Network processing method and device, storage medium and program product

Abstract

The embodiment of the invention discloses a network processing method and device, a storage medium and a program product, and aims to access a network device through an auxiliary voucher, avoid interruption of services, information and the like, and improve the access experience of a user. The method comprises the steps that a first access request including an effective certificate is sent to network equipment through a first gateway, the first access request is used for requesting the network equipment to generate an auxiliary certificate based on the effective certificate, and the effective certificate is used for representing equipment legality of access equipment; receiving an auxiliary voucher sent by the network equipment through the first gateway; after the bill verification server breaks down, a second access request is sent to a second gateway, the second access request comprises the auxiliary credential, and the second access request is used for requesting the second gateway to verify the equipment legality of the access equipment based on the auxiliary credential to obtain a verification result; receiving a verification result sent by the second gateway; and when the verification result indicates that the access equipment is legal equipment, accessing the network equipment through the second gateway.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of communication, in particular to a network processing method and device, a storage medium and a program product. BACKGROUND

[0002] With the expansion of network scale and the complexity of services, the security and management of internal networks become more and more important.

[0003] In the traditional network access scheme, the ticket verification server needs to issue a credential every time the access device initiates an access request to the network device, and the gateway needs to verify the credential to determine whether the access device is a legal and secure device. In this way, only when the access device is a legal and secure device, the access device can access the network device with a valid credential.

[0004] However, once the ticket verification server fails, the ticket verification server cannot issue a credential, or other gateways cannot verify the ticket when the access request is loaded to other gateways, which cannot establish an access link, and thus the access device cannot normally access the network device, thereby affecting the interaction of services and information, and also affecting the user access experience. SUMMARY

[0005] Embodiments of the present application provide a network processing method, device, storage medium and program product, which are used for accessing a network device through an auxiliary credential, avoiding interruption of services and information, and improving user access experience.

[0006] Therefore, the present application provides a network processing method. The method can be applied to an access device, and the network processing method comprises:

[0007] sending a first access request to a network device through a first gateway, the first access request comprising a valid credential, the first access request being used to request the network device to generate an auxiliary credential based on the valid credential, the valid credential being used to represent the device legality of the access device;

[0008] receiving the auxiliary credential sent by the network device through the first gateway;

[0009] after the ticket verification server fails, sending a second access request to a second gateway, the second access request comprising the auxiliary credential, the second access request being used to request the second gateway to verify the device legality of the access device based on the auxiliary credential to obtain a verification result;

[0010] receiving the verification result sent by the second gateway;

[0011] When the verification result indicates that the access device is a legal device, the network device is accessed by the second gateway.

[0012] Another aspect of the present application provides a network processing method. The method can be applied to the second gateway, and the network processing method comprises:

[0013] After the ticket verification server fails, a second access request sent by the access device is received, the second access request comprising an auxiliary credential, the auxiliary credential being obtained by the network device based on a valid credential in a first access request, the first access request being sent by the access device to the network device through the first gateway, the valid credential being used to represent the device legality of the access device, the first ticket being a credential generated when the ticket verification server is in normal operation;

[0014] The device legality of the access device is verified based on the auxiliary credential to obtain a verification result;

[0015] The verification result is sent to the access device, so that when the verification result indicates that the access device is a legal device, the access device accesses the network device through the second gateway.

[0016] Another aspect of the present application provides a network processing method. The method can be applied to the first gateway, and the network processing method comprises:

[0017] The first access request sent by the access device is received, the first access request comprising a valid credential, the valid credential being used to represent the device legality of the access device;

[0018] The first access request is forwarded to the network device, so that the network device generates an auxiliary credential based on the valid credential;

[0019] The auxiliary credential sent by the network device is received and forwarded to the access device.

[0020] Another aspect of the present application provides an access device. The access device comprises:

[0021] The sending unit is configured to send a first access request to the network device through the first gateway, the first access request comprising a valid credential, the first access request being used to request the network device to generate an auxiliary credential based on the valid credential, the valid credential being used to represent the device legality of the access device;

[0022] The receiving unit is configured to receive the auxiliary credential sent by the network device through the first gateway;

[0023] The sending unit is configured to send a second access request to the second gateway after the ticket verification server fails, the second access request comprising the auxiliary credential, the second access request being used to request the second gateway to verify the device legality of the access device based on the auxiliary credential to obtain a verification result.

[0024] The receiving unit is configured to receive a verification result sent by the second gateway.

[0025] The processing unit is configured to access the network device through the second gateway when the verification result indicates that the access device is a legal device.

[0026] In a possible design, in another implementation manner of another aspect of the embodiment of the present application,

[0027] The sending unit is specifically configured to send a third access request to the ticket verification server before sending the first access request to the network device through the first gateway, where the third access request is used to request the ticket verification server to generate a first ticket, and the first ticket is a credential generated when the ticket verification server is normally running.

[0028] The receiving unit is specifically configured to receive the first ticket sent by the ticket verification server.

[0029] The sending unit is specifically configured to send a fourth access request to the first gateway, where the fourth access request includes the first ticket, and the fourth access request is used to request the first gateway to verify the first ticket to generate a valid credential.

[0030] The receiving unit is specifically configured to receive the valid credential sent by the first gateway.

[0031] In a possible design, in another implementation manner of another aspect of the embodiment of the present application, the auxiliary credential includes a valid duration, an update duration and an encryption key, the valid duration is a valid time of the auxiliary credential, the update duration is an interval time of updating the auxiliary credential, and the encryption key is used for the access device to encrypt the auxiliary credential.

[0032] In a possible design, in another implementation manner of another aspect of the embodiment of the present application, the first gateway is the same as the second gateway.

[0033] In a possible design, in another implementation manner of another aspect of the embodiment of the present application, the first gateway is different from the second gateway.

[0034] In a possible design, in another implementation manner of another aspect of the embodiment of the present application, the encryption key and the decryption key negotiated between the access device and the first gateway are the same as the encryption key and the decryption key negotiated between the access device and the second gateway, the encryption key is held by the access device, the decryption key is held by the first gateway and the second gateway, and the encryption key and the decryption key constitute a key pair.

[0035] Another aspect of the present application provides a second gateway. The second gateway comprises:

[0036] The receiving module is configured to receive a second access request sent by the access device after the ticket verification server fails, the second access request comprising an auxiliary credential, the auxiliary credential being obtained by the network device based on a valid credential in a first access request sent by the access device to the network device through the first gateway, the valid credential being used to represent device legitimacy of the access device;

[0037] The processing module is configured to verify the device legitimacy of the access device based on the auxiliary credential to obtain a verification result.

[0038] The sending module is configured to send the verification result to the access device, so that when the verification result is that the access device is a legal device, the access device accesses the network device through the second gateway.

[0039] In a possible design, in another implementation manner of another aspect of the embodiment of the present application, the auxiliary credential comprises an encryption key, the encryption key being used by the access device to encrypt the auxiliary credential; the processing module is specifically configured to:

[0040] match the decryption key held by the second gateway with the encryption key in the auxiliary credential;

[0041] obtain the verification result when the decryption key and the encryption key match successfully.

[0042] In a possible design, in another implementation manner of another aspect of the embodiment of the present application, when the second gateway is different from the first gateway, the encryption key and the decryption key negotiated between the access device and the second gateway are the same as the encryption key and the decryption key negotiated between the access device and the first gateway, the encryption key is held by the access device, the decryption key is held by the first gateway and the second gateway, and the encryption key and the decryption key constitute a key pair.

[0043] In a possible design, in another implementation manner of another aspect of the embodiment of the present application, the auxiliary credential further comprises a valid duration and an update duration, the valid duration being a valid time of the auxiliary credential, and the update duration being an interval time for updating the auxiliary credential.

[0044] Another aspect of the present application provides a first gateway. The first gateway comprises:

[0045] The receiving unit is configured to receive a first access request sent by an access device, the first access request comprising a valid credential, the valid credential being used to represent device legitimacy of the access device;

[0046] The forwarding unit is configured to forward the first access request to a network device, so that the network device generates an auxiliary credential based on the valid credential.

[0047] The receiving unit is configured to receive the auxiliary credential sent by the network device.

[0048] The forwarding unit is used to forward auxiliary credentials to the access device.

[0049] In one possible design, in another implementation of another aspect of the embodiments of this application, the first gateway further includes a processing unit; wherein,

[0050] The receiving unit is further configured to receive a fourth access request sent by the access device before receiving the first access request sent by the access device. The fourth access request includes a first ticket, which is a credential generated when the ticket verification server is running normally.

[0051] The processing unit is used to verify the first ticket and generate a valid voucher.

[0052] In one possible design, in another implementation of another aspect of the embodiments of this application,

[0053] The sending unit is specifically used to send the first ticket to the ticket verification server, so that the ticket verification server can verify the legitimacy of the first ticket and obtain the verification result;

[0054] The receiving unit is specifically used to receive the verification results sent by the ticket verification server;

[0055] The processing unit is specifically used to generate valid credentials based on the verification results.

[0056] In one possible design, in another implementation of another aspect of the embodiments of this application, the auxiliary credential includes a validity period, which is the validity time of the auxiliary credential.

[0057] The processing unit is also specifically used to: after receiving the auxiliary credential sent by the network device, detect the frequency of failure of the ticket verification server; when the frequency is greater than a preset threshold, increase the validity period to obtain an updated auxiliary credential;

[0058] The forwarding unit is specifically used to send the updated auxiliary credentials to the access device.

[0059] In another aspect, this application provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the methods described above.

[0060] Another aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods described above.

[0061] Another aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the methods described above.

[0062] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0063] In this embodiment, the access device sends a first access request to the network device through a first gateway. This first access request includes valid credentials and is used to request the network device to generate auxiliary credentials based on the valid credentials. The described valid credentials are used to characterize the access device's legitimacy. After sending the first access request, the access device receives the auxiliary credentials sent by the network device through the first gateway. Then, in the event of a failure of the ticket verification server, a second access request is sent to a second gateway. The second access request includes auxiliary credentials and is used to request the second gateway to verify the access device's legitimacy based on the auxiliary credentials to obtain a verification result. The access device then receives the verification result sent by the second gateway, and when the verification result indicates that the access device is a legitimate device, it accesses the network device through the second gateway.

[0064] In this application, the access device first requests the first gateway to generate a valid credential. After obtaining the valid credential, the access device uses it to request the network device to generate a corresponding auxiliary credential, thereby obtaining the auxiliary credential from the network device. Furthermore, since the auxiliary credential can, to a certain extent, clarify the legitimacy of the access device, even if the ticket verification server malfunctions, the access device can include the auxiliary credential in its access request. This allows the gateway receiving the access request to determine the device's legitimacy based on the auxiliary credential. In other words, regardless of which gateway the access request is routed to, or whether the ticket verification server issues a ticket in subsequent access requests, the gateway receiving the access request can determine the access device's legitimacy and security through the auxiliary credential. This establishes a communication link between the access device and the network device, enabling the access device to access the network device normally, preventing business and information interruptions, and improving the user experience. Attached Figure Description

[0065] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0066] Figure 1 A schematic diagram of the network access process in the existing scheme is shown;

[0067] Figure 2 A schematic diagram of the system framework provided in this application is shown;

[0068] Figure 3 A flowchart illustrating the network processing method provided in this application is shown.

[0069] Figure 4 Another flowchart illustrating the network processing method provided in this application is shown;

[0070] Figure 5 A schematic diagram of the auxiliary certificate provided in this application is shown;

[0071] Figure 6 Another flowchart illustrating the network processing method provided in this application is shown;

[0072] Figure 7 Another flowchart illustrating the network processing method provided in this application is shown;

[0073] Figure 8 This application provides a schematic diagram of a functional module structure of the access device.

[0074] Figure 9 A schematic diagram of a functional module structure of the second gateway provided in this application is shown;

[0075] Figure 10 This invention provides a schematic diagram of a functional module structure of the first gateway.

[0076] Figure 11 A schematic diagram of the hardware structure of the computer device provided in this application is shown. Detailed Implementation

[0077] This application provides a method, device, storage medium, and program product for network processing, used to access network devices through auxiliary credentials, avoiding interruptions to services and information, and improving the user access experience.

[0078] It is understood that in the specific embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0079] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0080] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that implementations of the application described herein can be implemented, for example, in sequences other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0081] An internal network is a computer network used within an enterprise or organization. It is typically built on internet protocols such as IP and provides a secure and efficient environment for information sharing and collaboration among users within the organization. With the increasing number of cybersecurity threats and the expansion of enterprise networks and the increasing complexity of business operations, the security of internal networks has become increasingly important.

[0082] In the relevant plan, Figure 1 A schematic diagram illustrating the network access process in an existing solution is shown. For example... Figure 1 As shown, the access device has a client installed. In step S1, when a user needs to access the network, they can generate request A through the access device and send it to the ticket verification server through the client. In step S2, the ticket verification server checks whether the access device has permission to access the internal network based on request A, and then generates and sends ticket B back to the access device if it confirms that the access device has permission. In step S3, the access device sends an access request to the gateway, which carries ticket B. In step S4, after receiving the access request, the gateway sends ticket B from the access request to the ticket verification server to verify the legitimacy of ticket B. In step S5, the ticket verification server sends the verification result back to the gateway. Therefore, in step S6, the gateway will only establish a communication connection with the access device based on the verification result if the verification result indicates that the access device is a legitimate device.

[0083] However, from the above Figure 1As illustrated by the network access schemes, most companies currently employ a strategy of secure devices accessing their internal networks. However, the security and legitimacy of these devices are determined through a combination of factors: the issuance of tickets by the ticket verification server and the verification of ticket validity by the ticket verification server and the gateway, both occurring each time a network request is initiated. In other words, if the ticket verification server malfunctions, it can lead to problems such as the inability to issue tickets or other credentials, or the inability of other gateways to verify tickets when access requests are routed to them. This can result in the inability to establish an access link, preventing the accessing device from accessing network devices normally, impacting business and information interactions, and affecting the user experience.

[0084] To address the aforementioned technical problems, this application provides a network processing method. The network processing method provided by this application can be applied to scenarios such as network device access. For example, the network processing method provided by this application can also be applied to… Figure 2 A schematic diagram of the described system framework. (See attached diagram.) Figure 2 As shown, the system framework includes at least an access device, a smart gateway, a ticket verification server, and network devices. The smart gateway can be different gateways within the same cluster or different gateways across clusters, such as gateway A and gateway B. For example, gateway A and gateway B can belong to different gateways within the same cluster or different gateways in different clusters; this application does not impose specific limitations.

[0085] When the ticket verification server is operating normally, the access device can request the server to send a standard first ticket and then send it to gateway A. Gateway A and the ticket verification server then verify the first ticket, and gateway A generates a valid credential and sends it back to the access device. The access device then includes the valid credential in its access request and sends it to the network device via gateway A, requesting the network device to generate a supplementary credential based on the valid credential. The access device can then receive the supplementary credential from the network device. This allows the access device to establish a communication link with the network device even if the ticket verification server fails, by sending the access request with the supplementary credential through gateway A to verify the device's legitimacy. Alternatively, even if the ticket verification server fails and the access request has been redirected to another gateway (e.g., gateway B), the access device can still establish a communication link with the network device by sending the access request with the supplementary credential through gateway B to verify the device's legitimacy.

[0086] In other words, in the network processing method provided in this application, regardless of which gateway the access request is loaded onto, or whether the ticket verification server issues a ticket in subsequent access requests, the gateway can determine that the access device is secure through auxiliary credentials, thereby establishing a communication link between the access device and the network device. This enables the access device to access the network device normally, avoiding interruptions to business and information, and improving the user access experience. The network processing method of this application can be applied in at least one of the following scenarios.

[0087] Applicable Scenario 1: Remote work, remote training, remote education, etc.

[0088] In one exemplary solution, in scenarios such as remote work, remote training, and remote education, after the remote access device applies the network processing method provided in this application, regardless of which gateway the access request sent by the remote device is loaded onto, or whether the ticket verification server issues a ticket in subsequent access requests, the gateway carrying the access request can determine that the access device is secure through auxiliary credentials, thereby establishing a communication link between the access device and the network device. Thus, the remote access device can connect to the network device promptly and uninterruptedly to securely access internal file sharing, intranets, etc., within the company or organization, thereby promoting users' ability to remotely access and participate in internal office work, training, and education activities via the Internet, and improving the user experience.

[0089] Applicable Scenario 2: Accessing Cloud Servers

[0090] In the cloud era, businesses and individuals frequently need to access resources within cloud services. When an access device applies the network processing method provided in this application, regardless of which gateway the access request is routed to, or whether the ticket verification server issues a ticket in subsequent access requests, the gateway carrying the access request can use auxiliary credentials to determine the access device's security, thereby establishing a communication link between the access device and network devices such as cloud servers. This allows the access device to access databases and files within the cloud server, saving time and costs while improving the user experience.

[0091] Scenario 3: Access and control of home devices and smart home devices

[0092] In many home environments where users have set up network attached storage (NAS) and smart home control systems, they can still access these network devices even when they leave their home network. Specifically, after applying the network processing method provided in this application, regardless of which gateway the access request is routed to, or whether the ticket verification server issues a ticket in subsequent access requests, the gateway carrying the access request can use auxiliary credentials to verify the security of the access device, thereby establishing a communication link between the access device and the home or smart home devices. This allows the access device to access the databases or other services within the home or smart home devices, improving convenience and user experience. Alternatively, after establishing the communication link, the access device can also remotely manage and control the home or smart home devices.

[0093] It should be noted that the network processing method mentioned in this application can be applied to other scenarios in practice, in addition to the scenarios mentioned above, such as internal information system access and internal development and testing environments. This application does not make any specific limitations.

[0094] The access devices involved in this application include, but are not limited to, mobile phones, tablets, laptops, desktop computers, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, and wearable devices. The client is deployed on the access device and can run on the access device via a browser or as a standalone application (APP), etc., without limitation in this application.

[0095] The ticket verification server involved in this application can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence (AI) platforms.

[0096] The network devices involved in this application include, but are not limited to, network servers and network computer equipment. For example, network computer equipment may include, but is not limited to, laptops, desktop computers, intelligent voice interaction devices, printers, etc. within the network, and no specific limitation is made in this application. Optionally, the network devices in this application may also include intranet devices, such as intranet servers and intranet computer equipment, and no specific limitation is made in this application.

[0097] The gateways involved in this application may include, but are not limited to, smart gateways such as smart home gateways and network access smart gateways, as well as internet gateways and LAN gateways, etc., which are not limited in this application.

[0098] Based on the above introduction, the network processing method in this application will be described below. Please refer to [link / reference]. Figure 3 The network processing method in this application embodiment can be completed through interaction and cooperation between devices. The method of this application includes:

[0099] 301. The access device sends a first access request to the network device through the first gateway. The first access request includes valid credentials.

[0100] In one or more embodiments, a user intends to access a network device in the network via an access device. In this case, the access device can be activated, and after activation, a first access request can be sent to the network device through a first gateway. The first access request includes valid credentials.

[0101] The valid credentials mentioned in this application can be understood as credentials used to characterize the legitimacy of the accessing device. In other words, through valid credentials, it can be clearly determined that the accessing device is legitimate and secure, and is allowed to access devices in the network. For example, the valid credentials mentioned in this application may include key information such as the accessing device's identity information, validity period, and encryption key.

[0102] Optionally, in one or more embodiments, before sending the first access request to the network device through the first gateway in step 301 above, the network processing method may further include how the accessing device obtains the valid credential. As an illustrative description, prior to step 301, the method may further include... Figure 4 Steps S401-S406, shown in another flowchart of the network processing method, are as follows:

[0103] S401. The access device sends a third access request to the ticket verification server.

[0104] The access device can send a third access request to the ticket verification server, which can then receive the third access request.

[0105] S402. The ticket verification server generates the first ticket based on the third access request.

[0106] In one or more examples, when operating normally, the ticket verification server can also generate corresponding ticket information for access requests from accessing devices. For instance, after receiving a third access request from an accessing device, the ticket verification server generates a first ticket based on the third access request. It should be noted that the first ticket can be understood as a credential generated by the ticket verification server during normal operation. This first ticket can be used to verify the identity of the accessing device, ensuring the security of data and network resources and preventing potential security threats.

[0107] S403. The ticket verification server sends the first ticket to the accessing device.

[0108] After the ticket verification server generates the first ticket, it can send the first ticket back to the accessing device.

[0109] S404. The access device sends a fourth access request to the first gateway, the fourth access request including the first ticket.

[0110] After receiving the first ticket from the ticket verification server, the access device can also include the first ticket in a fourth access request. In this way, the access device sends the fourth access request to the first gateway, requesting the first gateway to verify the validity of the first ticket, and then generate the corresponding valid credential if the ticket is valid.

[0111] S405. The first gateway verifies the first ticket to generate a valid credential.

[0112] After receiving the first ticket from the accessing device, the first gateway can verify it. For example, the first gateway can send the first ticket to a ticket verification server, which will then match the first ticket sent by the first gateway with its own generated first ticket to verify its validity. If the ticket verification server verifies the first ticket's validity, it will inform the first gateway of the verification result, and the first gateway will then generate a corresponding valid credential based on the verification result.

[0113] S406. The first gateway sends valid credentials to the accessing device.

[0114] After verifying and generating the corresponding valid credentials, the first gateway needs to send the valid credentials back to the accessing device. In this way, the accessing device can obtain the valid credentials.

[0115] Through steps S401 to S406, the accessing device can obtain valid credentials through the combined action of the first gateway and the normally operating ticket verification server. After obtaining valid credentials, the accessing device then includes these credentials in a first access request, which is subsequently sent to the network device via the first gateway.

[0116] In one or more examples, the access device may send a first access request carrying valid credentials to a first gateway, which then forwards the first access request carrying valid credentials to the network device.

[0117] 302. The network device generates auxiliary credentials based on the valid credentials in the first access request.

[0118] After receiving a first access request sent by the accessing device through the first gateway, the network device can extract the valid credentials carried in the first access request and then generate auxiliary credentials based on the valid credentials. It should be noted that the auxiliary credentials described in this application can be understood as additional credentials derived from valid credentials that can be used for a specific purpose or access control.

[0119] In one or more examples, the network device can verify the authenticity of valid credentials and perform authorization verification based on the request content, such as the target domain requested by the accessing device. If the authorization verification passes, the network device then generates the necessary auxiliary credentials.

[0120] It should be noted that the auxiliary credential described in this application includes at least a validity period, an update period, and an encryption key. The validity period is understood as the effective time of the auxiliary credential, the update period is understood as the interval between updates to the auxiliary credential, and the encryption key is used by the access device to encrypt the auxiliary credential. For example, the auxiliary credential may also include information about the network device requesting access.

[0121] For example, Figure 5 A schematic diagram of the auxiliary certificate provided in this application is shown. For example... Figure 5 As shown, the auxiliary credentials reveal that the requested network device's URL is "demo1.com," the credential's validity period is X1 minutes, its update period is X2 minutes, and the encryption key is xxxxxxx. Therefore, from... Figure 5 It can be clearly understood that the auxiliary credential expires after X1 minutes. During its valid period, the auxiliary credential ensures data security, preventing attackers from accessing network devices using an expired auxiliary credential. Furthermore, from... Figure 5It can also be learned that the auxiliary credentials can be updated regularly after X2 minutes from the current moment, which can reduce the risk of auxiliary credentials being abused and attacked, improve the security of auxiliary credentials, and ensure the accuracy and timeliness of auxiliary credentials.

[0122] It should be noted that the above Figure 5 The specific values ​​shown in the document, such as "demo1.com", X1 minutes, X2 minutes, and the encryption key xxxxxxx, are merely illustrative descriptions in this application. In practical applications, other values ​​may also be included, and this application does not impose any specific limitations.

[0123] 303. The network device sends auxiliary credentials to the accessing device through the first gateway.

[0124] After generating and obtaining auxiliary credentials, the network device can send the auxiliary credentials to the first gateway, which then forwards them to the accessing device. Thus, the accessing device obtains the auxiliary credentials through the first gateway.

[0125] In one or more optional embodiments, after receiving the auxiliary credential sent by the network device, the first gateway can also detect the frequency of failures of the ticket verification server. If the frequency exceeds a preset threshold, the validity period of the auxiliary credential is increased, thereby obtaining an updated auxiliary credential. In this way, the first gateway can also forward the updated auxiliary credential to the access device, allowing the access device to initiate an access request based on the updated auxiliary credential. By increasing the validity period of the auxiliary credential through detecting the frequency of failures, the reliability and stability of the entire system can be enhanced, thereby reducing the risk of abuse and leakage of the auxiliary credential.

[0126] In some optional examples, the auxiliary credentials mentioned in this application may also be generated by the first gateway based on valid credentials, and no specific limitation is made in the embodiments of this application.

[0127] 304. After the ticket verification server fails, the access device sends a second access request to the second gateway, which includes auxiliary credentials.

[0128] If the ticket verification server malfunctions, it will be unable to continue providing tickets or cooperating with the gateway to verify the validity of credentials, potentially preventing users from accessing network devices in a timely manner. Therefore, when the ticket verification server fails, the accessing device can include supplementary credentials in a second access request, which will then be sent to a second gateway. The second gateway will then verify the device's legitimacy using the supplementary credentials.

[0129] 305. The second gateway verifies the legality of the accessing device based on the auxiliary credentials to obtain the verification result.

[0130] After receiving the auxiliary credential sent by the accessing device, the second gateway can verify the device's legitimacy based on the auxiliary credential, thereby obtaining the verification result.

[0131] In one or more embodiments, the access device and different gateways have negotiated the encryption and decryption keys beforehand. Therefore, the access device holds the encryption key, and the gateway holds the decryption key. Thus, after the access device obtains the auxiliary credential, it includes the encryption key in the auxiliary credential, as detailed above. Figure 5 The content should be understood accordingly. Furthermore, in this application, the encryption and decryption keys negotiated between different gateways and access devices in the same or different clusters are identical, and the encryption and decryption keys constitute a key pair. For example, assuming gateway A is in cluster a and gateway B is in cluster b, if cluster a and cluster b are different, the encryption and decryption keys negotiated between gateway A and the access device mentioned in this application are the same as those negotiated between gateway B and the access device; conversely, if cluster a and cluster b are the same, the encryption and decryption keys negotiated between gateway A and the access device mentioned in this application can also be the same as those negotiated between gateway B and the access device. By setting the same key pair, the access request can be processed by the gateway in whichever cluster it is loaded onto, enabling the gateway to complete the verification of auxiliary credentials, thus improving verification efficiency.

[0132] In this way, after receiving the auxiliary credential, the second gateway can use its own decryption key to match the encryption key in the auxiliary credential, and then obtain the verification result when the decryption key and the encryption key match successfully.

[0133] In some optional embodiments, the access device in this application can negotiate encryption and decryption keys with the gateway in different ways. For example, after establishing a gateway connection with the access device, the gateway sends a digital certificate containing the encryption key to the access device, which then verifies the reliability of the digital certificate sent by the gateway to ensure the authenticity of the encryption key. Subsequently, the access device generates a random session key and encrypts this session key using the encryption key to generate encrypted key data. Further, the access device sends the encrypted key data to the gateway, which then uses its decryption key to decrypt the encrypted key data to obtain the original session key. Thus, the gateway and the access device have the same session key for subsequent encryption and decryption of communications.

[0134] 306. The second gateway sends the verification result to the accessing device.

[0135] After obtaining the verification result, the second gateway can send the verification result back to the accessing device. The accessing device then receives the verification result. It should be noted that this verification result verifies the legitimacy of the accessing device, that is, whether the accessing device has legitimate access rights.

[0136] 307. When the verification result indicates that the accessing device is a legitimate device, the accessing device accesses the network device through the second gateway.

[0137] After obtaining the verification result, if the verification result indicates that the access device is a legitimate device, the access device can establish a communication connection with the second gateway, thereby accessing the network device through the second gateway.

[0138] It should be noted that the second gateway mentioned in steps 304 to 307 above may be the same as or different from the first gateway mentioned in steps 301 to 303 above. For example, if the second access request mentioned in step 304 is still loaded on the old gateway (i.e., the first gateway) after the ticket verification server fails, then the second gateway is regarded as the first gateway; conversely, if the second access request mentioned in step 304 is loaded on a new other gateway (such as the second gateway), then the second gateway is different from the first gateway.

[0139] In some optional examples, the communication connection mentioned in this application can also be a persistent connection. A persistent connection, as described, is a communication method in network communication where a client and server in an access device maintain a persistent connection. This means that multiple data packets can be continuously sent over a single connection. During the connection maintenance period, even if no data packets are sent, both parties need to periodically send link detection packets to maintain the connection state. In the scenario of persistent connections, this application can reuse valid credentials, auxiliary credentials, etc., to improve data transmission efficiency and reduce the overhead of frequently sending and receiving credentials.

[0140] In this embodiment, regardless of which gateway the access request is loaded onto, or whether the ticket verification server issues a ticket in subsequent access requests, the gateway receiving the access request can determine that the accessing device is legitimate and secure through auxiliary credentials. This establishes a communication link between the accessing device and the network device, enabling the accessing device to access the network device normally, avoiding interruptions to business and information, and improving the user experience. Moreover, establishing a communication connection through the auxiliary credentials of this application can effectively compensate for the shortcomings of current ticket verification server failures that prevent normal data transmission, allowing users to continue accessing the network device without being aware of the problem.

[0141] Optionally, in one or more embodiments, in the above...Figure 3 Based on the illustrated embodiment, taking the example where the second gateway is the same as the first gateway, Figure 6 Another flowchart illustrating the network processing method provided in this application is shown. Figure 6 As shown, the network processing method includes at least the following steps:

[0142] 601. The access device sends a third access request to the ticket verification server.

[0143] The access device can send a third access request to the ticket verification server, which can then receive the third access request.

[0144] 602. The ticket verification server generates the first ticket based on the third access request.

[0145] In one or more examples, under normal operating conditions, the ticket verification server can also generate corresponding ticket information for access requests from accessing devices. For instance, upon receiving a third access request from an accessing device, the ticket verification server generates a first ticket based on the third access request. This first ticket can be used to verify the identity of the accessing device, ensuring the security of data and network resources and preventing potential security threats.

[0146] 603. The ticket verification server sends the first ticket to the accessing device.

[0147] After the ticket verification server generates the first ticket, it can send the first ticket back to the accessing device.

[0148] 604. The access device sends a fourth access request to the first gateway, the fourth access request including the first ticket.

[0149] After receiving the first ticket from the ticket verification server, the access device can also include the first ticket in a fourth access request. In this way, the access device sends the fourth access request to the first gateway, requesting the first gateway to verify the validity of the first ticket, and then generate the corresponding valid credential if the ticket is valid.

[0150] 605. The first gateway verifies the first ticket to generate a valid credential.

[0151] After receiving the first ticket from the accessing device, the first gateway can verify it. For example, the first gateway can send the first ticket to a ticket verification server, which will then match the first ticket sent by the first gateway with its own generated first ticket to verify its validity. If the ticket verification server verifies the first ticket's validity, it will inform the first gateway of the verification result, and the first gateway will then generate a corresponding valid credential based on the verification result.

[0152] 606. The first gateway sends valid credentials to the accessing device.

[0153] After verifying and generating the corresponding valid credentials, the first gateway needs to send the valid credentials back to the accessing device. In this way, the accessing device can obtain the valid credentials.

[0154] 607. The access device sends a first access request to the network device through the first gateway. The first access request includes valid credentials.

[0155] 608. The network device generates auxiliary credentials based on the valid credentials in the first access request.

[0156] 609. The network device sends auxiliary credentials to the accessing device through the first gateway.

[0157] It should be noted that the content described in steps 607 to 609 above can be referred to in the foregoing. Figure 3 The content described in steps 301 to 303 is for your understanding and will not be repeated here.

[0158] 610. After the ticket verification server fails, the access device sends a second access request to the first gateway, the second access request including auxiliary credentials.

[0159] If the ticket verification server malfunctions, it will be unable to provide tickets or cooperate with the gateway to verify the validity of credentials, potentially preventing users from accessing network devices in a timely manner. Alternatively, if it is still desired that the second access request be routed to the old gateway (i.e., the first gateway), then after the ticket verification server malfunctions, the accessing device can carry auxiliary credentials in the second access request and send it to the first gateway, where the first gateway will verify the device's legitimacy using the auxiliary credentials.

[0160] 611. The first gateway verifies the legality of the accessing device based on the auxiliary credentials to obtain the verification result.

[0161] After receiving the auxiliary credential sent by the accessing device, the first gateway can verify the device's legitimacy based on the auxiliary credential, thereby obtaining the verification result.

[0162] In one or more embodiments, the access device and different gateways can negotiate the encryption and decryption keys beforehand. Thus, the access device holds the encryption key, and the gateway holds the decryption key. After the access device obtains the auxiliary credential, it carries the encryption key within the auxiliary credential, as detailed above. Figure 5 To understand the content.

[0163] In this way, after receiving the auxiliary credential, the first gateway can use its own decryption key to match the encryption key in the auxiliary credential, and then obtain the verification result when the decryption key and the encryption key match successfully.

[0164] 612. The first gateway sends the verification result to the accessing device.

[0165] After obtaining the verification result, the first gateway can send the verification result back to the accessing device. The accessing device then receives the verification result. It should be noted that this verification result verifies the legitimacy of the accessing device, that is, whether the accessing device has legitimate access rights.

[0166] 613. When the verification result indicates that the accessing device is a legitimate device, the accessing device accesses the network device through the first gateway.

[0167] In this embodiment, even if the access request is still loaded onto the old first gateway, or whether the ticket verification server issues a ticket in subsequent access requests, the first gateway that receives the access request can still determine that the accessing device is legitimate and secure through auxiliary credentials, thereby establishing a communication link between the accessing device and the network device, thereby enabling the accessing device to access the network device normally, avoiding interruptions to business and information, and improving the user access experience.

[0168] Optionally, in one or more embodiments, in the above... Figure 3 Based on the illustrated embodiment, taking an example where the second gateway is different from the first gateway, Figure 7 Another flowchart illustrating the network processing method provided in this application is shown. Figure 7 As shown, the network processing method includes at least the following steps:

[0169] 701. The access device sends a third access request to the ticket verification server.

[0170] 702. The ticket verification server generates the first ticket based on the third access request.

[0171] 703. The ticket verification server sends the first ticket to the accessing device.

[0172] 704. The access device sends a fourth access request to the first gateway, the fourth access request including the first ticket.

[0173] 705. The first gateway verifies the first ticket to generate a valid credential.

[0174] 706. The first gateway sends valid credentials to the accessing device.

[0175] 707. The accessing device sends a first access request to the network device through the first gateway. The first access request includes valid credentials.

[0176] 708. The network device generates auxiliary credentials based on the valid credentials in the first access request.

[0177] 709. The network device sends auxiliary credentials to the accessing device through the first gateway.

[0178] It should be noted that the content described in steps 707 to 709 above can be referred to in the foregoing. Figure 3 The content described in steps 301 to 303 is for your understanding and will not be repeated here.

[0179] 710. After the ticket verification server fails, the access device sends a second access request to the second gateway, which includes auxiliary credentials.

[0180] If the ticket verification server malfunctions, it will be unable to continue providing tickets or cooperating with the gateway to verify the validity of credentials, potentially causing users to be unable to access network devices in a timely manner. Furthermore, if it is desired to load the second access request onto a new gateway, such as a second gateway, then after the ticket verification server malfunctions, the accessing device can carry auxiliary credentials in the second access request and send it to the second gateway, which will then verify the device's legitimacy using the auxiliary credentials.

[0181] 711. The second gateway verifies the legality of the accessing device based on the auxiliary credentials to obtain the verification result.

[0182] After receiving the auxiliary credential sent by the accessing device, the second gateway can verify the device's legitimacy based on the auxiliary credential, thereby obtaining a verification result. The verification process by which the second gateway obtains the verification result can be referred to the aforementioned steps. Figure 3 The content described in step 305 should be understood, and will not be repeated here.

[0183] In this way, after receiving the auxiliary credential, the second gateway can use its own decryption key to match the encryption key in the auxiliary credential, and then obtain the verification result when the decryption key and the encryption key match successfully.

[0184] 712. The second gateway sends the verification result to the accessing device.

[0185] After obtaining the verification result, the second gateway can send the verification result back to the accessing device. The accessing device then receives the verification result. It should be noted that this verification result verifies the legitimacy of the accessing device, that is, whether the accessing device has legitimate access rights.

[0186] 713. When the verification result indicates that the accessing device is a legitimate device, the accessing device accesses the network device through the second gateway.

[0187] In this embodiment of the application, even if the access request is loaded onto a new gateway, i.e., the second gateway, or whether the ticket verification server issues a ticket in a subsequent access request, the second gateway that receives the access request can still determine that the accessing device is legitimate and secure through auxiliary credentials, thereby establishing a communication link between the accessing device and the network device, thereby enabling the accessing device to access the network device normally, avoiding interruptions to business and information, and improving the user access experience.

[0188] The foregoing primarily describes the solutions provided by the embodiments of this application from a methodological perspective. It is understood that to achieve the above functions, corresponding hardware structures and / or software modules are included to execute each function. Those skilled in the art should readily recognize that, based on the modules and algorithm steps described in conjunction with the embodiments disclosed in this application, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0189] The access device in this application is described in detail below; please refer to [link / reference]. Figure 8 , Figure 8 This is a schematic diagram of one embodiment of the access device in this application. The access device includes:

[0190] The sending unit 802 is used to send a first access request to the network device through the first gateway. The first access request includes a valid credential. The first access request is used to request the network device to generate an auxiliary credential based on the valid credential. The valid credential is used to characterize the device legitimacy of the accessing device.

[0191] The receiving unit 801 is used to receive auxiliary credentials sent by the network device through the first gateway;

[0192] The sending unit 802 is used to send a second access request to the second gateway after the ticket verification server fails. The second access request includes auxiliary credentials and is used to request the second gateway to verify the device legitimacy of the access device based on the auxiliary credentials to obtain a verification result.

[0193] The receiving unit 801 is used to receive the verification result sent by the second gateway;

[0194] The processing unit 803 is used to access the network device through the second gateway when the verification result indicates that the access device is a legitimate device.

[0195] Optionally, in the above Figure 8 Based on the corresponding embodiments, in another embodiment of the access device provided in this application,

[0196] The sending unit 802 is further configured to send a third access request to the ticket verification server before sending the first access request to the network device through the first gateway. The third access request is used to request the ticket verification server to generate a first ticket, which is a credential generated when the ticket verification server is operating normally.

[0197] The receiving unit 801 is specifically used to receive the first ticket sent by the ticket verification server;

[0198] The sending unit 802 is further configured to send a fourth access request to the first gateway. The fourth access request includes a first ticket and is used to request the first gateway to verify the first ticket in order to generate a valid credential.

[0199] The receiving unit 801 is also specifically used to receive valid credentials sent by the first gateway.

[0200] Optionally, in the above Figure 8 Based on the corresponding embodiments, in another embodiment of the access device provided in this application, the auxiliary credential includes a validity period, an update period, and an encryption key. The validity period is the validity time of the auxiliary credential, the update period is the interval time when the auxiliary credential is updated, and the encryption key is used by the access device to encrypt the auxiliary credential.

[0201] Optionally, in the above Figure 8 Based on the corresponding embodiments, in another embodiment of the access device provided in this application, the first gateway and the second gateway are the same.

[0202] Optionally, in the above Figure 8Based on the corresponding embodiments, in another embodiment of the access device provided in this application, the first gateway and the second gateway are different.

[0203] Optionally, in the above Figure 8 Based on the corresponding embodiments, in another embodiment of the access device provided in this application, the encryption key and decryption key negotiated between the access device and the first gateway are the same as the encryption key and decryption key negotiated between the access device and the second gateway. The encryption key is held by the access device, and the decryption key is held by the first gateway and the second gateway. The encryption key and the decryption key constitute a key pair.

[0204] This application provides an access device. Using this access device, regardless of which gateway the access request is loaded onto, or whether the ticket verification server issues a ticket in subsequent access requests, the gateway receiving the access request can determine the access device's legitimacy and security through auxiliary credentials. This establishes a communication link between the access device and the network device, enabling the access device to access the network device normally, avoiding interruptions to business and information services, and improving the user experience.

[0205] The second gateway in this application is described in detail below. Please refer to [link / reference]. Figure 9 , Figure 9 This is a schematic diagram of one embodiment of the second gateway in this application. The second gateway includes:

[0206] The receiving module 901 is used to receive a second access request sent by the access device after the ticket verification server fails. The second access request includes auxiliary credentials, which are obtained by the network device based on the valid credentials in the first access request. The first access request is a request sent by the access device to the network device through the first gateway. The valid credentials are used to characterize the device legitimacy of the access device.

[0207] Processing module 902 is used to verify the device legitimacy of the access device based on auxiliary credentials in order to obtain the verification result;

[0208] The sending module 903 is used to send the verification result to the accessing device, so that when the verification result shows that the accessing device is a legitimate device, the accessing device can access the network device through the second gateway.

[0209] Optionally, in the above Figure 9 Based on the corresponding embodiments, in another embodiment of the second gateway provided in this application, the auxiliary credential includes an encryption key, which is used by the access device to encrypt the auxiliary credential; the processing module 902 is specifically used for:

[0210] The decryption key held by the second gateway is matched with the encryption key in the auxiliary credential.

[0211] The verification result is obtained when the decryption key and the encryption key are successfully matched.

[0212] Optionally, in the above Figure 9 Based on the corresponding embodiments, in another embodiment of the second gateway provided in this application, when the second gateway is different from the first gateway, the encryption key and decryption key negotiated between the access device and the second gateway are the same as the encryption key and decryption key negotiated between the access device and the first gateway. The encryption key is held by the access device, and the decryption key is held by the first gateway and the second gateway. The encryption key and the decryption key constitute a key pair.

[0213] Optionally, in the above Figure 9 Based on the corresponding embodiments, in another embodiment of the second gateway provided in this application, the auxiliary credential further includes a validity period and an update period, wherein the validity period is the validity time of the auxiliary credential and the update period is the interval time when updating the auxiliary credential.

[0214] In this embodiment of the application, a second gateway is provided. Using this second gateway, auxiliary credentials can be used to determine whether the accessing device is legitimate and secure, thereby establishing a communication link between the accessing device and the network device. This enables the accessing device to access the network device normally, avoiding interruptions to services and information, and improving the user experience.

[0215] The first gateway in this application is described in detail below. Please refer to [link / reference]. Figure 10 , Figure 10 This is a schematic diagram of one embodiment of the first gateway in this application. The first gateway includes:

[0216] The receiving unit 1001 is used to receive a first access request sent by the accessing device. The first access request includes a valid credential, which is used to characterize the device legitimacy of the accessing device.

[0217] Forwarding unit 1002 is used to forward the first access request to the network device so that the network device can generate auxiliary credentials based on valid credentials;

[0218] The receiving unit 1001 is used to receive auxiliary credentials sent by the network device;

[0219] Forwarding unit 1002 is used to forward auxiliary credentials to the access device.

[0220] Optionally, in the above Figure 9 Based on the corresponding embodiments, in another embodiment of the first gateway provided in this application, the first gateway further includes a processing unit 1003; wherein,

[0221] The receiving unit 1001 is further configured to receive a fourth access request sent by the access device before receiving the first access request sent by the access device. The fourth access request includes a first ticket, which is a credential generated when the ticket verification server is running normally.

[0222] Processing unit 1003 is used to verify the first ticket and generate a valid voucher.

[0223] Optionally, in the above Figure 9 Based on the corresponding embodiments, in another embodiment of the first gateway provided in this application, the sending unit 1004 is specifically used to send the first ticket to the ticket verification server so that the ticket verification server can perform legality verification on the first ticket and obtain the verification result;

[0224] The receiving unit 1001 is specifically used to receive the verification result sent by the ticket verification server;

[0225] The processing unit 1003 is specifically used to generate valid credentials based on the verification results.

[0226] Optionally, in the above Figure 9 Based on the corresponding embodiments, in another embodiment of the first gateway provided in this application, the auxiliary credential includes a validity period, which is the validity time of the auxiliary credential;

[0227] The processing unit 1003 is also specifically used for: after receiving the auxiliary credential sent by the network device, detecting the frequency of failure of the ticket verification server; when the frequency is greater than a preset threshold, increasing the validity period to obtain an updated auxiliary credential;

[0228] Forwarding unit 1002 is specifically used to forward the updated auxiliary credential to the access device.

[0229] In this embodiment of the application, a first gateway is provided. Using this first gateway, auxiliary credentials can be used to determine whether the accessing device is legitimate and secure, thereby establishing a communication link between the accessing device and the network device. This enables the accessing device to access the network device normally, avoiding interruptions to services and information, and improving the user experience.

[0230] The access device, first gateway, second gateway, network device, ticket verification server, etc. provided in this application can be used with computer equipment. Please refer to [link / reference]. Figure 11 , Figure 11This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The computer device 300 can vary significantly due to different configurations or performance characteristics. It may include one or more central processing units (CPUs) 322 (e.g., one or more processors) and a memory 332, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 342 or data 344. The memory 332 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on a server. Furthermore, the CPU 322 may be configured to communicate with the storage media 330 and execute the series of instruction operations stored in the storage media 330 on the computer device 300.

[0231] Computer device 300 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341, such as Windows Server. TM Mac OS X TM Unix TM Linux TM FreeBSD TM etc.

[0232] The steps performed by computer device 300 in the above embodiments can be based on this Figure 11 The computer device structure shown.

[0233] This application also provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the methods described in the foregoing embodiments.

[0234] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the methods described in the foregoing embodiments.

[0235] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the methods described in the foregoing embodiments.

[0236] It is understood that in the specific embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0237] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0238] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0239] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0240] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0241] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a server or terminal device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing computer programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0242] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method of network processing, characterized by, The method applied to an access device comprises: sending a first access request to a network device through a first gateway, the first access request comprising a valid credential, the first access request being used to request the network device to generate an auxiliary credential based on the valid credential, the valid credential being used to represent device legitimacy of the access device; receiving the auxiliary credential sent by the network device through the first gateway; after a ticket verification server fails, sending a second access request to a second gateway, the second access request comprising the auxiliary credential, the second access request being used to request the second gateway to verify the device legitimacy of the access device based on the auxiliary credential to obtain a verification result; receiving the verification result sent by the second gateway; when the verification result indicates that the access device is a legal device, accessing the network device through the second gateway.

2. The method of claim 1, wherein, Before sending a first access request to a network device through a first gateway, the method further comprises: sending a third access request to the ticket verification server, the third access request being used to request the ticket verification server to generate a first ticket; receiving the first ticket sent by the ticket verification server, the first ticket being a credential generated when the ticket verification server is normally operated; sending a fourth access request to the first gateway, the fourth access request comprising the first ticket, the fourth access request being used to request the first gateway to verify the first ticket to generate the valid credential; receiving the valid credential sent by the first gateway.

3. The method of any one of claims 1-2, wherein, The auxiliary credential comprises a valid duration, an update duration and an encryption key, the valid duration being a valid time of the auxiliary credential, the update duration being an interval time for updating the auxiliary credential, and the encryption key being used for the access device to encrypt the auxiliary credential.

4. The method of claim 3, wherein, The first gateway is different from the second gateway.

5. The method of claim 4, wherein, The method further comprises: The encryption key and a decryption key negotiated between the access device and the first gateway are the same as the encryption key and the decryption key negotiated between the access device and the second gateway, the encryption key is held by the access device, the decryption key is held by the first gateway and the second gateway, and the encryption key and the decryption key constitute a key pair.

6. A method of network processing, characterized by, The method applied to a second gateway comprises: after a ticket verification server fails, receiving a second access request sent by an access device, the second access request comprising an auxiliary credential, the auxiliary credential being obtained by a network device based on a valid credential in a first access request, the first access request being sent by the access device to the network device through a first gateway, and the valid credential being used to represent device legitimacy of the access device; verifying the device legitimacy of the access device based on the auxiliary credential to obtain a verification result; sending the verification result to the access device, so that when the verification result indicates that the access device is a legal device, the access device accesses the network device through the second gateway.

7. The method of claim 6, wherein, The auxiliary credential includes an encryption key, and the encryption key is used for the access device to encrypt the auxiliary credential; device legitimacy of the access device is verified based on the auxiliary credential to obtain a verification result, including: The decryption key held by the second gateway matches the encryption key in the auxiliary credential; When the decryption key and the encryption key match successfully, a verification result is obtained.

8. A method of network processing, characterized by, The method applied to the first gateway includes: Receiving a first access request sent by an access device, the first access request including a valid credential, the valid credential being used to represent device legitimacy of the access device; Forwarding the first access request to a network device to enable the network device to generate an auxiliary credential based on the valid credential; Receiving the auxiliary credential sent by the network device and forwarding the auxiliary credential to the access device.

9. The method of claim 8, wherein, Before receiving the first access request sent by the access device, the method further includes: Receiving a fourth access request sent by the access device, the fourth access request including a first ticket, the first ticket being a credential generated when a ticket verification server is normally running; Verifying the first ticket to generate the valid credential.

10. The method of claim 9, wherein, Verifying the first ticket to generate the valid credential includes: Sending the first ticket to the ticket verification server to enable the ticket verification server to perform legitimacy verification on the first ticket to obtain a verification result; Receiving the verification result sent by the ticket verification server; Generating the valid credential based on the verification result.

11. The method according to any one of claims 8 to 10, characterized in that, The auxiliary credential includes a valid duration, and the valid duration is a valid time of the auxiliary credential; After receiving the auxiliary credential sent by the network device, the method further includes: Detecting a frequency of failure of the ticket verification server; When the frequency is greater than a preset threshold, increasing the valid duration to obtain an updated auxiliary credential; Forwarding the auxiliary credential to the access device includes: Sending the updated auxiliary credential to the access device.

12. An access device, characterized in that includes: A sending unit configured to send, through a first gateway, a first access request to a network device, the first access request including a valid credential, the first access request being used to request the network device to generate an auxiliary credential based on the valid credential, and the valid credential being used to represent device legitimacy of the access device; A receiving unit configured to receive, through the first gateway, the auxiliary credential sent by the network device; The sending unit is configured to, after a ticket verification server fails, send, to a second gateway, a second access request including the auxiliary credential, the second access request being used to request the second gateway to verify device legitimacy of the access device based on the auxiliary credential to obtain a verification result; The receiving unit is configured to receive the verification result sent by the second gateway; A processing unit configured to, when the verification result indicates that the access device is a legal device, access the network device through the second gateway.

13. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method for network processing according to any one of claims 1 to 11.

14. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method for network processing according to any one of claims 1 to 11.

15. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method for network processing according to any one of claims 1 to 11.

Images