Method and system for service access control

Abstract

The application relates to a service access control method and system. The method comprises the following steps: receiving terminal access information reported by an edge access device, wherein the terminal access information comprises terminal identification information, application identification information and application demand information; checking a binding relationship among the terminal identification information, the application identification information and the application demand information according to pre-stored registration information; when the binding relationship among the terminal identification information, the application identification information and the application demand information passes the check, issuing a service flow diversion strategy to the edge access device; the service flow diversion strategy is used for instructing the edge access device to access a service application packet corresponding to the terminal access information to a data center network, so that a terminal corresponding to the terminal access information accesses the data center network. The method can solve a security problem existing in an APN6 access scene to ensure normal service for legal users.

Description

Technical Field

[0001] The present application relates to the field of business processing technology, and in particular to a business access control method and system. Background Art

[0002] With the deepening of digital transformation, businesses are accelerating their cloud migration, achieving intelligent interconnection of everything, and a proliferation of new distributed applications. The multi-cloud nature of these services creates complex traffic access models, leading to rapid changes and a large number of enterprise IT (Information Technology) configuration policies. Enterprise operations personnel are tasked with maintaining cloud, network, and complex security policies, increasing operational complexity and failing to adapt to the evolving trends of these new networks. Cloud services have become fundamental to internet services, but within these processes, data transmission networks merely provide an underlay "pipeline" and lack awareness of business applications and requirements. Consequently, these networks are unable to provide refined and differentiated services for different users or businesses.

[0003] To address the problem of data transmission networks being unable to perceive service applications and service requirements, service-aware technology has been proposed. Application-aware IPv6 Networking (APN6), an innovative network architecture, encapsulates application identifiers and application requirements information within the IPv6 packet extension header. When processing IPv6 packets, it not only identifies the applications in use but also provides a deep understanding of their specific network requirements.

[0004] However, the APN6 application-side solution encapsulates application identifiers and application requirements information within IPv6 packet extension headers via application-side or cloud-side devices outside the network's trust domain, which may pose security issues. Therefore, resolving the security issues of the APN6 application-side solution to ensure normal service for legitimate users has become a technical issue that needs to be addressed. Summary of the Invention

[0005] Based on this, it is necessary to provide a service access control method and system that can solve the security problems existing in the APN6 access scenario to ensure that normal services are provided to legitimate users in response to the above technical problems.

[0006] In a first aspect, the present application provides a service access control method, comprising:

[0007] Receive terminal access information reported by edge access devices, the terminal access information including terminal identification information, application identification information and application requirement information;

[0008] Verifying the binding relationship between the terminal identification information, the application identification information, and the application requirement information based on the pre-stored registration information;

[0009] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0010] In one embodiment, the method further includes:

[0011] When the binding relationship between the terminal identification information, application identification information and application requirement information fails to pass the verification, a message discarding policy or a message rate limiting policy is sent to the edge access device; the message discarding policy is used to instruct the edge access device to discard the business application messages corresponding to the terminal access information, and the message rate limiting policy is used to instruct the edge access device to limit the rate of the business application messages corresponding to the terminal access information.

[0012] In one embodiment, when the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass verification, sending a message discarding policy to the edge access device includes:

[0013] When the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is missing in the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, application identification information and application requirement information has not passed the verification, and the message discarding policy is sent to the edge access device.

[0014] In one embodiment, when the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass verification, sending the message rate limit policy to the edge access device includes:

[0015] When the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and application requirement information is inconsistent, it is determined that the binding relationship between the terminal identification information, application identification information and application requirement information has not passed the verification, and the message rate limit policy is sent to the edge access device.

[0016] In one embodiment, sending a packet discarding policy or a packet rate limiting policy to an edge access device includes:

[0017] Send message discarding policy or message rate limiting policy to edge access device through border gateway flow specification protocol.

[0018] In one embodiment, issuing a service diversion policy to an edge access device; the service diversion policy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, including:

[0019] The business diversion strategy is issued to the edge access device through the border gateway flow specification protocol; the business diversion strategy is used to instruct the edge access device to divert the business application messages corresponding to the terminal access information to the segmented routing tunnel that meets the application requirement information, and connect the business application messages to the data center network through the segmented routing tunnel that meets the application requirement information.

[0020] In a second aspect, the present application also provides a service access control system, including:

[0021] An application-side terminal network, comprising at least one terminal; the at least one terminal is used to send service application messages to an edge access device;

[0022] The backbone network includes a network control system and a backbone forwarding device, and the backbone forwarding device includes an edge access device; the edge access device is used to parse the business application message to obtain terminal access information, and upload the terminal access information to the network control system, the terminal access information includes terminal identification information, application identification information and application requirement information; the network control system is used to verify the binding relationship between the terminal identification information, application identification information and application requirement information based on pre-stored registration information; when the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the business diversion strategy is issued to the edge access device; the edge access device is used to connect the business application message to the data center network according to the business diversion strategy;

[0023] The data center network is used to provide network services corresponding to business application messages for at least one terminal.

[0024] In one embodiment, the application-side terminal network further includes:

[0025] The terminal management system is used to bind the terminal identification information, application identification information and application requirement information to obtain registration information, and send the registration information to the network control system;

[0026] The network control system is used to store registration information.

[0027] In one embodiment, the edge access device is further configured to upload the terminal access information to the network control system via a remote data acquisition protocol.

[0028] In one embodiment, the application-side terminal network further includes:

[0029] The terminal aggregation device is used to aggregate service application messages sent by at least one terminal and send the aggregated service application messages to the edge access device.

[0030] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0031] Receive terminal access information reported by edge access devices, the terminal access information including terminal identification information, application identification information and application requirement information;

[0032] Verifying the binding relationship between the terminal identification information, the application identification information, and the application requirement information based on the pre-stored registration information;

[0033] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0035] Receive terminal access information reported by edge access devices, the terminal access information including terminal identification information, application identification information and application requirement information;

[0036] Verifying the binding relationship between the terminal identification information, the application identification information, and the application requirement information based on the pre-stored registration information;

[0037] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0038] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0039] Receive terminal access information reported by edge access devices, the terminal access information including terminal identification information, application identification information and application requirement information;

[0040] Verifying the binding relationship between the terminal identification information, the application identification information, and the application requirement information based on the pre-stored registration information;

[0041] When the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0042] The above-mentioned service access control method, system, computer equipment, storage medium and computer program product determine whether it is a legitimate terminal by verifying the binding relationship between the terminal identification information, application identification information and application requirement information according to the pre-stored registration information. When the verification is passed, the service diversion policy is sent to the edge access device to connect the service application message corresponding to the terminal access information to the data center network. It can accurately identify counterfeit and tampered terminal access information to identify counterfeit and tampered service application messages, ensure that the terminal access information on the application side can be trusted on the network side, has not been tampered with or counterfeited, and provide normal services to legitimate terminals, accurately and effectively solving the security issues in the APN6 access scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 This is a diagram of an application environment of a service access control method in one embodiment;

[0045] Figure 2 1 is a flow chart of a service access control method according to an embodiment;

[0046] Figure 3 is a schematic diagram of pre-stored registration information in one embodiment;

[0047] Figure 4 is a flow chart of a service access control method according to another embodiment;

[0048] Figure 5 A structural block diagram of a service access control system in one embodiment;

[0049] Figure 6 A schematic diagram of service access control of a service access system in one embodiment;

[0050] Figure 7This is a schematic diagram of an application of a service access system in one embodiment;

[0051] Figure 8 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0053] The service access control method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the edge access device 102 communicates with the network control system 104 through the network. The edge access device 102 reports the terminal access information to the network control system 104, and the terminal access information includes terminal identification information, application identification information and application requirement information. The network control system 104 receives the terminal access information and verifies the binding relationship between the terminal identification information, the application identification information and the application requirement information according to the pre-stored registration information. When the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, the service diversion strategy is sent to the edge access device 102. The edge access device 102 connects the service application message corresponding to the terminal access information to the data center network according to the service diversion strategy, so that the terminal corresponding to the terminal access information can access the data center network.

[0054] In an exemplary embodiment, Figure 2 As shown, a service access control method is provided, which is applied to Figure 1 The network control system in FIG. 1 is taken as an example to illustrate the method, which includes the following steps 202 to 206. Among them:

[0055] Step 202: Receive terminal access information reported by an edge access device. The terminal access information includes terminal identification information, application identification information, and application requirement information.

[0056] Terminal access information refers to the service application information of the terminal in the APN6 (Application-aware IPv6 Networking) access scenario. Terminal identification information is the unique identifier used for the terminal, such as the MAC address (Media Access Control Address). Application identification information is the unique identifier of the application currently being used by the terminal, such as the APN ID (Access Point Name Identifier). Application requirement information refers to the requirements of the application used by the terminal for the data center network providing network services, such as the APN Parameters (Access Point Name Parameters).

[0057] Optionally, the edge access device receives a service application message sent by the terminal. The service application message is a message that carries application identification information and application requirement information, and is an APN6 message. The edge access device parses the service application message to obtain information related to APN6. APN6-related information includes application identification information and application requirement information. The edge access device reports the terminal identification information, application identification information, and application requirement information as terminal access information to the network control system. The network control system receives the terminal access information reported by the edge access device.

[0058] Step 204: Verify the binding relationship between the terminal identification information, the application identification information, and the application requirement information according to the pre-stored registration information.

[0059] The pre-stored registration information refers to the binding relationship between the pre-registered terminal identification information, application identification information and application requirement information, including the binding relationship between the terminal identification information of the terminal and the application identification information and application requirement information of each corresponding application.

[0060] Optionally, the network control system checks whether the binding relationship between the terminal identification information, the application identification information, and the application requirement information is consistent with the pre-stored registration information. When the binding relationship between the terminal identification information, the application identification information, and the application requirement information is consistent with the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information, and the application requirement information has passed verification, indicating that the service application message corresponding to the terminal access information is legal and the terminal corresponding to the terminal access information is a legal terminal. When the binding relationship between the terminal identification information, the application identification information, and the application requirement information is inconsistent with the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information, and the application requirement information has failed verification, indicating that the service application message corresponding to the terminal access information is illegal and the terminal corresponding to the terminal access information is an illegal terminal.

[0061] For example, the pre-stored registration information is as follows: Figure 3 As shown in the figure, the MAC address represents the terminal identification information, the APN ID represents the application identification information, and the APN Para represents the application requirement information. Terminal A corresponds to two terminal applications, with the application identification information (APN IDs) xx and zz. The application requirement information (APN Para) corresponding to xx is low latency. The application requirement information (APN Para) corresponding to zz is normal. Terminal B also corresponds to two terminal applications, with the application identification information (APN IDs) yy and vv. The application requirement information (APN Para) corresponding to yy is normal. The application requirement information (APN Para) corresponding to vv is high bandwidth.

[0062] Step 206: When the binding relationship between the terminal identification information, application identification information and application requirement information passes verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

[0063] The service diversion strategy refers to the strategy for forwarding service application messages normally, that is, for allowing normal access to terminals. The data center network is used to provide network services for deploying various applications.

[0064] Optionally, when the binding relationship between the terminal identification information, application identification information, and application requirement information passes verification, a service diversion policy is issued to the edge access device. After receiving the service diversion policy, the edge access device connects the service application message corresponding to the terminal access information to the data center network, thereby realizing the terminal corresponding to the terminal access information accessing the application server of the data center network and providing network services to the terminal.

[0065] Furthermore, a service diversion strategy is issued to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, including: issuing the service diversion strategy to the edge access device through the border gateway flow specification protocol; the service diversion strategy is used to instruct the edge access device to divert the service application message corresponding to the terminal access information to the segmented routing tunnel that meets the application requirement information, and connect the service application message to the data center network through the segmented routing tunnel that meets the application requirement information.

[0066] The Border Gateway Flow Specification Protocol (BGP) refers to the Border Gateway Protocol Flow Specification (BGP FlowSpec). FlowSpec is a BGP extension that allows routing policies to be specified and applied within the routing policy database. FlowSpec provides a flexible way to define, transmit, and apply traffic filtering rules, helping network administrators achieve more precise and scalable traffic control. A segment routing tunnel refers to an SRv6 (Segment Routing IPv6) tunnel. SRv6 accomplishes hop-by-hop forwarding by inserting a routing extension header (SRH) into IPv6 packets, pushing an explicit IPv6 address stack into the SRH, and having intermediate nodes continuously update the destination address and offset address stack.

[0067] Specifically, the service diversion policy is delivered to the edge access device via the border gateway flow specification protocol. Upon receiving the service diversion policy, the edge access device diverts the service application packets corresponding to the terminal access information to the segment routing tunnel that meets the application requirements, and then connects the service application packets to the data center network along the segment routing tunnel that meets the application requirements.

[0068] By distributing service diversion policies to edge access devices through the Border Gateway Flow Specification Protocol, more precise and scalable traffic control of service application packets is achieved. The edge access device directs service application packets corresponding to terminal access information to segmented routing tunnels that meet application requirements, enabling application diversion and flexible routing.

[0069] Traditionally, APN6 application-side solutions encapsulate application identifiers and application requirements information within IPv6 packet extension headers via application-side or cloud-side devices outside the network's trusted domain. This can lead to application-side spoofing and security concerns. To address application-side spoofing, access control lists (ACLs) are typically deployed at the network boundary of the trusted domain to filter incoming packets from outside the trusted domain, discarding traffic that illegally accesses internal information. However, this approach cannot handle packets of different service types, which may have similar traffic characteristics, resulting in low accuracy.

[0070] In the above-mentioned service access control method, the binding relationship between the terminal identification information, application identification information and application requirement information is verified according to the pre-stored registration information to determine whether it is a legal terminal. When the verification is passed, the service diversion policy is sent to the edge access device to connect the service application message corresponding to the terminal access information to the data center network. It can accurately identify counterfeit and tampered terminal access information, identify counterfeit and tampered service application messages, ensure that the terminal access information on the application side can be trusted on the network side, and has not been tampered with or counterfeited, and provide normal services to legal terminals, accurately and effectively solving the security issues in the APN6 access scenario.

[0071] In an exemplary embodiment, the above method also includes: when the binding relationship between the terminal identification information, application identification information and application requirement information fails to pass the verification, sending a message discarding policy or a message rate limiting policy to the edge access device; the message discarding policy is used to instruct the edge access device to discard the business application message corresponding to the terminal access information, and the message rate limiting policy is used to instruct the edge access device to limit the rate of the business application message corresponding to the terminal access information.

[0072] Optionally, when the binding relationship between the terminal identification information, application identification information, and application requirement information is inconsistent with the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, application identification information, and application requirement information has not passed the verification, indicating that the business application message corresponding to the terminal access information is illegal, and the terminal corresponding to the terminal access information is an illegal terminal. At this time, the network control system sends a message discarding policy or a message speed limiting policy to the edge access device. When the edge access device receives the message discarding policy, it discards the business application message corresponding to the terminal access information. When the edge access device receives the message speed limiting policy, it limits the speed of the business application message corresponding to the terminal access information.

[0073] Traditionally, to address application-side impersonation, access control lists (ACLs) are deployed at the network boundary of the trusted domain to filter packets entering from outside the trusted domain. However, this approach requires manual adjustments once the five-tuple changes, making operations and maintenance difficult and preventing automatic blocking of service traffic.

[0074] In this embodiment, when the binding relationship between the terminal identification information, application identification information and application requirement information fails to pass the verification, a message discarding policy or a message speed limiting policy is sent to the edge access device to implement message discarding or speed limiting of business application messages, which can prevent the traffic of tampered and forged business application messages from affecting the normal forwarding of the network.

[0075] In an optional manner of the above embodiment, sending the packet discarding policy or the packet rate limiting policy to the edge access device includes: sending the packet discarding policy or the packet rate limiting policy to the edge access device through a border gateway flow specification protocol.

[0076] Because the Border Gateway Flow Specification Protocol provides a flexible way to define, transmit and apply traffic filtering rules, it can help network administrators achieve more precise and scalable traffic control. When the binding relationship between terminal identification information, application identification information and application requirement information fails to pass the verification, the Border Gateway Flow Specification Protocol sends a message discarding policy or a message rate limiting policy to the edge access device, which can achieve more precise and scalable traffic control for business application messages.

[0077] In an optional manner of the above embodiment, when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass verification, a preset rule may be used to determine whether to issue a message discarding policy or a message rate limiting policy.

[0078] Optionally, when the binding relationship between the terminal identification information, application identification information and application requirement information fails to pass the verification, sending the message discarding policy to the edge access device includes: when the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the pre-stored registration information lacks terminal identification information, determining that the binding relationship between the terminal identification information, application identification information and application requirement information fails to pass the verification, and sending the message discarding policy to the edge access device.

[0079] When it is detected that the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the pre-stored registration information lacks terminal identification information, a message discarding policy can be sent to the edge access device to avoid providing network services to illegal terminals.

[0080] In an optional manner of the above embodiment, when the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, sending the message rate limit policy to the edge access device includes: when the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and the application requirement information is inconsistent, determining that the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, and sending the message rate limit policy to the edge access device.

[0081] When it is detected that the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is consistent, and at least one of the application identification information and application requirement information is inconsistent, a message rate limit policy can be sent to the edge access device, which not only ensures uninterrupted application traffic, but also ensures normal application network services.

[0082] In another embodiment, Figure 4 As shown, a service access control method is provided, comprising the following steps:

[0083] Step 402: Receive terminal access information reported by an edge access device. The terminal access information includes terminal identification information, application identification information, and application requirement information.

[0084] Step 404: Verify the binding relationship between the terminal identification information, the application identification information, and the application requirement information according to the pre-stored registration information.

[0085] Step 406: When the verification is passed, the business diversion strategy is sent to the edge access device through the border gateway flow specification protocol; the business diversion strategy is used to instruct the edge access device to divert the business application message corresponding to the terminal access information to the segmented routing tunnel that meets the application requirement information, and connect the business application message to the data center network through the segmented routing tunnel that meets the application requirement information.

[0086] Step 408, when the binding relationship between the terminal identification information, application identification information and application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is missing in the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, application identification information and application requirement information has not passed the verification, and the message discarding policy is sent to the edge access device through the border gateway flow specification protocol.

[0087] Step 410, when the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and the application requirement information is inconsistent, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information has not passed the verification, and the message rate limit policy is sent to the edge access device through the border gateway flow specification protocol.

[0088] In this embodiment, the binding relationship between the terminal identification information, application identification information, and application requirement information is verified based on the pre-stored registration information to determine whether it is a legitimate terminal. When the verification is passed, a service diversion policy is sent to the edge access device to connect the service application message corresponding to the terminal access information to the data center network. This can accurately identify counterfeit and tampered terminal access information, identify counterfeit and tampered service application messages, ensure that the terminal access information on the application side is trustworthy on the network side, has not been tampered with or counterfeited, and provide normal services to legitimate terminals. In addition, when the verification fails, a message discarding policy or a message rate limiting policy is sent to the edge access device to prevent the traffic of tampered and counterfeit service application messages from affecting the normal forwarding of the network, thereby accurately and effectively solving the security issues in the APN6 access scenario.

[0089] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0090] Based on the same inventive concept, embodiments of the present application also provide a service access control system for implementing the aforementioned service access control method. The implementation solution provided by this system is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations of one or more service access control system embodiments provided below can be found in the above-mentioned limitations of the service access control method and will not be further elaborated here.

[0091] In an exemplary embodiment, Figure 5As shown, a service access control system is provided, comprising: an application-side terminal network, a backbone network, and a data center network. The application-side terminal network includes a terminal management system, at least one terminal, and a terminal aggregation device. For example, the at least one terminal may include terminal A and terminal B. The backbone network includes a network control system and backbone forwarding devices PE1 to PE8. PE1 represents an edge access device. The network control system can communicate with the backbone forwarding devices. The data center network includes application servers, wherein:

[0092] At least one terminal is used to send a service application message to an edge access device.

[0093] The edge access device is used to parse the business application message, obtain the terminal access information, and upload the terminal access information to the network control system. The terminal access information includes terminal identification information, application identification information and application requirement information; the network control system is used to verify the binding relationship between the terminal identification information, application identification information and application requirement information according to the pre-stored registration information; when the binding relationship between the terminal identification information, application identification information and application requirement information passes the verification, the business diversion strategy is issued to the edge access device; the edge access device is used to connect the business application message to the data center network according to the business diversion strategy.

[0094] The data center network is used to provide network services corresponding to business application messages for at least one terminal.

[0095] Specifically, at least one terminal is used to encapsulate the application identification information and application requirement information corresponding to the application into the initial application message to obtain a business application message. The initial application message refers to an ordinary IPV6 message, including the source address, destination address, application data, etc. In general, since there are many terminals, and the edge access devices of the backbone network are relatively few and fixed, such as PE1. Therefore, at least one terminal aggregation device, such as a terminal aggregation switch, is added between the terminal and the edge access device. The terminal aggregation device is used to aggregate the business application messages sent by at least one terminal and send the aggregated business application messages to the edge access device.

[0096] In this embodiment, the network control system determines whether it is a legitimate terminal by verifying the binding relationship between the terminal identification information, application identification information and application requirement information based on pre-stored registration information. When the verification is passed, the service diversion policy is sent to the edge access device, and the edge access device connects the service application message corresponding to the terminal access information to the data center network, so that the service access system can accurately identify counterfeit and tampered terminal access information, so as to identify counterfeit and tampered service application messages, ensure that the terminal access information on the application side can be trusted on the network side, and has not been tampered with or counterfeited, and provide normal services to legitimate terminals, accurately and effectively solving the security issues in the APN6 access scenario.

[0097] In an exemplary embodiment, the application-side terminal network further includes:

[0098] The terminal management system is used to bind the terminal identification information, application identification information and application requirement information to obtain registration information, and send the registration information to the network control system.

[0099] The network control system is used to store registration information.

[0100] Specifically, before performing service access control, the terminal management system pre-binds the terminal identification information, application identification information and application requirement information to obtain registration information, and synchronizes the registration information to the network control system, which is conducive to the network control system to accurately identify counterfeit and tampered service application messages.

[0101] In an exemplary embodiment, the edge access device is further configured to upload the terminal access information to the network control system via a remote data acquisition protocol.

[0102] Edge access devices use the remote data collection protocol, Telemetry, to report terminal access information. This enables granular application visualization, providing an intuitive and complete understanding of network traffic flow, and tracking, analyzing, and locating network performance and faults. This addresses the inability of existing network technologies, such as SNMP (Simple Network Management Protocol) and NetFlow (network monitoring), to track, analyze, and locate network performance and faults when acquiring service traffic information. Furthermore, it integrates with APN6 to profile traffic characteristics of key applications or terminals, presenting traffic paths, characteristics, patterns of change, and trends, enabling visual monitoring of application traffic.

[0103] Furthermore, before performing service access control, the service access system is also used to configure protocol channels between backbone forwarding devices, such as the OSPF (Open Shortest Path First) protocol, and to open control protocol channels between backbone forwarding devices and the network control system, such as the Telemetry protocol for collecting terminal access information and the BGP FlowSpec protocol for issuing application message processing policies.

[0104] In an exemplary embodiment, Figure 6 Figure 1 shows a schematic diagram of service access control in a service access system, in which the service access system performs service access control in the order of numbers ① to ⑤. Specifically, ①: The terminal management system is used to bind the terminal identification information, application identification information, and application requirement information of the terminal to obtain registration information, and then send the registration information to the network control system; the network control system is used to store the registration information. ②: The terminal is used to encapsulate the application identification information and application requirement information corresponding to the application into an initial application message to obtain a service application message. The terminal aggregation device is used to aggregate the service application messages sent by at least one terminal and send the aggregated service application messages to the edge access device. ③: The edge access device is used to parse the service application message to obtain terminal access information and upload the terminal access information to the network control system via the Telemetry protocol. ④: The network control system is used to verify the binding relationship between the terminal identification information, application identification information, and application requirement information based on pre-stored registration information. If the verification is successful, the network control system sends a service diversion policy to the edge access device. If the verification fails, the network control system sends a message drop policy or a message rate limit policy to the edge access device. ⑤: BGP FlowSpec protocol supports diverting traffic to SPv6 channels, discarding packets, or limiting the packet rate.

[0105] For example, Figure 7Figure 1 shows an application diagram of the service access system. Terminal A registers an application with the terminal management system. The specific information is: Terminal A, Application App-1, APN-ID: xx, APN-Para: low latency (low latency requirement). When a user at Terminal A uses Application App-1, the service application message sent by Terminal A encapsulates the APN-ID and application requirement information, APN-Para, which are consistent with the information registered with the terminal management system. After receiving the service application message from Terminal A, the backbone network's edge access device, PE1, parses the message to obtain Terminal A's terminal access information and reports it to the network control system using the Telemetry protocol. The network control system verifies that the terminal access information reported by PE1 is consistent with the registered information. Based on the application requirement information in Terminal A's terminal access information, it uses BGP FlowSpec to issue a service diversion policy, directing Terminal A's service application messages to an SRv6 tunnel that meets the application requirements of App-1, enabling Terminal A to access the application server on the data center network. The SRv6 tunnel that meets the requirements of App-1 is the tunnel between PE1 and PE8. The forwarding path of this tunnel is PE1-PE2-PE4-PE6-PE8.

[0106] Terminal B registers an application in the terminal management system. The specific information is: Terminal B, Application App-2, APN-ID: yy, APN-Para: normal (normal requirements). When Terminal B uses Application App-2, to obtain better network service, Terminal B sends service application packets encapsulated with Application App-2, but forged with App1's APN ID: xx, which is inconsistent with the information registered in the terminal management system. After receiving the service application packet from Terminal B, PE1, the edge access device in the backbone network, parses the packet to obtain Terminal B's access information and reports it to the network control system using the Telemetry protocol. After verification, the network control system finds that the access information reported by Terminal B is inconsistent with the registered information. This identifies forgery and uses BGP FlowSpec to issue a packet drop or rate limit policy. This policy drops or limits the rate of App2 traffic from Terminal B to prevent the tampered and forged application traffic from disrupting network forwarding.

[0107] Each module in the service access control device described above may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0108] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store pre-stored registration information, service diversion strategies, message discard strategies, message rate limit strategies and other data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a service access control method is implemented.

[0109] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0110] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0111] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0112] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0113] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0114] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0115] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0116] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A service access control method, characterized in that: The method comprises: Receive terminal access information reported by the edge access device, wherein the terminal access information includes terminal identification information, application identification information, and application requirement information; Verifying the binding relationship between the terminal identification information, the application identification information, and the application requirement information according to pre-stored registration information; When the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, the service diversion strategy is sent to the edge access device; the service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, so that the terminal corresponding to the terminal access information can access the data center network.

2. The method according to claim 1, characterized in that The method further comprises: When the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, a message discarding policy or a message rate limiting policy is sent to the edge access device; the message discarding policy is used to instruct the edge access device to discard the business application message corresponding to the terminal access information, and the message rate limiting policy is used to instruct the edge access device to limit the rate of the business application message corresponding to the terminal access information.

3. The method according to claim 2, characterized in that When the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass verification, sending a message discarding policy to the edge access device includes: When the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and the terminal identification information is missing in the pre-stored registration information, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information has not passed the verification, and a message discarding policy is sent to the edge access device.

4. The method according to claim 2, characterized in that When the binding relationship between the terminal identification information, the application identification information, and the application requirement information fails to pass verification, sending the message rate limit policy to the edge access device includes: When the binding relationship between the terminal identification information, the application identification information and the application requirement information is inconsistent with the pre-stored registration information, and at least one of the application identification information and the application requirement information is inconsistent, it is determined that the binding relationship between the terminal identification information, the application identification information and the application requirement information fails to pass the verification, and a message rate limit policy is sent to the edge access device.

5. The method according to claim 2, characterized in that The sending of the message discarding policy or the message rate limiting policy to the edge access device includes: A message discarding policy or a message rate limiting policy is sent to the edge access device via a border gateway flow specification protocol.

6. The method according to claim 1, characterized in that issuing the service diversion strategy to the edge access device; The service diversion strategy is used to instruct the edge access device to connect the service application message corresponding to the terminal access information to the data center network, including: Sending a service diversion strategy to the edge access device via a border gateway flow specification protocol; The service diversion strategy is used to instruct the edge access device to divert the service application message corresponding to the terminal access information to the segment routing tunnel that meets the application requirement information, and connect the service application message to the data center network through the segment routing tunnel that meets the application requirement information.

7. A service access control system, characterized in that: The system comprises: An application-side terminal network, comprising at least one terminal; at least one of the terminals is configured to send a service application message to an edge access device; A backbone network, comprising a network control system and a backbone forwarding device, wherein the backbone forwarding device comprises an edge access device; the edge access device is used to parse the business application message to obtain terminal access information, and upload the terminal access information to the network control system, wherein the terminal access information comprises terminal identification information, application identification information and application requirement information; the network control system is used to verify the binding relationship between the terminal identification information, the application identification information and the application requirement information according to pre-stored registration information; when the binding relationship between the terminal identification information, the application identification information and the application requirement information passes the verification, a business diversion strategy is issued to the edge access device; the edge access device is used to connect the business application message to the data center network according to the business diversion strategy; The data center network is used to provide network services corresponding to the business application message to at least one of the terminals.

8. The system according to claim 7, characterized in that The application side terminal network also includes: The terminal management system is used to bind the terminal identification information, the application identification information and the application requirement information to obtain registration information, and send the registration information to the network control system; The network control system is used to store the registration information.

9. The system according to claim 7, wherein: The edge access device is further configured to upload the terminal access information to the network control system via a remote data acquisition protocol.

10. The system according to claim 7, wherein: The application side terminal network also includes: The terminal aggregation device is used to aggregate the service application messages sent by at least one of the terminals and send the aggregated service application messages to the edge access device.

Images