Network access method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a network access method and device, electronic equipment, a storage medium and a program product, and belongs to the technical field of network communication, the method comprises the following steps: receiving a user traffic data packet sent by a user terminal, and identifying a message bearing type of the user traffic data packet; searching a clustering broadband user account corresponding to the user terminal in a pre-stored user information record according to the message bearing type; if the searching is successful, allowing the user terminal to access the network; if the searching fails, authenticating the user terminal according to the message bearing type; and after the authentication is successful, establishing a mapping relationship between the feature information of the user terminal and the clustering broadband user account, storing the mapping relationship into a user information record, and allowing the user terminal to access the network. According to the application, the user information record is stored and maintained in advance, the clustering broadband user account is searched according to the message bearing type, and the user terminal is judged to pass the network authentication according to the search result, so that the capability of unified authentication of the clustering broadband optical fiber fixed network and the mobile network at the same time is realized.

Description

Network access methods, devices, electronic equipment, storage media and software products Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a network access method, device, electronic device, storage medium, and program product. Background Technology

[0002] In clustered broadband scenarios where a large number of broadband users are concentrated in a specific geographical area, the main way fixed-line users access the network is by receiving network authentication request messages such as DHCP, DNS, and HTTP 302 sent by user terminals through fiber optic fixed-line equipment from the clustered broadband access gateway. Based on the user's MAC / IP address in the request message, the gateway determines whether the user has completed internet access authentication. If authentication is not completed, the request message is forwarded to the authentication service for authentication. If authentication is completed, the request message is forwarded to the proxy gateway. In the proxy gateway, Network Address Translation (NAT) is performed on the user's IP address and the corresponding PPPoE tunnel, enabling user traffic to pass through the operator's BRAS to the metropolitan area network, thus completing fixed-line network access.

[0003] However, because the existing clustered broadband access gateway's DHCP and Portal services do not support clustered broadband users obtaining IP addresses and Portal authentication via 5G CPE, it lacks the ability to achieve unified authentication for clustered broadband fiber optic fixed networks and 5G CPE mobile networks. It cannot simultaneously access the gateway via VXLAN tunnel based on 5G CPE mobile networks and differentiate campuses via QINQ based on fiber optic fixed networks, thus preventing clustered broadband users from having both fiber optic fixed networks and 5G CPE mobile networks for internet access. Summary of the Invention

[0004] This application provides a network access method, device, electronic device, storage medium, and program product to address the shortcomings of existing technologies, such as the lack of ability of clustered broadband access gateways to achieve unified authentication for clustered broadband fiber optic fixed networks and 5G CPE mobile networks, and the inability of clustered broadband users to have both fiber optic fixed networks and 5G CPE mobile networks for internet access.

[0005] This application provides a network access method applied to a clustered broadband access gateway. The method includes: receiving user traffic data packets sent by a user terminal; identifying the message bearer type of the user traffic data packets; the message bearer type includes QinQ message type and VXLAN message type; searching for a clustered broadband user account corresponding to the user terminal in a pre-stored user information record according to the message bearer type; if the search is successful, allowing the user terminal to access the network; if the search fails, authenticating the user terminal according to the message bearer type; after successful authentication, establishing a mapping relationship between the user terminal's feature information and the clustered broadband user account and storing it in the user information record, and allowing the user terminal to access the network.

[0006] According to a network access method provided in this application, if the message bearer type is a VXLAN message type, the characteristic information of the user terminal includes the MAC address of the wireless terminal access device that carries the user traffic data packet; other user terminals under the wireless terminal access device share the mapping relationship corresponding to the MAC address of the wireless terminal access device.

[0007] According to a network access method provided in this application, the step of searching for a clustered broadband user account corresponding to the user terminal in a pre-stored user information record based on the packet bearer type includes: if the packet bearer type is a QinQ packet type, then extracting the SVLAN tag from the user traffic data packet and searching for the corresponding clustered broadband user account in the clustered broadband user table of the user information record; if the packet bearer type is a VXLAN packet type, then extracting the source MAC address encapsulated in the outer layer of the user traffic data packet and searching for the corresponding clustered broadband user account in the access device table of the user information record; the source MAC address belongs to the wireless terminal access device transmitting the user traffic data packet.

[0008] According to a network access method provided in this application, after successful authentication, the method further includes: determining the Virtual Network Identifier (VNI) corresponding to the clustered broadband user account; creating a bridge corresponding to the VNI; creating a QinQ sub-interface for processing QinQ packets and a VXLAN tunnel endpoint interface for processing VXLAN packets; and adding the QinQ sub-interface and the VXLAN tunnel endpoint interface to the bridge, so that fiber optic fixed network users and wireless terminal access device users belonging to the same clustered broadband user account can achieve Layer 2 interconnection through the bridge.

[0009] According to a network access method provided in this application, after allowing the user terminal to access the network, the method further includes: in response to a cancellation login request, deleting the QinQ sub-interface and the VXLAN tunnel endpoint interface.

[0010] According to a network access method provided in this application, allowing the user terminal to access the network includes: searching for a Virtual Network Identifier (VNI) corresponding to the clustered broadband user account in the user information record; if the search is successful, forwarding the user traffic data packet to the bridge corresponding to the VNI.

[0011] This application also provides a network access device deployed on a clustered broadband access gateway. The device includes: a type identification module, used to receive user traffic data packets sent by a user terminal and identify the message bearer type of the user traffic data packets; the message bearer type includes QinQ message type and VXLAN message type; an account lookup module, used to look up the clustered broadband user account corresponding to the user terminal in a pre-stored user information record according to the message bearer type; a first access module, used to allow the user terminal to access the network if the lookup is successful; a second access module, used to authenticate the user terminal according to the message bearer type if the lookup fails; after successful authentication, a mapping relationship between the feature information of the user terminal and the clustered broadband user account is established and stored in the user information record, and the user terminal is allowed to access the network.

[0012] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the network access methods described above.

[0013] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network access method as described above.

[0014] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the network access methods described above.

[0015] The network access method, apparatus, electronic device, storage medium, and program product provided in this application, through a clustered broadband access gateway, pre-stores the clustered broadband user accounts that have activated fixed-line or mobile network services in the user information record of the clustered broadband access gateway, taking into account the different mobile and fixed-line access methods in clustered broadband scenarios. This pre-maintains user information records for different message bearer types, so that after receiving user traffic data packets sent by user terminals, the gateway can search for the corresponding clustered broadband user account of the user terminal in the user information record according to the different message bearer types of the user traffic data packets. When the clustered broadband user account is found, the user terminal is directly allowed to access the network. When the clustered broadband user account cannot be found, network authentication is performed according to different message bearer types, so that the user terminal can access the network through mobile or fixed-line methods. This enables the clustered broadband access gateway to simultaneously realize unified authentication for clustered broadband fiber optic fixed-line and mobile networks, allowing clustered broadband users to have both fiber optic fixed-line and mobile network access methods. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 is an example diagram of network infrastructure and network access in a campus dormitory.

[0018] Figure 2 is one of the flowcharts of the network access method provided in this application.

[0019] Figure 3 is an example diagram of clustered broadband fixed-mobile converged networking provided in this application.

[0020] Figure 4 is a second flowchart of the network access method provided in this application.

[0021] Figure 5 is a schematic diagram of the VXLAN message format provided in this application.

[0022] Figure 6 is an example diagram of clustered broadband fixed network and mobile network converged bridging network provided in this application.

[0023] Figure 7 is a schematic diagram of the network access device provided in this application.

[0024] Figure 8 is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] The network access method, apparatus, electronic device, storage medium, and program product of this application are described below with reference to Figures 1 to 8.

[0027] Clustered broadband scenarios refer to situations where a large number of broadband users have concentrated demand within a specific geographical area, including school dormitories, hotels or apartment buildings, and corporate parks. These scenarios are typically characterized by high user density, frequent network use, and high mobility.

[0028] Taking a campus dormitory as an example of a clustered broadband scenario, to achieve fiber optic fixed-line internet access, the typical network infrastructure and network structure of a campus dormitory generally includes: one Optical Network Unit (ONU) is deployed in each dormitory, such as an optical modem; the ONU is connected to the campus optical line terminal (OLT), and the campus OLT is connected to the aggregation switch. A C-VLAN (Customer VLAN) tag is added to the optical modem to identify the dormitory; an S-VLAN (Service VLAN) tag is added to the campus OLT to identify the services provided by the campus. An access gateway and portal are added after the aggregation switch for authentication, along with the carrier's AAA authentication, and a proxy gateway and the carrier's Broadband Remote Access Server (BRAS) are added to establish a tunnel.

[0029] Figure 1 is an example diagram of network infrastructure networking and network access in a campus dormitory. As shown in Figure 1, taking dormitory 614 with 4 student users as an example, after student user A in dormitory 614 in campus A activates the clustered broadband Internet access service, the operator synchronizes the user account information to the proxy gateway and AAA (Authentication, Authorization, and Accounting) service, and completes the establishment of the PPPoE tunnel. The process of student A initiating an Internet access authentication message is as follows: (1) Student A initiates DHCP, DNS, HTTP302, and other requests through the user terminal. After the request message passes through the ONU, the CVLAN tag of dormitory 614 is added, and after passing through the OLT, the SVLAN tag of the campus or dormitory building is added. The SVLAN tags of different campuses are different to achieve isolation between different areas; (2) The access gateway determines whether student user A has completed Internet access authentication based on the user MAC / IP address in the request message, and performs CVLAN tag and SVLAN tag termination processing; if authentication is completed, the request message is forwarded to the proxy gateway; if authentication is not completed, the request message is forwarded to the authentication service; (3) When the access gateway authenticates, it identifies the SVLAN of the request message. For different SVLANs, select the DNS, HTTP302, DHCP, and DHCP services corresponding to the park. When the request message is sent to each service, remove the CVLAN tag and SVLAN tag to complete the IP address and Portal connection; (4) After the client obtains the IP address and Portal address, access the Portal to complete the user login authentication. During authentication, the HTTP request carries the clustered broadband account information and MAC / IP, etc. After authentication, synchronize the user information (user MAC, IP) to the access gateway; (5) After authentication, the user's Internet traffic is forwarded to the proxy gateway after passing through the access gateway. In the proxy gateway, network address translation (NAT) is performed for the user IP and the corresponding PPPoE tunnel to realize the user traffic to the metropolitan area network through the operator's BRAS.

[0030] In existing solutions where users access the edge via 5G CPE devices, the 5G CPE (Customer Premise Equipment) acts as a wireless router, allowing users to access the nearest 5G base station using existing non-5G devices (such as laptops, tablets, and other devices that only support Wi-Fi or Ethernet). The User Plane Function (UPF) is part of the 5G core network, primarily responsible for handling user plane data traffic, performing packet routing and forwarding, and deployed at the network edge to interoperate with dedicated servers, enabling local offloading of data traffic. When a 5G CPE device accesses the core network through the UPF, it is assigned an IP address, enabling Layer 3 interoperability between the 5G CPE and edge services. The 5G CPE device is configured with Virtual eXtensible Local Area Network (VXLAN) information, creating a VXLAN tunnel overlaid on the 5G channel. User terminals access the metropolitan area network (MAN) via "5G CPE+NR+UPF+VXLAN". The network architecture is "WiFi over VXLAN over 5G", which provides users with higher stability, wider coverage, and better network security. For applications that require a large amount of data transmission, accessing the MAN via 5G CPE can provide a smoother experience.

[0031] However, the current clustered broadband gateway has the problem of not being able to simultaneously support users to authenticate and forward data through the 5G CPE mobile network or fiber optic fixed network access gateway. Specifically, this includes: (1) Clustered broadband users cannot have both fiber optic fixed network and 5G CPE mobile network access methods, that is, clustered broadband users cannot simultaneously have the ability to access the gateway through the VXLAN tunnel based on the 5G CPE mobile network and to distinguish the campus based on the fiber optic fixed network through QINQ; (2) Since the DHCP and Portal services of the clustered broadband gateway do not support clustered broadband users to obtain IP addresses through 5G CPE and Portal authentication, it does not have the ability to achieve unified authentication of clustered broadband fiber optic fixed network and 5G CPE mobile network and 5G CPE mobile network authentication exemption; (3) Clustered broadband users cannot access the dormitory fixed network through the 5G CPE mobile network, and cannot achieve interoperability between the mobile network and fixed network of terminal users under the same clustered broadband account.

[0032] In view of the above, this application provides a network access method, apparatus, electronic device, storage medium, and program product to solve at least one of the aforementioned problems.

[0033] Figure 2 is a flowchart of one of the network access methods provided in this application. As shown in Figure 2, the network access method is applied to a clustered broadband access gateway, including but not limited to steps 201 to 204.

[0034] Clustering broadband access gateways are used in servers connected to switches. They support both access and proxy functions, and can be used to access user traffic.

[0035] Step 201: Receive user traffic data packets sent by the user terminal and identify the message bearer type of the user traffic data packets.

[0036] The message bearer types include QinQ message type and VXLAN message type.

[0037] User terminals include mobile user terminals and fixed-line user terminals; mobile user terminals can specifically be terminal devices such as mobile phones and tablets; fixed-line user terminals can specifically be terminal devices such as desktop computers.

[0038] Specifically, the user terminal sends user traffic data packets, including requests for obtaining IP addresses and Portal authentication, to the clustered broadband access gateway through fiber optic fixed network equipment or wireless terminal access equipment (such as 5G CPE equipment). After receiving the user traffic data packets sent by the user terminal, the clustered broadband access gateway identifies the message bearer type of the user traffic data packets based on the message header type carried by the user traffic data packets.

[0039] When the user terminal is a fixed-line user terminal, the user terminal accesses the network through fiber optic fixed-line equipment, and the user traffic data packets sent carry a QinQ header and a QinQ message type. When the user terminal is a mobile user terminal, the user terminal accesses the network through a wireless terminal access device (such as a 5G CPE), and the user traffic data packets sent carry a VXLAN header and a VXLAN message type.

[0040] Step 202: Based on the message bearer type, search for the clustered broadband user account (USERID) corresponding to the user terminal in the pre-stored user information records.

[0041] Among them, user information records are records used to pre-store relevant information of clustered broadband users, fixed network user terminals, mobile network user terminals and wireless terminal access devices, and can be composed of one or more association tables.

[0042] Specifically, after the clustering broadband access gateway identifies the message bearer type of the user traffic data packet as a QINQ message type or a VXLAN message type, it determines at least one target association table in at least one association table of the pre-stored user information records, and queries the clustering broadband user account corresponding to the user terminal in the target association table.

[0043] It is understandable that the target association table in the user information record being searched may be different when the identified message bearer type is different.

[0044] Optionally, the user information records include a clustered broadband user table corresponding to clustered broadband users, a fixed network user table corresponding to fixed network user terminals, a mobile network user table corresponding to mobile network user terminals, and an access device table corresponding to wireless terminal access devices.

[0045] Optionally, the clustered broadband user table is used to obtain QINQ and VNI information based on the clustered broadband user account. The clustered broadband user table includes a clustered broadband user account field, a VNI field, a vlan Ctag field, and a vlan Stag field. The key is USRID{clustered broadband account ID}, and the value is a TAG{32-bit VNI + 16-bit Ctag + 16-bit Stag} structure.

[0046] Optionally, the fixed-line user table is used to determine whether authentication is successful based on the user's MAC address and to remove and add QINQ and CVLAN information records. The fixed-line user table includes the fixed-line (QINQ) internet access user device MAC field, FLAG field, vlan Ctag field, vlan Stag field, and clustered broadband user account field. The key is the fixed-line internet access user device MAC address, and the value is a USER {2-bit FLAG + 16-bit Ctag + 16-bit Stag + 32-bit USERID} structure.

[0047] Optionally, the mobile network user table is used to determine whether authentication is successful based on the user's MAC address and to strip and add VXLAN header information records. The mobile network user table includes the mobile network (VXLAN) internet access user equipment MAC field (i.e., the VXLAN inner source MAC address), FLAG field, clustered broadband user account field, VXLAN outer MAC (OMAC) field, and VXLAN outer IP (OIP) field (i.e., the MAC and IP of the 5G CPE). The key is the mobile network internet access user equipment MAC address, and the value is a USER{2-bit FLAG + 48-bit OMAC + 32-bit OIP + 32-bit USERID} structure.

[0048] Optionally, the access device table is used to determine whether tunnel authentication is successful and to record registration and acquisition of relevant information based on the MAC address of the wireless terminal access device. The access device table includes an ID association table for the wireless terminal access device MAC field, network type tag (FLAG) field, VLAN Ctag field, VLAN Stag field, clustered broadband user account field, and VXLAN Network Identifier (VNI) field. Here, the key is the wireless terminal access device MAC address, which is the outer source MAC address of the VXLAN tunnel, and the value is USER{2-bit FLAG + 16-bit Ctag + 16-bit Stag + 32-bit USERID + 20-bit VNI}. The network type tag is used to identify whether it is a mobile or fixed network; a network type tag value of 1 indicates a mobile network, and a network type tag value of 0 indicates a fixed network.

[0049] For example, when the wireless terminal access device is a 5G CPE device, the clustered broadband user table can be a hash table based on the clustered broadband user account, the fixed network user table can be a hash table based on the MAC of the fixed network (QINQ) Internet access user device, the mobile network user table can be a hash table based on the MAC of the mobile network (VXLAN) Internet access user device, and the access device table can be a hash table based on the MAC of the mobile network 5G CPE device.

[0050] Optionally, the clustered broadband user account is a user information record written into the fiber optic fixed network equipment or wireless terminal access equipment that transmits user traffic data packets during registration.

[0051] For example, for clustered broadband users who have activated 5G CPE, a VNI is assigned to them to distinguish users when purchasing and registering the 5G CPE device. When the 5G CPE device is started, the starting point of the internal VXLAN tunnel is created. The USERID, VNI and FLAG are set to 1 and sent to the clustered broadband access gateway through the configuration management platform to update the access device table maintained in the clustered broadband access gateway.

[0052] In addition, during 5G CPE device registration, the USERID and VNI are associated with the 5G CPE user relationship table in the Portal DB database through the configuration management platform, which is used to interface with the campus Portal and complete the 5G CPE device user registration.

[0053] Table 1 is the 5G CPE user relationship table of the Portal DB database provided in this application. As shown in Table 1, the 5G CPE user relationship table of the PortalDB database includes the clustered broadband user account field, VNI field, vlan Ctag field and vlan Stag field. Among them, only the VNI is updated when the 5G CPE device is registered, while the Stag is updated when the fiber optic fixed network device is registered.

[0054] Table 1

[0055] Step 203: If the search is successful, the user terminal is allowed to access the network.

[0056] Specifically, if the clustered broadband access gateway finds the clustered broadband user account in the user information record, it indicates a successful search and confirms that the user terminal has passed network authentication, allowing the user terminal to access the network.

[0057] Step 204: If the search fails, the user terminal is authenticated according to the message bearer type; after successful authentication, the mapping relationship between the feature information of the user terminal and the clustered broadband user account is established and stored in the user information record, and the user terminal is allowed to access the network.

[0058] Specifically, if the clustered broadband access gateway fails to find the clustered broadband user account in the user information record, it cannot directly confirm that the user terminal has passed network authentication. Instead, it needs to determine different user authentication methods based on the message bearer type to authenticate the user terminal. After successful user terminal authentication, a mapping relationship between the user terminal's feature information and the clustered broadband user account is established and stored in the user information record, allowing the user terminal to access the network.

[0059] In one embodiment, authenticating the user terminal based on the message bearer type includes: if the message bearer type is a QinQ message type, removing the CVLAN tag from the user traffic data packet to obtain a traffic data packet to be authenticated; if the message bearer type is a VXLAN message type, removing the VXLAN tag from the user traffic data packet to obtain a traffic data packet to be authenticated; the traffic data packet to be authenticated includes an SVLAN tag; based on the SVLAN tag, determining the target campus scheduling service; forwarding the traffic data packet to be authenticated to the target campus scheduling service; the target campus scheduling service is used to perform network authentication on the user terminal.

[0060] SVLAN tags can be used to identify different services, regions, campuses, and services.

[0061] Figure 3 is an example diagram of the clustered broadband fixed-mobile converged networking provided in this application, and Figure 4 is a flowchart of the network access method provided in this application. As shown in Figures 3 and 4, on the one hand, for user traffic data packets of the QinQ message type, according to the authentication process of obtaining IP address and Portal according to "1->2->3->4->6->13->15->17", in the case that the clustered broadband user account cannot be obtained by directly querying user information records, the clustered broadband access gateway strips the CVLAN tag from the packet header of the user traffic data packet through the CVLAN processing module to obtain the traffic data packet to be authenticated with the SVLAN tag retained. At the same time, the target campus scheduling service is determined according to the SVLAN tag, wherein the scheduling service is deployed and isolated from the network through containerization.

[0062] The traffic data packets to be authenticated are forwarded to the target campus scheduling service. The target campus scheduling service performs network authentication on the user terminal, including identifying the protocol type (DNS, APR, DHCP, and HTTP, etc.) and processing it differently depending on the protocol type: if it's DHCP, an IP address is assigned; if it's APR, a gateway MAC address is responded to; if it's DNS, a Portal domain name resolution address is responded to; if it's HTTP and the requested destination address is not a Portal address, an HTTP 302 relocation response is performed to establish a Portal connection; if it's HTTP and the requested destination address is a Portal address, portal processing is performed to complete user authentication.

[0063] On the other hand, for user traffic data packets of VXLAN type, according to the authentication process of obtaining IP address and Portal ("1->2->3->5->6->13->15->17"), when the clustered broadband user account cannot be obtained by directly querying user information records, the clustered broadband access gateway removes the VXLAN tag from the header of the user traffic data packet through the VXLAN processing module, and then adds an SVLAN tag to the header, resulting in a traffic data packet to be authenticated including the SVLAN tag. The SVLAN tag added to the header can be carried by the user traffic data packet or obtained by querying the clustered broadband user table, fixed network user table, mobile network user table, and access device table maintained by the clustered broadband access gateway. Based on the SVLAN tag, the target campus scheduling service is determined. The traffic data packet to be authenticated is forwarded to the target campus scheduling service, where the user terminal is authenticated through services such as DHCP or Portal, achieving uniformity in authentication between mobile and fixed networks.

[0064] It should be noted that the network authentication steps in mobile network scenarios are the same as those in fixed network scenarios, and will not be repeated here.

[0065] Optionally, after successful authentication of a fixed-line user, the VLAN Stag and VLAN Ctag in the clustered broadband user table maintained by the clustered broadband access gateway are updated, as is the USERID in the fixed-line user table. After successful authentication of a mobile user, the VNI in the clustered broadband user table maintained by the clustered broadband access gateway is updated. It should be noted that the updated data in the association table of the clustered broadband access gateway after successful network authentication are all valid values.

[0066] Optionally, Figure 5 is a schematic diagram of the VXLAN packet format provided in this application. Referring to Figure 5, taking a 5G CPE device as an example, for user traffic data packets of the VXLAN packet type, the VXLAN packet header includes an 8-byte VXLAN header, an 8-byte Outer UDP header, a 20-byte Outer IP header, and a 14-byte Outer Ethernet header. The Outer Ethernet SMAC is the MAC address of the 5G CPE device; the Inner Ethernet SMAC is the MAC address of the device connecting to the 5G CPE Wi-Fi network, i.e., the user terminal MAC address; the Outer IP SIP is the IP address of the 5G CPE device, assigned by the UPF core network; and the Outer UDP's sport and dport bits are fixed at 4789.

[0067] Based on the aforementioned VXLAN message type of user traffic data packets, when stripping the VXLAN label from the user traffic data packet of the first authenticated user, the MAC, FLAG (updated to 1, indicating mobile network), OMAC, and OIP of the mobile network user equipment are simultaneously recorded in the mobile network user table maintained by the clustered broadband access gateway. OMAC (outer source MAC) is the MAC address of the 5G CPE device recorded in the Outer Ethernet header, and OIP (outer source IP) is the IP address of the 5G CPE device recorded in the Outer IP header.

[0068] By performing authentication and campus association queries on the inner source MAC (MAC of the 5G CPE user) in the VXLAN packet and the outer source MAC (MAC of the 5G CPE device) carried by the first authenticated user, unified authentication for mobile and fixed network users, as well as unified authentication for tunnels and users, can be achieved.

[0069] The network access method provided in this application, through a clustered broadband access gateway, pre-stores the clustered broadband user accounts that have activated fixed-line or mobile network services in the user information record of the clustered broadband access gateway, taking into account the different mobile and fixed-line access methods in the clustered broadband scenario. This pre-maintains user information records for different message bearer types, so that after receiving user traffic data packets sent by user terminals, the gateway can search for the corresponding clustered broadband user account of the user terminal in the user information record according to the different message bearer types of the user traffic data packets. When the clustered broadband user account is found, the user terminal is directly allowed to access the network. When the clustered broadband user account cannot be found, network authentication is performed according to different message bearer types, so that the user terminal can access the network through mobile or fixed-line methods. This enables the clustered broadband access gateway to simultaneously realize unified authentication for clustered broadband fiber optic fixed-line and mobile networks, allowing clustered broadband users to have both fiber optic fixed-line and mobile network access methods.

[0070] Based on the above embodiments, as an optional embodiment, if the message bearer type is a VXLAN message type, the characteristic information of the user terminal includes the MAC address of the wireless terminal access device that carries the user traffic data packet; other user terminals under the wireless terminal access device share the mapping relationship corresponding to the MAC address of the wireless terminal access device.

[0071] Specifically, when the message bearer type of the user traffic data packet is VXLAN message type, if it fails to find the clustered broadband user account corresponding to the user terminal in the pre-stored user information record, and after successfully authenticating the user terminal according to the message bearer type, the characteristic information of the user terminal is determined to include the MAC address of the wireless terminal access device carrying the user traffic data packet. A mapping relationship between the MAC address of the wireless terminal access device and the clustered broadband user account is established, and the mapping relationship between the MAC address of the wireless terminal access device and the clustered broadband user account is stored in the user information record, so that other network terminals that subsequently access the network through the same wireless terminal access device can share the mapping relationship between the MAC address of the wireless terminal access device and the clustered broadband user account.

[0072] In other words, when other network terminals that subsequently access the network through the same wireless terminal access device send user traffic data packets to the clustered broadband access gateway, the clustered broadband access gateway can directly find the corresponding clustered broadband user account in the user information record, confirm the successful search, and allow other user terminals to access the network.

[0073] The network access method provided in this application establishes a mapping relationship between the MAC address of the wireless terminal access device and the clustered broadband user account after the user terminal fails to be directly searched for in the pre-stored user information record and is successfully authenticated according to the message bearer type. The mapping relationship between the MAC address of the wireless terminal access device and the clustered broadband user account is then stored in the user information record. This allows other network terminals that subsequently access the network through the same wireless terminal access device to share the mapping relationship between the MAC address of the wireless terminal access device and the clustered broadband user account, thus enabling authentication-free access for other users based on the MAC address of the wireless terminal access device after the first user is authenticated.

[0074] Based on the above embodiments, as an optional embodiment, the step of searching for the clustered broadband user account corresponding to the user terminal in the pre-stored user information record according to the message bearer type includes: if the message bearer type is a QINQ message type, then extracting the SVLAN tag from the user traffic data packet and searching for the corresponding clustered broadband user account in the clustered broadband user table of the user information record; if the message bearer type is a VXLAN message type, then extracting the source MAC address encapsulated in the outer layer of the user traffic data packet and searching for the corresponding clustered broadband user account in the access device table of the user information record; the source MAC address belongs to the wireless terminal access device that transmits the user traffic data packet.

[0075] It is understandable that the clustered broadband user table includes the vlanStag field corresponding to the SVLAN tag of the user traffic data packet and the clustered broadband user account field; the access device table includes the wireless terminal access device MAC field corresponding to the source MAC address encapsulated in the outer layer of the user traffic data packet and the clustered broadband user account field.

[0076] Specifically, as shown in Figures 3 and 4, after receiving user traffic data packets sent by user terminals, the clustering broadband access gateway identifies whether the user data packets are carried by QinQ or VXLAN in the access function.

[0077] When the clustered broadband access gateway identifies that the user traffic data packet's packet bearer type is a QinQ header, it indicates that the user terminal is a dormitory fixed-line user terminal. The query parameter is determined to be the SVLAN tag carried by the user traffic data packet, and the target query table is the clustered broadband user table in the user information record. The authentication process for fixed-line users to obtain IP addresses and Portals is shown in Figure 4 ("1->2->3->4->6->13->15->17"). The clustered broadband access gateway uses the SVLAN tag carried by the user traffic data packet to query the corresponding clustered broadband user account in the clustered broadband user table. If the account exists, the user authentication is successful, and the subsequent network access process can continue.

[0078] When the clustered broadband access gateway identifies that the message bearer type carried by the user traffic data packet is VXLAN, it indicates that the user terminal is a 5G CPE mobile network user terminal. The query parameter is determined to be the source MAC address encapsulated in the outer layer of the user traffic data packet, and the target query table is determined to be the access device table in the user information record. The authentication process for mobile network users to obtain IP address and Portal is shown in Figure 4 as “1->2->3->5->6->13->15->17”. The clustered broadband access gateway uses the outer source MAC address carried in the user traffic data packet to query the corresponding clustered broadband user account in the access device table. If it exists, it means that the user authentication is successful and the subsequent network access process can continue.

[0079] The network access method provided in this application, through a clustered broadband access gateway, pre-maintains a clustered broadband user table for fixed-line QINQ packets and an access device table for VXLAN packets, taking into account the different mobile and fixed-line access methods in clustered broadband scenarios. This allows the gateway to determine different query parameters and target query tables based on the different packet bearer types of user traffic data packets after receiving user traffic data packets from user terminals. The query parameters are then used to search for clustered broadband user accounts in the target query table. Upon obtaining a clustered broadband user account, the gateway determines that the user terminal has passed network authentication, enabling the user terminal to access the network via either mobile or fixed-line methods. This achieves the clustered broadband access gateway's ability to simultaneously implement unified authentication for both clustered broadband fiber optic fixed-line and mobile networks, allowing clustered broadband users to simultaneously have both fiber optic fixed-line and mobile network access methods.

[0080] Based on the above embodiments, as an optional embodiment, after successful authentication, the process further includes: determining the Virtual Network Identifier (VNI) corresponding to the clustered broadband user account; creating a bridge corresponding to the VNI; creating a QinQ sub-interface for processing QinQ packets and a VXLAN tunnel endpoint interface for processing VXLAN packets; and adding the QinQ sub-interface and the VXLAN tunnel endpoint interface to the bridge, so that fiber optic fixed network users and wireless terminal access device users belonging to the same clustered broadband user account can achieve Layer 2 interconnection through the bridge.

[0081] Specifically, in addition to performing clustered broadband authentication based on the MAC addresses of mobile users and the MAC addresses of wireless terminal access devices carried by authenticated users, the clustered broadband access gateway also creates bridges, QinQ sub-interfaces, and VXLAN tunnel endpoint interfaces within the gateway.

[0082] Specifically, after the user terminal corresponding to the user traffic data packet with the message carrying type VXLAN message passes authentication, on the one hand, the clustered broadband access gateway creates a bridge with a bridge ID equal to the corresponding VNI based on the VNI corresponding to the user traffic data packet, so as to connect the user's fixed network and mobile network Layer 2 network.

[0083] On the other hand, the clustered broadband access gateway creates a VXLAN tunnel endpoint interface for the VNI corresponding to the user traffic data packet within the gateway. This allows the VXLAN tunnel endpoint interface within the clustered broadband access gateway to form the first VXLAN tunnel connecting the wireless terminal access device and the VXLAN tunnel start interface configured during registration. This enables all users under this account who access the access gateway through the 5G CPE device to join the corresponding bridge.

[0084] On the other hand, the clustered broadband access gateway creates a QinQ sub-interface within the gateway. This QinQ sub-interface is used to strip and add QinQ headers, that is, to terminate QinQ headers. This includes stripping the QinQ header when traffic enters the bridge from the sub-interface and re-adding the QinQ header when traffic returns from the bridge to the sub-interface.

[0085] Figure 6 is an example diagram of the clustered broadband fixed-line and mobile-line converged bridging network provided in this application. As shown in Figure 6, user traffic data packets will select the corresponding bridge based on the user's MAC address before entering the bridge. For students A and B in the same dormitory, since the dormitory shares an ONU and passes through the campus OLT, they have the same QINQ tag. The Ctag and Stag in the user traffic data packets sent by the user terminals of students A and B are the same, with Ctag being 100 and Stag being 201. However, their MAC addresses are different; student A's MAC address is mac1, and student B's MAC address is mac2. Therefore, the clustered broadband access gateway needs to obtain the clustered user broadband account ID and QINQ information (Ctag and Stag) through the MAC address, and obtain the VNI from the clustered broadband user table based on the clustered user broadband account ID. Based on the VNI, a corresponding bridge (BD) is created, so that student A with VNI 101 creates the corresponding bridge BD101, and student B with VNI 102 creates the corresponding bridge BD102.

[0086] On the other hand, the clustered broadband access gateway creates a second VXLAN tunnel within the gateway, connecting the clustered broadband access gateway to the proxy gateway, so as to connect all authenticated users under the clustered broadband user account corresponding to the VNI to the network of the proxy gateway after passing through the bridge.

[0087] Finally, after creating the bridge, QinQ sub-interface, VXLAN tunnel endpoint interface, and second VXLAN tunnel, the QinQ sub-interface, VXLAN tunnel endpoint interface, and second VXLAN tunnel can be added to the bridge.

[0088] It should be noted that the QinQ sub-interface, the VXLAN tunnel endpoint interface, and the VNI corresponding to the second VXLAN tunnel within the same bridge all correspond to the bridge ID of that bridge.

[0089] For example, as shown in Figure 6, when VNI equals 101, the bridge ID equals VNI, which is 101.

[0090] It is understandable that the creation of VXLAN tunnels and QinQ sub-interfaces is passively triggered based on successful Portal authentication. If authentication fails or there is no authentication, the corresponding VXLAN tunnels, bridges, and QinQ sub-interfaces will not be created.

[0091] In addition, after a 5G CPE user completes Portal authentication, the clustered broadband access gateway updates the VNI in the clustered broadband user table.

[0092] The network access method provided in this application creates a bridge, a QinQ sub-interface, and a VXLAN tunnel endpoint interface in a clustered broadband access gateway, and adds the QinQ sub-interface and the VXLAN tunnel endpoint interface to the bridge. Clustered broadband users can achieve Layer 2 interconnection between fiber optic fixed network and 5G CPE mobile network. The VXLAN endpoint tunnel and the MAC-based QinQ sub-interface under the same account are added to a bridge to open up the Layer 2 network.

[0093] As an optional embodiment, determining the Virtual Network Identifier (VNI) corresponding to the clustered broadband user account includes: determining the Virtual Network Identifier (VNI) corresponding to the clustered broadband user account when the user terminal is the first authenticated user.

[0094] Specifically, after the clustered broadband access gateway authenticates the user terminal based on the query user information record or the authentication is successful, if the user terminal is the first authenticated user, the virtual network identifier (VNI) corresponding to the clustered broadband user account is determined, and the corresponding bridge, QinQ sub-interface, VXLAN tunnel endpoint interface and second VXLAN tunnel are created based on the VNI.

[0095] While creating the bridge, QinQ sub-interface, VXLAN tunnel endpoint interface, and second VXLAN tunnel, the USERID in the mobile network user table is also updated, the new VNI in the clustered broadband user table is updated (the new Ctag and Stag are updated during fixed network user authentication), and the new Ctag and Stag in the access device table are updated.

[0096] After the first authenticated user confirms successful network authentication, subsequent user terminals accessing the network through the same wireless terminal access device will not create a bridge, QinQ sub-interface, VXLAN tunnel endpoint interface, or first VXLAN tunnel after confirming successful network authentication. Instead, they will directly use the bridge, QinQ sub-interface, VXLAN tunnel endpoint interface, and first VXLAN tunnel that were created after the first authenticated user passed network authentication to access the network.

[0097] Optionally, after the first authenticated user successfully completes authentication, if requests from other users on the same 5G CPE device reach the admission gateway, and if DHCP reserves a large number of IP addresses for each account, the clustered broadband user table can be queried based on the MAC address of the mobile network user device to obtain the Stag. If the Stag is not zero, other users do not need authentication (the Stag is updated during the first user authentication, indicating that all users on this 5G CPE device are exempt from authentication), and only need to obtain an IP address. If, due to the limitation on the number of MAC addresses that each account can access the internet simultaneously, clustered broadband generally limits the number of IP addresses that DHCP can reserve for each account, the USERID in the mobile network user table needs to be updated after Portal authentication, and a VXLAN tunnel will not be created (this is already completed after the first user's authentication).

[0098] By performing clustered broadband authentication based on the MAC address of the 5G CPE user and the MAC address of the 5G CPE device carried by the first authenticated user in the clustered broadband access gateway, a VXLAN endpoint tunnel is passively triggered to be created within the gateway after the first user passes the Portal authentication. The outer source MAC address correspondence table and the inner source MAC address correspondence table are also updated. This solves the problem that mobile and fixed network users of clustered broadband 5G CPE cannot access the Portal authentication in a unified manner. It can also realize authentication-free access when subsequent users access the network through the same wireless terminal access device based on the MAC address of the 5G CPE device. That is, after the first 5G CPE user completes the Portal authentication, subsequent users do not need to create a VXLAN endpoint tunnel or perform tunnel authentication. In other words, after the first authentication, all subsequent users do not need to perform MAC authentication for the tunnel.

[0099] Based on the above embodiments, as an optional embodiment, after allowing the user terminal to access the network, the method further includes: in response to the cancellation login request, deleting the QinQ sub-interface and the VXLAN tunnel endpoint interface.

[0100] Specifically, after any user sending user traffic data packets through the same wireless terminal access device sends a cancellation login request through the Portal, the clustered broadband access gateway deletes the QinQ sub-interface and VXLAN tunnel endpoint interface corresponding to the VNI of that wireless terminal access device, and also deletes the second VXLAN tunnel. In addition, it updates the VNI in the clustered broadband user table to an invalid value (e.g., 0), and updates the Ctag and stag in the access device table to invalid values ​​(e.g., 0).

[0101] The network access method provided in this application, by responding to a cancellation login request, deletes the QinQ sub-interface, VXLAN tunnel endpoint interface, and other interfaces created by the first user sending user traffic data packets through the wireless terminal access device during network authentication, thereby enabling secure network access for the same wireless terminal access device.

[0102] Based on the above embodiments, as an optional embodiment, allowing the user terminal to access the network includes: searching for a Virtual Network Identifier (VNI) corresponding to the clustered broadband user account in the user information record; if the search is successful, forwarding the user traffic data packet to the bridge corresponding to the VNI.

[0103] Specifically, referring to Figure 4, when the user traffic data packet header type is a QinQ header and the user terminal is a fixed-line user's internet access device, the user terminal's internet access process is shown in "1->2->7->8->9->14" and "1->2->7->8->10->12->14" in Figure 4. After the clustered broadband access gateway confirms that the user terminal has passed network authentication by querying the fixed-line user table or the park scheduling service, it obtains the clustered broadband user account. Further, it queries the clustered broadband user table and / or the fixed-line user table in the user information record to obtain the target VNI corresponding to the clustered broadband user account. If the target VNI is invalid (e.g., 0), it indicates that the user terminal has only subscribed to fixed-line services, and the lookup fails. Therefore, after the QinQ processing module removes the QinQ header, it is directly forwarded to the proxy gateway for processing. If the target VNI is a valid value (e.g., not 0), it indicates that the user terminal has subscribed to both fixed-line and mobile 5G CPE services, confirming a successful lookup. Therefore, based on the user's MAC address in the user traffic data packet, the user traffic data packet is forwarded to the target bridge with the bridge ID corresponding to the target VNI. Within the bridge with the bridge ID of the target VNI, the QinQ sub-interface and the VXLAN tunnel from the admission gateway to the proxy gateway are interconnected at Layer 2. The QinQ sub-interface performs termination processing on the QinQ packet header within the bridge. When traffic enters the bridge from the QinQ sub-interface, the QinQ label is stripped; when traffic returns from the bridge to the sub-interface, the QinQ header is re-added. The traffic is then forwarded to the proxy gateway for processing before reaching the operator's BRAS.

[0104] When the user traffic data packet header type is VXLAN header and the user terminal is a mobile network user's internet access device, the user terminal's internet access process is shown in Figure 4 as "1->2->7->11->12->14". After the clustered broadband access gateway confirms that the user terminal has passed network authentication by querying the access device table and / or the mobile network user table or the campus scheduling service, it obtains the clustered broadband user account. Further, based on the clustered broadband user account, it queries the clustered broadband user table to obtain the target VNI corresponding to the clustered broadband user account. If the VNI is invalid (e.g., 0), the user traffic data packet is discarded; if the target VNI is valid (e.g., not 0), the user traffic data packet is forwarded to the target bridge with the bridge ID corresponding to the target VNI based on the user's MAC address in the user traffic data packet. In the bridge with the bridge ID of the target VNI, the second VXLAN tunnel from the user's 5G CPE to the clustered broadband access gateway and the first VXLAN tunnel from the clustered broadband access gateway to the proxy gateway are interconnected at Layer 2. The traffic is forwarded to the proxy gateway for processing before reaching the operator's BRAS.

[0105] Optionally, the target VNI and the target bridge ID are the same.

[0106] Furthermore, combining the "1->2->7->8->10->BD1 (bridge)" and "1->2->7->11->BD1 (bridge)" processes in Figure 4 and Figure 6, on the one hand, after the user traffic data packet carrying the VXLAN header enters the clustered broadband access gateway, it queries the user information record to obtain the clustered broadband user account and determines that the authentication is successful. Then, it enters the target bridge corresponding to the target VNI of the clustered broadband user account. In the target bridge, the VXLAN tunnel from the user's 5G CPE to the access gateway and the corresponding QinQ sub-interface of the user are interconnected at Layer 2. On the other hand, after the user traffic data packet carrying the QinQ header enters the clustered broadband access gateway, it enters the corresponding bridge after authentication query and query whether the user has activated 5G CPE. In the bridge, the QinQ sub-interface and the VXLAN tunnel from the user's 5G CPE to the access gateway are interconnected at Layer 2, thereby realizing the convergence and interoperability of the 5G CPE mobile network and the dormitory fixed network of the clustered broadband user.

[0107] In addition, when dealing with the corresponding user traffic data packets, the mobile network user table can be queried to obtain information such as FLAG, outer source MAC, and outer source ID. For example, when FLAG is 1, it indicates that it is a mobile network user. Based on the outer source MAC, the mobile network user table is queried to obtain the VNI, the SVLAN header is stripped and a VXLAN header as shown in Figure 5 is added, which includes an 8-byte VXLAN header, an 8-byte OuterUDP header, a 20-byte Outer IP header and a 14-byte Outer Ethernet header.

[0108] Based on MAC decision-making bridges, all mobile network users under an account's VXLAN tunnel and fixed network users under the bridge's QinQ sub-interface can communicate with each other. A VXLAN tunnel belongs to only one account, while a QinQ sub-interface is shared by multiple accounts. The bridges of the accounts to which the users belong are distinguished by the user's MAC address.

[0109] The network access method provided in this application obtains a Virtual Individual (VNI) based on the successfully authenticated clustered broadband user account after the user terminal accesses the network. It then makes a bridge decision based on the MAC address, uniformly forwarding all packet requests of type QINQ and VXLAN to the bridge corresponding to the valid VNI for header termination processing. This adds the VXLAN endpoint tunnel and QINQ sub-interface under the same clustered broadband user account to a single bridge, enabling Layer 2 network connectivity. This solves the problems of different accounts sharing the same QINQ sub-interface not being isolated and the inability of mobile and fixed-line users under the same account to interconnect at Layer 2. It achieves interconnection between mobile and fixed-line users under the same clustered broadband user account. Users can have both fiber optic fixed-line and 5G CPE mobile internet access methods, enabling clustered broadband users to access the operator's BRAS outdoors via 5G CPE devices based on the clustered broadband access gateway. Furthermore, the clustered broadband access gateway can support different users under the same account to access simultaneously via QINQ or VXLAN tags and aggregate them into the same PPPoE proxy tunnel.

[0110] Overall, the network access method provided in this application allows clustered broadband users to access the clustered broadband gateway outdoors via a UPF connected to a 5G base station after purchasing 5G CPE equipment. This provides them with the same broadband authentication and BRAS bandwidth usage as fixed-line users, enabling them to access corresponding fixed-line services within the campus, such as printers, NAS, and servers, from outdoors via 5G base stations, achieving secure remote access and intranet penetration. Before clustered broadband user authentication, the method dynamically processes the QinQ and VXLAN packets carried in the data packets, performing DHCP, DNS processing, and Portal authentication on unauthenticated 5G CPE mobile users. Only after authentication is the VXLAN termination tunnel interface fixed in the access gateway. Based on the strategy of adding the VXLAN termination tunnel and the MAC-based QinQ sub-interface under the same clustered broadband account ID to a bridge to establish Layer 2 network connectivity, outdoor 5G CPE mobile users can access dormitory fixed-line services, enabling fixed-mobile interoperability. For those ordering 5G… CPE users can register and activate the mobile and fixed network convergence and interoperability function to achieve unified interoperability, authentication, and access to the metropolitan area network for clustered broadband fixed network and 5G CPE mobile network users. For scenarios where fiber optic fixed network access is not possible, 5G CPE can quickly access the metropolitan area network to obtain a stable, high-bandwidth, and low-latency network.

[0111] Figure 7 is a schematic diagram of the network access device provided in this application. As shown in Figure 7, the network access device is deployed on a clustered broadband access gateway, comprising a type identification module 701, an account lookup module 702, a first access module 703, and a second access module 704.

[0112] The type identification module 701 is used to receive user traffic data packets sent by user terminals and identify the message bearer type of the user traffic data packets; the message bearer type includes QinQ message type and VXLAN message type.

[0113] The account lookup module 702 is used to search for the clustered broadband user account corresponding to the user terminal in the pre-stored user information records according to the message bearer type.

[0114] The first access module 703 is used to allow the user terminal to access the network if the search is successful.

[0115] The second access module 704 is used to authenticate the user terminal according to the message bearer type if the lookup fails; after successful authentication, it establishes a mapping relationship between the feature information of the user terminal and the clustered broadband user account and stores it in the user information record, and allows the user terminal to access the network.

[0116] It should be noted that the network access device provided in this application can execute the network access method described in any of the above embodiments during actual operation, and this embodiment will not elaborate on this.

[0117] The network access device provided in this application, through a clustered broadband access gateway, pre-stores the clustered broadband user accounts that have activated fixed-line or mobile network services in the user information record of the clustered broadband access gateway, taking into account the different mobile and fixed-line access methods in the clustered broadband scenario. This pre-maintains user information records for different message bearer types, so that after receiving user traffic data packets sent by user terminals, it can look up the corresponding clustered broadband user account of the user terminal in the user information record according to the different message bearer types of the user traffic data packets. When the clustered broadband user account is found, the user terminal is directly allowed to access the network. When the clustered broadband user account cannot be found, network authentication is performed according to different message bearer types, so that the user terminal can access the network through mobile or fixed-line methods. This realizes that the clustered broadband access gateway has the ability to realize unified authentication for clustered broadband fiber optic fixed-line and mobile networks, and enables clustered broadband users to have both fiber optic fixed-line and mobile network access methods at the same time.

[0118] Figure 8 is a schematic diagram of the structure of the electronic device provided in this application. As shown in Figure 8, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840. The processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute the network access method provided in any of the above embodiments. The network access method is applied to a clustered broadband access gateway, including but not limited to the following steps: receiving user traffic data packets sent by a user terminal, identifying the packet bearer type of the user traffic data packets; the packet bearer type includes QinQ packet type and VXLAN packet type; searching for the clustered broadband user account corresponding to the user terminal in a pre-stored user information record according to the packet bearer type; if the search is successful, allowing the user terminal to access the network; if the search fails, authenticating the user terminal according to the packet bearer type; after successful authentication, establishing a mapping relationship between the user terminal's feature information and the clustered broadband user account and storing it in the user information record, and allowing the user terminal to access the network.

[0119] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network access method provided in any of the above embodiments. The network access method includes, but is not limited to, the following steps: receiving user traffic data packets sent by a user terminal, identifying the message bearer type of the user traffic data packets; the message bearer type includes QinQ message type and VXLAN message type; searching for a clustered broadband user account corresponding to the user terminal in a pre-stored user information record according to the message bearer type; if the search is successful, allowing the user terminal to access the network; if the search fails, authenticating the user terminal according to the message bearer type; after successful authentication, establishing a mapping relationship between the feature information of the user terminal and the clustered broadband user account and storing it in the user information record, and allowing the user terminal to access the network.

[0121] In another aspect, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the network access method provided in any of the above embodiments. The network access method includes, but is not limited to, the following steps: receiving user traffic data packets sent by a user terminal, identifying the message bearer type of the user traffic data packets; the message bearer type includes QinQ message type and VXLAN message type; searching for a clustered broadband user account corresponding to the user terminal in a pre-stored user information record according to the message bearer type; if the search is successful, allowing the user terminal to access the network; if the search fails, authenticating the user terminal according to the message bearer type; after successful authentication, establishing a mapping relationship between the feature information of the user terminal and the clustered broadband user account and storing it in the user information record, and allowing the user terminal to access the network.

[0122] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0123] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A network access method, characterized in that, An application to a clustered broadband access gateway, the method includes: receiving user traffic data packets sent by a user terminal; identifying the message bearer type of the user traffic data packets; the message bearer type includes QinQ message type and VXLAN message type; searching for a clustered broadband user account corresponding to the user terminal in a pre-stored user information record according to the message bearer type; if the search is successful, allowing the user terminal to access the network; if the search fails, authenticating the user terminal according to the message bearer type; after successful authentication, establishing a mapping relationship between the user terminal's feature information and the clustered broadband user account and storing it in the user information record, and allowing the user terminal to access the network.

2. The network access method according to claim 1, characterized in that, If the message bearer type is a VXLAN message type, the characteristic information of the user terminal includes the MAC address of the wireless terminal access device that carries the user traffic data packet; other user terminals under the wireless terminal access device share the mapping relationship corresponding to the MAC address of the wireless terminal access device.

3. The network access method according to claim 1, characterized in that, The step of searching for the clustered broadband user account corresponding to the user terminal in the pre-stored user information record according to the message bearer type includes: if the message bearer type is a QinQ message type, then extracting the SVLAN tag from the user traffic data packet and searching for the corresponding clustered broadband user account in the clustered broadband user table of the user information record; if the message bearer type is a VXLAN message type, then extracting the source MAC address encapsulated in the outer layer of the user traffic data packet and searching for the corresponding clustered broadband user account in the access device table of the user information record; the source MAC address belongs to the wireless terminal access device that transmits the user traffic data packet.

4. The network access method according to claim 1, characterized in that, After successful authentication, the process further includes: determining the Virtual Network Identifier (VNI) corresponding to the clustered broadband user account; creating a bridge corresponding to the VNI; creating a QinQ sub-interface for processing QinQ packets and a VXLAN tunnel endpoint interface for processing VXLAN packets; and adding the QinQ sub-interface and the VXLAN tunnel endpoint interface to the bridge so that fiber optic fixed network users and wireless terminal access device users belonging to the same clustered broadband user account can achieve Layer 2 interconnection through the bridge.

5. The network access method according to claim 4, characterized in that, After allowing the user terminal to access the network, the method further includes: in response to the cancellation login request, deleting the QinQ sub-interface and the VXLAN tunnel endpoint interface.

6. The network access method according to any one of claims 4, characterized in that, The step of allowing the user terminal to access the network includes: searching for the Virtual Network Identifier (VNI) corresponding to the clustered broadband user account in the user information record; if the search is successful, forwarding the user traffic data packet to the bridge corresponding to the VNI.

7. A network access device, characterized in that, Deployed in a clustered broadband access gateway, the device includes: a type identification module, used to receive user traffic data packets sent by a user terminal and identify the packet bearer type of the user traffic data packets; the packet bearer type includes QinQ packet type and VXLAN packet type; an account lookup module, used to look up the clustered broadband user account corresponding to the user terminal in a pre-stored user information record according to the packet bearer type; a first access module, used to allow the user terminal to access the network if the lookup is successful; a second access module, used to authenticate the user terminal according to the packet bearer type if the lookup fails; after successful authentication, a mapping relationship between the user terminal's feature information and the clustered broadband user account is established and stored in the user information record, and the user terminal is allowed to access the network.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the network access method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the network access method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the network access method as described in any one of claims 1 to 6.

Images