Private network access method, electronic equipment, storage medium and program product

Abstract

The invention provides a private network access method, electronic equipment, a storage medium and a program product, relates to the technical field of informatization, and is used for realizing data access to a private network under the conditions of not passing VPN (Virtual Private Network) authentication and adding an OLT (Optical Line Terminal). The method comprises the following steps: in response to a received first request message of a target user, identifying whether the target user is a private network signed user; the first request message is used for requesting to access a broadband core network; under the condition that the target user is a private network signed user, distributing target first UP equipment in the first UP group to the target user; the first UP devices in the first UP group are connected with the private network; sending a first response message to the target user through the target first UP device; the first response message is used for indicating the target user to establish connection with the target first UP equipment.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a private network access method, electronic equipment, storage medium and program product. Background Art

[0002] With the development of 5G and Gigabit networks, the gap between private line services and ordinary users in terms of bandwidth and latency is narrowing. This has led to more and more users wanting to quickly access private networks through ordinary home broadband or 5G networks.

[0003] There are two main ways to access a private network through home broadband: one is for users to access the private network through a virtual private network (VPN) and establish a secure VPN channel to access the private network; the other is to build a dedicated optical line terminal (OLT) within the coverage area of ​​the private network service, and users access the private network through ordinary broadband to enjoy low latency and good service experience.

[0004] The above two methods can meet the needs of contracted users to access private networks through home broadband, but there are problems such as poor access quality and stability, long investment and construction period, and poor flexibility. Summary of the invention

[0005] The present application provides a private network access method, electronic device, storage medium and program product, which can improve the quality, stability and flexibility of private network access while reducing investment costs and construction period.

[0006] In a first aspect, the present application provides a private network access method, which is applied to a control plane (CP) device in a broadband core network, including: in response to receiving a first request message from a target user, identifying whether the target user is a private network subscriber; the first request message is used to request access to the broadband core network; when the target user is a private network subscriber, allocating a target first UP device in a first user plane (UP) group to the target user; all first UP devices in the first UP group establish a connection with the private network; sending a first response message to the target user through the target first UP device; the first response message is used to instruct the target user to establish a connection with the target first UP device.

[0007] It can be understood that the private network access method provided in the embodiment of the present application is applied to the existing broadband core network, and does not require the addition of an OLT, which reduces the investment cost and construction period, and also increases the scope of use of the contracted users, reduces the limitations of the contracted users in accessing the private network, and improves the flexibility of private network access. At the same time, in this application, the UP devices in the bandwidth core network are grouped, and the first UP device is connected to the private network to carry the traffic of the contracted users of the private network. In this way, the contracted users do not need to undergo VPN authentication to access the private network, which improves the access quality and stability of the contracted users and provides the contracted users with a better quality private network access service.

[0008] In a possible implementation method, the first request message carries the private network subscription status information of the target user; identifying whether the target user is a private network subscription user includes: identifying whether the target user is a private network subscription user based on the private network subscription status information of the target user.

[0009] In another possible implementation, the first request message is a Point-to-Point Protocol over Ethernet (PPP over Ethernet, PPPoE) request message, and the TAG field in the PPPoE request message is used to carry the contract status information of the target user.

[0010] In another possible implementation, the first response message is a PPPoE response message; and the connection established between the target user and the target first UP device is a PPPoE connection.

[0011] In another possible implementation manner, the first UP devices in the first UP group are in a standby relationship with each other; and the first UP devices in the first UP group are configured with standby ports.

[0012] Another possible implementation method is that when the target user is not a private network subscriber, the target second UP device in the second UP group is assigned to the target user, and the second UP devices in the second UP group all establish a connection with the core router of the Internet; a second response message is sent to the target user through the target second UP device; the second response message is used to instruct the target user to establish a connection with the target second UP device.

[0013] In another possible implementation manner, the second UP devices in the second UP group are in a standby relationship with each other; and the second UP devices in the second UP group are configured with standby ports.

[0014] Another possible implementation is to deploy a service identification component on the target first UP device to identify the access target of the uplink service traffic of the target user to perform service diversion; wherein the access target includes a private network or the Internet.

[0015] In the second aspect, the present application provides a private network access device, which is applied to a CP device in a broadband core network; the private network access device includes an identification module, a processing module and a communication module; the identification module is used to identify whether the target user is a private network subscriber in response to receiving a first request message from the target user; the first request message is used to request access to the broadband core network; the processing module is used to allocate a target first UP device in a first UP group to the target user when the target user is a private network subscriber; the first UP devices in the first UP group all establish a connection with the private network; the communication module is used to send a first response message to the target user through the target first UP device; the first response message is used to instruct the target user to establish a connection with the target first UP device.

[0016] In a possible implementation manner, the identification module is specifically used to identify whether the target user is a private network subscription user based on the private network subscription status information of the target user.

[0017] In another possible implementation, the first request message is a PPPoE request message, and a TAG field in the PPPoE request message is used to carry the subscription status information of the target user.

[0018] In another possible implementation, the first response message is a PPPoE response message; and the connection established between the target user and the target first UP device is a PPPoE connection.

[0019] In another possible implementation manner, the first UP devices in the first UP group are in a standby relationship with each other; and the first UP devices in the first UP group are configured with standby ports.

[0020] Another possible implementation method is that the processing module is also used to assign the target second UP device in the second UP group to the target user when the target user is a non-dedicated network contracted user, and the second UP devices in the second UP group all establish a connection with the core router of the Internet; the communication module is also used to send a second response message to the target user through the target second UP device; the second response message is used to instruct the target user to establish a connection with the target second UP device.

[0021] In another possible implementation manner, the second UP devices in the second UP group are in a standby relationship with each other; and the second UP devices in the second UP group are configured with standby ports.

[0022] In another possible implementation, the processing module is used to deploy a service identification component on the target first UP device to identify the access target of the uplink service traffic of the target user to perform service diversion; wherein the access target includes a private network or the Internet.

[0023] In a third aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method of the first aspect above.

[0024] In a fourth aspect, the present application provides a computer-readable storage medium, which includes: computer software instructions; when the computer software instructions are executed in an electronic device, the electronic device implements the method of the first aspect above.

[0025] In a fifth aspect, the present application provides a computer program product, which includes a computer program; when the computer program runs in an electronic device, the electronic device implements the method of the first aspect.

[0026] The beneficial effects of the second to fifth aspects mentioned above refer to the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A network architecture diagram involved in a private network access method provided in this application;

[0028] Figure 2 A flowchart of a private network access method provided for this application;

[0029] Figure 3 A PADI message structure diagram in a private network access method provided by this application;

[0030] Figure 4 A TLV structure diagram of a private network access method provided for this application;

[0031] Figure 5 A service flow diagram for a subscriber to access a private network or the Internet provided for this application;

[0032] Figure 6 A service flow diagram for non-contracted users accessing the Internet provided for this application;

[0033] Figure 7 A schematic diagram of the composition of a private network access device provided in this application;

[0034] Figure 8 A schematic diagram of the composition of an electronic device provided in this application. DETAILED DESCRIPTION

[0035] The following will describe in detail a private network access method provided by the present application in conjunction with the accompanying drawings.

[0036] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0037] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0038] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0039] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0040] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second", etc. are used to distinguish the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. are not limiting the quantity and execution order.

[0041] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0042] Accessing a private network through home broadband can be applied to multiple scenarios, including remote office, online education, medical services, cloud service access, smart furniture management, security monitoring and scientific research and development. Accessing a private network through home broadband allows users to securely share files, video conference, remote medical consultation and device control.

[0043] At present, mobile network technology and business processes are relatively mature. The basic principle of realizing private network converged access is to divert access traffic by using the user access dedicated user plane (User Plane Function, UPF) as the user plane control logic (User Plane Control Logic, ULCL) diversion anchor point: when the user accesses the private network, the traffic is diverted to the N6 interface through the UPF. When accessing the Internet, it is sent to the UPF of the municipal network through the N9 interface, and then connected to the Internet through the N6 interface of the to C network UPF.

[0044] The traditional dedicated broadband network gateway (BNG) relies on the integrated control and transfer mode, which means that user behavior management, authentication, and policy control are all completed by the campus (BNG side). At present, there are two main methods for accessing a private network through home broadband: one is to install client software on the user terminal and establish a VPN channel through VPN dial-up to achieve the requirement of accessing the intranet; the other is to build an OLT within the coverage of the private network service, access the private network BNG device through a dedicated OLT device, and achieve access to the intranet. However, when establishing a VPN channel to access the private network, there are problems with poor access quality and stability; the investment cost for establishing OLT equipment for a private network is large, and the construction period is long. At the same time, the scope of access to the private network is limited, and the flexibility is low.

[0045] In view of the above technical problems, the present application provides a private network access method, which is applied to the CP device in the broadband core network; the idea is: in response to receiving the first request message of the target user, identify whether the target user is a private network contract user; when the target user is a private network contract user, assign the target first UP device in the first UP group to the target user; the first UP devices in the first UP group are all connected to the private network; send a first response message to the target user through the target first UP device. It can be understood that the private network access method provided in the embodiment of the present application is applied to the existing broadband core network, and there is no need to add an OLT, which reduces the investment cost and construction period. At the same time, it also increases the scope of use of the contracted users, reduces the limitations of the contracted users to access the private network, and improves the flexibility of private network access. At the same time, in the present application, the UP devices in the bandwidth core network are grouped, and the first UP device is connected to the private network to carry the traffic of the contracted users of the private network. In this way, the contracted users do not need to access the private network through VPN authentication, which improves the access quality and stability of the contracted users and provides the contracted users with better quality private network access services.

[0046] The embodiments provided in this application are described in detail below in conjunction with the accompanying drawings.

[0047] See also Figure 1, is a network architecture diagram of a private network access method provided in an embodiment of the present application. For example, Figure 1 As shown, the network architecture includes: broadband core network, private network, Internet and user equipment.

[0048] In some embodiments, the broadband core network includes: a CP device, multiple UP devices, and a network access device, wherein the CP device is connected to the multiple UP devices, and the network access device is respectively connected to the multiple UP devices.

[0049] Exemplarily, the CP device is mainly responsible for the control plane functions, and is responsible for the authentication, authorization, address allocation and other management functions of the target user. For example, the CP device determines whether the target user is a private network subscriber based on the subscription status information of the target user.

[0050] Exemplarily, the CP device may include a router, a control module of a switch, a network management system, and the like.

[0051] In some embodiments, the UP device focuses on the functions of the user plane, and is mainly responsible for processing the forwarding of user data traffic, including tasks such as receiving, forwarding, and maintaining status of traffic. Exemplarily, the UP device may include a switch and a load balancer.

[0052] In some embodiments, the network access device is an access device for user equipment to enter a broadband core network.

[0053] Among them, user equipment can be a terminal connected to a network access device, including computers, mobile phones, tablets, smart TVs and other devices that can access the Internet and use related services.

[0054] Exemplarily, the network access device may be a broadband access server, a fiber optic access device, a digital subscriber line modem, etc. Among them, the fiber optic access device may be an optical network unit (Optical Network Unit, ONU) or an OLT.

[0055] In some embodiments, Figure 1 As shown, the network access device and the UP device can be connected via a bearer network, wherein the bearer network is used to establish a connection between the network access device and the UP device, and plays the role of a fiber channel; illustratively, the bearer network can be an intelligent metropolitan area network.

[0056] For example, Figure 1 As shown, the bearer network includes a minimum cell rate (MCR) and a maximum entry rate (MER); wherein the network access device is connected to the MER, the UP device is connected to the MCR, and the MER and the MCR are connected correspondingly.

[0057] Among them, MCR is mainly responsible for core data forwarding within the metropolitan area network, processing data traffic from different subnets, and performing efficient routing selection.

[0058] MER is responsible for bringing traffic from the Internet or other external networks into the metropolitan area network and providing access services to users. MER connects user terminals with the core network and serves as a data entry point.

[0059] In some embodiments, a private network refers to an independent network built for a specific organization, enterprise or institution, which is usually isolated from the Internet and aims to provide network services with higher degree of specialization, security, control and stability.

[0060] In some embodiments, the Internet includes: a core router (CR), a content delivery network (CDN) server, and a backbone network.

[0061] Among them, CR is a key device in wide area networks and large networks, responsible for efficient data forwarding and routing, and realizing key functions such as data forwarding, network interconnection, load balancing and traffic management.

[0062] Exemplarily, when a user needs to access the Internet, the UP device transmits the user traffic to the CR device, and then the CR device routes the user traffic to the corresponding destination.

[0063] Among them, the backbone network refers to the high-speed network trunk lines connecting multiple cities or regions within a country or region.

[0064] In some embodiments, the CP devices in the broadband core network may be in the form of a CP1+1 disaster recovery group. In this way, when a CP device fails, it can be switched to another backup CP device to ensure service continuity.

[0065] The CP1+1 disaster recovery group actually has two control CP devices, CP1 and CP2, with the same control function. In terms of design, no matter which CP device fails, the other CP device can take over seamlessly, ensuring that the network will not be interrupted due to problems at the control layer.

[0066] In some embodiments, the CP device divides multiple UP devices in the same UP pool into a first UP group and a second UP group. The first UP group includes multiple first UP devices, and the multiple first UP devices are connected to the private network to carry the service traffic of the private network subscribers; the second UP group includes multiple second UP devices, and the multiple second UP devices are connected to the Internet to carry the service traffic of non-private network subscribers (such as users accessing the Internet).

[0067] In some embodiments, the first UP devices in the first UP group are in a standby relationship with each other; and the first UP devices in the first UP group are configured with standby ports.

[0068] Exemplarily, a UP warm standby group is configured, that is, a common first UP device and a standby first UP device are configured in the first UP group.

[0069] Exemplarily, for each first UP device in the first UP group, a port of each first UP device is configured with a common port and a standby port.

[0070] In some embodiments, the first UP device in the first UP group may be deployed in a different location. For example, the first UP device in the first UP group may be placed in different machine rooms.

[0071] For example, when the first UP device fails and cannot be used, the backup first UP device can be used to take over the private network access service of the first UP device; or, when the common port of the first UP device fails, the backup port of the first UP device can be used to take over the private network access service on the first UP device.

[0072] As another possible implementation manner, the second UP devices in the second UP group are in a standby relationship with each other; and the second UP devices in the second UP group are configured with standby ports.

[0073] Exemplarily, a UP warm standby group is configured, that is, a common second UP device and a standby second UP device are configured in the second UP group.

[0074] Exemplarily, for each second UP device in the second UP group, a port of each second UP device is configured with a common port and a standby port.

[0075] In some embodiments, the second UP device in the second UP group may be deployed in a different location. For example, the second UP device in the second UP group may be placed in different computer rooms.

[0076] Exemplarily, when the second UP device fails and cannot be used, the backup second UP device can be used to take over the private network access service of the second UP device; or, if the common port of the second UP device fails, the backup port of the second UP device can be used to take over the private network access service on the second UP device.

[0077] It can be understood that by setting up a UP warm standby group, when the UP device fails or the main UP device fails, the backup UP device can quickly take over the functions of the main UP device without restarting or reconfiguring, thereby improving the reliability of the private network access method, reducing downtime, and promoting business continuity, while reducing maintenance costs and enhancing user experience and flexibility.

[0078] It should be noted that the application scenarios of the embodiments of the present disclosure are not limited. The system architecture and business scenarios described in the embodiments of the present disclosure are intended to more clearly illustrate the technical solutions of the embodiments of the present disclosure, and do not constitute limitations on the technical solutions provided by the embodiments of the present disclosure. It is known to those skilled in the art that with the evolution of technology and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0079] See also Figure 2 , is a flow chart of a private network access method provided in an embodiment of the present application. Figure 2 As shown, a private network access method provided by the present application is applied to a CP device in a broadband core network, and specifically includes the following steps S201 to S203.

[0080] S201. In response to receiving a first request message from a target user, identifying whether the target user is a private network subscriber.

[0081] The first request message is used to request access to a broadband core network.

[0082] In some embodiments, the first request message carries the private network subscription status information of the target user, and the above step S201 can also be implemented as: based on the private network subscription status information of the target user, identifying whether the target user is a private network subscription user.

[0083] Exemplarily, a virtual interface "Oc interface" is defined on the network access device and the CP device corresponding to the user equipment respectively, for transmitting the private network subscription status information of the target user.

[0084] As a possible implementation manner, the first request message is a PPPoE request message, and the TAG field in the PPPoE request message is used to carry the subscription status information of the target user.

[0085] Exemplarily, the PPPoE request message can be a PPPoE Active Discovery Initiation (PADI) message for discovering a PPPoE server. It is understandable that discovering an available PPPoE server is the first step in the PPPoE connection establishment process, and is used to discover a PPPoE server to establish a session.

[0086] For example, the structure of the PADI message is as follows: Figure 3 As shown, the host media access control (Media Access Control, MAC) address (Host_mac_addr) represents the Ethernet MAC address of the network access device accessed by the target user, which is used to identify the network access device that initiates the PPPoE session; Ethernet-type (Ethernet_Type, ETHER_TYPE) represents the PPPoE dial-up stage; version (Ver, V) represents the PPPoE version number; type (type, T) represents the PPPoE type; the code field (Code) represents the PPPoE message type, 0x09 represents the PADI message; the session field identifier (SESSION_ID) is an unsigned value in the network byte order and needs to be set to 0x0000; the length (LEN GTH) represents the payload length of the PPPoE message; the service tag-name (TAG_TYPE) indicates the service name requested by the host; the service tag-length (TAG_LENGTH) represents the length of the service tag-parameter value (TAG_VALUE).

[0087] For example, it is assumed that the values ​​of the TAG field in the current PADI message are all in the unallocated state, such as 1-256, 266-271, 275-287, 290-512, and 516-65535. Figure 3 As shown, in the embodiment of the present application, TAG_TYPE=0x0010 is selected to carry the private network subscription information of the target user, and whether the target user is a private network subscription user is determined based on the value of TAG_VALUE. For example, when the value of TAG_VALUE is 0, it indicates a non-subscribed user, and when the value of TAG_VALUE is 1, it indicates a subscribed user. The defined variables are not unique and will not be elaborated here.

[0088] For example, Figure 4 This is a schematic diagram of the data encoding (Type-Length-Value, TLV) format used by TAG in the embodiment of the present application, wherein TAG_TYPE is used to indicate the meaning of the parameter value of the TYG_VALUE field, for example, in the embodiment of the present application, it is used to indicate the contract status of the target user; TYG_LENGTH is used for the length of TYG_VALUE, and the unit is usually bytes; the value of TYG_VALUE is used to indicate the contract status of the target user, and the length is determined by TYG_LENGTH.

[0089] For example, the contract information of the target user is transmitted to all UP devices in the UP pool in the form of broadcast through a PADI (source MAC is the MAC of the ONU, and the destination MAC is the MAC of all UP devices in the UP pool) message. After all UP devices in the UP pool receive the PADI message, they encapsulate the VXLAN message (the original PADI message as a whole is used as the PAYLOAD of the VXLAN message) and send it to the CP device. The CP device parses the VXLAN message and obtains the contract status of the target user through the TAG field.

[0090] It can be understood that by using CP devices to identify whether the target user is a contracted user, the authentication process of the contracted user before accessing the private network is avoided, making the private network access method more convenient. At the same time, identifying private network users through CP devices improves the security and management efficiency of private network access, improves the user experience, and avoids the risk of data leakage and abuse when contracted users access the private network.

[0091] S202: When the target user is a subscriber of a private network, the target first UP device in the first UP group is allocated to the target user; and the first UP devices in the first UP group are all connected to the private network.

[0092] As a possible implementation manner, the target first UP device may be any UP device in the first UP group.

[0093] As another possible implementation method, the CP device determines the target first UP device based on the load balancing situation of the first UP devices in the first UP group; or, the CP device determines the target first UP device based on the resource utilization of each first UP device in the first UP group; in this way, problems such as network delay caused by excessive UP device resource utilization can be avoided.

[0094] It can be understood that the contracted user is assigned to the first target UP device, and the first target UP is connected to the private network. The contracted user can directly access the private network through the first UP device, which simplifies the process of the contracted user accessing the private network and improves the contracted user's sense of experience.

[0095] S203: Send a first response message to the target user through the target first UP device.

[0096] The first response message is used to instruct the target user to establish a connection with the target first UP device.

[0097] The first response message is a PPPoE response message.

[0098] Exemplarily, the PPPoE response message may be a PPPoE Active Discovery Offer (PADO) message or the like.

[0099] In some embodiments, the connection established between the target user and the target first UP device is a PPPoE connection.

[0100] Exemplarily, after determining the target first UP device assigned to the target user, the CP device returns a PADO message to the network access device corresponding to the target device through the target first UP device. Accordingly, after receiving the PADO message, the network access device corresponding to the target user establishes a PPPoE connection with the target first UP device.

[0101] It can be understood that the embodiment of the present application can send a first response message to the target user through the target first UP device, instructing the contracted user to establish a PPPoE connection with the target first UP device. The PPPoE connection has higher security and versatility, and improves the security of data when the contracted user accesses a private network.

[0102] In some embodiments, a service identification component is deployed on the target first UP device to identify the access target of the target user's uplink service traffic to perform service diversion; wherein the access target includes a private network or the Internet.

[0103] Illustratively, a service awareness component (SA) card can identify the access target of the uplink service traffic through the application identification function of the SA card.

[0104] Exemplarily, the target first UP device may identify the access target of the uplink service traffic based on at least one of the destination IP address, port number, and DNS policy of the uplink service traffic.

[0105] In some embodiments, see Figure 5 , the target user generates uplink service traffic, and sends the uplink service traffic of the target user to the target first UP device through the network access device corresponding to the user device. The service identification component on the target first UP device identifies the access target of the uplink service traffic of the target user; when the access target of the uplink service traffic of the target user is a private network, the uplink service traffic of the user is transmitted through the connection link between the target first UP device and the private network; when the access target of the uplink service traffic of the target user is the Internet, the target first UP device sends the uplink service traffic of the target user to the CR, and the CR sends the uplink service traffic received from the target user to the backbone network. Among them, the network access device corresponding to the target user and the target first UP device can be connected through the bearer network.

[0106] In some embodiments, when the uplink service traffic of the target user passes through the target first UP device, different access targets of the uplink service traffic flow out through different physical ports.

[0107] Exemplarily, when the target user's uplink service traffic is accessed to a private network, the first physical port is used; when the target user's uplink service traffic is accessed to the Internet, the second physical port is used. For example, since accessing a private network requires a higher data transmission rate, the first physical port needs to have the characteristics of low latency and high bandwidth. It is understandable that the first physical port and the second physical port can be configured according to actual conditions, which will not be described in detail here.

[0108] It can be understood that by diverting the target user's uplink business traffic through the business identification component, the target user's access to the private network and the Internet requests can be effectively allocated to different paths, reducing network congestion, improving the speed and efficiency of private network access, and avoiding the impact between the private network and the Internet, causing data confusion and resulting in private network data loss.

[0109] In some embodiments, after the above step S201, a private network access method provided by an embodiment of the present application may further include the following steps S204-S205:

[0110] S204: When the target user is a non-private network subscriber, the target second UP device in the second UP group is allocated to the target user, and the second UP devices in the second UP group are all connected to the core router of the Internet.

[0111] As a possible implementation manner, the target second UP device may be any UP device in the second UP group.

[0112] As another possible implementation method, the CP device determines the target second UP device based on the load balancing situation of the second UP devices in the second UP group; or, the CP device determines the target second UP device based on the resource utilization of each second UP device in the second UP group; or, the CP device determines the target second UP device in the second UP group by means of a hash algorithm.

[0113] For example, when the CP device determines that the target user is a non-dedicated network contracted user, the access service of the non-dedicated network contracted user is taken over by the target second UP device. Since the UP devices in the second UP group are connected to the CR in the Internet, the non-contracted user can access the Internet through the target second UP device. In this way, by separating the private network UP and the Internet UP, interference can be reduced, network congestion can be avoided, and stability and service experience can be improved.

[0114] It is understandable that non-contracted users directly use the second UP device to access the Internet. On the one hand, this avoids interference and network congestion. On the other hand, since the business traffic of non-dedicated network contracted users is small and the configuration requirements are low, it can reduce investment costs and construction cycles.

[0115] S205: Send a second response message to the target user through the target second UP device.

[0116] The second response message is used to instruct the target user to establish a connection with the target second UP device.

[0117] Exemplarily, after determining that the target user is a non-subscribed user and a target second UP device, determine the target virtual MAC on the target second UP device, wherein the target second UP device establishes a connection with the target user through the target virtual MAC.

[0118] As a possible implementation manner, the target virtual MAC may be any virtual MAC corresponding to the target second UP device.

[0119] As another possible implementation manner, the CP device determines the target virtual MAC based on the load balancing situation of the target second UP device; or, the CP device determines the target virtual MAC of the target second UP device by means of a hash algorithm.

[0120] For example, see Figure 6 , the target user generates uplink service traffic, sends the uplink service traffic of the target user to the target second UP device through the network access device corresponding to the user device, the target second UP device receives the uplink service traffic of the target user, and the target second UP device sends the uplink service traffic of the target user to the backbone network through the CR. Among them, the network access device corresponding to the target user and the target second UP device can be connected through the bearer network.

[0121] It can be understood that establishing a connection between a non-contracted user and the target second device speeds up the time for the non-contracted user to access the Internet. At the same time, the second UP group and the first UP group do not interfere with each other, which improves the fault tolerance rate of accessing the Internet and avoids confusion caused by mixing data between contracted users and non-contracted users, thereby improving stability and business experience.

[0122] It can be seen that the above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the embodiment of the present application provides a hardware structure and / or software module corresponding to each function. It should be easily appreciated by those skilled in the art that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0123] The embodiment of the present application can divide the function modules of the private network access device according to the above method example. For example, each function module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software function modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0124] In some embodiments, the present application also provides a private network access device, which may include one or more functional modules for implementing the private network access method of the above method embodiment.

[0125] For example, Figure 7 A schematic diagram of the composition of a private network access device provided in an embodiment of the present application. Figure 7 As shown, the private network access device is applied to a CP device in a broadband core network; the private network access device includes an identification module 801, a processing module 802 and a communication module 803.

[0126] In some embodiments, the identification module 801 is used to identify whether the target user is a private network subscriber in response to receiving a first request message from the target user; the first request message is used to request access to the broadband core network; the processing module 802 is used to assign the target first UP device in the first UP group to the target user when the target user is a private network subscriber; the first UP devices in the first UP group all establish a connection with the private network; the communication module 803 is used to send a first response message to the target user through the target first UP device; the first response message is used to instruct the target user to establish a connection with the target first UP device.

[0127] In some other embodiments, the identification module 801 is specifically used to identify whether the target user is a private network subscription user based on the private network subscription status information of the target user.

[0128] In some further embodiments, the first request message is a PPPoE request message, and the TAG field in the PPPoE request message is used to carry the subscription status information of the target user.

[0129] In some other embodiments, the first response message is a PPPoE response message; and the connection method established between the target user and the target first UP device is a PPPoE connection.

[0130] In some further embodiments, the first UP devices in the first UP group are in a standby relationship with each other; and the first UP devices in the first UP group are configured with standby ports.

[0131] In some other embodiments, the processing module 802 is further used to assign the target second UP device in the second UP group to the target user when the target user is a non-private network subscriber, and the second UP devices in the second UP group are all connected to the core router of the Internet. The communication module 803 is also used to send a second response message to the target user through the target second UP device; the second response message is used to instruct the target user to establish a connection with the target second UP device.

[0132] In some further embodiments, the second UP devices in the second UP group are in a standby relationship with each other; and the second UP devices in the second UP group are configured with standby ports.

[0133] In some other embodiments, the processing module 802 is used to deploy a service identification component on the target first UP device to identify the access target of the target user's uplink service traffic to perform service diversion; wherein the access target includes a private network or the Internet.

[0134] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiment of the present invention provides a possible structural diagram of the electronic device involved in the above-mentioned embodiment. Figure 8 As shown, the electronic device 900 includes: a processor 902 , a communication interface 903 , and a bus 904 . Optionally, the electronic device 900 may further include a memory 901 .

[0135] The processor 902 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the present application. The processor 902 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0136] The communication interface 903 is used to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0137] The memory 901 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0138] As a possible implementation, the memory 901 may exist independently of the processor 902, and the memory 901 may be connected to the processor 902 via a bus 904 to store instructions or program codes. When the processor 902 calls and executes the instructions or program codes stored in the memory 901, a private network access method provided in an embodiment of the present invention can be implemented.

[0139] In another possible implementation, the memory 901 may also be integrated with the processor 902 .

[0140] The bus 904 may be an extended industry standard architecture (EISA) bus, etc. The bus 904 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0141] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0142] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be completed by computer instructions to instruct the relevant hardware, and the program can be stored in the above computer-readable storage medium. When the program is executed, it may include the processes of the above method embodiments. The computer-readable storage medium can be the memory or memory of any of the above embodiments. The above computer-readable storage medium can also be an external storage device of the above service calling device, such as a plug-in hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. equipped on the above service calling device. Further, the above computer-readable storage medium can also include both the internal storage unit of the above service calling device and an external storage device. The above computer-readable storage medium is used to store the above computer program and other programs and data required by the above service calling device. The above computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

[0143] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program product is run on a computer, the computer is enabled to execute any one of the private network access methods provided in the above embodiments.

[0144] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for accessing a private network, characterized in that: Applied to a CP device in a broadband core network, the method comprises: In response to receiving a first request message from a target user, identifying whether the target user is a private network subscriber; the first request message is used to request access to a broadband core network; In the case where the target user is a private network subscriber, the target first UP device in the first UP group is allocated to the target user; the first UP devices in the first UP group are all connected to the private network; A first response message is sent to the target user through the target first UP device; the first response message is used to instruct the target user to establish a connection with the target first UP device.

2. The method according to claim 1, characterized in that The first request message carries the private network subscription status information of the target user; The identifying whether the target user is a private network subscriber includes: Based on the private network subscription status information of the target user, it is identified whether the target user is a private network subscription user.

3. The method according to claim 2, characterized in that The first request message is a PPPoE request message, and the TAG field in the PPPoE request message is used to carry the subscription status information of the target user.

4. The method according to claim 3, characterized in that The first response message is a PPPoE response message; and the connection mode established between the target user and the target first UP device is a PPPoE connection.

5. The method according to claim 1, characterized in that The first UP devices in the first UP group are in a standby relationship with each other; and the first UP devices in the first UP group are configured with standby ports.

6. The method according to claim 1, characterized in that The method further comprises: In the case where the target user is a non-private network subscriber, the target second UP device in the second UP group is allocated to the target user, and the second UP devices in the second UP group are all connected to the core router of the Internet; A second response message is sent to the target user through the target second UP device; the second response message is used to instruct the target user to establish a connection with the target second UP device.

7. The method according to claim 6, characterized in that The second UP devices in the second UP group are in a standby relationship with each other; and the second UP devices in the second UP group are configured with standby ports.

8. The method according to claim 1, characterized in that A service identification component is deployed on the target first UP device to identify the access target of the uplink service traffic of the target user to perform service diversion; wherein the access target includes a private network or the Internet.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the processor is coupled to the memory; the memory is used to store computer instructions, and the computer instructions are loaded and executed by the processor to enable a computer device to implement a private network access method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes computer-executable instructions. When the computer-executable instructions are executed on a computer, the computer is enabled to execute the private network access method according to any one of claims 1 to 8.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed on an electronic device, the electronic device executes the private network access method as claimed in any one of claims 1 to 8.

Images