Network equipment management method and system, computer equipment and readable storage medium

Abstract

The embodiment of the invention provides a network equipment management method and system, computer equipment and a readable storage medium. The method comprises the following steps: a communication gateway obtains a login authentication message transmitted by first network equipment through a data transmission tunnel; wherein the data transmission tunnel is generated based on an open virtual private network protocol; the communication gateway performs key analysis on the login authentication message to obtain a to-be-verified key of the first network equipment; the communication gateway determines a first domain management and control server used for managing and controlling the first network equipment based on a preset domain relation mapping table, and reads a corresponding management and control authentication key; wherein the preset domain relation mapping table comprises a management authority mapping relation of each domain management and control server to different network devices; and the communication gateway merges the first network device into a target domain network managed and controlled by the first domain management and control server when comparing that the secret key to be verified is consistent with the management and control authentication secret key. Therefore, the expandability of the network can be increased while the complexity of system management is reduced.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a network device management method, system, computer device and readable storage medium. Background Art

[0002] In recent years, Internet technology and network services have developed rapidly, and scalable, efficient, and intelligent network control and management have become an important development direction of mobile Internet. In mobile Internet, mobile devices, as the main body of communication, retain a large amount of data information, which can be used to analyze network performance and provide various services. With the increasing number of application scenarios and mobile devices, the demand for communication between devices and the complexity of unified management of all devices are also increasing. Effective management of massive mobile devices has become a key issue that needs to be solved in the mobile Internet era.

[0003] In the related art, most multi-domain network systems provide interfaces for software-defined networking (SDN) based on the OpenFlow protocol to facilitate the control and management of the data plane. However, when the network topology changes and the traffic routing needs to be adjusted, the controller will generate corresponding OpenFlow rules based on the current workload of each server and send them to the switch so that the switch forwards the incoming data packets to the most suitable destination server according to these rules. However, this adjustment method may cause some problems. On the one hand, the forwarding action depends entirely on the implementation of the OpenFlow interface of the switch, and each forwarding decision needs to be defined through the OpenFlow table entry, which means that any change in the network topology or policy requires the update of the corresponding table entry. As the scale of the network expands, the difficulty of managing and maintaining these table entries increases exponentially, thereby increasing the complexity of the system. On the other hand, the OpenFlow protocol has undergone multiple versions of development, and there are functional differences and grammatical changes between different versions, which affects the scalability of the network. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to provide a network device management method, system, computer device and readable storage medium, which can reduce the complexity of system management while increasing the scalability of the network.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a network device management method, which is applied to a network device management system, wherein the network device management system includes a central control server, multiple domain control servers and a communication gateway, and the method includes:

[0006] The communication gateway obtains a login authentication message transmitted by the first network device via a data transmission tunnel; wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports a communication connection between any network device and a corresponding domain control server;

[0007] The communication gateway performs key parsing on the login authentication message to obtain a key to be verified of the first network device;

[0008] The communication gateway determines, based on a preset domain relationship mapping table, a first domain control server for controlling the first network device, and reads a control authentication key generated by the first domain control server for the first network device;

[0009] The preset domain relationship mapping table includes a mapping relationship between the management authority of each domain control server for different network devices, and the management authority of each domain control server for the corresponding network device is determined and granted by the central control server based on the registration configuration information of the corresponding network device;

[0010] When the communication gateway compares the key to be verified and the control authentication key and finds that the key is consistent with the control authentication key, the communication gateway incorporates the first network device into the target domain network controlled by the first domain control server.

[0011] In some implementations, before the communication gateway obtains the login authentication message transmitted by the first network device via the data transmission tunnel, the method further includes:

[0012] The central control server obtains registration configuration information corresponding to the first network device and saves the registration configuration information; wherein the first network device is a communication device to be incorporated into the domain network;

[0013] The central control server determines, based on the registration configuration information, a first domain control server having a management authority mapping relationship with the first network device;

[0014] Encapsulating the registration configuration information and the management authority mapping relationship into a first message, and transmitting the first message to the first domain management and control server and the communication gateway respectively;

[0015] The first domain control server extracts device identification information of the first network device from the first message, and saves the device identification information;

[0016] The communication gateway extracts the management authority mapping relationship from the first message, and stores the management authority mapping relationship in a domain relationship mapping table.

[0017] In some implementations, after the communication gateway extracts the management authority mapping relationship from the first message and stores the management authority mapping relationship in a domain relationship mapping table, the communication gateway further includes:

[0018] The communication gateway obtains first network device information managed by the first domain control server;

[0019] When the first network device information indicates that the first network device is the first network device managed by the first domain management and control server, the communication gateway adds a network address translation route for the first network device.

[0020] In some implementations, before the communication gateway obtains the login authentication message transmitted by the first network device via the data transmission tunnel, the method further includes:

[0021] The communication gateway configures the communication data of the data transmission tunnel through a pre-configured open virtual private network server, wherein the communication data at least includes a port address for receiving data messages, a tunnel transmission protocol, a tunnel mode, a target certificate storage path, a certificate verification algorithm path, and a target network segment that the first network device is allowed to access;

[0022] After the open virtual private network client pre-installed on the communication gateway and the open virtual private network server are both turned on, a data transmission tunnel is formed between the communication gateway and the first network device, wherein the open virtual private network client is configured with at least the Internet Protocol address and the port address of the open virtual private network server.

[0023] In some implementations, the network device management method further includes:

[0024] The communication gateway receives a network exit request message sent by the second network device via a corresponding data transmission tunnel;

[0025] The communication gateway verifies the network withdrawal request message according to the field structure of the network withdrawal request message to obtain a first verification result;

[0026] When the first verification result indicates that the network exit request message has passed the verification, the communication gateway transmits the network exit request message to the second domain control server corresponding to the second network device;

[0027] The second domain management and control server deletes the data resources corresponding to the second network device according to the network exit request message;

[0028] The second domain control server sends a data refresh request to the central control server, so that the central control server refreshes the data of the network device management system after receiving the data refresh request;

[0029] The communication gateway deletes the management authority mapping relationship corresponding to the second network device in the domain relationship mapping table.

[0030] In some implementations, the communication gateway verifies the network disconnection request message according to the field structure of the network disconnection request message to obtain a first verification result, including:

[0031] The communication gateway obtains a verification hash table;

[0032] The communication gateway extracts fields from the network exit request message according to the field structure to obtain a plurality of fields to be checked;

[0033] The communication gateway performs regular check on the corresponding multiple fields to be checked respectively based on the regular rule corresponding to each field to be checked in the check hash table to obtain a first check result.

[0034] In some implementations, after the communication gateway deletes the management authority mapping relationship corresponding to the second network device in the domain relationship mapping table, the communication gateway further includes:

[0035] The communication gateway obtains the second network device information managed by the second domain control server;

[0036] When the second network device information indicates that the second network device is the last network device managed by the second domain management and control server, the communication gateway deletes the network address translation route corresponding to the second network device.

[0037] In some implementations, the network device management method further includes:

[0038] The central control server transmits a first device transfer request message to the communication gateway, wherein the first device transfer request message includes registration configuration information of a third network device to be transferred, and server information of a third domain control server to which the third network device needs to be transferred;

[0039] The communication gateway verifies the first device transfer request message according to the field structure of the received first device transfer request message to obtain a second verification result;

[0040] When the second verification result indicates that the first device transfer request message has passed the verification, the communication gateway transfers the target data message subsequently transmitted by the third network device to the target queue for temporary storage;

[0041] The communication gateway parses the first device transfer request message to determine the third domain control server to which the third network device is transferred;

[0042] The communication gateway extracts the server information of the destination domain control server from the first device transfer request message, and modifies the management authority mapping relationship between the third network device and the historically associated domain control server in the domain relationship mapping table according to the server information, so as to establish an updated management authority mapping relationship between the third network device and the third domain control server;

[0043] The historically associated domain control server deletes the device identification information corresponding to the third network device;

[0044] The third domain control server stores the device identification information corresponding to the third network device, and transfers the target data message temporarily stored in the target queue to the third domain control server.

[0045] In some implementations, the network device management method further includes:

[0046] When the third network device to be transferred is a single network device, the communication gateway adds a network address translation route for the third network device according to the Internet Protocol address of the third network device;

[0047] When the number of the plurality of third network devices to be transferred exceeds a preset threshold, the communication gateway adds a network address translation route for the plurality of third network devices according to a network segment address corresponding to any third network device.

[0048] In some implementations, the network device management method further includes:

[0049] When a domain control server fails, the central control server determines a fourth network device that has a management authority mapping relationship with the failed domain control server;

[0050] Obtaining, through the central control server, available loads corresponding to a plurality of domain control servers operating normally, and determining at least one fourth domain control server from the plurality of domain control servers based on the available loads;

[0051] The central control server transmits a second device transfer request message to the communication gateway; wherein the second device transfer request message includes the registration configuration information of the fourth network device to be transferred, and the server information of the fourth domain control server to which the fourth network device needs to be transferred.

[0052] Accordingly, a second aspect of an embodiment of the present application proposes a network device management system, including a central control server, multiple domain control servers and a communication gateway, including:

[0053] The central control server is used to determine the management authority granted to each domain control server for the corresponding network device based on the registration configuration information of the corresponding network device;

[0054] The domain control server is used to manage corresponding network devices;

[0055] The communication gateway is used to obtain a login authentication message transmitted by the first network device via a data transmission tunnel, perform key parsing on the login authentication message, and obtain a key to be verified of the first network device, wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports a communication connection between any network device and a corresponding domain control server;

[0056] The communication gateway is further used to determine a first domain control server for controlling the first network device based on a preset domain relationship mapping table, and read a control authentication key generated by the first domain control server for the first network device, wherein the preset domain relationship mapping table includes a mapping relationship between management permissions of each domain control server for different network devices;

[0057] The communication gateway is further used to merge the first network device into the target domain network controlled by the first domain control server when the key to be verified is consistent with the control authentication key.

[0058] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the network device management method described in any one of the embodiments of the first aspect of the present application when executing the computer program.

[0059] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the network device management method described in any one of the embodiments of the first aspect of the present application.

[0060] In the embodiment of the present application, a communication gateway is used to obtain a login authentication message transmitted by a first network device via a data transmission tunnel; wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports the communication connection between any network device and the corresponding domain control server; the communication gateway performs key analysis on the login authentication message to obtain the key to be verified of the first network device; the communication gateway determines the first domain control server used to control the first network device based on a preset domain relationship mapping table, and reads the control authentication key of the first domain control server; wherein the preset domain relationship mapping table contains the management authority mapping relationship of each domain control server to different network devices, and the management authority of each domain control server to the corresponding network device is determined and granted by the central control server based on the registration configuration information of the corresponding network device; when the communication gateway compares the key to be verified and the control authentication key to be consistent, the first network device is incorporated into the target domain network controlled by the first domain control server. In this way, all network devices managed by the domain control server can be connected to the central control server and the communication gateway through the open virtual private network protocol. When the network topology changes, only the configuration needs to be updated on the central control server and the communication gateway, without the need to set up a controller in each branch and perform separate maintenance and changes on the controller, which reduces the system complexity and management costs and improves the management efficiency. On the other hand, as an independent open virtual private network protocol solution, the open virtual private network protocol can establish a communication connection between a network device and a communication gateway through a corresponding tunnel, can run on a variety of hardware platforms, does not require specific protocol-compatible hardware, and does not have specific requirements for hardware and platforms, which greatly increases the scalability of the network. In summary, the present application can increase the scalability of the network while reducing the complexity of system management. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a schematic diagram of the architecture of the network device management system provided in the embodiment of the present application;

[0062] Figure 2 This is a functional module diagram of the device management system provided by the embodiment of the present application.

[0063] Figure 3 is a flow chart of a network device management method provided by an embodiment of the present application;

[0064] Figure 4 is a network access flow chart of a network device provided in an embodiment of the present application;

[0065] Figure 5 is a flowchart of network device disconnection provided by an embodiment of the present application;

[0066] Figure 6 is a flow chart of inter-domain transfer of a network device provided in an embodiment of the present application;

[0067] Figure 7 It is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0069] It should be noted that, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0070] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0071] In recent years, Internet technology and network services have developed rapidly, and scalable, efficient, and intelligent network control and management have become an important development direction of mobile Internet. In mobile Internet, mobile devices, as the main body of communication, retain a large amount of data information, which can be used to analyze network performance and provide various services. With the increasing number of application scenarios and mobile devices, the demand for communication between devices and the complexity of unified management of all devices are also increasing. Effective management of massive mobile devices has become a key issue that needs to be solved in the mobile Internet era.

[0072] In the related art, most multi-domain network systems provide interfaces for software-defined networking (SDN) based on the OpenFlow protocol to facilitate the control and management of the data plane. However, when the network topology changes and the traffic routing needs to be adjusted, the controller will generate corresponding OpenFlow rules based on the current workload of each server and send them to the switch so that the switch forwards the incoming data packets to the most suitable destination server according to these rules. However, this adjustment method may cause some problems. On the one hand, the forwarding action depends entirely on the implementation of the OpenFlow interface of the switch, and each forwarding decision needs to be defined through the OpenFlow table entry, which means that any change in the network topology or policy requires the update of the corresponding table entry. As the scale of the network expands, the difficulty of managing and maintaining these table entries increases exponentially, thereby increasing the complexity of the system. On the other hand, the OpenFlow protocol has undergone multiple versions of development, and there are functional differences and grammatical changes between different versions, which affects the scalability of the network.

[0073] Based on this, the embodiments of the present application provide a network device management method, system, computer device and readable storage medium, which can reduce the complexity of system management while increasing the scalability of the network.

[0074] The network device management method, system, computer device and readable storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the network device management system in the embodiments of the present application is described.

[0075] Please refer to Figure 1 In some implementations, an embodiment of the present application provides a device management system, including a central control server, multiple domain control servers, and a communication gateway.

[0076] In some implementations, a central management center (CMC) is used to determine the management authority granted to each domain management server for the corresponding network device based on the registration configuration information of the corresponding network device;

[0077] Area Controller (AR), used to manage corresponding network devices;

[0078] A communication gateway (Gateway Router, GR), used to obtain a login authentication message transmitted by the first network device via a data transmission tunnel, perform key parsing on the login authentication message, and obtain a key to be verified of the first network device, wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports a communication connection between any network device and a corresponding domain control server;

[0079] The communication gateway is further used to determine a first domain control server for controlling the first network device based on a preset domain relationship mapping table, and read a control authentication key generated by the first domain control server for the first network device, wherein the preset domain relationship mapping table includes a mapping relationship of management permissions of each domain control server to different network devices;

[0080] The communication gateway is also used to merge the first network device (Mobile Router, MR) into the target domain network controlled by the first domain control server when the key to be verified and the control authentication key are consistent.

[0081] The specific implementation of the network device management system is basically the same as the specific implementation of the network device management method, which will be further described below and will not be repeated here.

[0082] Please refer to Figure 2 In some implementations, the functional modules of the device management system include a communication interaction module, a domain management module, a security protection module, and a data storage module, and each module can communicate and interact.

[0083] Exemplarily, a communication interaction module is provided in the central control server, the domain control server, the communication gateway and the network device, and the communication interaction module can standardize the data message format and the interaction process transmitted in the network. For example, the communication interaction module can maintain the forwarding of communication messages between the network device and the domain control server, as well as the mapping relationship between the two, the update of system routing information, and the message parsing of the communication gateway.

[0084] Furthermore, a domain management module can be set in the communication gateway and the central control server. The domain management module can use tunnel technology and routing strategies to adjust the structure of the domain network, divide different network domains, and maintain the domain relationship of network devices. Specifically, it includes information mapping and updating between network devices and domain networks, as well as updating of domain network information.

[0085] Furthermore, a security protection module can be set in the communication gateway, which can check the format of the data packets flowing through to prevent illegal or invalid data packets from attacking the internal network. The security protection module can be used for key consistency check in the network device management system, message security check, etc.

[0086] Furthermore, a data storage module can be set in the communication gateway, domain management server and central management server. The data storage module can perform distributed storage of information transmitted from remote devices, including the design of a preset domain relationship mapping table, etc. The data storage module can include the storage and update of information of network devices connected to the network, the storage and update of domain network information and mapping information between network devices and domain management servers, the storage of key information and routing information, etc.

[0087] In some implementations, on the premise of meeting the requirements of the embodiments of the present application, the network device management system may also be provided with other functional modules to implement the network device management method in the embodiments of the present application.

[0088] The network device management method in the embodiments of the present application can be illustrated by the following embodiments.

[0089] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for enabling the normal operation of the embodiment of the present application will be obtained.

[0090] In the embodiment of the present application, the network device management system will be described from the perspective of the network device management system, which may include a central control server, multiple domain control servers, and a communication gateway. The network device management system may be integrated into a computer device. Figure 3 and Figure 4 , Figure 3 and Figure 4 This is a flowchart of the steps of the network device management method provided in the embodiment of the present application. The embodiment of the present application takes the network device management system as an example of being specifically integrated on a terminal or a server. When the processor on the terminal or the server executes the program instructions corresponding to the network device management method, the specific process is as follows:

[0091] Step 101, the communication gateway obtains a login authentication message transmitted by the first network device via a data transmission tunnel; wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports a communication connection between any network device and a corresponding domain control server.

[0092] In some embodiments, in order to ensure the security of the internal network, when a network device needs to access the network, the login authentication message of the corresponding first network device can be obtained through the data transmission tunnel, so that the first network device can be authenticated through the login authentication message to improve the efficiency and security of network management.

[0093] Among them, the communication gateway can be a unified entry point for data transmission between network devices and multiple internal domain networks. In addition, the communication gateway also undertakes tasks such as security checking, key resolution and network address translation routing.

[0094] The first network device may be a new network device to be incorporated into the corresponding domain network, and may be any type of network terminal or router.

[0095] The data transmission tunnel may be a secure transmission channel created based on an open virtual private network protocol (Open Virtual Private Network, OpenVPN), and is used to transmit data packets between two network entities.

[0096] The login authentication message may be a verification data packet sent to the communication gateway through a data transmission tunnel when a new network device attempts to join the corresponding domain network for the first time. The login authentication message contains the identity information of the first network device and the key material required for authentication, which is used to prove the legal identity of the first network device and request access permission.

[0097] Among them, the open virtual private network protocol can be an open source virtual private network protocol for creating a secure encrypted tunnel on a public network (such as the Internet). The open virtual private network protocol allows users to securely access remote networks or services through a public network (such as the Internet), which can adapt to different network environments and network device types and does not rely on specific hardware.

[0098] The domain control server can be used to manage and maintain the status information and configuration parameters of all network devices in the domain network.

[0099] Exemplarily, the login authentication message may include the device identification of the first network device, the Media Access Control (MAC) address or serial number, the user name or user password, the digital certificate, the device status information, etc. The login authentication messages corresponding to different network devices may be different, and shall be determined based on the actual situation.

[0100] Specifically, a data transmission tunnel created based on an open virtual private network protocol can be used to transmit login authentication messages, so that after authentication, the first network device can be added to the corresponding domain network without making large-scale adjustments to the entire infrastructure, and a secure and reliable communication path is provided for the first network device.

[0101] By using the communication gateway as the unified entry point for data transmission between network devices and multiple internal domain networks, the system not only realizes centralized management and efficient data routing, but also ensures key tasks such as security checks, key resolution, and network address translation routing for all incoming and outgoing data. For new network devices to be incorporated into the domain network (such as the first network device), no matter what type of terminal or router it is, it can send login authentication messages through a secure transmission tunnel created based on an open virtual private network protocol to perform identity authentication and access requests, so that the new device can quickly and securely join the corresponding domain network and enjoy a stable and reliable encrypted communication path in subsequent operations.

[0102] In some implementations, in order to ensure that all first network devices attempting to access the network have gone through a formal registration process so as to facilitate effective management and monitoring thereof, the central control server may select the most appropriate domain control server for the first target device according to the specific conditions of the first target device (e.g., regional location, functional requirements, etc.), and transmit the information to the domain control server and the communication gateway to ensure that it can be quickly and accurately integrated into the existing management system, thereby optimizing resource utilization and simplifying the network architecture. Exemplarily, before step 101, it may also include:

[0103] (A.1) The central control server obtains registration configuration information corresponding to the first network device and saves the registration configuration information; wherein the first network device is a communication device to be incorporated into the domain network;

[0104] (A.2) The central control server determines, based on the registration configuration information, a first domain control server having a management authority mapping relationship with the first network device;

[0105] (A.3) Encapsulating the registration configuration information and the management authority mapping relationship into a first message, and transmitting the first message to the first domain management and control server and the communication gateway respectively;

[0106] (A.4) The first domain management and control server extracts the device identification information of the first network device from the first message, and saves the device identification information;

[0107] (A.5) The communication gateway extracts the management authority mapping relationship from the first message, and stores the management authority mapping relationship in the domain relationship mapping table.

[0108] Among them, the central control server can be one of the core components of the network equipment management system, responsible for performing cross-domain equipment management tasks, such as network equipment access, network exit and inter-domain transfer in the entire network, and working with communication gateways, domain control servers and network equipment to achieve efficient domain management of large-scale network equipment.

[0109] The registration configuration information may refer to a set of basic information submitted by the first network device to be incorporated into the domain network when applying to join. The registration configuration information includes but is not limited to the device name, Internet Protocol address, geographical location, the domain network, intended use, etc., to help the central control server evaluate and determine the target domain network to be assigned to the first network device.

[0110] The first domain control server may be a domain control server selected by the central control server for managing network devices. Each domain network has its own dedicated domain control server to handle all related affairs within the domain network.

[0111] The first message may be an information packet including registration configuration information of the first network device and a management authority mapping relationship between the first network device and the corresponding first domain control server.

[0112] The device identification information may be a basic information set used to uniquely identify and configure the first network device, such as the device name and Internet Protocol address of the first network device.

[0113] The management authority mapping relationship may describe the scope of control authority that the first domain control server has over the first network device, that is, which specific domain control server can manage and configure the first network device. The management authority mapping relationship is determined by the central control server based on the registration configuration information of the first network device.

[0114] The domain relationship mapping table may be a database table stored inside the communication gateway, which records the corresponding relationship between each domain management and control server and its associated network devices.

[0115] For example, assume that a new first network device (such as router Device_X) needs to be added to a LAN in the internal network. The following are the detailed steps in the specific implementation process:

[0116] First, the network administrator registers the registration configuration information of the first network device on the central management and control platform, such as the device name (Device_X), the province where it is located (Province A), the IP address (100.600.1.100), and the first domain management and control server (AR_A).

[0117] Furthermore, after receiving the above registration configuration information, the central control server can verify and save it. Afterwards, the central control server can encapsulate these registration configuration information together with the management authority mapping relationship into a first message named "First_Report". The first message can be transmitted to the first domain control server (AR_A) and the communication gateway through the communication interaction module.

[0118] Furthermore, after receiving the "First_Report" message, the first domain management server (AR_A) extracts the device identification information (such as device name, Internet Protocol address, etc.) of Device_X therefrom, and saves the device identification information in its local database for subsequent management and use.

[0119] Furthermore, the communication gateway can extract the mapping relationship between Device_X and AR_A from the first message named "First_Report" and store it in its own domain relationship mapping table. In this way, through centralized management and unified configuration, the relevant information of the new first network device is saved accordingly, reducing the possibility of human error, ensuring data consistency, and improving data maintainability.

[0120] Through the above methods, centralized management and unified configuration of cross-domain devices can be achieved through the central control server, ensuring the accurate storage of new device information and efficient operation of the network, and improving the efficiency and flexibility of large-scale network device management.

[0121] In some implementations, in order to ensure that the newly added first network device can communicate with the corresponding first domain control server or external network through the communication gateway, when the first network device information indicates that the first network device is the first network device managed by the first domain control server, the communication gateway can add a network address translation route for the first network device so that data can be transmitted smoothly. For example, after (A.5), it can also include:

[0122] (B.1) The communication gateway obtains the first network device information managed by the first domain control server;

[0123] (B.2) When the first network device information indicates that the first network device is the first network device managed by the first domain management and control server, the communication gateway adds a network address translation route for the first network device.

[0124] The first network device information may be information of multiple network devices managed by the first domain control server, including but not limited to the number of the multiple network devices managed.

[0125] Among them, the network address translation route can be a (Network Address Translation, NAT) route, which can be a rule or path set by the communication gateway for the first network device, so that the first network device can smoothly access the Internet or other external networks, while protecting the first network device's real internal Internet Protocol address from being directly recognized by the outside world.

[0126] In some implementations, when the first network device joins the domain network managed by the domain control server, since before this, the domain network has no task network device to access the external network or communicate with other internal networks through the public Internet Protocol (IP) address, it is necessary to add a network address translation route for the first network device to ensure that the first network device can correctly communicate between the internal and external networks. When there are subsequent network devices joining the same domain network, the existing address translation rules can be reused, and there is no need to configure a new network address translation route for each network device separately, thereby saving public IP address resources and simplifying network configuration.

[0127] Exemplarily, after the communication gateway obtains the first network device information managed by the first domain control server (AR_A), it learns that the first network device (MR_X) is the first device managed by the first domain control server. Therefore, the communication gateway can add a network address translation route for MR_X, mapping MR_X's private IP address (192.168.1.2) to the public IP address (203.0.113.1) of the communication gateway, so that MR_X can access the Internet.

[0128] Through the above methods, the communication gateway can intelligently decide when and how to configure the network address translation route, which not only ensures that each network device can communicate safely and efficiently, but also optimizes the utilization and management process of network resources to the maximum extent. Especially for large-scale and dynamically changing enterprise network environments, this mechanism provides higher flexibility and reliability.

[0129] In some implementations, in order to ensure that the first network device can be incorporated into the corresponding target domain network in the safest way while maintaining good communication performance and service quality, a data transmission tunnel can be configured between the first network device and the communication gateway to ensure the security of data transmission and enhance the scalability and flexibility of the network architecture. Exemplarily, before step 101, the following may also be included:

[0130] (C.1) The communication gateway configures the communication data of the data transmission tunnel through a pre-configured open virtual private network server, wherein the communication data at least includes a port address for receiving data messages, a tunnel transmission protocol, a tunnel mode, a target certificate storage path, a certificate verification algorithm path, and a target network segment that the first network device is allowed to access;

[0131] (C.2) After the open virtual private network client pre-installed on the first network device and the open virtual private network server are both turned on, a data transmission tunnel is formed between the communication gateway and the first network device, wherein the open virtual private network client is configured with at least the Internet Protocol address and port address of the open virtual private network server.

[0132] Among them, the open virtual private network server can be a software component based on the OpenVPN protocol, which can be run on the communication gateway. By establishing an encrypted connection between the open virtual private network server and the open virtual private network client, it can ensure that the data exchange between the internal network and the external network is both safe and reliable.

[0133] The communication data may be a set of parameters and information that need to be configured when setting up a data transmission tunnel. The communication data is used to define the relevant data for building, maintaining and terminating a secure communication channel.

[0134] The tunnel transmission protocol may be a transport layer protocol used by the data transmission tunnel, and the tunnel transmission protocol may be a User Datagram Protocol (UDP) or a Transmission Control Protocol (TCP).

[0135] The tunnel mode may be a virtual network interface type used by a data transmission tunnel, which is used to create a secure data transmission channel. The tunnel mode may be a network tunnel (TUN) or a point-to-point tunnel (TAP).

[0136] Among them, the target certificate storage path can be the file path of the digital certificate (such as the root certificate), and the target certificate is used to sign the digital certificates (such as the root certificate) of the open virtual private network server and the open virtual private network client to ensure the authenticity of the identities of both parties.

[0137] The certificate verification algorithm path may be a specified Diffie-Hellman parameter file path, which is used to securely negotiate a shared key between an open virtual private network client and an open virtual private network server.

[0138] The target network segment may be an intranet segment that allows an open virtual private network client to access, so that the open virtual private network client can access corresponding resources through a data transmission tunnel.

[0139] The open virtual private network client may be an application installed on the first network device, responsible for initiating and maintaining a secure connection with the open virtual private network server. The open virtual private network client may locate the corresponding open virtual private network server according to preset configuration items (such as the Internet Protocol address and port address of the server).

[0140] In some embodiments, the establishment of the data transmission tunnel depends on the close cooperation between the pre-configured open virtual private network (OpenVPN) server and the client. Specifically, as a core node, the communication gateway can define the communication rules of the secure channel by setting a series of key parameters (such as port address, transmission protocol, tunnel mode, certificate storage path, verification algorithm path and target network segment) in the open virtual private network server. When the OpenVPN client is installed and configured on the first network device and successfully connected to the OpenVPN server on the communication gateway, an encrypted data transmission tunnel is formed between the two. The data transmission tunnel not only ensures the security and privacy of all transmitted data, but also allows remote network devices to securely access the internal network through the public Internet, while realizing effective management and monitoring of these network devices.

[0141] For example, if the first network device MR1 needs to be securely added to the internal network of enterprise A. First, install and configure the OpenVPN Server program (i.e., open virtual private network server) on the communication gateway, set the port address to 1194, use the UDP transmission protocol, and specify the routing tunnel mode as tun. Then, configure the certificate authority (CA) certificate, the location of the server public key and private key, and the certificate verification algorithm path and other security parameters, and set the target network segment allowed to be accessed for MR1.

[0142] Further, the OpenVPN client (i.e., the open virtual private network client) can be installed on MR1, and the necessary information is configured, including the Internet Protocol address and port address (i.e., remote address remote) of the communication gateway, the CA certificate (ca.crt) and the key (cl ient.key) required for authentication. And add a tunnel route on MR1, transfer the sent data packet to the tun interface on MR1, and ensure that it is transmitted through the data transmission tunnel. Finally, after starting the OpenVPN service of both parties, the data transmission tunnel between MR1 and the communication gateway can be established. At this time, the communication gateway will detect the data packet of port 1194, and forward the data from MR1 to the corresponding domain control server according to the preset routing rules, so as to achieve the management of MR1 and the secure transmission of data. In addition, the communication gateway turns on the IP forwarding function to ensure that the data packet can accurately reach the domain control server, so that the data transmission tunnel between the new network device MR1 and the communication gateway is established. In some embodiments, the data transmission tunnel between any network device and the communication gateway can be established with reference to the above steps, and this application will not be repeated here.

[0143] By building a data transmission tunnel between the first network device and the communication gateway, the first network device can be securely added to the internal network, ensuring that it can access necessary internal resources while maintaining the security and reliability of data transmission, providing a solid foundation for domain management of large-scale network devices.

[0144] Step 102: The communication gateway performs key analysis on the login authentication message to obtain the key to be verified of the first network device.

[0145] In some implementations, in order to prevent unauthorized network devices from accessing and ensure the security and stability of the network environment, the communication gateway may parse and authenticate the login authentication message sent by the first network device to ensure that only authorized devices can successfully join the network.

[0146] Among them, the key to be verified can be encrypted information extracted from the login authentication message and used to verify the identity of the first network device. The key to be verified can be generated by the first network device and encapsulated into a login authentication message and sent to the communication gateway when the first network device attempts to access the network.

[0147] For example, if the first network device Device_X needs to be securely incorporated into the domain network of enterprise A, after establishing a data transmission tunnel between Device_X and the communication gateway, Device_X will send a login authentication message containing authentication information to the communication gateway through the data transmission tunnel. After receiving the login authentication message sent by Device_X, the communication gateway will first perform a preliminary analysis on it and extract key fields in the login authentication message, including but not limited to device identification information (such as MAC address or serial number), user name / password, digital certificate, etc. Further, the communication gateway can extract the pre-shared key or other forms of key material used for encrypted transmission from the login authentication message. If the key material is encrypted, the pre-configured server private key is used to decrypt this part of the data to restore the original key to be verified. For example, if the key secret-key-123456 is extracted, then secret-key-123456 is the key to be verified.

[0148] Through the above method, the communication gateway can efficiently and accurately verify each first network device attempting to join the network, ensuring that only first network devices that meet the requirements can obtain access rights, thereby ensuring the security and stability of the entire network environment.

[0149] Step 103: The communication gateway determines a first domain control server for controlling the first network device based on a preset domain relationship mapping table, and reads a control authentication key generated by the first domain control server for the first network device;

[0150] Among them, the preset domain relationship mapping table contains the management authority mapping relationship of each domain control server to different network devices, and the management authority of each domain control server to the corresponding network device is determined and granted by the central control server based on the registration configuration information of the corresponding network device.

[0151] In some embodiments, in order to ensure that the first network device is assigned to the correct management domain, the identity authentication process of the first network device can be completed by searching and matching the correct management and control authentication key in the preset domain relationship mapping table, so that the first network device can be safely and reliably assigned to the appropriate domain network, while also ensuring the effective use of network resources and service quality, and achieving a more efficient and intelligent network management method.

[0152] The control authentication key may be encrypted information generated by the first domain control server for a specific first network device and fed back to the communication gateway for storage.

[0153] In some implementations, the preset domain relationship mapping table includes a mapping relationship of management permissions of each domain control server to corresponding network devices. Specifically, after the first network device successfully registers with the central control server, the central control server will assign the first network device to the corresponding first domain control server, and the assigned first domain control server has management permissions for the first network device, and encapsulate the permission mapping relationship into a message and send it to the communication gateway, which saves the permission mapping relationship through the preset domain relationship mapping table.

[0154] In some implementations, the management and control authentication key can also be a shared key, and the domain management server can verify all network devices with management permissions through this shared key. The key is used to verify the login authentication request from the device, ensuring that only devices with the correct key can be authorized to join the corresponding domain network. The management and control authentication key is created when the device is first registered and is uniquely associated with the identity of each device to ensure the security and accuracy of identity authentication.

[0155] In some embodiments, after receiving a first message sent by a central control server and parsing the first message to determine the first network device that needs to be managed, the control authentication key can generate a corresponding control authentication key for the first network device and send it to the communication gateway for storage. Alternatively, after receiving a login authentication message sent by the first network device, the communication gateway can generate a corresponding control authentication key for the first network device and send it to the communication gateway. Exemplarily, the control authentication key can be in the form of deviceX-key-12345, etc.

[0156] Through the above method, the security and accuracy of the identity authentication of the first network device are ensured, the domain management process of large-scale network equipment is simplified, the resource utilization and service response speed are improved, and it is conducive to the subsequent rapid comparison of the key to be verified and the management and control authentication key.

[0157] Step 104: When the communication gateway compares the key to be verified and the control authentication key and finds that they are consistent, the communication gateway incorporates the first network device into the target domain network controlled by the first domain control server.

[0158] In some implementations, in order to ensure that the first network device can be smoothly integrated into the domain network corresponding to the domain control server, the verified first network device can be incorporated into the target domain network controlled by the first domain control server to optimize resource allocation and management efficiency and enhance system security.

[0159] The target domain network can be a specific network area or subnet that the first network device is formally included in and allowed to access after successfully passing identity authentication. Each target domain network can be managed by at least one domain management server and has independent security policies, access control lists, and service configurations. The first network device joining the target domain network means that it can communicate with other network devices belonging to the same domain and enjoy corresponding network resources and services according to preset rules.

[0160] Exemplarily, the first network device is represented by Device_X. When the communication gateway determines that the key to be verified is deviceX-key-12345 by parsing the login authentication message of Device_X, the communication gateway can query the control authentication key deviceX-key-12345 generated by the first domain control server for Device_X in the domain relationship mapping table, and save it in the local database. At the same time, the key to be verified is compared with the control authentication key to find out that the key to be verified and the control authentication key are consistent. Therefore, the first network device can be incorporated into the target domain network controlled by the first domain control server.

[0161] In some embodiments, when the key to be verified and the control authentication key are consistent, indicating that the first network device has failed to access the network, the communication gateway can return a prompt of failed network access to the first network device. When the number of network access failures of the first network device exceeds a preset number, for example, more than 3 times, the communication gateway can refuse to receive the login authentication message of the first network device.

[0162] In the embodiment of the present application, a communication gateway is used to obtain a login authentication message transmitted by a first network device via a data transmission tunnel; wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports the communication connection between any network device and the corresponding domain control server; the communication gateway performs key analysis on the login authentication message to obtain the key to be verified of the first network device; the communication gateway determines the first domain control server used to control the first network device based on a preset domain relationship mapping table, and reads the control authentication key of the first domain control server; wherein the preset domain relationship mapping table contains the management authority mapping relationship of each domain control server to different network devices, and the management authority of each domain control server to the corresponding network device is determined and granted by the central control server based on the registration configuration information of the corresponding network device; when the communication gateway compares the key to be verified and the control authentication key to be consistent, the first network device is incorporated into the target domain network controlled by the first domain control server. In this way, all network devices managed by the domain control server can be connected to the central control server and the communication gateway through the open virtual private network protocol. When the network topology changes, only the configuration needs to be updated on the central control server and the communication gateway, without the need to set up a controller in each branch and perform separate maintenance and changes on the controller, which reduces the system complexity and management costs and improves the management efficiency. On the other hand, as an independent open virtual private network protocol solution, the open virtual private network protocol can establish a communication connection between a network device and a communication gateway through a corresponding tunnel, can run on a variety of hardware platforms, does not require specific protocol-compatible hardware, and does not have specific requirements for hardware and platforms, which greatly increases the scalability of the network. In summary, the present application can increase the scalability of the network while reducing the complexity of system management.

[0163] Please refer to Figure 5 In some implementations, when a network device needs to exit a domain network, in order to ensure that the network device can be safely and orderly removed from the management domain to which it belongs, a security check can be performed on the exit request message to verify the accuracy and security of the exit request message, so as to maintain the overall security of the network and the effective management of resources. For example, the network device management method may also include:

[0164] (D.1) The communication gateway receives a network exit request message sent by the second network device via the corresponding data transmission tunnel;

[0165] (D.2) The communication gateway verifies the network disconnection request message according to the field structure of the network disconnection request message to obtain a first verification result;

[0166] (D.3) When the first verification result indicates that the network exit request message has passed the verification, the communication gateway transmits the network exit request message to the second domain control server corresponding to the second network device;

[0167] (D.4) The second domain management and control server deletes the data resources corresponding to the second network device according to the network exit request message;

[0168] (D.5) The second domain control server sends a data refresh request to the central control server, so that the central control server refreshes the data of the network device management system after receiving the data refresh request;

[0169] (D.6) The communication gateway deletes the management authority mapping relationship corresponding to the second network device in the domain relationship mapping table.

[0170] The second network device may be any network device that has joined the target domain network and is currently initiating a withdrawal request with the intention of withdrawing from or being removed from the current target domain network. The second network device may send a withdrawal request message because the device no longer needs to use the network resources, the device fails, the location changes, or other management requirements.

[0171] The network exit request message may be an encrypted message information generated by the second network device and sent to the communication gateway, which is used to formally request to leave the current target domain network. The network exit request message contains necessary information fields, such as device identifier, reason description, etc., so that the system can correctly handle its network exit process.

[0172] The first verification result may be a result obtained by the communication gateway performing a series of verifications (such as format check, signature verification, etc.) on the content of the message after receiving the network exit request message. The first verification result is used to determine whether to continue processing the network exit request of the second network device.

[0173] The second domain control server may be a domain control server currently managing the second network device. The second domain control server receives the network exit request message forwarded by the communication gateway and performs corresponding cleanup operations on data resources related to the second network device.

[0174] The data resources may include but are not limited to configuration files, log records, session status and other related information stored in the second domain management and control server related to the second network device.

[0175] For example, if the second network device a is a mobile router of enterprise A, and now it needs to be removed from the internal network (i.e., the target domain network), the second network device a can encapsulate a network withdrawal request message, including the MAC address 00:A0:C9:14:C8:29 of the second network device a and the target domain network information, and send it to the communication gateway through the data transmission tunnel.

[0176] Further, when the communication gateway receives the network exit request message, it can use the preset regular rule to verify the fields in the network exit request message to obtain a first verification result to confirm the legitimacy and integrity of the network exit request message. In some implementations, the verification rules for different fields can be set according to actual conditions, and the embodiments of the present application do not impose specific restrictions on this.

[0177] Further, when the first verification result indicates that the network exit request message has passed the verification, the communication gateway can forward the network exit request message to the second domain control server corresponding to the second network device a. After receiving the network exit request message, the second domain control server cleans up all configuration files, log records and database entries related to the second network device a, and stops any associated tasks or services.

[0178] Furthermore, after the second domain control server has deleted all resource data related to the second network device a, it can send a data refresh request to the central control server through the communication interaction module, prompting the central control server to update the relevant information in its network device management system to ensure the consistency and accuracy of the data.

[0179] Furthermore, when the central control server refreshes the data of the entire network, the communication gateway will also update the corresponding domain relationship mapping table and delete the management authority mapping relationship related to the second network device a.

[0180] Through the above method, the second network device can be successfully withdrawn from the target domain network in a safe and orderly manner, ensuring the security of the network environment and the effective management of resources. In this way, not only the stability and consistency of the system are maintained, but also the overall management and operation efficiency is improved.

[0181] In some implementations, in order to achieve highly automated and refined verification of the network exit request message, regular rules can be introduced to verify the network exit request message, so as to enhance the security protection capability of the system while ensuring that each network exit request can be processed accurately. For example, (D.2) may include:

[0182] (D.2.1) The communication gateway obtains the verification hash table;

[0183] (D.2.2) The communication gateway extracts fields from the network exit request message according to the field structure to obtain multiple fields to be checked;

[0184] (D.2.3) The communication gateway performs regular check on the corresponding multiple fields to be checked based on the regular rule corresponding to each field to be checked in the check hash table to obtain a first check result.

[0185] Among them, the verification hash table can be a data structure that stores field names and their corresponding regular rules, which is used to verify whether each field to be verified in the network exit request message meets the expected format and content requirements. Each entry in the verification hash table contains an identifier of a field to be verified and a regular expression or other form of verification rule associated with it. The verification hash table can be pre-defined by the system administrator according to security policies and service requirements, or automatically generated by the system through preset data, so that it can be loaded and used by the communication gateway when needed.

[0186] The field to be checked may be a specific information item or data element extracted from the network exit request message, and the field to be checked is a key component of the entire message.

[0187] The regular rule may be a text matching pattern, which is used to define the valid format of each field in the data message to ensure that the received data meets the expected standard.

[0188] Exemplarily, the fields to be checked may include a device identifier, timestamp, operation type, etc. When checking the network exit request message, the communication gateway will take out each field to be checked one by one and check it according to the preset regular rules. Each field to be checked has its own corresponding regular rule to ensure its legality and accuracy.

[0189] Exemplarily, when the network exit request message needs to be verified, a preset verification hash table can be loaded first, and the verification hash table contains each field to be verified and its corresponding regular rule. After that, the communication gateway can parse the network exit request message, extract each key field, that is, the field to be verified. For example, the field to be verified can be mac_address, domain_name and time stamp, and apply the corresponding regular rule to each field. If all the fields to be verified pass the verification, the first verification result is verification passed.

[0190] Through the above method, the communication gateway can efficiently and accurately verify the legitimacy of the network exit request message, ensuring that only requests that meet the specifications can be further processed, thereby ensuring the security and reliability of the network.

[0191] In some implementations, in order to optimize network configuration and reduce unnecessary resource usage, when the second network device is the last network device managed by the second domain control server, the data transmission tunnel and network address translation route related to the domain control server can be deleted through the communication gateway to optimize the network configuration. For example, after (D.6), it can also include:

[0192] (E.1) The communication gateway obtains the second network device information managed by the second domain control server;

[0193] (E.2) When the second network device information indicates that the second network device is the last network device managed by the second domain management and control server, the communication gateway deletes the network address translation route corresponding to the second network device.

[0194] The second network device information may be information on the number of network devices managed by the second domain control server.

[0195] For example, assume that the second network device a is the last network device managed by the second domain control server, its MAC address is 00:A0:C9:14:C8:29, IP address is 192.168.1.100, connected to the communication gateway through a data transmission tunnel, and assigned an internal IP address of 10.8.0.2. When the second network device a needs to be disconnected from the network, the communication gateway requests the second domain control server to obtain the list of devices currently under management, confirms that the second network device a is the last (that is, the only one currently managed) device managed by the second domain control server, and the communication gateway can delete the network address translation route corresponding to the second network device a, as well as the corresponding tunnel route, that is, delete the data transmission tunnel related to the network device managed by the second domain control server.

[0196] Through the above methods, the security of the network environment and the effective management of resources can be ensured, relevant resources can be released in time, and the accuracy of network configuration can be ensured.

[0197] Please refer to Figure 6 In some implementations, in order to provide a safe, orderly and efficient method for handling cross-domain transfer of network devices, the communication gateway may be notified of the need for device transfer and the necessary configuration information may be provided to ensure that data loss does not occur during the device transfer process, so that the device can quickly adapt to the new working environment and continue to provide stable services, thereby ensuring the accuracy and integrity of information transmission. For example, the network device management method may also include:

[0198] (F.1) The central control server transmits a first device transfer request message to the communication gateway, wherein the first device transfer request message includes registration configuration information of the third network device to be transferred, and server information of the third domain control server to which the third network device needs to be transferred;

[0199] (F.2) the communication gateway verifies the first device transfer request message according to the field structure of the received first device transfer request message to obtain a second verification result;

[0200] (F.3) When the second verification result indicates that the first device transfer request message has passed the verification, the communication gateway transfers the target data message subsequently transmitted by the third network device to the target queue for temporary storage;

[0201] (F.4) The communication gateway parses the first device transfer request message and determines the third domain control server to which the third network device is transferred;

[0202] (F.5) The communication gateway extracts the server information of the destination domain control server from the first device transfer request message, and modifies the management authority mapping relationship between the third network device and the historically associated domain control server in the domain relationship mapping table according to the server information, so as to establish an updated management authority mapping relationship between the third network device and the third domain control server;

[0203] (F.6) The historically associated domain control server deletes the device identification information corresponding to the third network device;

[0204] (F.7) The third domain control server saves the device identification information corresponding to the third network device, and transfers the target data message temporarily stored in the target queue to the third domain control server.

[0205] The first device transfer request message may be a special message generated by the central control server and sent to the communication gateway, which is used to instruct to transfer a specific network device (third network device) from the current management domain to another designated management domain. The first device transfer request message includes the registration configuration information of the device to be transferred and the relevant information of the new domain control server.

[0206] The third network device may be a specific network device that is planned to be transferred from one domain network to another domain network for management. The third network device may be a domain that needs to be changed due to business requirements, location changes or other management reasons.

[0207] The third domain control server may be a new domain control server that will take over the third network device. The third domain control server is responsible for receiving and managing the devices transferred to this domain, ensuring that these network devices can be smoothly integrated into the new network environment, and providing necessary management and monitoring services.

[0208] The server information may include but is not limited to detailed information such as the IP address, port number, and access rights of the third domain control server, which is used to clearly identify and connect to the domain control server.

[0209] Among them, the second verification result can be the verification result obtained by the communication gateway after receiving the first device transfer request message, by performing a series of verifications (such as format checking, signature verification, etc.) on the content of the first device transfer request message, to decide whether to continue processing this transfer request.

[0210] The target data message may be a data packet generated by the third network device during or after the transfer process and needs to be forwarded to the new third domain control server. The target data message may contain important information such as device status updates and log records, which must be properly processed to ensure the normal operation and service continuity of the third network device.

[0211] The target queue may be a buffer in the communication gateway for temporarily storing data packets to be processed. When the device is being transferred, all data packets from the third network device will be temporarily stored in this queue until the transfer is completed and then forwarded to the new third domain control server.

[0212] In some implementations, the central control server can globally evaluate and decide which devices need to be transferred between domains, and centrally manage all network devices to ensure that all operations are performed within a controlled range, ensuring data consistency and avoiding confusion that may be caused by decentralized decision-making.

[0213] Exemplarily, assume that there is a large-scale network, which includes multiple domain control servers, a central control server and a communication gateway. Now, it is necessary to transfer a third network device (represented by MR_Z) from the domain network control range of a second domain control server AR_C to the domain network control range of a third domain control server AR_D. First, the central control server can encapsulate a first device transfer request message, which contains the registration configuration information of MR_Z (such as device name, IP address, etc.) and the server information of the third domain control server AR_D (such as IP address, etc.). After the above information is encapsulated, the first device transfer request message can be obtained. The central control server can send the first device transfer request message to the communication gateway through the communication interaction module of the agent program. The communication gateway verifies the multiple preset fields in the first device transfer request message according to the field structure of the received first device transfer request message, and obtains a second verification result. If it is determined that the message format of the first device transfer request message is correct and the information is complete, a second verification result that passes the verification can be obtained.

[0214] Further, when the second verification result indicates that the first device transfer request message has passed the verification, the communication gateway starts to block the newly generated target data message from MR_Z, and transfers the target data message to the target queue for temporary storage, so as to avoid the newly generated target data message from being lost during the device transfer process. Further, the target queue can be set in the communication gateway, or in a storage module uniformly maintained by the system.

[0215] Furthermore, the communication gateway can parse the verified first device transfer request message, extract the server information of the third network device to be transferred, such as device identification information, device IP address, etc., and determine the third domain management server AR_D to which the third network device is to be transferred.

[0216] Furthermore, since the domain relationship mapping table of the communication gateway stores the management authority mapping relationship between the third network device and the historically associated domain control server AR_C, and after the third network device MR_Z is transferred, AR_C will no longer have the authority to manage MR_Z. Therefore, it is necessary to modify the management authority mapping relationship, that is, to modify the management authority mapping relationship between MR_Z and AR_C to the management authority mapping relationship between MR_Z and AR_D.

[0217] Furthermore, since AR_C, which was historically associated with MR_Z, no longer has management authority over MR_Z, the device identification information and corresponding data resources related to MR_Z can be deleted in AR_C. When the third network device MR_Z is the last network device managed by AR_C, the communication gateway also needs to delete the network address translation route corresponding to AR_C. If MR_Z is not the last network device managed by AR_C, it does not need to be deleted.

[0218] In some implementations, before deleting the device identification information and corresponding data resources related to MR_Z in AR_C, the data resources can be copied or transferred to the origin field of the database table for backup, so that the relevant historical information of MR_Z can be queried when needed, so as to facilitate recovery and backtracking of domain migration operations.

[0219] Further, after receiving the verified first device transfer request message, the third domain control server AR_D can extract the device identification information (such as device identification information) of the third network device MR_Z from the first device transfer request message and save it. Further, AR_D can save the target data message of MR_Z temporarily stored in the target queue.

[0220] Furthermore, after the third domain management and control server AR_D saves the device identification information and target data message of MR_Z, it can request the central management and control server to refresh the visualization status of the entire network through the communication interaction module to facilitate resource update.

[0221] Through centralized management and strict verification mechanisms, network devices can be safely and orderly migrated between different management domains, while maintaining the consistency and stability of the entire network. This improves management efficiency while also enhancing system security and reliability.

[0222] In some implementations, in order to achieve effective resource utilization and ease of management, during the device transfer process, the communication gateway may add corresponding network address translation routes according to the number and specific circumstances of the devices to be transferred, so as to flexibly and efficiently adjust the configuration of the network address translation routes according to different circumstances. Exemplarily, the network device management method may also include:

[0223] (G.1) When the third network device to be transferred is a single network device, the communication gateway adds a network address translation route for the third network device according to the Internet Protocol address of the third network device;

[0224] (G.2) When the number of the plurality of third network devices to be transferred exceeds a preset threshold, the communication gateway adds a network address translation route for the plurality of third network devices according to the network segment address corresponding to any third network device.

[0225] Among them, the network segment address can be a network identifier used to identify a set of IP address ranges. The network segment address can be composed of a network part and a subnet mask to define a specific subnet or network segment. For example, in IPv4, "192.168.1.0 / 24" means that all IP addresses from "192.168.1.0" to "192.168.1.255" belong to the same network segment, so "192.168.1.0 / 24" belongs to the network segment address from "192.168.1.0" to "192.168.1.255".

[0226] For example, when equipment migration in a test environment or equipment adjustment under specific business needs requires manual migration of a single third network device (such as mobile router MR_Z) to a new management domain, the communication gateway can add a separate network address translation route that is accurate to IP based on the IP address (Internet Protocol address) of MR_Z to ensure that other devices are not affected and the migration process is more controllable.

[0227] For example, when a domain local router fails and triggers an emergency strategy involving the automatic migration of all network devices in the domain, it is very time-consuming and inefficient to configure the network address translation route for each network device one by one. Since network devices in the same domain network usually share the same network segment address, a network segment-level network address translation route is sufficient to ensure that all data packets of third network devices can be correctly forwarded to the new domain control server. Therefore, by adding a network address translation route covering the entire network segment, all relevant network devices can be processed at one time to improve configuration efficiency.

[0228] Furthermore, whether multiple network devices with the same network segment address need to be migrated simultaneously can be determined by determining whether the number of the multiple third network devices to be migrated exceeds a preset threshold. For example, the preset threshold can be set to 3, 5, 10, etc., and this application does not limit the specific value.

[0229] In some embodiments, when the number of multiple third network devices to be transferred exceeds a preset threshold, whether it is necessary to add a corresponding network address translation route to each third network device one by one, or to uniformly add a network address translation route to the network segment addresses corresponding to multiple third network devices, can also be determined by the technicians.

[0230] Through the above methods, the communication gateway can flexibly configure network address translation routes according to different migration scenarios, improving management and operation efficiency.

[0231] In some implementations, in order to quickly and safely transfer the affected network devices to other normally operating domain control servers when a domain control server fails, the server most suitable for taking over the fourth network device can be selected based on the load of the normally operating domain control server to ensure service continuity and network stability, and improve resource utilization and management efficiency. For example, the network device management method may also include:

[0232] (H.1) When a domain control server fails, the central control server determines a fourth network device that has a management authority mapping relationship with the failed domain control server;

[0233] (H.2) obtaining, through the central control server, available loads corresponding to multiple domain control servers that are operating normally, and determining at least one fourth domain control server from the multiple domain control servers based on the available loads;

[0234] (H.3) The central control server transmits a second device transfer request message to the communication gateway; wherein the second device transfer request message includes registration configuration information of the fourth network device to be transferred, and server information of the fourth domain control server to which the fourth network device needs to be transferred.

[0235] The fourth network device may be a network device originally managed by a failed domain control server. Since the original domain control server of the fourth network device has problems, it needs to be transferred to another normally operating domain control server for management and monitoring to ensure that it can continue to work normally and provide services.

[0236] The fourth domain control server may be one or more new domain control servers selected from a plurality of normally operating domain control servers, and is used to take over the fourth network device affected by the failure of the original management server. The fourth domain control server is selected based on the available load to ensure that the new domain control server can effectively handle the newly added management tasks without being overloaded.

[0237] The second device transfer request message may be a data message generated by the central control server and sent to the communication gateway, which is used to instruct to transfer a specific fourth network device from the failed domain control server to the selected fourth domain control server. The second device transfer request message includes the registration configuration information of the device to be transferred and the relevant information of the new domain control server, ensuring that the transfer operation can be performed smoothly.

[0238] For example, if there is a large network, it is divided into multiple domain networks, each domain network corresponds to its own domain control server. If the second domain control server (AR_B) fails, it affects the fourth network devices MR_G, MR_W, etc. managed by it. At this time, the central control server will determine all the fourth network devices that have a management authority mapping relationship with the failed domain control server AR_B.

[0239] Furthermore, the central control server can obtain the available loads corresponding to multiple domain control servers in normal operation, and select the domain control server with the largest available load, such as AR_X, as the fourth domain control server to take over the fourth network devices such as MR_G and MR_W.

[0240] Furthermore, the central control server can generate a second device transfer request message based on the registration configuration information of MR_G, MR_W, etc., the server information of the fourth domain control server AR_X to which the fourth network device needs to be transferred, and the management authority mapping relationship between the fourth network device and AR_X, and send the second device transfer request message to the communication gateway through the communication interaction module.

[0241] In some embodiments, after the communication gateway receives the second device transfer request message, the communication gateway parses the second device transfer request message to determine the fourth domain control server to which the fourth network device is transferred. Thereafter, the communication gateway extracts the server information of the fourth domain control server from the second device transfer request message, and based on the server information, modifies the management authority mapping relationship between the fourth network device and the failed domain control server in the domain relationship mapping table to establish an updated management authority mapping relationship between the fourth network device and the fourth domain control server. The failed domain control server deletes the device identification information corresponding to the fourth network device, and the fourth domain control server saves the device identification information corresponding to the fourth network device, and transfers the target data message temporarily stored in the target queue to the fourth domain control server. The details of the specific network device transfer have been expanded above and will not be repeated here.

[0242] Through the above method, the affected network devices can be quickly transferred to a new domain control server when the domain control server fails, ensuring service continuity and network stability, while improving resource utilization and management efficiency.

[0243] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above network device management method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0244] See also Figure 7 , Figure 7 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0245] The processor 71 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0246] The memory 72 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 72 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 72, and the processor 71 calls and executes the network device management method of the embodiment of this application;

[0247] Input / output interface 73, used to implement information input and output;

[0248] Communication interface 74, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0249] A bus 75 that transmits information between the various components of the device (e.g., the processor 71, the memory 72, the input / output interface 73, and the communication interface 74);

[0250] The processor 71 , the memory 72 , the input / output interface 73 and the communication interface 74 are connected to each other in communication within the device via a bus 75 .

[0251] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned network device management method is implemented.

[0252] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0253] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0254] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0255] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0256] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0257] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0258] It should be understood that in the present application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0259] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0260] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0261] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0262] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0263] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A network device management method, characterized in that: Applied to a network device management system, the network device management system includes a central control server, multiple domain control servers and a communication gateway, the method includes: The communication gateway obtains a login authentication message transmitted by the first network device via a data transmission tunnel; wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports a communication connection between any network device and a corresponding domain control server; The communication gateway performs key parsing on the login authentication message to obtain a key to be verified of the first network device; The communication gateway determines, based on a preset domain relationship mapping table, a first domain control server for controlling the first network device, and reads a control authentication key generated by the first domain control server for the first network device; The preset domain relationship mapping table includes a mapping relationship between the management authority of each domain control server for different network devices, and the management authority of each domain control server for the corresponding network device is determined and granted by the central control server based on the registration configuration information of the corresponding network device; When the communication gateway compares the key to be verified and the control authentication key and finds that the key is consistent with the control authentication key, the communication gateway incorporates the first network device into the target domain network controlled by the first domain control server.

2. The network device management method according to claim 1, characterized in that: Before the communication gateway obtains the login authentication message transmitted by the first network device via the data transmission tunnel, the communication gateway further includes: The central control server obtains registration configuration information corresponding to the first network device and saves the registration configuration information; wherein the first network device is a communication device to be incorporated into the domain network; The central control server determines, based on the registration configuration information, a first domain control server having a management authority mapping relationship with the first network device; Encapsulating the registration configuration information and the management authority mapping relationship into a first message, and transmitting the first message to the first domain management and control server and the communication gateway respectively; The first domain control server extracts device identification information of the first network device from the first message, and saves the device identification information; The communication gateway extracts the management authority mapping relationship from the first message, and stores the management authority mapping relationship in a domain relationship mapping table.

3. The network device management method according to claim 2, characterized in that: After the communication gateway extracts the management authority mapping relationship from the first message and stores the management authority mapping relationship in the domain relationship mapping table, the method further includes: The communication gateway obtains first network device information managed by the first domain control server; When the first network device information indicates that the first network device is the first network device managed by the first domain management and control server, the communication gateway adds a network address translation route for the first network device.

4. The network device management method according to claim 1, characterized in that: Before the communication gateway obtains the login authentication message transmitted by the first network device via the data transmission tunnel, the communication gateway further includes: The communication gateway configures the communication data of the data transmission tunnel through a pre-configured open virtual private network server, wherein the communication data at least includes a port address for receiving data messages, a tunnel transmission protocol, a tunnel mode, a target certificate storage path, a certificate verification algorithm path, and a target network segment that the first network device is allowed to access; After the open virtual private network client pre-installed on the communication gateway and the open virtual private network server are both turned on, a data transmission tunnel is formed between the communication gateway and the first network device, wherein the open virtual private network client is configured with at least the Internet Protocol address and the port address of the open virtual private network server.

5. The network device management method according to claim 1, characterized in that: The method further comprises: The communication gateway receives a network exit request message sent by the second network device via a corresponding data transmission tunnel; The communication gateway verifies the network withdrawal request message according to the field structure of the network withdrawal request message to obtain a first verification result; When the first verification result indicates that the network exit request message has passed the verification, the communication gateway transmits the network exit request message to the second domain control server corresponding to the second network device; The second domain management and control server deletes the data resources corresponding to the second network device according to the network exit request message; The second domain control server sends a data refresh request to the central control server, so that the central control server refreshes the data of the network device management system after receiving the data refresh request; The communication gateway deletes the management authority mapping relationship corresponding to the second network device in the domain relationship mapping table.

6. The network device management method according to claim 5, characterized in that: The communication gateway verifies the network withdrawal request message according to the field structure of the network withdrawal request message to obtain a first verification result, including: The communication gateway obtains a verification hash table; The communication gateway extracts fields from the network exit request message according to the field structure to obtain a plurality of fields to be checked; The communication gateway performs regular check on the corresponding multiple fields to be checked respectively based on the regular rule corresponding to each field to be checked in the check hash table to obtain a first check result.

7. The network device management method according to claim 5, characterized in that: After the communication gateway deletes the management authority mapping relationship corresponding to the second network device in the domain relationship mapping table, the method further includes: The communication gateway obtains the second network device information managed by the second domain control server; When the second network device information indicates that the second network device is the last network device managed by the second domain management and control server, the communication gateway deletes the network address translation route corresponding to the second network device.

8. The network device management method according to claim 1, characterized in that: The method further comprises: The central control server transmits a first device transfer request message to the communication gateway, wherein the first device transfer request message includes registration configuration information of a third network device to be transferred, and server information of a third domain control server to which the third network device needs to be transferred; The communication gateway verifies the first device transfer request message according to the field structure of the received first device transfer request message to obtain a second verification result; When the second verification result indicates that the first device transfer request message has passed the verification, the communication gateway transfers the target data message subsequently transmitted by the third network device to the target queue for temporary storage; The communication gateway parses the first device transfer request message to determine the third domain control server to which the third network device is transferred; The communication gateway extracts the server information of the destination domain control server from the first device transfer request message, and modifies the management authority mapping relationship between the third network device and the historically associated domain control server in the domain relationship mapping table according to the server information, so as to establish an updated management authority mapping relationship between the third network device and the third domain control server; The historically associated domain control server deletes the device identification information corresponding to the third network device; The third domain control server stores the device identification information corresponding to the third network device, and transfers the target data message temporarily stored in the target queue to the third domain control server.

9. The network device management method according to claim 8, characterized in that: The method further comprises: When the third network device to be transferred is a single network device, the communication gateway adds a network address translation route for the third network device according to the Internet Protocol address of the third network device; When the number of the plurality of third network devices to be transferred exceeds a preset threshold, the communication gateway adds a network address translation route for the plurality of third network devices according to a network segment address corresponding to any third network device.

10. The network device management method according to claim 8, characterized in that: The method further comprises: When a domain control server fails, the central control server determines a fourth network device that has a management authority mapping relationship with the failed domain control server; Obtaining, through the central control server, available loads corresponding to a plurality of domain control servers operating normally, and determining at least one fourth domain control server from the plurality of domain control servers based on the available loads; The central control server transmits a second device transfer request message to the communication gateway; wherein the second device transfer request message includes the registration configuration information of the fourth network device to be transferred, and the server information of the fourth domain control server to which the fourth network device needs to be transferred.

11. A network device management system, characterized in that: It includes a central control server, multiple domain control servers, and communication gateways, including: The central control server is used to determine the management authority granted to each domain control server for the corresponding network device based on the registration configuration information of the corresponding network device; The domain control server is used to manage corresponding network devices; The communication gateway is used to obtain a login authentication message transmitted by the first network device via a data transmission tunnel, perform key parsing on the login authentication message, and obtain a key to be verified of the first network device, wherein the data transmission tunnel is generated based on an open virtual private network protocol, and the open virtual private network protocol supports a communication connection between any network device and a corresponding domain control server; The communication gateway is further used to determine a first domain control server for controlling the first network device based on a preset domain relationship mapping table, and read a control authentication key generated by the first domain control server for the first network device, wherein the preset domain relationship mapping table includes a mapping relationship between management permissions of each domain control server for different network devices; The communication gateway is further configured to, when the key to be verified is consistent with the management and control authentication key, merge the first network device into the target domain network controlled by the first domain management and control server.

12. A computer device, characterized in that: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the network device management method according to any one of claims 1 to 10 when executing the computer program.

13. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network device management method according to any one of claims 1 to 10 is implemented.

Images