Access restriction method, device and medium based on FTTR master-slave management

Abstract

The present application proposes an access restriction method, device and medium based on FTTR master-slave management, the method is applied to the slave gateway, including: receiving a service package sent by the user end; matching the service package with a first list for storing service package restriction rules, the service package restriction rules are issued by the master gateway when it determines that any service package meets the access control rules; when no matching service package restriction rules are found in the first list, forwarding the service package to the master gateway; when a matching service package restriction rule is found in the first list, discarding the service package, wherein any service package restriction rule is used to restrict a unique service package. Through the method proposed in the present application, the slave gateway directly restricts the service package according to the service package restriction rules issued by the master gateway, which can effectively alleviate the load pressure of the master gateway and realize distributed restriction.

Description

Technical Field

[0001] The present invention relates to the field of FTTR (Fiber to The Room) and access restriction, and in particular to an access restriction method, device and medium based on FTTR master-slave management. Background Art

[0002] In recent years, FTTR network, as an advanced network deployment method, has brought significant network advantages to users by laying optical fiber directly into the room. Fiber optic access to the room can greatly improve the network connection speed. Compared with traditional network access methods, its data transmission rate can achieve a qualitative leap. Moreover, this connection method has excellent stability, which can effectively reduce network fluctuations and interruptions, and provide users with a reliable network experience. In the FTTR networking environment, users have diverse needs for network access restrictions. Among them, restricting access to specific domain names during specific time periods is an important issue that needs to be solved urgently.

[0003] In the current network architecture, the main gateway is responsible for the access restriction function for all users. Whether it is a home network, an enterprise office network or other types of network environments, all users' network access behaviors need to be screened and restricted by the main gateway. The service forwarding in the slave gateway is mostly implemented by the hardware acceleration module. Since the hardware acceleration module is designed mainly to achieve fast forwarding, it lacks the ability to perform detailed analysis of the data packet content, that is, it cannot analyze user traffic packet by packet. The access restriction function often requires in-depth analysis of the information in the network data packet to determine whether it meets the access restriction conditions. Therefore, since the slave gateway cannot analyze packet by packet, it cannot implement the access restriction function for user traffic. Summary of the invention

[0004] The embodiment of the present invention provides an access restriction method, device and medium based on FTTR master-slave management. The method analyzes the user's network access request by using the service flow analysis capability of the master gateway, and synchronously transmits the access restriction result obtained by the analysis to the slave gateway. The slave gateway directly restricts the user's access according to the service package restriction rules issued by the master gateway, thereby realizing a distributed access restriction function, which can effectively alleviate the load pressure of the master gateway.

[0005] In a first aspect, an embodiment of the present invention provides an access restriction method based on FTTR master-slave management, which is applied to a slave gateway and includes:

[0006] Receive the service packet sent by the user end;

[0007] Matching the service package with a first list for storing service package restriction rules, wherein the service package restriction rules are issued by the main gateway when it is determined that any service package meets the access control rules;

[0008] When no matching service package restriction rule is found in the first list, forwarding the service package to the primary gateway;

[0009] When a matching service package restriction rule is found in the first list, the service package is discarded, wherein any service package restriction rule is used to restrict a unique service package.

[0010] In some possible embodiments, before matching the service package with the first list for storing the service package restriction rules issued by the primary gateway, the process further includes:

[0011] Matching the service packet with a second list for storing hardware acceleration rules;

[0012] When a hardware acceleration rule that the service packet complies with is found in the second list, forwarding the service packet to the main gateway;

[0013] Matching the hardware acceleration rules includes matching the source port.

[0014] In some possible embodiments, the method further includes:

[0015] When no matching hardware acceleration rule is found in the second list and no matching service package restriction rule is found in the first list, a hardware acceleration rule corresponding to the service package is generated and added to the second list.

[0016] In some possible embodiments, the service package restriction rule is a five-tuple restriction rule, and finding a matching service package restriction rule in the first list includes:

[0017] If the service packet matches the source IP, destination IP, protocol, and destination port in any five-tuple restriction rule, it is determined that a matching five-tuple restriction rule is found.

[0018] In some possible embodiments, the method further includes:

[0019] Deleting a first service package restriction rule corresponding to the first access control rule according to a first instruction sent by the primary gateway when modifying the first access control rule;

[0020] According to the second instruction sent by the primary gateway when deleting the second access control rule, the second service package restriction rule corresponding to the second access control rule is deleted.

[0021] In a second aspect, the embodiment of the present application further proposes an access restriction method based on FTTR master-slave management, which is applied to a master gateway, including:

[0022] receiving a service packet sent from the gateway, and matching the service packet with the access control rules in the third list;

[0023] If there is a matching access control rule in the third list, discard the service packet;

[0024] Generate a business package restriction rule corresponding to the business package, associate the matching access control rule and business package restriction rule with the slave gateway ID, and add them to the third list;

[0025] According to the ID of the slave gateway, the corresponding service package restriction rule is sent to the corresponding slave gateway.

[0026] In some possible embodiments, the method further includes:

[0027] If there is no matching access control rule in the third list, the service packet is forwarded.

[0028] In some possible embodiments, the method further includes at least one of the following steps:

[0029] In response to the access control rule modification instruction, determine the modified first access control rule and its associated first business package restriction rule and the first slave gateway ID, modify the first access control rule and instruct the slave gateway corresponding to the first slave gateway ID to delete the corresponding first business package restriction rule;

[0030] In response to the access control rule deletion instruction, determine the deleted second access control rule and its associated second business package restriction rule and second slave gateway ID, delete the second access control rule and instruct the slave gateway corresponding to the second slave gateway ID to delete the corresponding second business package restriction rule.

[0031] In the third aspect, an embodiment of the present application also proposes an access restriction device based on FTTR master-slave management, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute an access restriction method based on FTTR master-slave management as described in any one of the first aspect or the second aspect above.

[0032] In a fourth aspect, an embodiment of the present application further proposes a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute an access restriction method based on FTTR master-slave management as described in any one of the first aspect or the second aspect above.

[0033] The access restriction method, device and medium based on FTTR master-slave management proposed in the embodiment of the present application, the method receives the service package sent by the user terminal from the gateway; matches the service package with the first list for storing service package restriction rules, the service package restriction rules are issued by the main gateway when it determines that any service package meets the access control rules; when no matching service package restriction rules are found in the first list, the service package is forwarded to the main gateway; when a matching service package restriction rule is found in the first list, the service package is discarded, wherein any service package restriction rule is used to restrict a unique service package. Through the method proposed in the embodiment of the present application, the slave gateway can directly restrict the service package according to the service package restriction rules issued by the main gateway, which can effectively alleviate the load pressure of the main gateway and realize distributed restriction.

[0034] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 This is a schematic diagram of the structure of an access restriction system based on FTTR master-slave management in an embodiment of the present application;

[0037] Figure 2 This is a schematic diagram of hardware accelerated rule matching from a gateway in an embodiment of the present application;

[0038] Figure 3 A schematic diagram of access control rule matching performed by the main gateway in an embodiment of the present application;

[0039] Figure 4 A schematic diagram of a software module of a main gateway in an embodiment of the present application;

[0040] Figure 5 A schematic diagram of a process for configuring access control rules by a main gateway in an embodiment of the present application;

[0041] Figure 6 This is a schematic diagram of matching service package restriction rules from a gateway in an embodiment of the present application;

[0042] Figure 7 This is a schematic diagram of a software module of a slave gateway in an embodiment of the present application;

[0043] Figure 8 This is a schematic diagram of a service package restriction process using a domain name access control rule as an example in an embodiment of the present application;

[0044] Fig. 9 A schematic diagram of a flow chart of an access restriction method based on FTTR master-slave management applied to a slave gateway in an embodiment of the present application;

[0045] Fig.10 A schematic diagram of a flow chart of an access restriction method based on FTTR master-slave management applied to a master gateway in an embodiment of the present application;

[0046] Fig.11 This is a schematic diagram of the structure of an access restriction device based on FTTR master-slave management in an embodiment of the present application. DETAILED DESCRIPTION

[0047] To further illustrate the technical solution provided by the embodiments of the present application, a detailed description is given below in conjunction with the accompanying drawings and specific implementation methods.

[0048] With the rapid development of FTTR technology, its application fields are becoming more and more extensive. In the networking environment of FTTR, users have diverse needs for network access restrictions. Among them, restricting access to specific domain names in a specific time period is an important issue that needs to be solved urgently. In the current network architecture, the main gateway assumes the access restriction function for all users. Whether it is a home network, an enterprise office network or other types of network environments, all users' network access behaviors need to be screened and restricted by the main gateway. The service forwarding in the slave gateway is mostly implemented by the hardware acceleration module. Since the design purpose of the hardware acceleration module is mainly to achieve fast forwarding, it lacks the ability to perform detailed analysis of the data packet content, that is, it cannot analyze user traffic packet by packet. The access restriction function often requires in-depth analysis of the information in the network data packet to determine whether it meets the access restriction conditions.

[0049] Therefore, in view of the problem that the slave gateway in the prior art cannot perform packet-by-packet analysis and thus cannot implement the access restriction function for user traffic, the embodiment of the present application proposes an access restriction implementation system based on FTTR master-slave management, wherein the FTTR network can be a passive optical fiber network PON network or a POF optical fiber network, and the user's network access request is analyzed by means of the service traffic analysis capability of the master gateway, and the access restriction result obtained by the analysis is synchronously transmitted to the slave gateway. The slave gateway directly restricts the user's access according to the service packet restriction rules issued by the master gateway, thereby realizing a distributed access restriction function, which can effectively alleviate the load pressure of the master gateway.

[0050] In the embodiment of the present application, the access restriction system based on FTTR master-slave management includes a master gateway and a slave gateway, such as Figure 1 As shown, where:

[0051] The slave gateway is used to receive a service package sent by a user terminal; match the service package with a first list for storing service package restriction rules, wherein the service package restriction rules are issued by the master gateway when it is determined that any service package complies with the access control rules; when no matching service package restriction rules are found in the first list, the service package is forwarded to the master gateway; when a matching service package restriction rule is found in the first list, the service package is discarded, wherein any service package restriction rule is used to restrict a unique service package.

[0052] The master gateway is used to receive the business package sent by the slave gateway, match the business package with the access control rules in the third list; if there is a matching access control rule in the third list, discard the business package; generate a business package restriction rule corresponding to the business package, associate the matching access control rule and business package restriction rule with the slave gateway ID and add them to the third list; according to the ID of the slave gateway, send the corresponding business package restriction rule to the corresponding slave gateway.

[0053] The embodiment of the present application proposes an access restriction system based on FTTR master-slave management, in which the slave gateway directly restricts the user's access according to the service package restriction rules issued by the master gateway, and stores the service package restriction rules in the corresponding first list, thereby realizing a distributed access restriction function. By using the master gateway's ability to analyze service packages, the service packages sent by the user end are analyzed, and the access restriction results obtained by the analysis are synchronously transmitted to the slave gateway, which can effectively alleviate the load pressure of the master gateway.

[0054] In some possible embodiments, the slave gateway in the system is further configured to preferentially forward service packets that comply with the hardware acceleration rules based on preset hardware acceleration rules.

[0055] When a user accesses the Internet, the user terminal sends a service packet to the secondary gateway. Figure 2 As shown, after receiving the service packet sent by the user terminal, the slave gateway matches the service packet with the second list for storing hardware acceleration rules. When the hardware acceleration rule that the service packet complies with is found in the second list, the service packet is forwarded to the master gateway.

[0056] In the embodiment of the present application, the second list stores hardware acceleration rules, and matching the hardware acceleration rules includes matching the source port. Since the user end may use different source ports to send the same service packet, matching the hardware acceleration rules includes matching the source port, providing support for subsequent matching and restriction of the same service packet.

[0057] When the corresponding master gateway receives the service packet forwarded by the slave gateway, Figure 3 As shown, it is also used to match the service package with the access control rules in the third list, wherein:

[0058] If there is a matching access control rule in the third list, discard the service packet;

[0059] If there is no matching access control rule in the third list, the service packet is forwarded.

[0060] In some possible embodiments, the third list includes: access control rules, business package restriction rules, and associated slave gateway IDs. The master gateway is further configured to generate business package restriction rules corresponding to the business package after determining that there are matching access control rules in the third list, associate the matching access control rules and business package restriction rules with the slave gateway ID, and add them to the third list, and send the corresponding business package restriction rules to the corresponding slave gateway according to the slave gateway ID.

[0061] In some possible embodiments, the service packet restriction rule is a five-tuple restriction rule, including: source IP, destination IP, protocol, destination port and source port.

[0062] In some possible embodiments, before performing service processing, the main gateway in the system needs to configure access control rules, wherein, in the embodiment of the present application, Figure 4 As shown, the software module of the main gateway includes at least one of the following modules: a main gateway management module 401 , an access control configuration module 402 , and an access control function module 403 .

[0063] The main gateway is used to configure access control rules, such as Figure 5 As shown, it is specifically used to perform at least one of the following steps:

[0064] Step 501, receiving the user's access control rules through the above-mentioned main gateway management module, and forwarding the access control rules to the above-mentioned access control configuration module;

[0065] Step 502, configuring relevant parameters based on the access control rules through the access control configuration module;

[0066] Step 503: Based on the relevant parameters configured by the access control configuration module, the access control function module acts on the NF_INET_FORWARD point of the Linux kernel network protocol stack to match and restrict access to the designated service.

[0067] Correspondingly, the slave gateway is further configured to store the service package restriction rule in the first list of the slave gateway after receiving the service package restriction rule sent by the master gateway.

[0068] When the slave gateway does not find the hardware acceleration rule that the service packet complies with in the second list, Figure 6 As shown, it is also used to match the service package with a first list for storing service package restriction rules, wherein:

[0069] When a matching service package restriction rule is found in the first list, the service package is discarded;

[0070] When no matching service packet restriction rule is found in the first list, the service packet is forwarded to the primary gateway.

[0071] In some possible embodiments, the slave gateway is also used to generate hardware acceleration rules corresponding to the business package and add them to the second list when no matching hardware acceleration rules are found in the second list and no matching business package restriction rules are found in the first list.

[0072] Specifically, the slave gateway learns the five-tuple information of the service packet through the hardware acceleration module, generates the hardware acceleration rule corresponding to the service packet, and the subsequent service packets that meet the hardware acceleration rule are directly forwarded by the slave gateway, which is more efficient.

[0073] In some possible embodiments, the first list stores the service package restriction rules issued by the primary gateway, the service package restriction rules in the first list are five-tuple restriction rules, and finding a matching service package restriction rule in the first list includes:

[0074] If the service packet matches the source IP, destination IP, protocol, and destination port in any five-tuple restriction rule, it is determined that a matching five-tuple restriction rule is found.

[0075] Considering the characteristics of computer access to business websites, after the business website access fails, the business packet discarded by the main gateway will be retransmitted. When the slave gateway receives the retransmitted business packet, it can find the matching hardware acceleration rule and forward the retransmitted business packet. The business packet is still discarded at the main gateway. The main gateway records the number of packet losses and information of the business packet. When it is determined that the corresponding business packet restriction rule has been sent to the slave gateway, there is no need to repeatedly synchronize the business packet restriction rule of the business packet to the slave gateway. After several retransmissions fail, the computer tries to change the source port to try to access again. According to this feature, when the slave gateway actually matches the business packet restriction rule, it only matches the source IP, destination IP, protocol, and destination port in the five-tuple restriction rule, and does not match the source port. This can improve the success rate of access restriction and reduce the load on the slave gateway.

[0076] In some possible embodiments, the slave gateway works in a layer 2 bridge mode, and the slave gateway uses a built-in software module to perform forwarding acceleration and limit specified service packets, such as Figure 7 As shown, the software module of the slave gateway includes at least one of the following modules: a slave gateway management module 701 , a hardware acceleration module 702 , an access control configuration module 703 , and an access control function module 704 .

[0077] The slave gateway is used to accelerate the forwarding of service packets, which is achieved by relying on the above-mentioned hardware acceleration module. The hardware acceleration module can quickly process the forwarding of network data packets through special circuit design and algorithm optimization. When processing a large amount of network traffic, the hardware acceleration module can efficiently forward service packets from one network interface to another without occupying too much CPU resources.

[0078] In the embodiment of the present application, the slave gateway is also used to store the business package restriction rules in the first list of the slave gateway after receiving the business package restriction rules issued by the master gateway. Specifically, the slave gateway receives the business package restriction rules issued by the master gateway through the slave gateway management module, and then the slave gateway management module forwards the business package restriction rules to the access control configuration module, and the access control configuration module generates a corresponding configuration based on the business package restriction rules, and finally acts on the NF_BR_FORWARD point through the access control function module, and matches and restricts access based on the business package restriction rules of the configuration.

[0079] At this time, if the slave gateway receives the retransmitted service packet after modifying the source port under the domain name again, the corresponding service packet restriction rule can be matched through the access control function module, and the service packet is discarded. At the same time, the packet loss statistics are synchronized to the slave gateway management module, realizing the access restriction function of the slave gateway to the user's service packet, effectively alleviating the load pressure of the main gateway.

[0080] The following is a flowchart of domain name access control rules, which are configured on the master gateway, and an access restriction system based on FTTR master-slave management in an embodiment of the present application is used to enable the slave gateway to restrict the service package under the specified domain name, such as Figure 8 As shown:

[0081] Step 801, receiving a service packet sent by a user terminal from a gateway, matching the service packet with a second list for storing hardware acceleration rules, and if no hardware acceleration rule that the service packet complies with is found in the second list, matching the service packet with a first list for storing service packet restriction rules;

[0082] Step 802: the slave gateway fails to find a matching service package restriction rule in the first list, and forwards the service package to the master gateway;

[0083] Step 803, after receiving the service packet sent by the slave gateway, the master gateway matches the service packet with the domain name access control rules in the third list;

[0084] Step 804, the master gateway finds a matching domain name access control rule in the third list, discards the service package, generates a service package restriction rule corresponding to the service package, associates the matching domain name access control rule and service package restriction rule with the slave gateway ID, and adds them to the third list, and sends the corresponding service package restriction rule to the corresponding slave gateway according to the slave gateway ID;

[0085] Step 805, the slave gateway receives the service package restriction rule issued by the master gateway, adds the service package restriction rule to the first list, and generates a corresponding configuration according to the newly added service package restriction rule in the first list;

[0086] Step 806, the slave gateway receives the service packet retransmitted after the source port is modified under the domain name again, matches the service packet with the second list for storing hardware acceleration rules, and if no hardware acceleration rule that the service packet complies with is found in the second list, matches the service packet with the updated first list;

[0087] Step 807: the slave gateway finds a matching service packet restriction rule in the first list and discards the service packet.

[0088] When the main gateway receives a service packet, it executes the original normal routing check forwarding logic. After determining that it is a forwarded service packet, it enters the NF_INET_FORWARD point in the Linux kernel network protocol stack through the access control function module, parses the service packet to obtain the domain name accessed by the service packet, and matches the domain name with the pre-configured domain name access control rules in the access control configuration module one by one. If the matching rules are met, the service packet is discarded. If the matching rules are not met, the service packet is forwarded normally.

[0089] The HTTPS protocol is most commonly used to access a domain name. According to the HTTPS protocol interaction process, the user sends a Client Hello message, and by parsing the value of Extension:server_name in the Client Hello service package, the domain name accessed by the service package is determined.

[0090] In the embodiment of the present application, the matching method includes complete matching and fuzzy matching. The complete matching has high matching accuracy, but it is easy to miss the subdomains under the domain name. Fuzzy matching, that is, business packages containing domain names and subdomains can be matched, is more practical. The embodiment of the present application only provides a possible implementation method, and the embodiment of the present application does not specifically limit how to match access control rules.

[0091] For example, when a domain name meets the domain name access control rules, the main gateway access restriction function module discards the service package, records the packet loss statistics, and records the service package restriction rules of the service package. Taking the five-tuple information as an example, the five-tuple information (source IP, destination IP, protocol, source port and destination port) of the service package and the corresponding slave gateway ID are recorded, and the matching domain name access control rules and service package restriction rules are associated with the slave gateway ID and added to the third list maintained by the main gateway management module. The main gateway management module sends the service package restriction rules of the service package corresponding to the domain name access control rules, that is, the five-tuple restriction rules, to the corresponding slave gateway according to the associated slave gateway ID.

[0092] The management module of the slave gateway receives the service package restriction rules issued by the master gateway and forwards them to the access control configuration module. The access control configuration module generates corresponding configurations according to the issued service package restriction rules and synchronizes them to the access control function module. At this time, the domain name access control rules configured by the master gateway take effect on the slave gateway.

[0093] At this time, if the slave gateway receives the retransmitted service packet after modifying the source port under the domain name again, the corresponding five-tuple restriction rule can be matched through the access control function module, and the service packet is discarded. At the same time, the packet loss statistics are synchronized to the slave gateway management module, realizing the access restriction function of the slave gateway to the user service packet, effectively alleviating the load pressure of the main gateway.

[0094] In some possible embodiments, the master gateway in the system is further used for:

[0095] In response to the access control rule modification instruction from the user end, the modified first access control rule and its associated first business package restriction rule and the first slave gateway ID are determined, the first access control rule is modified and the slave gateway corresponding to the first slave gateway ID is instructed to delete the first business package restriction rule. The corresponding first slave gateway deletes the first business package restriction rule corresponding to the first access control rule according to the first instruction sent by the master gateway when modifying the first access control rule.

[0096] In some possible embodiments, the master gateway in the system is further used for:

[0097] In response to the access control rule deletion instruction from the user end, determine the deleted second access control rule and its associated second business package restriction rule and the second slave gateway ID, delete the second access control rule and instruct the slave gateway corresponding to the second slave gateway ID to delete the second business package restriction rule. The corresponding second slave gateway deletes the business package restriction rule corresponding to the second access control rule according to the second instruction sent by the master gateway when deleting the second access control rule.

[0098] In an embodiment of the present application, when the master gateway deletes the access control rules, the master gateway management module and the access control configuration module delete the access control rules and business package restriction rules of the master gateway itself, and at the same time instruct the slave gateway corresponding to the slave gateway ID associated with the access control rules to delete the corresponding business package restriction rules. The slave gateway corresponding to the slave gateway ID deletes the business package restriction rules corresponding to the access control rules according to the instructions sent by the master gateway when deleting the access control rules.

[0099] Taking the deletion of domain name access control rules as an example, the management module of the master gateway responds to the domain name access control rule deletion instruction and sends the domain name access control rule to be deleted to the access control configuration module. The access control configuration module determines the deleted domain name access control rule and its associated business package restriction rule and the slave gateway ID, and deletes the corresponding domain name access control rule and business package restriction rule. At the same time, the corresponding deleted business package restriction rule is sent to the slave gateway management module. After receiving the corresponding instruction, the slave gateway management module forwards the business package restriction rule corresponding to the domain name access control rule to the access control configuration module of the slave gateway, and the access control function module of the slave gateway is also synchronized accordingly, realizing the access control rule deletion function.

[0100] Taking the modification of domain name access control rules as an example, the management module of the master gateway responds to the domain name access control rule modification instruction and sends the domain name access control rule that needs to be modified to the access control configuration module. The access control configuration module determines the modified domain name access control rule and its associated business package restriction rule and the slave gateway ID, deletes the original domain name access control rule and business package restriction rule, and adds the modified domain name access control rule. At the same time, the corresponding deleted business package restriction rule is sent to the slave gateway management module. After receiving the corresponding instruction, the slave gateway management module forwards the business package restriction rule corresponding to the domain name access control rule to the access control configuration module of the slave gateway, and the access control function module of the slave gateway is also synchronized accordingly, realizing the access control rule modification function.

[0101] In some possible embodiments, the slave gateway management module is also used to synchronize packet loss statistics to the master gateway management module, and the master gateway management module is also used to merge the packet loss statistics data with the packet loss statistics data of the access control function module of the master gateway for user query.

[0102] Specifically, the management module of the main gateway responds to the instruction to query the domain name access control rules and the corresponding rule access restriction statistics, and returns the corresponding query result to the user based on the data counted by the management module of the main gateway.

[0103] The embodiment of the present application proposes an access restriction system based on FTTR master-slave management, which analyzes the user's network access request by leveraging the service traffic analysis capability of the master gateway, and synchronously transmits the access restriction result obtained by the analysis to the slave gateway. The slave gateway directly restricts the user's access according to the service package restriction rules issued by the master gateway, thereby realizing a distributed access restriction function, which can effectively alleviate the load pressure of the master gateway.

[0104] Based on the same inventive concept, the embodiment of the present application also proposes an access restriction method based on FTTR master-slave management, which is applied to the slave gateway, such as Fig. 9 As shown, including:

[0105] Step 901, receiving a service packet sent by a user terminal;

[0106] Step 902, matching the service package with a first list for storing service package restriction rules, wherein the service package restriction rules are issued by the primary gateway when it is determined that any service package complies with the access control rules;

[0107] Step 903: when no matching service package restriction rule is found in the first list, forward the service package to the primary gateway;

[0108] Step 904: when a matching service package restriction rule is found in the first list, the service package is discarded, wherein any service package restriction rule is used to restrict a unique service package.

[0109] In some possible embodiments, before matching the service package with the first list for storing the service package restriction rules issued by the primary gateway, the process further includes:

[0110] Matching the service packet with a second list for storing hardware acceleration rules;

[0111] When a hardware acceleration rule that the service packet complies with is found in the second list, forwarding the service packet to the main gateway;

[0112] Matching the hardware acceleration rules includes matching the source port.

[0113] In some possible embodiments, the method further includes:

[0114] Matching the service packet with a second list for storing hardware acceleration rules;

[0115] When no matching hardware acceleration rule is found in the second list and no matching service package restriction rule is found in the first list, generating a hardware acceleration rule corresponding to the service package and adding it to the second list;

[0116] Matching the hardware acceleration rules includes matching the source port.

[0117] In some possible embodiments, the service package restriction rule is a five-tuple restriction rule, and finding a matching service package restriction rule in the first list includes:

[0118] If the service packet matches the source IP, destination IP, protocol, and destination port in any five-tuple restriction rule, it is determined that a matching five-tuple restriction rule is found.

[0119] In some possible embodiments, the method further includes:

[0120] Deleting a first service package restriction rule corresponding to the first access control rule according to a first instruction sent by the primary gateway when modifying the first access control rule;

[0121] According to the second instruction sent by the primary gateway when deleting the second access control rule, the second service package restriction rule corresponding to the second access control rule is deleted.

[0122] Based on the same inventive concept, the embodiment of the present application also proposes an access restriction method based on FTTR master-slave management, which is applied to the main gateway, such as Fig.10As shown, including:

[0123] Step 1001, receiving a service packet sent from a gateway, and matching the service packet with an access control rule in a third list;

[0124] Step 1002: If there is a matching access control rule in the third list, discard the service packet;

[0125] Step 1003, generating a business package restriction rule corresponding to the business package, associating the matching access control rule and business package restriction rule with the slave gateway ID and adding them to the third list;

[0126] Step 1004: Send the corresponding service package restriction rule to the corresponding slave gateway according to the ID of the slave gateway.

[0127] In some possible embodiments, the method further includes:

[0128] If there is no matching access control rule in the third list, the service packet is forwarded.

[0129] In some possible embodiments, the method further includes at least one of the following steps:

[0130] In response to the access control rule modification instruction, determine the modified first access control rule and its associated first business package restriction rule and the first slave gateway ID, modify the first access control rule and instruct the slave gateway corresponding to the first slave gateway ID to delete the corresponding first business package restriction rule;

[0131] In response to the access control rule deletion instruction, determine the deleted second access control rule and its associated second business package restriction rule and second slave gateway ID, delete the second access control rule and instruct the slave gateway corresponding to the second slave gateway ID to delete the corresponding second business package restriction rule.

[0132] The access restriction method, device and medium based on FTTR master-slave management proposed in the embodiment of the present application, the method receives the service package sent by the user terminal from the gateway; matches the service package with the first list for storing service package restriction rules, the service package restriction rules are issued by the main gateway when it determines that any service package meets the access control rules; when no matching service package restriction rules are found in the first list, the service package is forwarded to the main gateway; when a matching service package restriction rule is found in the first list, the service package is discarded, wherein any service package restriction rule is used to restrict a unique service package. Through the method proposed in the embodiment of the present application, the slave gateway can directly restrict the service package according to the service package restriction rules issued by the main gateway, which can effectively alleviate the load pressure of the main gateway and realize distributed restriction.

[0133] Based on the same inventive concept, an embodiment of the present application also proposes an access restriction device based on FTTR master-slave management, comprising at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a process applied to a slave gateway in the above-mentioned access restriction method based on FTTR master-slave management, or can execute a process applied to a master gateway in the above-mentioned access restriction method based on FTTR master-slave management.

[0134] Refer to the following Fig.11 An access restriction device 110 based on FTTR master-slave management according to this embodiment of the present application is described. Fig.11 The device 110 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0135] like Fig.11 As shown, an access restriction device 110 based on FTTR master-slave management is presented in the form of a general electronic device. The components of an access restriction device 110 based on FTTR master-slave management may include but are not limited to: at least one processor 111, at least one memory 112, and a bus 113 connecting different system components (including the memory 112 and the processor 111).

[0136] Bus 113 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0137] The memory 112 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1121 and / or a cache memory 1122 , and may further include a read-only memory (ROM) 1123 .

[0138] Memory 112 may also include a program / utility 1125 having a set (at least one) of program modules 1124, such program modules 1124 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include a network environment.

[0139] An access restriction device 110 based on FTTR master-slave management can also communicate with one or more external devices 114 (e.g., keyboards, pointing devices, etc.), and can also communicate with one or more devices that enable users to interact with an access restriction device 110 based on FTTR master-slave management, and / or communicate with any device (e.g., routers, modems, etc.) that enables the access restriction device 110 based on FTTR master-slave management to communicate with one or more other electronic devices. Such communication can be performed through an input / output (I / O) interface 115. In addition, an access restriction device 110 based on FTTR master-slave management can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) through a network adapter 116. As shown in the figure, the network adapter 116 communicates with other modules of an access restriction device 110 based on FTTR master-slave management through a bus 113. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with an access restriction device 110 based on FTTR master-slave management, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0140] In some possible implementations, the embodiments of the present application also propose a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the access restriction system and method based on FTTR master-slave management as described in any of the above-mentioned implementation examples.

[0141] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0142] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An access restriction method based on FTTR master-slave management, characterized in that: Applicable to slave gateways, including: Receive the service packet sent by the user end; Matching the service packet with a second list for storing hardware acceleration rules, wherein the hardware acceleration rule corresponding to the service packet is generated by learning the quintuple information of the service packet; When a hardware acceleration rule that the service packet complies with is found in the second list, the service packet is forwarded to the primary gateway, wherein matching the hardware acceleration rule includes matching the source port; When no hardware acceleration rule that the business package complies with is found in the second list, the business package is matched with the first list for storing business package restriction rules, the business package restriction rules are issued when the main gateway parses the business package to obtain the domain name accessed by the business package, and determines based on the domain name that any business package complies with the access control rule; When no matching service package restriction rule is found in the first list, forwarding the service package to the primary gateway; When a matching service package restriction rule is found in the first list, the service package is discarded, wherein any service package restriction rule is used to restrict a unique service package; The service package restriction rule is a five-tuple restriction rule, and when matching the service package restriction rule, only the source IP, destination IP, protocol, and destination port in the five-tuple restriction rule are matched.

2. The method according to claim 1, characterized in that: Also includes: When no matching hardware acceleration rule is found in the second list and no matching service package restriction rule is found in the first list, a hardware acceleration rule corresponding to the service package is generated and added to the second list.

3. The method according to claim 1, characterized in that Also includes: Deleting a first service package restriction rule corresponding to the first access control rule according to a first instruction sent by the primary gateway when modifying the first access control rule; According to the second instruction sent by the primary gateway when deleting the second access control rule, the second service package restriction rule corresponding to the second access control rule is deleted.

4. An access restriction method based on FTTR master-slave management, characterized in that: Applied to the main gateway, including: Receive a service packet sent from the gateway after the gateway successfully matches the service packet with the hardware acceleration rule / failed to successfully match the service packet with the service packet restriction rule; Parsing the service package to obtain a domain name accessed by the service package, and matching the service package with an access control rule in a third list based on the domain name; If there is a matching access control rule in the third list, discard the service packet; Generate a business package restriction rule corresponding to the business package, associate the matching access control rule and business package restriction rule with the slave gateway ID and add them to the third list, wherein the business package restriction rule is a five-tuple restriction rule, which only includes the source IP, destination IP, protocol, and destination port in the five-tuple restriction rule; According to the ID of the slave gateway, the corresponding service package restriction rule is sent to the corresponding slave gateway; If there is no matching access control rule in the third list, the service packet is forwarded.

5. The method according to claim 4, characterized in that It also includes at least one of the following steps: In response to the access control rule modification instruction, determine the modified first access control rule and its associated first business package restriction rule and the first slave gateway ID, modify the first access control rule and instruct the slave gateway corresponding to the first slave gateway ID to delete the corresponding first business package restriction rule; In response to the access control rule deletion instruction, determine the deleted second access control rule and its associated second business package restriction rule and second slave gateway ID, delete the second access control rule and instruct the slave gateway corresponding to the second slave gateway ID to delete the corresponding second business package restriction rule.

6. An access restriction device based on FTTR master-slave management, characterized in that: It includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute an access restriction method based on FTTR master-slave management as described in any one of claims 1 to 3 or claims 4 to 5.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute an access restriction method based on FTTR master-slave management as described in any one of claims 1 to 3 or claims 4 to 5.

Images