Authorization management method, controller and system based on SD-WAN
By setting fixed inventory units in the SD-WAN environment, periodically calculating and managing the number of authorizations, the problem of inaccurate equipment authorization management caused by system time deviation is solved, and more accurate and reliable authorization management is achieved.
Patent Information
- Application Number
- CN202510291395.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-12
- Publication Date
- 2025-06-27
AI Technical Summary
In the prior art, system time may be biased or artificially adjusted, resulting in the inability to effectively manage equipment authorization.
By setting fixed inventory units, periodically calculate the current remaining authorized quantity and current authorized inventory of the authorized equipment, and gradually subtract the fixed inventory units, so as to manage the authorized equipment's authorized equipment's authorization based on the current remaining authorized quantity and current authorized inventory.
It avoids errors caused by system time deviation or artificial adjustment, ensures the accuracy of authorization management, and solves the problem of inability to effectively manage equipment authorization.
Smart Images
Figure CN120223371A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of authorization management, and in particular to an authorization management method, controller and system based on SD-WAN. Background Art
[0002] SD-WAN (Software Defined Wide Area Network) is a network solution that optimizes wide area network connections through software-defined technology. It can intelligently manage multiple network links (such as MPLS, broadband, 4G / 5G, etc.) to improve the flexibility, performance and cost-effectiveness of enterprise networks. In the SD-WAN scenario, the controller generates an inventory of device authorizations through activation codes and authorizes specific devices through interface authorization. The controller also receives network inter-hop data packets and distributes the current billing status to the gateway to inform the gateway whether the device has expired and whether the function is available.
[0003] In the related art, when the duration and function of authorized devices are uniformly managed (for example, billing), the device authorization deadline is usually compared with the current system time based on the system time. If the authorization deadline is greater than the current time, the device authorization is considered to be valid; otherwise, the device authorization is considered to be expired. However, in actual business, the system time may be deviated or manually adjusted, resulting in the inability to effectively manage device authorization.
[0004] Therefore, how to improve the accuracy of authorization management has become a technical problem that needs to be solved urgently in the existing technology. Summary of the invention
[0005] In view of this, the purpose of the present invention is to provide an authorization management method, controller and system based on SD-WAN to overcome the problem that the current system time may be deviated or artificially adjusted, resulting in the inability to effectively manage device authorization.
[0006] To achieve the above objectives, the present invention adopts the following technical solutions:
[0007] In one aspect, an authorization management method based on SD-WAN is applied to a controller, and the method includes:
[0008] Determine the remaining authorized quantity and authorized inventory of the authorized device; wherein the remaining authorized quantity represents the number of remaining authorized units of the authorized device, and the authorized inventory represents the number of authorized units in inventory;
[0009] Periodically calculate the current remaining authorization quantity and the current authorized inventory of the authorized devices based on a preset fixed stock keeping unit. Among them, the current remaining authorization quantity of the authorized devices is the previous remaining authorization quantity minus the authorization quantity corresponding to the preset fixed stock keeping unit, and the current authorized inventory is the previous authorized inventory minus the preset fixed stock keeping unit of the number of authorized devices;
[0010] Manage the authorization of the authorized devices according to the current remaining authorization quantity and the current authorized inventory.
[0011] Optionally, determining the remaining authorization quantity and authorization library information of the authorized devices includes:
[0012] Respond to the authorization inventory data import instruction to determine the authorization inventory;
[0013] Respond to the device authorization quantity setting instruction, configure the authorization quantity of the device, regard the device as an authorized device, and regard the authorization quantity of the device as the initial remaining authorization quantity of the authorized device; among them, the authorization quantity set for the device is less than or equal to the authorization inventory.
[0014] Optionally, it further includes:
[0015] Perform validity verification on the authorization inventory data. Among them, the verification content of the validity verification includes whether it is a positive integer and whether the data format is a preset standard data format;
[0016] If the validity verification of the authorization inventory data passes, send a successful result of authorization inventory import to the client.
[0017] Optionally, the managing the authorization of the authorized devices according to the current remaining authorization quantity and the current authorized library information includes:
[0018] When the current remaining authorization quantity is less than the first authorization threshold, send an authorization expiration warning to the administrator so that the administrator manages the authorization of the authorized devices according to the current authorized inventory; or,
[0019] When the current remaining authorization quantity is less than the first authorization threshold and the current authorized inventory is greater than the first inventory threshold, allocate the unallocated authorization units in the current authorized inventory to the authorized devices; or,
[0020] When the current remaining authorization quantity is less than the first authorization threshold and the current authorized inventory is less than or equal to the first inventory threshold, send an inventory shortage warning to the administrator.
[0021] Optionally, it further includes:
[0022] When the current remaining authorized quantity is less than the second authorization threshold, close the authorization permissions of the authorized devices with low priority in the authorization device, or close the new authorization application;
[0023] wherein, the second authorization threshold is less than the first authorization threshold
[0024] Optionally, it further includes:
[0025] In response to the stock keeping unit setting instruction, set or modify the preset fixed stock keeping unit.
[0026] Optionally, it further includes:
[0027] Record the operation log of each subtraction of the preset fixed stock keeping unit; the operation log includes the operation time and the ID of the corresponding authorized device.
[0028] Optionally, the configuring the authorized quantity of the device in response to the device authorization quantity setting instruction includes:
[0029] In response to the authorized device configuration instruction, display the available devices;
[0030] According to the authorized device determination instruction, configure the authorized quantity of the target device among the available devices, and the configured available devices are used as authorized devices.
[0031] In another aspect, a controller includes a processor and a memory, and the processor is connected to the memory:
[0032] wherein, the processor is used to call and execute the program stored in the memory;
[0033] The memory is used to store the program, and the program is at least used to execute the SD-WAN-based authorization management method described in any one of the above.
[0034] In another aspect, an SD-WAN-based authorization management system includes: an API interface and the above-mentioned controller; the edge device is connected to the controller through the API interface.
[0035] The technical solution provided by the embodiments of the present invention has at least the following beneficial effects:
[0036] The authorization management method, controller, and system based on SD-WAN provided by the embodiments of the present invention set a fixed stock keeping unit, so that when periodically calculating the current remaining authorization quantity of the authorized devices and the current authorized stock, the fixed stock keeping unit is successively subtracted, thereby managing the authorization of the authorized devices according to the current remaining authorization quantity and the current authorized stock. Among them, by managing authorization through a fixed unit regardless of the system time, the errors caused by system time deviation or manual adjustment are avoided, and the problem of ineffective management of device authorization is solved. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.
[0038] Figure 1 It is a schematic flowchart of an authorization management method based on SD-WAN provided by an embodiment of the present invention;
[0039] Figure 2 It is a schematic structural diagram of a controller provided by an embodiment of the present invention;
[0040] Figure 3 It is a specific schematic flowchart of an authorization management based on SD-WAN provided by the embodiments of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0041] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be described in detail below. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other implementation manners obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.
[0042] As recorded in the background art, in the related art, when uniformly managing the duration and functions of authorized devices (for example, for billing), it is usually based on the system time to compare the device authorization expiration time with the current system time. If the authorization expiration time is greater than the current time, it is considered that the device authorization has not expired; otherwise, it is considered that the device authorization has expired. However, in actual operations, the system time may be deviated or manually adjusted, resulting in ineffective management of device authorization.
[0043] Therefore, how to improve the accuracy of authorization management has become a technical problem to be urgently solved in the prior art.
[0044] Based on this, embodiments of the present invention provide an authorization management method, a controller, and a system based on SD-WAN, which do not rely on the system time, manage the authorization inventory in fixed inventory units, and periodically and automatically deduct the authorization quantity of devices to ensure the accuracy of management and billing.
[0045] Figure 1 FIG. is a schematic flowchart of an authorization management method based on SD-WAN provided by an embodiment of the present invention, which is applied to a controller. Please refer to Figure 1 , and this embodiment may include the following steps:
[0046] Step S101, determine the remaining authorization quantity and authorization inventory of the authorized devices; wherein, the remaining authorization quantity represents the number of remaining authorization units of the authorized devices, and the authorization inventory represents the number of authorized units in the inventory.
[0047] That is, determine the initial remaining authorization quantity and the initial authorization inventory of the authorized devices.
[0048] In a specific authorization management process, the edge device can be connected to the authorization control system where the controller is located through the interface API, and the user can access the controller interface through a terminal (such as a PC). The edge device is the device to be authorized.
[0049] In some embodiments, the determining the remaining authorization quantity and authorization library information of the authorized devices includes:
[0050] Respond to the authorization inventory data import instruction to determine the authorization inventory;
[0051] Respond to the device authorization quantity setting instruction, configure the authorization quantity of the device, regard the device as an authorized device, and regard the authorization quantity of the device as the initial remaining authorization quantity of the authorized device; wherein, the authorized quantity set for the device is less than or equal to the authorization inventory.
[0052] Specifically, the user can log in to the controller authorization page, click on authorization management, and send an authorization inventory data import instruction to configure the authorization inventory. The configured authorization inventory is the initial authorization inventory. The authorization quantity of the edge device can also be configured. After configuration, the device is regarded as an authorized device.
[0053] It can be understood that such a setting can ensure that there are sufficient inventory units (for example, authorized units) in the authorization inventory for distribution.
[0054] In the embodiments of the present invention, each inventory unit can be defined as 1 second.
[0055] The number of authorized devices can be authorized and set according to requirements; the authorized inventory includes the available authorized quantity of the authorized devices and also the unallocated authorized quantity. In this embodiment, the authorized quantity can be the authorized unit.
[0056] In some embodiments, it further includes:
[0057] Perform validity verification on the authorized inventory data, where the verification content of the validity verification includes whether it is a positive integer and whether the data format is a preset standard data format;
[0058] If the validity verification of the authorized inventory data passes, send a successful result of importing the authorized inventory to the client.
[0059] It can be understood that when the user imports the authorized inventory data, the validity of the data can be verified. The verification content includes but is not limited to that the inventory quantity must be a positive integer and the data format should conform to the predefined standard. Store the verified inventory data in the database and use transactions to ensure the consistency and integrity of the data. The internal thread of the authorization system periodically calculates the remaining authorized quantity of the authorized devices and the authorized inventory information at regular intervals. Store the calculated inventory data in the database and use transactions to ensure the consistency and integrity of the data. Record the log of each deduction operation, including information such as the operation time, device ID, and deducted authorized quantity.
[0060] In some embodiments, in response to the device authorized quantity setting instruction, configuring the authorized quantity of the device includes:
[0061] In response to the authorized device configuration instruction, display the available devices;
[0062] According to the authorized device determination instruction, configure the authorized quantity of the target device among the available devices, and the configured available devices are used as authorized devices.
[0063] For example, the user can log in to the controller page for motor authorization, send an authorized device configuration instruction, the controller displays the available devices for the user to select, the user selects the available devices, performs authorization configuration, and configures the de-authorization quantity.
[0064] It is worth noting that when the controller authorization system background receives the authorization data, it will verify the validity of the input data, including but not limited to that the inventory quantity must be a positive integer, the data format should conform to the predefined standard, and whether the current device unique identifier is available. Store the verified authorization data in the database and use transactions to ensure the consistency and integrity of the data. Return the operation result to the client to inform whether the device authorization is successful.
[0065] Step S102: Based on a preset fixed inventory unit, periodically calculate the current remaining authorized quantity and the current authorized inventory of the authorized devices. Among them, the current remaining authorized quantity of the authorized devices is the previous remaining authorized quantity minus the authorized quantity corresponding to the preset fixed inventory unit, and the current authorized inventory is the previous authorized inventory minus the preset fixed inventory unit of the number of authorized devices.
[0066] In a specific implementation process, the authorized inventory is automatically reduced periodically, so as to achieve statistics independent of the system time.
[0067] In some embodiments, it further includes: responding to an inventory unit setting instruction, setting or modifying the preset fixed inventory unit.
[0068] It can be understood that the preset fixed inventory unit can be set or modified to improve the convenience of use.
[0069] In some embodiments, it further includes:
[0070] Record the operation log of each subtraction of the preset fixed inventory unit; the operation log includes the operation time and the ID of the corresponding authorized device.
[0071] Step S103: Manage the authorization of the authorized devices according to the current remaining authorized quantity and the current authorized inventory.
[0072] In some embodiments, the managing the authorization of the authorized devices according to the current remaining authorized quantity and the current authorized inventory information includes:
[0073] When the current remaining authorized quantity is less than the first authorization threshold, send an authorization expiration warning to the administrator, so that the administrator manages the authorization of the authorized devices according to the current authorized inventory. For example, the first authorization threshold can be a fixed value, such as 20% of the initial remaining authorized quantity.
[0074] When the current remaining authorized quantity is less than the first authorization threshold and the current authorized inventory is greater than the first inventory threshold, allocate the unallocated authorization units in the current authorized inventory to the authorized devices. For example, the first inventory threshold can be 30% of the initial remaining authorized quantity, or can be set according to requirements.
[0075] When the current remaining authorized quantity is less than the first authorization threshold and the current authorized inventory is less than or equal to the first inventory threshold, send an inventory shortage warning to the administrator.
[0076] In some embodiments, it further includes:
[0077] When the current remaining authorized quantity is less than the second authorization threshold, close the authorization permissions of the authorized devices with low priority in the authorization device, or close the new authorization applications;
[0078] Wherein, the second authorization threshold is less than the first authorization threshold.
[0079] In the embodiments of the present invention, after the setting is completed, when the device side initiates a heartbeat, it will carry the unique identifier of the device. The authorization system will detect whether the device unique identifier is available and whether the authorized number of the device is greater than 0, and will judge the authorization status according to the authorized number. Return the calculated authorization result to the device to inform the device of the authorization information.
[0080] It can be understood that by adopting the technical solution provided by the embodiments of the present invention, by setting a fixed inventory unit, when periodically calculating the current remaining authorized quantity of the authorized devices and the current authorized inventory, subtract the fixed inventory unit successively, so as to manage the authorization of the authorized devices according to the current remaining authorized quantity and the current authorized inventory. Among them, the system time is not relied on, and the authorization management is carried out through a fixed unit, avoiding the errors caused by system time deviation or manual adjustment, and solving the problem of ineffective management of device authorization.
[0081] Based on a general inventive concept, an embodiment of the present invention also provides a controller.
[0082] Figure 2 For the structural schematic diagram of a controller provided by an embodiment of the present invention, refer to Figure 2 , the controller provided by the embodiments of the present invention may include: a processor 21 and a memory 22, and the processor 21 is connected to the memory 22. Among them, the processor 21 is used to call and execute the program stored in the memory 22; the memory 22 is used to store the program, and the program is at least used to execute the method in the above embodiments.
[0083] Based on a general inventive concept, an embodiment of the present invention also provides an SD-WAN-based authorization management system.
[0084] Figure 3 For the specific process schematic diagram of an SD-WAN-based authorization management provided by an embodiment of the present invention. Refer to Figure 3 , the SD-WAN-based authorization management system includes an API interface and the above-mentioned controller; the edge device is connected to the controller through the API interface.
[0085] It can be understood that the same or similar parts in the above embodiments can be referred to each other, and the content not detailed in some embodiments can be seen in the same or similar content of other embodiments.
[0086] It should be noted that in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be construed as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "a plurality of" refers to at least two.
[0087] Any process or method description shown in a flowchart or described otherwise herein can be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a specific logical function or process. The scope of the preferred embodiments of the present invention includes additional implementations, where the functions may be executed in a substantially simultaneous manner or in an order opposite to that shown or discussed, according to the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.
[0088] It should be understood that various parts of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.
[0089] Those of ordinary skill in the art of the present technology can understand that all or part of the steps carried by the method of the above embodiments can be completed by instructing relevant hardware through a program. The program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.
[0090] In addition, each functional unit in various embodiments of the present invention can be integrated into one processing module, or each unit can exist physically alone, or two or more units can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0091] The above-mentioned storage medium can be a read-only memory, a magnetic disk, an optical disk, etc.
[0092] In the description of this specification, the descriptions referring to terms such as "one embodiment", "some embodiments", "examples", "specific examples", or "some examples", etc., mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples.
[0093] Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.
Claims
1. An authorization management method based on SD-WAN, characterized in that: Applied to a controller, the method comprises: Determine the remaining authorized quantity and authorized inventory of the authorized device; wherein the remaining authorized quantity represents the number of remaining authorized units of the authorized device, and the authorized inventory represents the number of authorized units in inventory; Based on the preset fixed inventory unit, the current remaining authorized quantity and the current authorized inventory of the authorized devices are periodically calculated, wherein the current remaining authorized quantity of the authorized devices is the last remaining authorized quantity minus the authorized quantity corresponding to the preset fixed inventory unit, and the current authorized inventory is the last authorized inventory minus the preset fixed inventory unit of the number of authorized devices; The authorization of the authorized device is managed according to the current remaining authorization quantity and the current authorization inventory.
2. The method according to claim 1, characterized in that The determining of the remaining number of authorizations and authorization library information of the authorized device includes: In response to an authorized inventory data import instruction, determining the authorized inventory; In response to the device authorization quantity setting instruction, the authorization quantity of the device is configured, the device is used as an authorized device, and the authorization quantity of the device is used as the remaining authorization quantity of the initial authorized device; wherein the authorization quantity set for the device is less than or equal to the authorized inventory.
3. The method according to claim 2, characterized in that Also includes: Performing validity verification on the authorized inventory data, wherein the validity verification includes whether it is a positive integer and whether the data format is a preset standard data format; If the validity verification of the authorized inventory data passes, a result of successful authorized inventory import is sent to the client.
4. The method according to claim 1, characterized in that The managing the authorization of the authorized device according to the current remaining authorization quantity and the current authorization library information includes: When the current remaining authorization quantity is less than the first authorization threshold, sending an authorization expiration warning to the administrator, so that the administrator can manage the authorization of the authorized device according to the current authorization inventory; or, When the current remaining authorization quantity is less than the first authorization threshold and the current authorization inventory is greater than the first inventory threshold, allocating unallocated authorization units in the current authorization inventory to the authorized device; or, When the current remaining authorized quantity is less than the first authorized threshold, and the current authorized inventory is less than or equal to the first inventory threshold, an insufficient inventory warning is sent to the administrator.
5. The method according to claim 4, characterized in that Also includes: When the current remaining number of authorizations is less than a second authorization threshold, closing the authorization rights of authorized devices with low priority among the authorized devices, or closing new authorization applications; The second authorization threshold is smaller than the first authorization threshold.
6. The method according to claim 1, characterized in that Also includes: In response to the inventory unit setting instruction, the preset fixed inventory unit is set or modified.
7. The method according to claim 1, characterized in that Also includes: An operation log is recorded for each deduction of a preset fixed inventory unit; the operation log includes the operation time and the ID of the corresponding authorized device.
8. The method according to claim 2, characterized in that: The step of configuring the authorized quantity of the device in response to the device authorized quantity setting instruction includes: In response to the authorized device configuration instruction, displaying available devices; According to the authorized device determination instruction, the authorized number of target devices is configured in the available devices, and the configured available devices are used as authorized devices.
9. A controller, characterized in that: The invention comprises a processor and a memory, wherein the processor is connected to the memory: Wherein, the processor is used to call and execute the program stored in the memory; The memory is used to store the program, and the program is at least used to execute the SD-WAN-based authorization management method described in any one of claims 1-8.
10. An authorization management system based on SD-WAN, characterized in that: include: An API interface and a controller as claimed in claim 9; The edge device is connected to the controller via the API interface.