration information of the CPE, etc.

[0085] Based on the aforementioned system architecture and related configurations, the embodiment of the present application adopts the idea of ​​separation of control and transmission, that is, various configuration information is arranged and issued by the cloud network controller, and the underlying network devices do not need to care about the business, but only need to provide a standard control interface and configure the network according to the arrangement instructions of the cloud network controller. Fig.11 As shown, the following steps are included:

[0086] S1101, during initialization, the cloud network controller sends configuration information to the UPF and the access gateway. Specifically, the operator's UPF and the cloud provider's access gateway are connected through the cloud network controller, that is, a GRE tunnel is established between the UPF and the access gateway.

[0087] S1102, when the user needs to use a private network, the user configures the VPC network that his / her CPE hopes to access to the cloud network controller through the cloud console.

[0088] S1103, the controller sends configuration information to the access gateway and the dedicated line gateway to configure a VXLAN tunnel between the access gateway and the dedicated line gateway to open up the connection between the access gateway and the dedicated line gateway.

[0089] S1104: The controller allocates exclusive IPSec tunnel resources to the user, and allocates and configures them to the CPE and the access gateway to open up the connection between the CPE and the access gateway.

[0090] After completing the above configuration, users can access the VPC on the cloud through CPE using the mobile network.

[0091] It can be seen that in the embodiments of the present application, the user CPE can quickly and efficiently access the cloud VPC, making full use of the low latency and high bandwidth characteristics of the 4G / 5G network, replacing the reliance on traditional dedicated lines when accessing dedicated gateways in related technologies. At the same time, through the cloud network controller, users only need simple configuration to allow the CPE device to automatically access the private network. For scenarios such as device offline and abnormal downtime, the cloud network controller can also automatically restore it. By building a full mesh network tunnel through multiple cloud network devices that serve as the primary and backup for each other, a more reliable connection service is provided, bringing users a network quality that is no less than that of a dedicated line connection.

[0092] The following describes an apparatus embodiment of the present application, which can be used to execute the access control method in the above-mentioned embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above-mentioned embodiment of the access control method of the present application.

[0093] Fig.12 A block diagram of an access control device according to an embodiment of the present application is shown, and the access control device may be arranged in a controller.

[0094] Reference Fig.12 As shown, the access control device 1200 according to an embodiment of the present application includes: an acquiring unit 1202 , a sending unit 1204 , a generating unit 1206 and a processing unit 1208 .

[0095] Among them, the acquisition unit 1202 is configured to obtain device information of the access device provided by the network access party, and obtain information of the private network that the network access party requests to access; the sending unit 1204 is configured to send a tunnel creation instruction to the access gateway corresponding to the private network according to the information of the private network, so as to instruct the access gateway to establish a transmission tunnel between the access device and the access device; the generation unit 1206 is configured to generate configuration information for the access device, and the configuration information is used to instruct the access device to establish a transmission tunnel between the access device and the access gateway; the processing unit 1208 is configured to send the configuration information to the access device if it is detected that the access device is online, so that the access device establishes a transmission tunnel with the access gateway according to the configuration information, and accesses the private network based on the established transmission tunnel.

[0096] In some embodiments of the present application, based on the aforementioned scheme, the processing unit 1208 is configured as follows: if a heartbeat message sent by the access device is received, it is determined that the access device is detected to be online; wherein, the heartbeat message is periodically sent after the access device is online.

[0097] In some embodiments of the present application, based on the aforementioned scheme, the access control device 1200 also includes: a receiving unit, configured to receive a heartbeat message periodically sent by the access device after it goes online, the heartbeat message containing the most recent startup time of the access device; the acquisition unit 1202 is also configured to: obtain the most recent startup time recorded for the access device from a database; if the most recent startup time contained in the heartbeat message is inconsistent with the most recent startup time recorded in the database, obtain the current configuration information of the access device; the sending unit 1204 is also configured to: if the current configuration information does not match the configuration information for the access device stored in the database, send the configuration information stored in the database to the access device.

[0098] In some embodiments of the present application, based on the aforementioned scheme, the process in which the sending unit 1204 sends the configuration information stored in the database to the access device includes: searching the database for configuration information that is different from the current configuration information based on the current configuration information and the configuration information for the access device stored in the database; and sending the configuration information in the database that is different from the current configuration information to the access device.

[0099] In some embodiments of the present application, based on the aforementioned scheme, the processing unit 1208 is also configured to: after sending the configuration information stored in the database to the access device, update the most recent startup time recorded for the access device in the database according to the most recent startup time contained in the heartbeat message.

[0100] In some embodiments of the present application, based on the aforementioned scheme, the acquisition unit 1202 is also configured to: obtain the tunnel encryption key provided by the network access party for the access device; the sending unit 1204 is also configured to: add the tunnel encryption key to the tunnel creation instruction and the configuration information, so that an encrypted transmission tunnel is established between the access device and the access network gateway based on the tunnel encryption key.

[0101] In some embodiments of the present application, based on the aforementioned scheme, the transmission tunnel is established between the access device and the access gateway through the core network network element; the sending unit 1204 is also configured to: send a general routing encapsulation GRE tunnel establishment instruction to the access gateway and the core network network element to instruct the core network network element to establish a GRE tunnel with the access gateway; wherein the transmission tunnel established between the access device and the access gateway is loaded onto the GRE tunnel.

[0102] In some embodiments of the present application, based on the aforementioned scheme, the private network corresponds to at least two access gateways; the sending unit 1204 sends a general routing encapsulation GRE tunnel establishment instruction to the access gateway and the core network element to instruct the core network element to establish a GRE tunnel with the access gateway, including: sending the GRE tunnel establishment instruction to the at least two access gateways and at least two core network elements to instruct each of the core network elements to establish the GRE tunnel with the at least two access gateways respectively, and instructing the GRE tunnel established between each of the core network elements and the at least two access gateways to be an equal-cost multi-path routing method.

[0103] In some embodiments of the present application, based on the aforementioned scheme, the private network corresponds to at least two access gateways; the processing unit 1208 sends the configuration information to the access device so that the access device establishes a transmission tunnel with the access gateway according to the configuration information, including: sending the configuration information to the access device to instruct the access device to establish transmission tunnels with the at least two access gateways respectively, and instructing the transmission tunnel established between the access device and the at least two access gateways to be an equal-cost multipath routing method.

[0104] In some embodiments of the present application, based on the aforementioned scheme, the sending unit 1204 is further configured to: send a tunnel creation instruction to the access gateway and a forwarding device connected between the access gateway and the private network to instruct the access gateway to establish a transmission tunnel between the access gateway and the forwarding device, and the transmission tunnel between the access gateway and the forwarding device is used to transmit the traffic of the access device to the forwarding device, so that the forwarding device routes the traffic of the access device to the private network.

[0105] In some embodiments of the present application, based on the aforementioned scheme, the private network corresponds to at least two access gateways and at least two forwarding devices; the sending unit 1204 sends a tunnel creation instruction to the access gateway, and the forwarding device connected between the access gateway and the private network to instruct the access gateway to establish a transmission tunnel between the forwarding device, including: sending a tunnel creation instruction to the at least two access gateways and the at least two forwarding devices to instruct each of the access gateways to establish a transmission tunnel with the at least two forwarding devices respectively, and instructing each of the transmission tunnels established between the access gateway and the at least two forwarding devices to be in an equal-cost multipath routing manner.

[0106] In some embodiments of the present application, based on the aforementioned scheme, the transmission tunnel established between the access device and the access gateway includes an Internet Security Protocol tunnel; the transmission tunnel established between the access gateway and the forwarding device includes a virtual extended LAN tunnel, and the virtual extended LAN tunnel is used to transmit the traffic after the access gateway decapsulates the Internet Security Protocol tunnel to the forwarding device.

[0107] Fig.13 A schematic diagram of the structure of a computer system of an electronic device suitable for implementing an embodiment of the present application is shown, and the electronic device may be the controller in the aforementioned embodiment.

[0108] It should be noted that Fig.13 The computer system 1300 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0109] like Fig.13As shown, the computer system 1300 may include a central processing unit (CPU) 1301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1302 or the program loaded from the storage part 1308 to the random access memory (RAM) 1303, such as executing the method described in the above embodiment. In the RAM 1303, various programs and data required for system operation are also stored. The CPU 1301, the ROM 1302 and the RAM 1303 are connected to each other through the bus 1304. The input / output (I / O) interface 1305 is also connected to the bus 1304.

[0110] The following components can be connected to the I / O interface 1305: an input section 1306 including a keyboard, a mouse, etc.; an output section 1307 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1308 including a hard disk, etc.; and a communication section 1309 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to the I / O interface 1305 as needed. A removable medium 1311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1310 as needed so that a computer program read therefrom is installed into the storage section 1308 as needed.

[0111] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program is used to perform the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1309, and / or installed from a removable medium 1311. When the computer program is executed by a central processing unit (CPU) 1301, various functions defined in the system of the present application are executed.

[0112] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a computer program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0113] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and a computer program.

[0114] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0115] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more computer programs, and when the above one or more computer programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0116] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0117] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable an electronic device to execute the method according to the implementation methods of the present application.

[0118] For example, the electronic device can be a controller, and the controller can execute Figure 2 The access control method shown.

[0119] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0120] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An access control method, characterized in that: include: Obtaining device information of an access device provided by a network access party, and obtaining information of a private network to which the network access party requests access; Sending a tunnel creation instruction to an access gateway corresponding to the private network according to the information of the private network, so as to instruct the access gateway to establish a transmission tunnel with the access device; Generate configuration information for the access device, where the configuration information is used to instruct the access device to establish a transmission tunnel with the access gateway; If it is detected that the access device is online, the configuration information is sent to the access device, so that the access device establishes a transmission tunnel with the access gateway according to the configuration information and accesses the private network based on the established transmission tunnel.

2. The access control method according to claim 1, characterized in that: The access control method further includes: If a heartbeat message sent by the access device is received, it is determined that the access device is detected to be online; wherein the heartbeat message is periodically sent after the access device is online.

3. The access control method according to claim 1, characterized in that: The access control method further includes: Receiving a heartbeat message periodically sent by the access device after it goes online, wherein the heartbeat message includes a most recent startup time of the access device; Acquire the most recent startup time recorded for the access device from the database; If the most recent startup time included in the heartbeat message is inconsistent with the most recent startup time recorded in the database, obtaining current configuration information of the access device; If the current configuration information does not match the configuration information for the access device stored in the database, the configuration information stored in the database is sent to the access device.

4. The access control method according to claim 3, characterized in that: Sending the configuration information stored in the database to the access device includes: According to the current configuration information and the configuration information for the access device stored in the database, searching the database for configuration information that is different from the current configuration information; The configuration information in the database that is different from the current configuration information is sent to the access device.

5. The access control method according to claim 3, characterized in that: After sending the configuration information stored in the database to the access device, the access control method further includes: According to the most recent startup time included in the heartbeat message, the most recent startup time recorded for the access device in the database is updated.

6. The access control method according to claim 1, characterized in that: The access control method further includes: Obtaining a tunnel encryption key provided by the network access party for the access device; The tunnel encryption key is added to the tunnel creation instruction and the configuration information, so that an encrypted transmission tunnel is established between the access device and the access network gateway based on the tunnel encryption key.

7. The access control method according to claim 1, characterized in that: The transmission tunnel is established by the access device and the access gateway through a core network element; the access control method further includes: Sending a general routing encapsulation (GRE) tunnel establishment instruction to the access gateway and the core network element to instruct the core network element to establish a GRE tunnel with the access gateway; The transmission tunnel established between the access device and the access gateway is loaded onto the GRE tunnel.

8. The access control method according to claim 7, characterized in that: The private network corresponds to at least two access gateways; the sending of a general routing encapsulation GRE tunnel establishment instruction to the access gateway and the core network element to instruct the core network element to establish a GRE tunnel with the access gateway includes: The GRE tunnel establishment instruction is sent to the at least two access gateways and at least two core network network elements to instruct each of the core network network elements to establish the GRE tunnel with the at least two access gateways respectively, and to instruct the GRE tunnel established between each of the core network network elements and the at least two access gateways to be in an equal-cost multi-path routing manner.

9. The access control method according to claim 1, characterized in that: The private network corresponds to at least two access gateways; sending the configuration information to the access device so that the access device establishes a transmission tunnel with the access gateway according to the configuration information, including: The configuration information is sent to the access device to instruct the access device to establish transmission tunnels with the at least two access gateways respectively, and to instruct the transmission tunnels established between the access device and the at least two access gateways to be in an equal-cost multipath routing manner.

10. The access control method according to claim 1, characterized in that: The access control method further includes: A tunnel creation instruction is sent to the access gateway and a forwarding device connected between the access gateway and the private network to instruct the access gateway to establish a transmission tunnel with the forwarding device. The transmission tunnel between the access gateway and the forwarding device is used to transmit the traffic of the access device to the forwarding device, so that the forwarding device routes the traffic of the access device to the private network.

11. The access control method according to claim 10, characterized in that: The private network corresponds to at least two access gateways and at least two forwarding devices; sending a tunnel creation instruction to the access gateway and the forwarding device connected between the access gateway and the private network to instruct the access gateway to establish a transmission tunnel with the forwarding device, including: A tunnel creation instruction is sent to the at least two access gateways and the at least two forwarding devices to instruct each of the access gateways to establish a transmission tunnel with the at least two forwarding devices respectively, and to instruct the transmission tunnel established between each of the access gateways and the at least two forwarding devices to be in an equal-cost multipath routing manner.

12. The access control method according to claim 10 or 11, characterized in that: The transmission tunnel established between the access device and the access gateway includes an Internet Security Protocol tunnel; the transmission tunnel established between the access gateway and the forwarding device includes a virtual extended LAN tunnel, and the virtual extended LAN tunnel is used to transmit the traffic after the access gateway decapsulates the Internet Security Protocol tunnel to the forwarding device.

13. An access control device, characterized in that: include: An acquisition unit configured to acquire device information of an access device provided by a network access party, and acquire information of a private network to which the network access party requests access; A sending unit, configured to send a tunnel creation instruction to an access gateway corresponding to the private network according to the information of the private network, so as to instruct the access gateway to establish a transmission tunnel with the access device; A generating unit, configured to generate configuration information for the access device, wherein the configuration information is used to instruct the access device to establish a transmission tunnel with the access gateway; The processing unit is configured to send the configuration information to the access device if it is detected that the access device is online, so that the access device establishes a transmission tunnel with the access gateway according to the configuration information and accesses the private network based on the established transmission tunnel.

14. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the access control method according to any one of claims 1 to 12 is implemented.

15. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more computer programs, which, when executed by the one or more processors, enables the electronic device to implement the access control method as described in any one of claims 1 to 12.

Images