Service access control method and system

Abstract

The invention relates to a service access control method and system. The method comprises the following steps: receiving terminal access information reported by edge access equipment, wherein the terminal access information comprises terminal identification information, application identification information and application demand information; verifying a binding relationship among the terminal identification information, the application identification information and the application demand information according to pre-stored registration information; when the binding relationship among the terminal identification information, the application identification information and the application demand information passes verification, issuing a service drainage strategy to the edge access device; the service drainage strategy is used for indicating the edge access equipment to access a service application message corresponding to the terminal access information to a data center network, so that a terminal corresponding to the terminal access information accesses the data center network. By adopting the method, the security problem existing in an APN6 access scene can be solved so as to ensure that normal services are provided for legal users.

Description

Technical Field

[0001] The present application relates to the technical field of business processing, and in particular to a business access control method and system. Background Art

[0002] With the deepening of digital transformation, businesses are accelerating to the cloud, everything is connected intelligently, and new distributed applications are emerging one after another. After the business is on the multi-cloud, the traffic access model is complex, resulting in fast changes and large number of enterprise IT (Information Technology) configuration strategies. The enterprise's operation and maintenance personnel need to maintain the cloud, network and complex security strategies. The operation and maintenance difficulty is getting higher and higher, and it is unable to adapt to the development trend of new networks. At present, cloud services have become the basic services of Internet services, but in the business processing process, the data transmission network only provides an Underlay (underlying network) "pipeline" and cannot perceive business applications and business demand information, resulting in the data transmission network being unable to provide refined and differentiated services for different users or businesses.

[0003] In order to solve the problem that the data transmission network cannot perceive the business application and business demand information, business awareness technology is proposed. APN6 (Application-aware IPv6 Networking) is an innovative network architecture that can encapsulate application identification or application demand information into the IPv6 message extension header. When processing IPv6 data packets, it can not only identify the applications in use, but also deeply understand the specific needs of these applications for the network.

[0004] However, the APN6 application-side solution encapsulates the application identifier or application requirement information into the IPv6 message extension header through the application-side or cloud-side device outside the network trust domain, which may cause security issues. Therefore, how to solve the security issues of the APN6 application-side solution to ensure normal services for legitimate users has become a technical problem that needs to be solved at present. Summary of the invention

[0005] Based on this, it is necessary to provide a service access control method and system that can solve the security problems existing in the APN6 access scenario to ensure that normal services are provided to legitimate users in response to the above technical problems.

[0006] In a first aspect, the present application provides a service access control method, comprising:

[0007] Receive terminal access information reported by the edge access device, the terminal access information including terminal identification information, application identification information and application requirement information;

[0008] Verifying the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information;

[0009] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0010] In one embodiment, the method further comprises:

[0011] When the binding relationship between the terminal identification information, application identification information and application requirement information fails to pass the verification, a message discarding policy or a message rate limiting policy is sent to the edge access device; the message discarding policy is used to instruct the edge access device to discard the business application messages corresponding to the terminal access information, and the message rate limiting policy is used to instruct the edge access device to limit the rate of the business application messages corresponding to the terminal access information.

[0012] In one of the embodiments, when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, sending the message discarding policy to the edge access device includes:

[0013] When the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is missing in the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, application identification information and application requirement information has not passed the verification, and a message discarding policy is sent to the edge access device.

[0014] In one embodiment, when the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass the verification, sending the message rate limit policy to the edge access device includes:

[0015] When the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and the application requirement information is inconsistent, it is determined that the binding relationship between the terminal identification information, application identification information and application requirement information has not passed the verification, and the message speed limit policy is sent to the edge access device.

[0016] In one embodiment, sending a message discarding policy or a message rate limiting policy to an edge access device includes:

[0017] Send the message discarding policy or message rate limiting policy to the edge access device through the border gateway flow specification protocol.

[0018] In one embodiment, issuing a service diversion strategy to an edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, including:

[0019] The business diversion strategy is issued to the edge access device through the border gateway flow specification protocol; the business diversion strategy is used to instruct the edge access device to divert the business application messages corresponding to the terminal access information to the segmented routing tunnel that meets the application requirement information, and connect the business application messages to the data center network through the segmented routing tunnel that meets the application requirement information.

[0020] In a second aspect, the present application also provides a service access control system, including:

[0021] The application side terminal network includes at least one terminal; the at least one terminal is used to send a service application message to an edge access device;

[0022] A backbone network, including a network control system and a backbone forwarding device, wherein the backbone forwarding device includes an edge access device; the edge access device is used to parse the service application message, obtain the terminal access information, and upload the terminal access information to the network control system, wherein the terminal access information includes the terminal identification information, the application identification information and the application requirement information; the network control system is used to verify the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information; when the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, the service diversion strategy is issued to the edge access device; the edge access device is used to access the service application message to the data center network according to the service diversion strategy;

[0023] The data center network is used to provide network services corresponding to business application messages for at least one terminal.

[0024] In one of the embodiments, the application side terminal network further includes:

[0025] The terminal management system is used to bind the terminal identification information, the application identification information and the application requirement information to obtain the registration information, and send the registration information to the network control system;

[0026] A network control system is used to store registration information.

[0027] In one of the embodiments, the edge access device is further used to upload the terminal access information to the network control system via a remote data acquisition protocol.

[0028] In one of the embodiments, the application side terminal network further includes:

[0029] The terminal aggregation device is used to aggregate service application messages sent by at least one terminal and send the aggregated service application messages to the edge access device.

[0030] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] Receive terminal access information reported by the edge access device, the terminal access information including terminal identification information, application identification information and application requirement information;

[0032] Verifying the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information;

[0033] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0035] Receive terminal access information reported by the edge access device, the terminal access information including terminal identification information, application identification information and application requirement information;

[0036] Verifying the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information;

[0037] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0038] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0039] Receive terminal access information reported by the edge access device, the terminal access information including terminal identification information, application identification information and application requirement information;

[0040] Verifying the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information;

[0041] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0042] The above-mentioned service access control method, system, computer device, storage medium and computer program product determine whether it is a legitimate terminal by verifying the binding relationship between the terminal identification information, application identification information and application requirement information according to the pre-stored registration information. When the verification is passed, the service diversion policy is sent to the edge access device to connect the service application message corresponding to the terminal access information to the data center network. It can accurately identify counterfeit and tampered terminal access information to identify counterfeit and tampered business application messages, ensure that the terminal access information on the application side can be trusted on the network side, has not been tampered with or counterfeited, and provide normal services to legitimate terminals, accurately and effectively solving the security issues in the APN6 access scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 An application environment diagram of a service access control method in an embodiment;

[0045] Figure 2 A schematic diagram of a flow chart of a service access control method in an embodiment;

[0046] Figure 3 is a schematic diagram of registration information pre-stored in one embodiment;

[0047] Figure 4 A schematic diagram of a flow chart of a service access control method in another embodiment;

[0048] Figure 5 A structural block diagram of a service access control system in an embodiment;

[0049] Figure 6 A schematic diagram of service access control of a service access system in an embodiment;

[0050] Figure 7An application schematic diagram of a service access system in an embodiment;

[0051] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The service access control method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the edge access device 102 communicates with the network control system 104 through the network. The edge access device 102 reports the terminal access information to the network control system 104, and the terminal access information includes terminal identification information, application identification information and application requirement information. The network control system 104 receives the terminal access information and verifies the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information. When the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, the service diversion strategy is sent to the edge access device 102. The edge access device 102 connects the service application message corresponding to the terminal access information to the data center network according to the service diversion strategy, so that the terminal corresponding to the terminal access information can access the data center network.

[0054] In an exemplary embodiment, Figure 2 As shown, a service access control method is provided, which is applied to Figure 1 The network control system in FIG. 1 is taken as an example to illustrate, and the steps include the following steps 202 to 206. Among them:

[0055] Step 202: Receive terminal access information reported by an edge access device, where the terminal access information includes terminal identification information, application identification information, and application requirement information.

[0056] Among them, terminal access information refers to the service application information of the terminal in the APN6 (Application-aware IPv6 Networking, application-aware network based on IPv6) access scenario. Terminal identification information refers to the unique identifier used for the terminal, such as MAC address (Media Access Control Address). Application identification information refers to the unique identifier of the application being used by the terminal, such as APN ID (Access Point Name Identifier). Application requirement information refers to the requirements of the application used by the terminal for the data center network that provides network services, such as APN Parameters (Access Point Name Parameters, access point requirement parameters).

[0057] Optionally, the edge access device receives a service application message sent by the terminal, and the service application message refers to a message carrying application identification information and application requirement information, which is an APN6 message. The edge access device parses the service application message to obtain information related to APN6. The information related to APN6 includes application identification information and application requirement information. The edge access device reports the terminal identification information, application identification information and application requirement information as terminal access information to the network control system. The network control system receives the terminal access information reported by the edge access device.

[0058] Step 204: verify the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information.

[0059] The pre-stored registration information refers to the binding relationship between the pre-registered terminal identification information, application identification information and application requirement information, including the binding relationship between the terminal identification information of the terminal and the application identification information and application requirement information of each corresponding application.

[0060] Optionally, the network control system checks whether the binding relationship between the terminal identification information, the application identification information, and the application requirement information is consistent with the pre-stored registration information. When the binding relationship between the terminal identification information, the application identification information, and the application requirement information is consistent with the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information, and the application requirement information passes the verification, indicating that the service application message corresponding to the terminal access information is legal, and the terminal corresponding to the terminal access information is a legal terminal. When the binding relationship between the terminal identification information, the application identification information, and the application requirement information is inconsistent with the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass the verification, indicating that the service application message corresponding to the terminal access information is illegal, and the terminal corresponding to the terminal access information is an illegal terminal.

[0061] For example, the pre-stored registration information is as follows: Figure 3 As shown, the MAC address represents the terminal identification information of the terminal, the APN ID represents the application identification information, and the APN Para represents the application requirement information. There are two terminal applications corresponding to terminal A, and the application identification information (APN ID) is xx and zz respectively. The application requirement information (APN Para) corresponding to xx is low latency (low latency requirement). The application requirement information (APN Para) corresponding to zz is normal (normal requirement). There are also two terminal applications corresponding to terminal B, and the application identification information (APN ID) is yy and vv respectively. The application requirement information (APN Para) corresponding to yy is normal (normal requirement). The application requirement information (APN Para) corresponding to vv is high bandwidth (high bandwidth requirement).

[0062] Step 206, when the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0063] The service diversion strategy refers to the strategy of forwarding service application messages normally, that is, normal access to terminals. The data center network is used to provide network services for deploying various applications.

[0064] Optionally, when the binding relationship between the terminal identification information, the application identification information and the application requirement information passes verification, the service diversion strategy is sent to the edge access device. After receiving the service diversion strategy, the edge access device connects the service application message corresponding to the terminal access information to the data center network, thereby realizing the need for the terminal corresponding to the terminal access information to access the application server of the data center network, and providing network services for the terminal.

[0065] Furthermore, a service diversion strategy is issued to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application messages corresponding to the terminal access information to the data center network, including: issuing the service diversion strategy to the edge access device through the border gateway flow specification protocol; the service diversion strategy is used to instruct the edge access device to divert the service application messages corresponding to the terminal access information to the segmented routing tunnel that meets the application requirement information, and connect the service application messages to the data center network through the segmented routing tunnel that meets the application requirement information.

[0066] Among them, the Border Gateway Flow Specification Protocol refers to the BGP FlowSpec (Border Gateway Protocol Flow Specification) protocol. FlowSpec is an extended feature of BGP that allows routing policies to be specified and applied in the routing policy database. FlowSpec provides a flexible way to define, transmit and apply traffic filtering rules, which can help network administrators achieve more accurate and scalable traffic control. The segment routing tunnel refers to the SRv6 (Segment Routing IPv6, segment routing based on IPv6) tunnel. SRv6 inserts a routing extension header SRH (Segment Routing Header) into the IPv6 message, pushes an explicit IPv6 address stack into the SRH, and the intermediate nodes continuously update the destination address and offset address stack to complete hop-by-hop forwarding.

[0067] Specifically, the business diversion strategy is issued to the edge access device through the border gateway flow specification protocol. After receiving the business diversion strategy, the edge access device diverts the business application message corresponding to the terminal access information to the segment routing tunnel that meets the application requirement information, and connects the business application message to the data center network along the segment routing tunnel that meets the application requirement information.

[0068] By sending the service diversion strategy to the edge access device through the border gateway flow specification protocol, more accurate and scalable flow control can be achieved for service application messages. The edge access device diverts the service application messages corresponding to the terminal access information to the segmented routing tunnel that meets the application demand information, which can achieve application diversion and flexible routing.

[0069] In traditional technology, the APN6 application-side solution is to encapsulate the application identification or application requirement information into the IPv6 message extension header through the application-side or cloud-side device outside the network trust domain, which may cause application-side spoofing problems, leading to security problems. In order to solve the application-side spoofing problem, it is generally necessary to deploy an access control list (ACL) policy at the network boundary of the trusted domain to filter the messages entering from outside the trusted domain and discard the traffic that illegally accesses internal information from the outside. However, this method cannot handle messages of different business types, which may have similar traffic characteristics, so the accuracy is not high.

[0070] In the above-mentioned service access control method, the binding relationship between the terminal identification information, application identification information and application requirement information is verified according to the pre-stored registration information to determine whether it is a legitimate terminal. When the verification is passed, the service diversion strategy is sent to the edge access device to connect the service application message corresponding to the terminal access information to the data center network. It can accurately identify counterfeit and tampered terminal access information, identify counterfeit and tampered business application messages, ensure that the terminal access information on the application side can be trusted on the network side, has not been tampered with or counterfeited, and provide normal services to legitimate terminals, accurately and effectively solving the security issues in the APN6 access scenario.

[0071] In an exemplary embodiment, the above method also includes: when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, sending a message discarding policy or a message rate limiting policy to the edge access device; the message discarding policy is used to instruct the edge access device to discard the business application message corresponding to the terminal access information, and the message rate limiting policy is used to instruct the edge access device to limit the rate of the business application message corresponding to the terminal access information.

[0072] Optionally, when the binding relationship between the terminal identification information, the application identification information, and the application requirement information is inconsistent with the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information, and the application requirement information has not passed the verification, indicating that the business application message corresponding to the terminal access information is illegal, and the terminal corresponding to the terminal access information is an illegal terminal. At this time, the network control system sends a message discarding policy or a message speed limiting policy to the edge access device. When the edge access device receives the message discarding policy, the business application message corresponding to the terminal access information is discarded. When the edge access device receives the message speed limiting policy, the business application message corresponding to the terminal access information is speed limited.

[0073] In traditional technology, in order to solve the problem of application-side impersonation, the access control list (ACL) policy is generally deployed at the network boundary of the trusted domain to filter the messages entering from outside the trusted domain. However, once the quintuple changes, this method needs to be manually adjusted, which makes operation and maintenance very difficult and cannot automatically block business traffic.

[0074] In this embodiment, when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, a message discarding policy or a message speed limiting policy is sent to the edge access device to implement message discarding or speed limiting of the business application messages, thereby preventing the traffic of tampered and forged business application messages from affecting the normal forwarding of the network.

[0075] In an optional manner of the above embodiment, sending the message discarding policy or the message rate limiting policy to the edge access device includes: sending the message discarding policy or the message rate limiting policy to the edge access device through the border gateway flow specification protocol.

[0076] Since the border gateway flow specification protocol provides a flexible way to define, transmit and apply traffic filtering rules, it can help network administrators achieve more precise and scalable traffic control. When the binding relationship between terminal identification information, application identification information and application requirement information fails to pass the verification, the border gateway flow specification protocol is used to send a message discarding policy or a message rate limiting policy to the edge access device, which can achieve more precise and scalable traffic control for business application messages.

[0077] In an optional manner of the above embodiment, when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, a preset rule may be used to determine whether to issue a message discarding policy or a message rate limiting policy.

[0078] Optionally, when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, sending the message discarding policy to the edge access device includes: when the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is missing in the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, and sending the message discarding policy to the edge access device.

[0079] When it is detected that the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the pre-stored registration information lacks terminal identification information, a message discarding policy can be sent to the edge access device to avoid providing network services to illegal terminals.

[0080] In an optional manner of the above embodiment, when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, sending the message rate limit policy to the edge access device includes: when the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and the application requirement information is inconsistent, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, and sending the message rate limit policy to the edge access device.

[0081] When it is checked that the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is consistent, and at least one of the application identification information and application requirement information is inconsistent, the message rate limit policy can be sent to the edge access device, which not only ensures that the application traffic is not interrupted, but also guarantees the network service of the normal application.

[0082] In another embodiment, Figure 4 As shown, a service access control method is provided, comprising the following steps:

[0083] Step 402: Receive terminal access information reported by an edge access device, where the terminal access information includes terminal identification information, application identification information, and application requirement information.

[0084] Step 404: verify the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information.

[0085] Step 406, when the verification is passed, the business diversion strategy is sent to the edge access device through the border gateway flow specification protocol; the business diversion strategy is used to instruct the edge access device to divert the business application message corresponding to the terminal access information to the segmented routing tunnel that meets the application requirement information, and connect the business application message to the data center network through the segmented routing tunnel that meets the application requirement information.

[0086] Step 408, when the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is missing in the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information has not passed the verification, and the message discarding policy is sent to the edge access device through the border gateway flow specification protocol.

[0087] Step 410, when the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and the application requirement information is inconsistent, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information has not passed the verification, and the message rate limit policy is sent to the edge access device through the border gateway flow specification protocol.

[0088] In this embodiment, by verifying the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information, it is determined whether it is a legitimate terminal. When the verification is passed, the service diversion strategy is sent to the edge access device to connect the service application message corresponding to the terminal access information to the data center network, which can accurately identify the counterfeit and tampered terminal access information, to identify the counterfeit and tampered service application message, to ensure that the terminal access information on the application side can be trusted on the network side, has not been tampered with or counterfeited, and to provide normal services to legitimate terminals. In addition, when the verification fails, a message discarding strategy or a message speed limiting strategy is sent to the edge access device, which can prevent the traffic of the tampered and counterfeited service application message from affecting the normal forwarding of the network, thereby accurately and effectively solving the security issues in the APN6 access scenario.

[0089] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0090] Based on the same inventive concept, the embodiment of the present application also provides a service access control system for implementing the service access control method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more service access control system embodiments provided below can refer to the limitations on the service access control method above, and will not be repeated here.

[0091] In an exemplary embodiment, Figure 5As shown, a service access control system is provided, including: an application side terminal network, a backbone network and a data center network. The application side terminal network includes a terminal management system, at least one terminal and a terminal aggregation device. For example, the at least one terminal may include terminal A and terminal B. The backbone network includes a network control system and backbone forwarding devices PE1 to PE8. PE1 represents an edge access device. The network control system can communicate with the backbone forwarding device. The data center network includes an application server, wherein:

[0092] At least one terminal is used to send a service application message to an edge access device.

[0093] The edge access device is used to parse the business application message, obtain the terminal access information, and upload the terminal access information to the network control system. The terminal access information includes terminal identification information, application identification information and application requirement information; the network control system is used to verify the binding relationship between the terminal identification information, application identification information and application requirement information according to the pre-stored registration information; when the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the business diversion strategy is issued to the edge access device; the edge access device is used to connect the business application message to the data center network according to the business diversion strategy.

[0094] The data center network is used to provide network services corresponding to business application messages for at least one terminal.

[0095] Specifically, at least one terminal is used to encapsulate the application identification information and application requirement information corresponding to the application into the initial application message to obtain a business application message. The initial application message refers to an ordinary IPV6 message, including a source address, a destination address, application data, etc. In general, since there are many terminals, the edge access devices of the backbone network are relatively few and fixed, such as PE1. Therefore, at least one terminal aggregation device, such as a terminal aggregation switch, is added between the terminal and the edge access device. The terminal aggregation device is used to aggregate the business application messages sent by at least one terminal, and send the aggregated business application messages to the edge access device.

[0096] In this embodiment, the network control system determines whether it is a legitimate terminal by verifying the binding relationship between the terminal identification information, application identification information and application requirement information according to the pre-stored registration information. When the verification is passed, the service diversion policy is sent to the edge access device, and the edge access device connects the service application message corresponding to the terminal access information to the data center network, so that the service access system can accurately identify counterfeit and tampered terminal access information, so as to identify counterfeit and tampered business application messages, and ensure that the terminal access information on the application side can be trusted on the network side, without being tampered with or counterfeited, and provide normal services to legitimate terminals, accurately and effectively solving the security issues in the APN6 access scenario.

[0097] In an exemplary embodiment, the application side terminal network further includes:

[0098] The terminal management system is used to bind the terminal identification information, application identification information and application requirement information to obtain registration information, and send the registration information to the network control system.

[0099] A network control system is used to store registration information.

[0100] Specifically, before performing service access control, the terminal management system pre-binds the terminal identification information, application identification information and application requirement information to obtain registration information, and synchronizes the registration information to the network control system, which is conducive to the network control system to accurately identify counterfeit and tampered service application messages.

[0101] In an exemplary embodiment, the edge access device is also used to upload the terminal access information to the network control system through a remote data acquisition protocol.

[0102] Edge access devices use the remote data collection protocol, namely the Telemetry protocol, to report terminal access information, which enables fine application visualization, intuitive and complete understanding of the traffic flowing through the network, and tracking, analyzing and locating network performance and faults, solving the problem that existing network technical means, such as SNMP (Simple Network Management Protocol) and NetFlow (network monitoring function), cannot track, analyze and locate network performance and faults when obtaining business traffic information. At the same time, it combines APN6 to perform traffic feature profiling on key applications or terminals, presenting their traffic paths, characteristics, change patterns and trends, and achieving visual monitoring of application traffic.

[0103] Furthermore, before performing service access control, the service access system is also used to configure protocol channels between backbone forwarding devices, such as the OSPF (Open Shortest Path First) protocol, and to open control protocol channels between backbone forwarding devices and the network control system, such as the Telemetry protocol for collecting terminal access information and the BGP FlowSpec protocol for issuing application message processing policies.

[0104] In an exemplary embodiment, Figure 6 As shown, a schematic diagram of service access control of a service access system is shown, wherein the service access system performs service access control in the order of numbers ① to ⑤, specifically, ①: the terminal management system is used to bind the terminal identification information, application identification information and application requirement information of the terminal to obtain registration information, and send the registration information to the network control system; the network control system is used to store the registration information. ②: the terminal is used to encapsulate the application identification information and application requirement information corresponding to the application into the initial application message to obtain the service application message. The terminal aggregation device is used to aggregate the service application message sent by at least one terminal and send the aggregated service application message to the edge access device. ③: the edge access device is used to parse the service application message to obtain the terminal access information, and upload the terminal access information to the network control system through the Telemetry protocol. ④: the network control system is used to verify the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information; when the verification is passed, the service diversion strategy is sent to the edge access device; when the verification is not passed, the message discarding strategy or the message speed limiting strategy is sent to the edge access device. ⑤: BGP FlowSpec protocol supports diverting traffic to SPv6 channels, discarding packets, or limiting the packet rate.

[0105] For example, Figure 7As shown, a schematic diagram of the application of the service access system is shown; terminal A registers an application information in the terminal management system, and the specific information is: terminal A, application App-1 APN-ID: xx, APN-Para: low latency (low latency requirement). When the user of terminal A uses application App-1, the service application message sent by terminal A encapsulates the APN-ID of application App-1 and the application requirement information APN-Para, which is consistent with the information registered in the terminal management system. After receiving the service application message sent by terminal A, the edge access device PE1 of the backbone network parses the message information, obtains the terminal access information of terminal A, and reports the terminal access information of terminal A to the network control system using the Telemetry protocol. After verification, the network control system finds that the terminal access information of terminal A reported by PE1 is consistent with the registration information. According to the application requirement information in the terminal access information of terminal A, the BGP FlowSpec protocol is used to issue a service diversion strategy, and the service application message of terminal A is introduced to the SRv6 tunnel that meets the application requirements of App-1, so as to realize the requirement of terminal A to access the application server of the data center network. The SRv6 tunnel that meets the requirements of App-1 is the tunnel between PE1 and PE8. The forwarding path of this tunnel is PE1-PE2-PE4-PE6-PE8.

[0106] Terminal B has registered an application information in the terminal management system. The specific information is: Terminal B, APN-ID of application App-2: yy, APN-Para: normal (normal demand). When the user of terminal B uses application App-2, in order to obtain better network services, the service application message sent by terminal B encapsulates application App-2, but forges the APN ID of App1: xx, which is inconsistent with the information registered in the terminal management system. After receiving the service application message sent by terminal B, the edge access device PE1 of the backbone network parses the message information, obtains the terminal access information of terminal B, and reports the terminal access information of terminal B to the network control system using the Telemetry protocol. After verification, the network control system finds that the terminal access information sent by terminal B reported by PE1 is inconsistent with the registration information. After detecting the forged behavior, it will use the BGP FlowSpec protocol to send a message discarding policy or a message rate limiting policy to discard or limit the application traffic of App2 of terminal B to prevent the tampered and forged application information traffic from affecting the normal forwarding of the network.

[0107] Each module in the above service access control device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0108] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store pre-stored registration information, business diversion strategies, message discard strategies, message speed limit strategies and other data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a service access control method is implemented.

[0109] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0110] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0111] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0112] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0113] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0114] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0115] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0116] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A service access control method, characterized in that: The method comprises: Receiving terminal access information reported by an edge access device, the terminal access information including terminal identification information, application identification information and application requirement information; Verifying the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information; When the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

2. The method according to claim 1, characterized in that The method further comprises: When the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, a message discarding policy or a message rate limiting policy is sent to the edge access device; the message discarding policy is used to instruct the edge access device to discard the business application message corresponding to the terminal access information, and the message rate limiting policy is used to instruct the edge access device to limit the rate of the business application message corresponding to the terminal access information.

3. The method according to claim 2, characterized in that When the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass verification, sending a message discarding policy to the edge access device includes: When the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is missing in the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information has not passed the verification, and a message discarding policy is sent to the edge access device.

4. The method according to claim 2, characterized in that: When the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass verification, sending the message rate limit policy to the edge access device includes: When the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and the application requirement information is inconsistent, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information has not passed the verification, and a message rate limit policy is sent to the edge access device.

5. The method according to claim 2, characterized in that: The sending of the message discarding strategy or the message rate limiting strategy to the edge access device includes: A message discarding policy or a message rate limiting policy is sent to the edge access device through a border gateway flow specification protocol.

6. The method according to claim 1, characterized in that The sending of the service diversion strategy to the edge access device; The service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, including: Sending a service diversion strategy to the edge access device through a border gateway flow specification protocol; The service diversion strategy is used to instruct the edge access device to divert the service application message corresponding to the terminal access information to the segment routing tunnel that meets the application requirement information, and access the service application message to the data center network through the segment routing tunnel that meets the application requirement information.

7. A service access control system, characterized in that: The system comprises: The application side terminal network includes at least one terminal; at least one of the terminals is used to send a service application message to an edge access device; A backbone network, comprising a network control system and a backbone forwarding device, wherein the backbone forwarding device comprises an edge access device; the edge access device is used to parse the service application message, obtain terminal access information, and upload the terminal access information to the network control system, wherein the terminal access information comprises terminal identification information, application identification information and application requirement information; the network control system is used to verify the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information; when the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, a service diversion strategy is issued to the edge access device; the edge access device is used to connect the service application message to the data center network according to the service diversion strategy; The data center network is used to provide network services corresponding to the business application message to at least one of the terminals.

8. The system according to claim 7, characterized in that The application side terminal network also includes: The terminal management system is used to bind the terminal identification information, the application identification information and the application requirement information to obtain registration information, and send the registration information to the network control system; The network control system is used to store the registration information.

9. The system according to claim 7, characterized in that The edge access device is also used to upload the terminal access information to the network control system through a remote data acquisition protocol.

10. The system according to claim 7, characterized in that The application side terminal network also includes: The terminal aggregation device is used to aggregate the service application messages sent by at least one of the terminals and send the aggregated service application messages to the edge access device.

Images