Distributed wireless communication method

Abstract

The invention belongs to the field of communication, and particularly relates to a distributed wireless communication method, which comprises the following steps: constructing an access layer, and carrying out equipment installation and cable connection on POE switches and wireless APs distributed on each floor, the access layer is constructed through the distributed POE switches and wireless APs, one POE switch corresponds to one area, and the other POE switch corresponds to one wireless AP. Independent wireless ports are arranged in all areas in a distributed mode to assist users in accessing in the areas, directional management and control of the accessed users are carried out through corresponding I P addresses in the level of the wireless ports, and a unified management platform is established in cooperation with an aggregation switch and an AC controller. On the premise of pre-classification of directional management and control, hierarchical unified management is performed on the users accessing the network, on one hand, hierarchical decentralized management of the accessed users is realized, the load capacity of the users accessing the network is improved, and on the other hand, strategy issuing and equipment checking can be performed through cooperation of the convergence layer and the access layer, so that the network access efficiency is improved. And when a network fault occurs, rapid locking and efficient operation and maintenance can be realized.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a distributed wireless communication method. Background Art

[0002] Existing intranet wireless communication refers to the communication between devices in an internal network (intranet) through wireless technology. Intranet usually refers to a local area network (LAN), which generally covers a radius of several thousand meters and is mainly used for communication and data exchange between internal computers.

[0003] Intranet wireless communication is widely used in offices, homes, campuses and other places, providing convenient wireless network access and facilitating the use of mobile devices. Its advantages are: high flexibility: wireless communication is not restricted by physical cables and the network can be flexibly arranged; strong scalability: new wireless devices can be easily added to adapt to changing needs; good user experience: providing seamless mobile network access to improve work efficiency and user experience.

[0004] The existing intranet wireless communication method is to communicate through multiple wireless devices or nodes. These devices or nodes are distributed in different geographical locations and use network protocols for data transmission and communication. However, they all use aggregation switches in conjunction with wireless APs to build wireless networks. When there are too many wireless access points on the user side, there is a problem of IP address confusion. When any user side is attacked, it will threaten the upstream aggregation switch, resulting in security incidents on the intranet side, which leads to inconvenient management and insufficient risk resistance. Summary of the invention

[0005] (I) Purpose of the invention

[0006] In order to solve the technical problems existing in the background technology, the present invention proposes a distributed wireless communication method, which has the characteristics of hierarchical and independent management of access users according to IP address segments through distributed wireless ports, and the aggregation switch can centrally manage each wireless port, thereby realizing hierarchical and decentralized management under the overall architecture of a multi-layer wireless network.

[0007] (II) Technical solution

[0008] To solve the above technical problems, the present invention provides a distributed wireless communication method, comprising the following steps:

[0009] Step 1: Build the access layer, install the POE switches and wireless APs on each floor, connect the cables, and create distributed wireless ports;

[0010] Step 2: Build the aggregation layer, aggregate the POE switches distributed on each floor to the aggregation switch, and centrally manage the devices connected to the aggregation switch through the AC controller;

[0011] Step 3: Build the core layer, connect the aggregation switch to the core switch, and equip the core switch with a firewall to isolate the internal and external networks;

[0012] Step 4: Form a multi-layer wireless network architecture through the core layer, aggregation layer and access layer, plan IP addresses for each switch, AC controller and wireless AP from top to bottom, and allocate IP address segments for each wireless port;

[0013] Step 5: Add the employee authority policy set corresponding to each wireless port IP address segment on the AC controller. The user accesses the wireless network through the wireless AP of any wireless port, identifies the IP address and traverses the corresponding employee authority policy set for employee authentication. The hierarchical and decentralized management of the overall wireless network architecture is performed according to the employee authority policy.

[0014] Step 6: Use east-west traffic interaction between the distributed POE switches to protect the security of wireless intranet traffic.

[0015] Preferably, the POE switch is interconnected with the aggregation switch upstream and connected with the wireless AP downstream, responsible for network signal transmission and powering the wireless AP;

[0016] The POE switch is connected to at least one wireless AP, which is deployed at various locations on the floor where the POE switch is installed for wireless access of employees.

[0017] Preferably, the POE switches distributed on each floor can be expanded with additional switches, which are converged with the POE switches to the convergence switch;

[0018] The new switch should be connected to at least one wireless AP.

[0019] Preferably, the AC controller is deployed in a side-by-side manner on the aggregation switch, and the two interact through network cables;

[0020] Among them, the aggregation switch allocates independent wired gateways to each distributed POE switch;

[0021] The AC controller allocates wireless user gateways to the wireless APs downstream of each distributed POE switch.

[0022] Preferably, the core switch is connected to the external network upstream and the internal network downstream, and the firewall is used for security filtering, access control, intrusion detection and log recording between the internal and external networks.

[0023] Preferably, the overall multi-layer wireless network architecture composed of the core layer, aggregation layer and access layer adopts a top-down approach to network debugging. The aggregation switches and AC controllers of the aggregation layer build a unified management platform interconnected with the core switches, and manage IP address segment design, business IP address segment design and other related equipment IP address design for switches and wireless APs in the entire network.

[0024] Preferably, the wireless AP of each distributed wireless port has an IP address segment with sufficient IP addresses, and the user is automatically allocated an IP in the IP segment after accessing the corresponding wireless port through the wireless AP.

[0025] Preferably, add an employee authority policy set corresponding to each wireless port IP address segment on the AC controller side.

[0026] Distributed wireless ports set the general administrator and subordinate administrators in the employee authority policy set. The general administrator controls the POE switch and wireless AP, and the authority of the subordinate administrator is set by the general administrator;

[0027] The aggregation switches and AC controllers are managed by the super administrator who is superior to the chief administrator.

[0028] Preferably, user authentication includes internal employee authentication and visitor authentication;

[0029] Employee authentication uses web account authentication and wired authentication;

[0030] Visitor authentication uses QR code authentication, SMS authentication, or mini-program authentication.

[0031] Preferably, east-west traffic interaction is adopted between the distributed POE switches, and the communication traffic between the two flows completely in the internal network of this level without involving the external network, so that behavior visualization, access records and interception of risky traffic can be achieved in the network of this level.

[0032] The above-mentioned technical scheme of the present invention has the following beneficial technical effects: the access layer is built by distributed POE switches and wireless APs, one POE switch corresponds to one area, and independent wireless ports are distributedly set in each area to assist users in accessing the area. Directed management and control of access users are performed through corresponding IP addresses at the wireless port level. A unified management platform is established in conjunction with the aggregation switch and the AC controller. Under the premise of pre-classification of directed management and control, hierarchical and unified management of users accessing the network is performed. On the one hand, hierarchical and decentralized management of access users is realized, and the load capacity of user access to the network is improved. On the other hand, policies can be issued and equipment can be checked through the cooperation of the aggregation layer and the access layer, and network failures can be quickly locked and efficiently operated and maintained. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1A schematic diagram of a distributed wireless communication method of the present invention;

[0034] Figure 2 It is a schematic diagram of the network topology of the overall wireless network architecture of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0036] like Figure 1-2 As shown, a distributed wireless communication method proposed by the present invention includes the following steps:

[0037] Step 1: Build the access layer, install the POE switches and wireless APs on each floor, connect the cables, and create distributed wireless ports. One wireless AP can connect multiple users to the wireless network.

[0038] Among them, the POE switch is interconnected with the aggregation switch upstream and connected to the wireless AP downstream, responsible for network signal transmission and powering the wireless AP;

[0039] The POE switch is connected to at least one wireless AP, which is deployed at various locations on the floor where the POE switch is installed for wireless access of employees.

[0040] It should be added that: the POE switches distributed on each floor can be expanded with new switches. When a single POE switch in the area cannot meet the number of wireless AP installation requirements or exceeds the power supply distance, wireless APs can be added or powered by expanding new switches. The expanded new switches and the original POE switches are the same-level devices, and they are unified with the POE switches to the aggregation switch;

[0041] It is understandable that the newly added switch is connected to at least one wireless AP.

[0042] Step 2: Build the aggregation layer, aggregate the POE switches distributed on each floor to the aggregation switch, and centrally manage the devices connected to the aggregation switch through the AC controller;

[0043] The AC controller is deployed in a side-by-side manner on the aggregation switch, and the two interact through network cables;

[0044] Among them, the aggregation switch allocates independent wired gateways to each distributed POE switch;

[0045] The AC controller allocates wireless user gateways to the wireless APs downstream of each distributed POE switch;

[0046] The cooperation between the two can open up the branch network of each wireless port from top to bottom and perform unified debugging of the lower-level wireless ports.

[0047] Step 3: Build the core layer, connect the aggregation switch to the core switch, and equip the core switch with a firewall to isolate the internal and external networks;

[0048] Step 4: Form a multi-layer wireless network architecture through the core layer, aggregation layer and access layer, plan IP addresses for each switch, AC controller and wireless AP from top to bottom, and allocate IP address segments for each wireless port;

[0049] Step 5: Add the employee authority policy set corresponding to each wireless port IP address segment on the AC controller. The user accesses the wireless network through the wireless AP of any wireless port, identifies the IP address and traverses the corresponding employee authority policy set for employee authentication. The hierarchical and decentralized management of the overall wireless network architecture is performed according to the employee authority policy.

[0050] Step 6: Use east-west traffic interaction between the distributed POE switches to protect the security of wireless intranet traffic.

[0051] In this embodiment, the access layer is built through distributed POE switches and wireless APs. One POE switch corresponds to one area. Independent wireless ports are distributed in each area to assist users in accessing the area. Directed management and control of access users are performed through corresponding IP addresses at the wireless port level. A unified management platform is established in conjunction with the aggregation switch and the AC controller. Under the premise of pre-classification of directed management and control, hierarchical and unified management of users accessing the network is performed. On the one hand, hierarchical and decentralized management of access users is realized, and the load capacity of user access to the network is improved. On the other hand, policies can be issued and equipment can be checked through the cooperation of the aggregation layer and the access layer. When a network failure occurs, it can be quickly locked and efficiently operated and maintained.

[0052] As an installation example of a POE switch and wireless AP:

[0053] Panel AP: Install on the wall of an office with people, at the same height as the existing network port; install on the ceiling of an office without people; install panel AP near the seat in a single-person office, and near the door in an office with two or more people;

[0054] Ordinary AP: Installed in the center of the ceiling of a large office, or near the corridor on the ceiling of a small office or conference room;

[0055] High-density APs: Installed in the center of the ceiling of a large conference room and near the corridor of a small conference room.

[0056] In one embodiment, the core switch is connected to the external network upstream and the internal network downstream, and the firewall is used for security filtering, access control, intrusion detection and logging between the internal and external networks;

[0057] Security filtering: Firewalls can detect data packets entering and leaving the network to prevent unauthorized access and potential threats;

[0058] Access control: By configuring security policies, the firewall can control which internal resources can be accessed externally and which external requests can be allowed to enter the internal network;

[0059] Intrusion detection: The firewall can detect potential intrusions and take appropriate protective measures, such as blocking suspicious connections;

[0060] Logging: Record all data packets passing through the firewall for security auditing and troubleshooting;

[0061] A firewall is installed on the core switch to isolate the internal and external networks to ensure the security and stability of the network.

[0062] In step 4, the core layer, aggregation layer and access layer form a multi-layer wireless network architecture and use a top-down approach to debug the network. The aggregation switches and AC controllers of the aggregation layer build a unified management platform interconnected with the core switches to design management IP address segments, business IP address segments and other related equipment IP addresses for switches and wireless APs throughout the network.

[0063] Among them, management IP address segment design: assign IP address segments to each device

[0064]

[0065] Business IP address segment design:

[0066]

[0067]

[0068] It can be understood that the wireless AP of each distributed wireless port has an IP address segment with sufficient IP addresses. After the user accesses the corresponding wireless port through the wireless AP, the IP is automatically allocated in the IP segment. The access user is directed by IP, which is equivalent to adding a label to the access user for easy management and control.

[0069] In one embodiment, an employee authority policy set corresponding to each wireless port IP address segment is added on the AC controller side. The user accesses the wireless network through the wireless AP of any wireless port, identifies the IP address and traverses the corresponding employee authority policy set for employee authentication. The hierarchical and decentralized management of the overall wireless network architecture is performed according to the employee authority policy.

[0070] Employee authentication uses web account authentication and wired authentication. After the user wirelessly accesses the wireless AP to obtain an IP address, the AC controller calls the employee permission policy set corresponding to the IP address and fills in the user information on the authentication page. The AC controller verifies the user information with the employee permission policy set. If the verification is correct, the authentication is passed and permissions are allocated.

[0071] It can be understood that the distributed wireless port sets the general administrator and subordinate administrators in the employee authority policy set. The general administrator controls the POE switch and wireless AP, and the authority of the subordinate administrator is set by the general administrator;

[0072] That is, each distributed wireless port has a general administrator and subordinate administrators at this level. The authority of each administrator can be set by the superior administrator. They can manage the network equipment of the unit, issue policies, view equipment, etc., to facilitate network maintenance and management.

[0073] It should be added that the aggregation switches and AC controllers are managed by the super administrator who is the superior of the general administrator. The super administrator can perform hierarchical and decentralized management of network management. The super administrator has the authority at the aggregation layer and can manage the entire network.

[0074] In another embodiment, visitor authentication uses QR code authentication, SMS authentication, or mini-program authentication.

[0075] QR code authentication and review enables visitor access based on user access rights allocation;

[0076] SMS authentication requires the AC manager to connect to the operator's SMS gateway platform to implement real-name Internet access authentication.

[0077] In one embodiment, east-west traffic interaction is adopted between the distributed POE switches. The east-west traffic security is different from the traditional ACL rules, which reduces the waste of hardware resources similar to ACL rules. The communication traffic between the two flows completely in the internal network of this level without involving the external network. Behavior visualization, access records and interception of risky traffic are realized in the network of this level. Through the management of east-west traffic, the resources of each POE switch can be better utilized.

[0078] For example, through reasonable traffic scheduling and load balancing, the utilization rate of POE switches can be improved, resource waste can be reduced, and overall performance can be improved.

[0079] It should be understood that the above specific embodiments of the present invention are only used to illustrate or explain the principles of the present invention, and do not constitute a limitation of the present invention. Therefore, any modifications, equivalent substitutions, improvements, etc. made without departing from the spirit and scope of the present invention should be included in the protection scope of the present invention. In addition, the appended claims of the present invention are intended to cover all changes and modifications that fall within the scope and boundaries of the appended claims, or the equivalent forms of such scope and boundaries.

Claims

1. A distributed wireless communication method, characterized in that: The following steps are involved: Step 1: Build the access layer, install the POE switches and wireless APs on each floor, connect the cables, and create distributed wireless ports; Step 2: Build the aggregation layer, aggregate the POE switches distributed on each floor to the aggregation switch, and centrally manage the devices connected to the aggregation switch through the AC controller; Step 3: Build the core layer, connect the aggregation switch to the core switch, and equip the core switch with a firewall to isolate the internal and external networks; Step 4: Form a multi-layer wireless network architecture through the core layer, aggregation layer and access layer, plan IP addresses for each switch, AC controller and wireless AP from top to bottom, and allocate IP address segments for each wireless port; Step 5: Add the employee authority policy set corresponding to each wireless port IP address segment on the AC controller. The user accesses the wireless network through the wireless AP of any wireless port, identifies the IP address and traverses the corresponding employee authority policy set for employee authentication. The hierarchical and decentralized management of the overall wireless network architecture is performed according to the employee authority policy. Step 6: Use east-west traffic interaction between the distributed POE switches to protect the security of wireless intranet traffic.

2. A distributed wireless communication method according to claim 1, characterized in that: The POE switch is interconnected with the aggregation switch upstream and connected to the wireless AP downstream, responsible for network signal transmission and powering the wireless AP; The POE switch is connected to at least one wireless AP, which is deployed at various locations on the floor where the POE switch is installed for wireless access of employees.

3. A distributed wireless communication method according to claim 1, characterized in that: The POE switches distributed on each floor can be expanded with new switches, which are then aggregated with the POE switches to the aggregation switch; The new switch should be connected to at least one wireless AP.

4. A distributed wireless communication method according to claim 1, characterized in that: The AC controller is deployed in a side-by-side manner on the aggregation switch, and the two interact through network cables; Among them, the aggregation switch allocates independent wired gateways to each distributed POE switch; The AC controller allocates wireless user gateways to the wireless APs downstream of each distributed POE switch.

5. A distributed wireless communication method according to claim 1, characterized in that: The core switch is connected to the external network upstream and the internal network downstream. The firewall is used for security filtering, access control, intrusion detection and logging between the internal and external networks.

6. A distributed wireless communication method according to claim 1, characterized in that: The overall multi-layer wireless network architecture consists of the core layer, aggregation layer and access layer, and adopts a top-down approach to network debugging. The aggregation switches and AC controllers at the aggregation layer build a unified management platform interconnected with the core switches to perform management IP address segment design, business IP address segment design and other related equipment IP address design for switches and wireless APs throughout the network.

7. A distributed wireless communication method according to claim 1, characterized in that: The wireless AP of each distributed wireless port has an IP address segment with sufficient IP addresses. After the user accesses the corresponding wireless port through the wireless AP, an IP is automatically allocated within the IP segment.

8. A distributed wireless communication method according to claim 1, characterized in that: Add the employee permission policy set corresponding to each wireless port IP address segment on the AC controller. Distributed wireless ports set the general administrator and subordinate administrators in the employee authority policy set. The general administrator controls the POE switch and wireless AP, and the authority of the subordinate administrator is set by the general administrator; The aggregation switches and AC controllers are managed by the super administrator who is superior to the chief administrator.

9. A distributed wireless communication method according to claim 1, characterized in that: User authentication includes internal employee authentication and visitor authentication; Employee authentication uses web account authentication and wired authentication; Visitor authentication uses QR code authentication, SMS authentication, or mini-program authentication.

10. A distributed wireless communication method according to claim 1, characterized in that: The distributed POE switches use east-west traffic interaction, and the communication traffic between the two flows completely within the internal network of this level without involving the external network. Behavior visualization, access records and interception of risky traffic are achieved in the network of this level.

Images