Network access management method and system, server and readable storage medium

Abstract

The embodiment of the invention provides a network access management method and system, a server and a readable storage medium, relates to the technical field of communication, can solve the problem of relatively large time delay when an AAA system performs authentication authorization and charging, and is applied to the network access management system. The system comprises a center node in a preset area of a network access scene, a plurality of edge nodes and at least one gateway device. Comprising the following steps: receiving a network access request initiated by a user through gateway equipment, wherein the network access request carries a user identifier, a user address and an access mode identifier; and determining a target sub-region of the user based on the user address, routing the network access request to a target edge node corresponding to the target sub-region, and performing access authentication on the network access request through the target edge node to obtain an authentication result. And if the authentication result represents that the authentication is passed, performing network access resource quantification through a target center node corresponding to the target edge node, and obtaining a network access resource quantification result.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a network access management method, system, server, and readable storage medium. Background Technology

[0002] With the rapid development of broadband networks and the rapid popularization of new services, user access scenarios are becoming increasingly complex. Different access scenarios correspond to different network access modes, such as Point-to-Point Protocol over Ethernet (PPPoE), Internet Protocol over Ethernet (IPoE), Dynamic Host Configuration Protocol + Portal Authentication Protocol (DHCP + Portal), and other network access modes.

[0003] The Authentication, Authorization, Accounting (AAA) system is a key component of network access management, responsible for functions such as verifying the identity of network access users, allocating resource permissions, and calculating and compiling fees.

[0004] However, existing AAA systems suffer from significant latency in authentication, authorization, and billing, impacting the user experience. Summary of the Invention

[0005] This application provides a network access management method, system, server, and readable storage medium, which can solve the problem of large latency in AAA systems when performing authentication, authorization, and billing.

[0006] Firstly, this application provides a network access management method applied to a network access management system. The network access management system includes a central node, multiple edge nodes, and at least one gateway device within a preset area of ​​a network access scenario. The central node is a node located at the center of the preset area. The preset area is divided into multiple sub-areas, each sub-area corresponding to one edge node. The central node in the preset area corresponds to multiple edge nodes.

[0007] The method includes: The gateway device receives network access requests initiated by users, which carry user identifiers, user addresses, and access method identifiers. Based on the user address, the target sub-region of the user is determined, and the network access request is routed to the target edge node corresponding to that sub-region. The target edge node performs access authentication on the network access request and obtains the authentication result. If the authentication result indicates successful authentication, the target center node corresponding to the target edge node performs network access resource quantification and obtains the network access resource quantification result.

[0008] Based on the first aspect, by separating the authentication and quantization processes in the network access management system, implementing the authentication process at edge nodes and the quantization process at the central node, compared to implementing both authentication and quantization processes at the central node, the load pressure on the central node can be reduced, thereby improving the billing efficiency of the central node. Furthermore, by implementing the high-frequency authentication process at the edge nodes of the network access management system, compared to implementing the authentication process at the central node, there is no need to transmit data to a distant central node; the authentication process can be implemented at a closer edge node, reducing transmission losses and the impact of the central node's load pressure on authentication latency, thus improving the efficiency of the network access management system's authentication and consequently enhancing the user experience. Finally, improving the efficiency of authentication and quantization in the network access management system can reduce the latency of authentication and quantization, further improving the user experience.

[0009] In one possible implementation, the above-mentioned access authentication of network access requests through the target edge node and obtaining the authentication result includes: The target edge node performs structured parsing of network access requests to obtain user authentication information, including the parsed user identifier, user address, and access method identifier. The target edge node then verifies the authentication information based on the user's preset authentication information to obtain the authentication result.

[0010] In another possible implementation, the aforementioned preset authentication information includes first preset authentication information.

[0011] The above-mentioned method of verifying authentication information based on the user's preset authentication information through the target edge node and obtaining the authentication result includes: The authentication information is verified based on the first preset authentication information, which is the preset authentication information in the local cache of the edge node within the first time period.

[0012] The above methods also include: If the target preset authentication information matches the authentication information, the user's network access request is deemed authenticated. If the first preset authentication information does not match the authentication information, the authentication information is verified based on the second preset authentication information, which is the preset authentication information obtained by the edge node from the central node. If the target second preset authentication information matches the authentication information, the user's network access request is deemed authenticated. If neither the second preset authentication information nor the authentication information matches, the user's network access request is deemed unsuccessful.

[0013] In another possible implementation, the above method also includes: If a user's network access request fails authentication, the gateway device will return an authentication failure message to the user.

[0014] In another possible implementation, if the authentication result indicates that the authentication is successful, the method further includes: The gateway device collects user session data, generates a quantization request, and sends the quantization request to the target edge node. The session data includes session establishment time, uplink resource quantization value, downlink resource quantization value, and access duration. The target edge node performs structured parsing on the quantization request, extracts the core resource quantization fields corresponding to the quantization request, and sends the core resource quantization fields to the target central node.

[0015] The above-mentioned quantification of network access resources through the target center node corresponding to the target edge node, and the acquisition of network access resource quantification results, include: By using the target central node, and based on resource quantification rules and core resource quantification fields, the user's session data is quantified to obtain network access resource quantification results. The resource quantification rules are used to characterize the quantification rules for the session duration and / or resources used by the user's network services.

[0016] In another possible implementation, the above method also includes: The target central node stores the quantification results of network access resources corresponding to the user's session data in the database.

[0017] In another possible implementation, the above method also includes: If abnormal user session data is detected by the target central node, the user session data is marked as abnormal data. The target central node then performs resource quantization on the user session data according to the minimum resource quantization rule to obtain the network access resource quantization result. The minimum resource quantization rule is used to characterize resource quantization with a preset abnormal quantization value.

[0018] In another possible implementation, after determining the user's target sub-region based on the user's address, the above method further includes: If the target edge node corresponding to the target sub-region is abnormal, the network access request is routed to the target center node corresponding to the target edge node through the gateway device. The target center node then performs access authentication on the network access request and obtains the authentication result.

[0019] Secondly, this application provides a network access management system, which includes a central node, multiple edge nodes, and a gateway device in a preset area of ​​a network access scenario. The central node is a node matched to the center of the preset area. The preset area is divided into multiple sub-areas, each sub-area corresponding to an edge node, and the central node in the preset area corresponds to multiple edge nodes.

[0020] The gateway device receives network access requests initiated by users, which carry user identifiers, user addresses, and access method identifiers. The gateway device also determines the user's target sub-region based on the user address and routes the network access request to the target edge node corresponding to that sub-region.

[0021] The target edge node is used to authenticate network access requests and obtain authentication results. When the authentication result indicates successful authentication, the target edge node also receives user session data from the gateway device and sends the session data to the corresponding target center node.

[0022] The target central node is used to quantify network access resources based on session data and obtain the quantification results of network access resources.

[0023] In one possible implementation, the target edge node includes a protocol processing module and an authentication and authorization module.

[0024] The protocol processing module is used to perform structured parsing of network access requests to obtain user authentication information. This authentication information includes the parsed user identifier, user address, and access method identifier.

[0025] The authentication and authorization module is used to verify authentication information based on the user's preset authentication information and obtain the authentication result.

[0026] In another possible implementation, the aforementioned preset authentication information includes first preset authentication information and second preset authentication message. The first preset authentication information is the preset authentication information stored in the edge node's local cache for a first time period, and the second preset authentication information is the preset authentication information obtained by the edge node from the central node.

[0027] If the target first preset authentication information matches the authentication information, the authentication and authorization module determines that the user's network access request authentication is successful. If the first preset authentication information does not match the authentication information, the authentication and authorization module verifies the authentication information based on the second preset authentication information. If the target second preset authentication information matches the authentication information, the authentication and authorization module determines that the user's network access request authentication is successful. If neither the second preset authentication information nor the authentication information matches, the authentication and authorization module determines that the user's network access request authentication is unsuccessful.

[0028] In another possible implementation, if the authentication result indicates that the authentication is successful, The gateway device is also used to collect user session data, generate quantization requests, and send quantization requests to the protocol processing module. The session data includes session establishment time, uplink resource quantization value, downlink resource quantization value, and access duration.

[0029] The protocol processing module is also used to perform structured parsing of quantization requests, extract the core resource quantization fields corresponding to the quantization requests, and send the core resource quantization fields to the target central node.

[0030] In another possible implementation, the aforementioned target central node includes a resource quantification module.

[0031] The resource quantification module is used to quantify user session data based on resource quantification rules and core fields to obtain network access resource quantification results. Specifically, the resource quantification rules characterize the session duration and / or resource usage of a user's network services.

[0032] In another possible implementation, the resource quantization module is further configured to mark the user's session data as abnormal data if abnormality is detected. The resource quantization module is also configured to perform resource quantization on the user's session data according to a minimum resource quantization rule, obtaining the network access resource quantization result. The minimum resource quantization rule is used to characterize resource quantization based on a preset abnormal quantization value.

[0033] In another possible implementation, the aforementioned target central node includes a database module.

[0034] The database module stores the second preset authentication information for multiple users. It also stores the network access resource quantification results corresponding to the user's session data.

[0035] In another possible implementation, the central node mentioned above includes a protocol processing module and an authentication and authorization module.

[0036] If an edge node malfunctions, the protocol processing module of the central node is used to perform structured parsing of network access requests to obtain user authentication information, including the parsed user identifier, user address, and access method identifier.

[0037] The authentication and authorization module of the central node is used to verify authentication information based on the user's preset authentication information and obtain the authentication result.

[0038] In another possible implementation, the module to be processed includes one or more of the following: a protocol processing module, an authentication and authorization module, a resource quantification module, and a database module.

[0039] The target central node includes an interface registration module, which is used to register services for the modules to be processed and to configure routing between the modules to be processed.

[0040] In another possible implementation, the interface registration module receives a service registration request from a module to be processed and verifies the service information corresponding to the service registration request to obtain a service routing table. The service information in the service registration request includes module information, interface information, and deployment information corresponding to the module to be processed. The service routing table is used to represent the forwarding rules for business requests among the modules to be processed. Business requests include network access requests and quantization requests.

[0041] The interface registration module is also used to send the service routing table to the processing module, so that the processing module can forward business requests based on the service routing table.

[0042] In another possible implementation, the aforementioned interface registration module is used to send the service routing table to the module to be processed, so that the module to be processed can forward business requests based on the service routing table.

[0043] In another possible implementation, the aforementioned target central node includes a configuration query module.

[0044] The configuration query module is used to perform the initial initialization configuration of the protocol processing module. The initial initialization configuration includes sending protocol processing parameters to the protocol processing module based on a first preset interface. The protocol processing parameters include the structured parsing rules corresponding to the business request.

[0045] The configuration query module is also used to perform a second initialization configuration on the authentication and authorization module. This second initialization configuration includes sending an initial authentication policy to the authentication and authorization module based on a second preset interface. The initial authentication policy includes an account / password authentication policy.

[0046] The configuration query module is also used to perform third initialization configuration on the database module. This third initialization configuration includes sending initial business data to the database module based on a third preset interface. The initial business data includes preset authentication data.

[0047] The configuration query module is also used to perform a fourth initialization configuration on the resource quantification module. The fourth initialization configuration includes sending the initial billing rules to the resource quantification module based on the fourth preset interface.

[0048] In another possible implementation, the aforementioned protocol processing module, authentication and authorization module, resource quantification module, database module, interface registration module, and configuration query module are all encapsulated as independent containers, and each independent container includes at least one container instance.

[0049] For each independent container, the orchestration platform predicts the trend of the load metric based on the corresponding load metric of the independent container, and obtains the prediction results so that the orchestration platform can adjust the container instance of the independent container.

[0050] In another possible implementation, the load metrics for the above protocol processing module include session concurrency, and the load metrics for the resource quantization module include the amount of quantization results generated.

[0051] When the independent container is a protocol processing module, if the prediction result indicating session concurrency for the protocol processing module is greater than the first session load threshold, the orchestration platform increases the number of container instances for the protocol processing module. If the prediction result indicating session concurrency is less than the second session load threshold, the orchestration platform reduces the number of container instances for the protocol processing module.

[0052] When the independent container is a resource quantization module, if the amount of quantization results generated by the prediction result representation corresponding to the resource quantization module is greater than the first quantization result load threshold, the business system expands the number of container instances for the resource quantization module. If the amount of quantization results generated by the prediction result representation corresponding to the resource quantization module is less than the second quantization result load threshold, the business system reduces the number of container instances for the resource quantization module.

[0053] In another possible implementation, the edge node includes a first edge node and at least one second edge node. The first edge node includes at least two independent containers corresponding to protocol processing modules and at least two independent containers corresponding to authentication and authorization modules. The second edge node includes at least two independent containers corresponding to protocol processing and at least two independent containers corresponding to authentication and authorization modules.

[0054] Thirdly, this application provides a server, which includes a communication interface, a processor, and a memory. The memory stores at least one computer program, which is loaded and executed by the processor to implement the above-described network access management method, or to implement the above-described network access management system.

[0055] Fourthly, this application provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the above-described network access management method, or to implement the above-described network access management system.

[0056] Fifthly, this application provides a computer program product, which includes a computer program or instructions that, when executed by a processor, implement the aforementioned network access management method or the aforementioned network access management system. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This application provides an illustration of an application scenario for a network access management method. Figure 2 A schematic diagram of the hardware structure of an edge node provided in an embodiment of this application; Figure 3 A flowchart illustrating a network access management method provided in an embodiment of this application; Figure 4 A schematic diagram of the architecture of a network access management system provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a network access management device provided in an embodiment of this application. Detailed Implementation

[0059] The following describes in detail, with reference to the accompanying drawings, a network access management method and system provided in the embodiments of this application.

[0060] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0061] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0062] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0063] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0064] The following explanations of some terms used in the embodiments of this disclosure are provided to facilitate understanding by those skilled in the art: (1) AAA (Authentication, Authorization, Accounting) system: It is the general term for the three functional modules of authentication, authorization and accounting. It is the core management and control system for network access and resource access. Its core objectives are to verify the legitimacy of user identity, allocate resource access permissions, statistically analyze resource usage and realize the billing closed loop.

[0065] (2) Container: A lightweight virtualization technology that packages an application and its dependent runtime environment (libraries, configuration files, runtime) into an independent, lightweight, standardized, and portable unit through operating system-level isolation (rather than hardware virtualization).

[0066] (3) Cluster: A cluster is a group of computers (called nodes) that work together and are connected by software and networks to appear as a single, more powerful system.

[0067] (4) BNG (Broadband Network Gateway): Also known as BRAS (Broadband Remote Access Server), it is a core network element and control node in the broadband access network of telecommunications operators. It is located between the operator's metropolitan area aggregation network and the backbone core network, serving as the service aggregation point, policy enforcement point, and network boundary point for user broadband access.

[0068] (5) Radius (Remote Authentication Dial-In User Service): is a client / server protocol that provides centralized authentication, authorization and billing functions for users or devices that need to access the network.

[0069] With the rapid development of broadband networks and the rapid popularization of new services, user access scenarios are becoming increasingly complex. Different access scenarios correspond to different network access modes, such as Point-to-Point Protocol over Ethernet (PPPoE), Internet Protocol over Ethernet (IPoE), Dynamic Host Configuration Protocol + Portal Authentication Protocol (DHCP + Portal), and other network access modes.

[0070] The Authentication, Authorization, Accounting (AAA) system is a key component of network access management, responsible for functions such as verifying the identity of network access users, allocating resource permissions, and calculating and compiling fees.

[0071] However, existing AAA systems deeply integrate authentication, authorization, billing, protocol processing, and data storage into a monolithic architecture. This results in complex dependencies between modules, requiring system-wide modifications for new services or features. This leads to long development cycles, high risks, and difficulty in handling sudden traffic spikes and rapidly growing user numbers. Furthermore, existing AAA systems employ a centralized deployment model, requiring all user access requests (including those from peripheral city areas) to be transmitted across the network to the provincial core node for processing. The combined effect of transmission link losses and core node load increases authentication latency, manifesting as slow dial-up connections, delayed upgrades, and untimely responses to temporary speed boosts, negatively impacting user experience.

[0072] To address the aforementioned technical issues, the network access management method provided in this application involves a gateway device receiving a network access request initiated by a user. The network access request carries a user identifier, user address, and access method identifier. The gateway device determines the user's target sub-region based on the user address and routes the network access request to the target edge node corresponding to the target sub-region. The target edge node performs access authentication on the network access request to obtain an authentication result. If the authentication result indicates successful authentication, network access resources can be quantified through the target center node corresponding to the target edge node to obtain the network access resource quantification result.

[0073] In this embodiment, based on the first aspect, by separating the authentication and quantization processes in the network access management system, implementing the authentication process at the edge nodes and the quantization process at the central node, compared to implementing both authentication and quantization processes at the central node, the load pressure at the central node can be reduced, thereby improving the billing efficiency of the central node. By implementing the high-frequency authentication process at the edge nodes of the network access management system, compared to implementing the authentication process at the central node, there is no need to transmit to a distant central node; the authentication process can be implemented at a closer edge node, reducing transmission losses and the impact of the central node's load pressure on authentication latency, thereby improving the efficiency of the network access management system in performing authentication, and thus improving the user experience. Furthermore, improving the efficiency of the network access management system in performing authentication and quantization can reduce the latency of the network access management system in performing authentication and quantization, which can also improve the user experience.

[0074] Figure 1 This is an application scenario diagram of a network access management method provided in an embodiment of this application.

[0075] like Figure 1 As shown, the diagram includes a preset area, which can be divided into multiple sub-regions. For example... Figure 1 As shown, the preset area is divided into three sub-areas. The figure also includes a network access management system 100, which includes a gateway device 101, an edge node 102 corresponding to each sub-area, a central node 103 corresponding to the preset area, and the user's user terminal.

[0076] Figure 1 The rectangle shown represents a preset area. This preset area can refer to the coverage area of ​​a single company or the coverage area of ​​a province.

[0077] When the preset area is the coverage area of ​​a province, the sub-areas can be divided according to the cities or districts in the province, or according to the coverage of multiple base stations in the province, thus obtaining multiple sub-areas.

[0078] Taking the coverage area of ​​a province as an example, edge nodes can be deployed in the core data center of a prefecture-level city or in the same data center as the gateway device, while central nodes can be deployed in the provincial data center.

[0079] In this embodiment, the gateway device can be any device with the function of forwarding service requests. For example, the gateway device can be a broadband network gateway, a broadband remote access server (BRAS) device, etc.

[0080] Edge nodes and central nodes can be servers, electronic devices, etc. For example, a server can be a single physical server; or it can be two or more physical servers sharing different responsibilities, with multiple servers collaborating to achieve corresponding functions. In terms of server type, for example, a server can be a blade server, a high-density server, a rack server, or a tower server, etc.

[0081] Gateway device 101 receives service requests sent by user terminals in a preset area and forwards them to edge node 102. These service requests include network access requests and quantization requests. Edge node 102 receives the service requests from gateway device 101, performs structured parsing on the requests, and processes the parsed requests accordingly. For example, edge node 102 performs structured parsing on network access requests to obtain authentication information, verifies the authentication information based on the user's corresponding preset authentication information, and obtains the authentication result. Edge node 102 also performs structured parsing on quantization requests, extracts the resource quantization core fields corresponding to the quantization requests, and sends these core fields to central node 103, enabling central node to perform resource quantization based on these core fields and obtain the resource quantization result.

[0082] Taking edge nodes as servers as an example, Figure 2 This is a schematic diagram of the hardware structure of an edge node provided in an embodiment of this application.

[0083] See Figure 2 , Figure 2 The server 200 shown may include a processor 201, a memory 202, a communication interface 203, and a bus 204. The processor 201, the memory 202, and the communication interface 203 can be connected via the bus 204.

[0084] Processor 201 is the control center of server 200, and can be a general-purpose central processing unit (CPU) or other general-purpose processors. The general-purpose processor can be a microprocessor or any conventional processor.

[0085] As an example, processor 201 may include one or more CPUs, for example Figure 2 CPU 0 and CPU 1 are shown in the diagram.

[0086] The memory 202 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0087] In one possible implementation, the memory 202 may exist independently of the processor 201. The memory 202 can be connected to the processor 201 via a bus 204 and is used to store data, instructions, or program code. When the processor 201 calls and executes the instructions or program code stored in the memory 202, it can implement the network access management method provided in the embodiments of this application.

[0088] In another possible implementation, the memory 202 can also be integrated with the processor 201.

[0089] The communication interface 203 is used for the server 200 to connect with other devices via a communication network, which can be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. The communication interface 203 may include a receiving unit for receiving data and a transmitting unit for sending data.

[0090] Bus 204 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 2 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0091] It should be pointed out that, Figure 2 The structure shown does not constitute a limitation on the server, except... Figure 2 In addition to the components shown, the server may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0092] Figure 3 This is a flowchart illustrating a network access management method provided in an embodiment of this application, as shown below. Figure 3 As shown, it is applied to a network access management system, which includes a central node, multiple edge nodes, and at least one gateway device in a preset area of ​​the network access scenario.

[0093] The central node is the node that matches the center of the preset region. The preset region is divided into multiple sub-regions, and each sub-region corresponds to an edge node. The central node in the preset region corresponds to multiple edge nodes.

[0094] The method includes: S301. Receive network access requests initiated by users through the gateway device.

[0095] In this embodiment, the gateway device is used to receive network access requests sent by users based on user terminals. The user terminal is an entity that directly interacts with the user who has a network access request and can transform the user's intention to access the network into an operational entity for network behavior.

[0096] A network access request is used to represent network information initiated by a user terminal based on user operations to obtain network access permissions and resource allocation when accessing the network, or network information automatically generated by the user terminal to obtain network access permissions and resource allocation.

[0097] The network access request includes the user identifier, user address, and access method identifier.

[0098] User identifiers are used to identify the identity information of users requesting network access. They are key information used by network access management systems to identify, authenticate, and distinguish different users. For example, a user identifier can be a user account identifier, including a user account used for login, a mobile phone number, a Subscription Permanent Identifier (SUPI), or a Subscription Concealed Identifier (SUCI). A user identifier can also be a physical identifier of a user terminal, including a Mobile Device Identifier (MDI) or an International Mobile Subscriber Identity (IMSI).

[0099] A user address is used to identify the logical or physical location of a user requesting network access within the network. It serves as the basis for the network access management system to forward network access requests. For example, a user address can be its own Media Access Control Address (MAC address), Internet Protocol version 4 (IPv4) address, Internet Protocol version 6 (IPv6) address, Virtual Local Area Network Identifier (VLAN ID), etc. A user address can also be the geographical coordinates of a terminal device.

[0100] Access method identifier is a feature information used to characterize the access technology type of a user terminal accessing the network. It is used by the network access management system to determine the access technology type of the user terminal, so that the network access management system can determine different authentication policies, resource allocation rules, etc. based on the access technology type.

[0101] For example, the access method can be that the user terminal initiates a network access request via PPPoE dialing, so that the gateway device can receive the network access request initiated by the user terminal based on the account and password; or, the access method can be that the user terminal initiates a network access request via IPoE direct connection, so that the gateway device can receive the network access request automatically initiated by the user terminal based on terminal identifiers such as MAC address and VLAN ID; or, the access method can also be that the user terminal initiates a network access request via DHCP+WebPortal, so that the gateway device can receive the user terminal's request for a private Internet Protocol (IP) address, which is first automatically initiated by the user terminal via Dynamic Host Configuration Protocol (DHCP), and then receive the network access request initiated by the terminal on the World Wide Web (Web) authentication portal by entering an account and password, SMS verification code, or scanning a QR code.

[0102] S302. Determine the user's target sub-region based on the user's address, and route the network access request to the target edge node corresponding to the target sub-region.

[0103] In one feasible implementation, the gateway device may include a mapping relationship between user addresses, sub-regions, and edge nodes. This mapping relationship can be stored in the local routing table of the gateway device, enabling the gateway device to route network access requests to the target edge node corresponding to the target sub-region based on the local routing table.

[0104] In another feasible implementation, a region determination model can be deployed in the gateway device. By inputting the user's address into the region determination model, the model can output the sub-region corresponding to the user's address. Thus, the gateway device can route network access requests to the target edge node corresponding to the target sub-region based on the local routing table.

[0105] S303. Authenticate the network access request through the target edge node and obtain the authentication result.

[0106] The authentication result is used to characterize the authenticity and authorization status of the user who has a network access request.

[0107] In one scenario, the authentication result indicates that the authentication was successful, meaning that the user has the right to access the network and network resources.

[0108] In another scenario, the authentication result indicates authentication failure, meaning the user does not have permission to access the network.

[0109] In one specific implementation, the target edge node can perform structured parsing of the network access request to obtain the user's authentication information. Based on the user's preset authentication information, the authentication information is verified to obtain the authentication result. The authentication information includes the parsed user identifier, user address, and access method identifier.

[0110] S304. If the authentication result indicates that the authentication is successful, the network access resources are quantified through the target center node corresponding to the target edge node to obtain the network access resource quantification result.

[0111] It should be noted that when authentication is successful, the user has the right to access the network and various resources within the network. These resources include web browsing, video streaming, file downloading, online social networking, and cloud application access.

[0112] Network access resource quantification is used to characterize and quantify users' network resource usage behavior. Raw measurement data can be obtained through network access resource quantification.

[0113] The quantification results of network access resources are used to characterize the billing bills obtained based on the original measurement data.

[0114] In one feasible implementation, the original measurement data can be the cumulative user session duration, so the quantification result of network access resources can be a billing bill obtained based on session duration and the corresponding session duration billing rules.

[0115] In another feasible implementation, the original measurement data can be the cumulative user traffic usage, so the quantification result of network access resources can be a billing bill obtained based on traffic usage and the corresponding traffic billing rules.

[0116] In this embodiment, based on the first aspect, by separating the authentication and quantization processes in the network access management system, implementing the authentication process at edge nodes and the quantization process at the central node, compared to implementing both authentication and quantization processes at the central node, the load pressure on the central node can be reduced, thereby improving the billing efficiency of the central node. By implementing the high-frequency authentication process at the edge nodes of the network access management system, compared to implementing the authentication process at the central node, there is no need to transmit data to a distant central node; the authentication process can be implemented at a closer edge node, reducing transmission losses and the impact of the central node's load pressure on authentication latency. This improves the authentication efficiency of the network access management system, thereby improving the user experience. Furthermore, improving the efficiency of authentication and quantization in the network access management system reduces the latency of authentication and quantization, further enhancing the user experience.

[0117] The following is a detailed description of the method by which the target edge node performs access authentication on the network access request and obtains the authentication result in step S303 above.

[0118] S3031. Perform structured parsing of network access requests through the target edge node to obtain the user's authentication information.

[0119] Authentication information is used to identify user information that needs to be authenticated in a network access request.

[0120] The authentication information includes the parsed user identifier, user address, and access method identifier.

[0121] In some embodiments, the data structure, encapsulation format, and data fields of different network access requests may differ.

[0122] For example, if a user terminal initiates a network access request via PPPoE dialing, the core data fields of the network access request may include data such as username / password, device MAC address, and PPP session ID. These core data fields are encapsulated in a PPP protocol frame.

[0123] If a user terminal initiates a network access request via IPoE direct connection, the core data fields of the network access request may include data such as the terminal MAC address, DHCP Option parameters, and IP address request type. These core data fields are encapsulated in a DHCP message.

[0124] If the user terminal initiates a network access request via DHCP+Web Portal, the core data fields of the network access request may include data such as mobile phone number / verification code, terminal fingerprint, and access duration request. These core data fields are encapsulated in an HTTP form.

[0125] In network access scenarios, edge nodes will receive different network access requests. If the edge nodes directly authenticate the network access requests, it will make it impossible for the edge nodes to quickly identify the user's authentication information, and it will also increase the processing pressure on the edge nodes.

[0126] Therefore, before authenticating network access requests, edge nodes can first perform structured parsing of the network access requests. By extracting core data fields from the network access requests and encapsulating the core fields into a unified data structure based on a preset format, different network access requests can be transformed into authentication information with standardized data structures that are easy to identify and verify.

[0127] The following section provides a detailed explanation of how edge nodes perform structured parsing of network access requests.

[0128] In one feasible implementation, edge nodes are equipped with a structured parsing model. By inputting network access requests into this model, the authentication information output by the model can be directly obtained. The structured parsing model is used to perform structured parsing of network access requests. It is obtained through unsupervised training based on a large number of network access requests of different types and their corresponding authentication information.

[0129] In another feasible implementation, the edge nodes are equipped with structured templates corresponding to different types of network access requests. By extracting relevant information from the network access request and filling it into the corresponding structured template, the edge nodes can obtain the authentication information corresponding to the network access request.

[0130] S3032. Verify the authentication information based on the user's preset authentication information through the target edge node, and obtain the authentication result.

[0131] The default authentication information is user information stored in the network access management system. For example, the stored user information may include stored user identifiers, password hashes, device identifiers, etc.

[0132] The following section details how target edge nodes verify authentication information based on the user's preset authentication information.

[0133] In one feasible implementation, the central node of the network access management system stores user information. The target edge node, based on the user identifier corresponding to the authentication information, sends a request to the central node to obtain the preset authentication information corresponding to the user identifier, thereby obtaining the preset authentication information. Further, the target edge node verifies the authentication information based on the obtained preset authentication message.

[0134] In another feasible implementation, the edge nodes of the network access management system store a first preset authentication message, while the central node stores a second preset authentication message. The target edge node corresponding to the user verifies the authentication message based on the first preset authentication information. If the first preset authentication information does not match the authentication information, it verifies the authentication information based on the second preset authentication information.

[0135] In this embodiment, the first preset authentication information is the preset authentication message within a first time period stored in the local cache of the edge node. The second preset authentication information is the preset authentication information obtained by the edge node from the central node.

[0136] The local cache of an edge node can be a database or a distributed cache cluster used by the edge node to cache the user's preset authentication information.

[0137] The first time period represents a preset time period. For example, the first time period can be 1 hour, 6 hours, 24 hours, etc.

[0138] The first time period can be determined based on the network access status of users at the edge nodes. For edge nodes with high user network access frequency, the first time period can be shorter, such as 1 hour. For edge nodes with low user network access frequency, the first time period can be longer, such as 24 hours.

[0139] In some embodiments, in network access scenarios, the same user may need to authenticate multiple times within a short period of time. For example, a user terminal may need to authenticate multiple times within a short period of time due to unstable network information or loose network cables; or, a single broadband account may allow multiple devices to be online simultaneously, and when multiple devices of a user need to connect to the network, there may be multiple network access requests from different devices under the same user account within a short period of time; or, a user may leave and enter the same scene multiple times within a day, which may also result in multiple authentications, and so on.

[0140] Therefore, preset authentication information of active users in a short period of time can be stored in the edge nodes. That is, the first authentication information corresponding to the first time period stored in the edge nodes in this embodiment of the application allows the edge nodes to directly authenticate the user's identity based on the preset authentication information stored locally, without having to send a request to the central node to obtain the user's preset authentication information, thereby improving the efficiency of authentication.

[0141] In this embodiment, the authentication result includes either an authentication success result or an authentication failure result.

[0142] If the target's first preset authentication information matches the authentication information, then the obtained authentication result indicates successful authentication, and it can be determined that the user's network access request has been authenticated.

[0143] If the first preset authentication information does not match the authentication information, the verification information is based on the second preset authentication information. If the target second preset authentication information matches the authentication information, the obtained authentication result indicates successful authentication, and it can be determined that the user's network access request authentication has passed. If neither the second preset authentication information nor the authentication information matches, the obtained authentication result indicates authentication failure, and it can be determined that the user's network access request authentication has failed.

[0144] In this embodiment, if a user's network access request authentication fails, the gateway device can return authentication failure information to the user.

[0145] Authentication failure messages indicate the reason for user authentication failure. For example, authentication failure messages include user account not existing, user account password incorrect, plan expired, etc.

[0146] By first performing structured parsing of network access requests at edge nodes to obtain the corresponding authentication information, and then verifying the authentication information based on preset verification information, the efficiency of user authentication can be improved, thereby enhancing the user experience.

[0147] In some embodiments, if the target edge node corresponding to the target sub-region is abnormal, the network access request can be routed to the target center node corresponding to the target edge node through the gateway device, and the network access request can be authenticated by the target center node to obtain the authentication result.

[0148] The central node can also perform access authentication for users who have network access requests. When the edge node is abnormal, access authentication can be performed through the central node, which can ensure that user access authentication can still be performed when the edge node is abnormal, thus improving the practicality of the method.

[0149] The following provides a detailed explanation of step S304 above: if the authentication result indicates that the authentication is successful, the network access resources are quantified through the target center node corresponding to the target edge node, and the network access resource quantification result is obtained.

[0150] S3041. If the authentication result indicates that the authentication is successful, the user's session data is collected through the gateway device, a quantization request is generated, and the quantization request is sent to the target edge node.

[0151] In this embodiment, if the authentication result indicates successful authentication, the edge node sends authentication and authorization information to the user's corresponding gateway device, enabling the gateway device to provide the user with the corresponding network services based on the authorization information. When the user begins using the corresponding network service, the gateway device starts collecting the user's session data.

[0152] The session data may include session establishment time, uplink resource quantification value, downlink resource quantification value, and access duration.

[0153] Session establishment time is used to characterize when a user's session begins.

[0154] Uplink resource quantization, also known as uplink traffic, is used to characterize the total number of input bytes from the user to the network.

[0155] Downlink resource quantization, also known as downlink traffic, is used to characterize the total number of bytes output from the network to the user.

[0156] Access duration is used to represent the total duration accumulated from the start of a user's session to the end of the session.

[0157] A quantification request is used to represent a request to charge a user's session data. A quantification request may include information such as session data, user identifier, gateway device identifier, and session identifier.

[0158] The gateway device generates a quantization request based on the collected user session data and sends the quantization request to the target edge node, so that the target edge node can obtain the user's authentication result based on the quantization request.

[0159] S3042. Perform structured parsing of the quantization request through the target edge node, extract the core resource quantization fields corresponding to the quantization request, and send the core resource quantization fields to the target center node.

[0160] The method by which the target edge node performs structured parsing of the quantization request is the same as the method by which the target edge node performs structured parsing of the network access request. Step S2031 above has already provided a detailed explanation of the method by which the target edge node performs structured parsing of the network access request, and will not be repeated here.

[0161] The core fields for resource quantization are used to represent user data information during a session. These fields include parsed session data, user identifier, gateway device identifier, session identifier, and other information.

[0162] S3043. Through the target central node, based on the resource quantification rules and the core fields of resource quantification, perform resource quantification on the user's session data to obtain the network access resource quantification result.

[0163] In one embodiment, resource quantification rules can be used to characterize the quantification rules for the session duration corresponding to a user's network service.

[0164] In other embodiments, resource quantization rules can also be used to characterize the quantification rules of resources used by a user's network service corresponding to a session. In still other embodiments, resource quantization rules can also be used to characterize the quantification rules of session duration and resources used by a user's network service corresponding to a session.

[0165] The following section provides a detailed introduction to resource quantification methods based on resource quantification rules and core fields.

[0166] In one feasible implementation, the target central node can quantify resources by selecting the session duration or session resources corresponding to the user's network service based on the user's package type, or it can quantify resources through multi-dimensional information on session duration and session resources.

[0167] In another feasible implementation, the target central node can quantify the session duration, session resources, or both exceeding the free session duration and free session resources in the user's package type.

[0168] In another feasible implementation, dynamic packages with higher priority than user package types can exist. For example, time-based dynamic packages can offer double bandwidth, free data, or discounted billing during nighttime hours or weekday daytime when there are significant network downtime. Dynamic packages based on user network tenure can provide exclusive packages for users whose network tenure exceeds a preset limit. For users on dynamic packages, session data is quantified based on the dynamic package; for other users, session data is quantified based on the package type.

[0169] By using any of the above methods, resource quantification of the user's session data is performed to obtain the network access resource quantification result. The network resource quantification result is the billing statement for the user's session data.

[0170] In some embodiments, the network access resource quantification results corresponding to the user's session data can be stored in the database through the target central node.

[0171] The quantification results of network access resources serve as the original basis for user billing and cost accounting. By storing the quantification results in a database, data traceability can be achieved, thus improving the practicality of the method.

[0172] By first performing structured parsing of the quantization request at the edge node to obtain the corresponding core fields for resource quantization, and then performing resource quantization based on these core fields, the efficiency of resource quantization for user session data can be improved. Furthermore, performing resource quantization for user session data based on multiple billing methods enhances the practicality of resource quantization, thereby improving the user experience.

[0173] In some embodiments, if the target central node detects abnormal user session data, it can mark the user session data as abnormal data. For abnormal data, the target central node can perform resource quantification on the user session data according to the minimum resource quantification rule to obtain the network access resource quantification result.

[0174] Session data anomalies are used to characterize user session data that does not conform to normal data patterns. Session data anomalies can be any one or more of the following: abnormal session establishment time, abnormal uplink resource quantization value, abnormal downlink resource quantization value, and abnormal access duration. For example, the uplink resource quantization value exceeds the reasonable range, or the access duration is lower than the minimum access duration.

[0175] The minimum resource quantification rule is used to bill abnormal data.

[0176] The minimum resource quantization rule can be used to characterize the resource quantification of user session data through preset anomaly quantization values. These preset anomaly quantization values ​​include preset anomaly quantization values ​​corresponding to session duration and preset anomaly quantization values ​​corresponding to session resources. The preset anomaly quantization value can be a fixed value.

[0177] In this embodiment, the target central node can also mark abnormal session data as abnormal, triggering a manual review process based on the abnormal marking, allowing users to verify the session data. In this embodiment, by applying a minimum resource quantification rule to abnormal session data, resource quantification can be performed, preventing user losses and improving the practicality of the method.

[0178] The following embodiments provide a detailed description of the network access management system described above.

[0179] The network access management system includes gateway devices, edge nodes (target edge nodes), and (target edge node) central nodes.

[0180] The central node is the node that matches the center of the preset region. The preset region is divided into multiple sub-regions, and each sub-region corresponds to an edge node. The central node in the preset region corresponds to multiple edge nodes.

[0181] Gateway devices are used to receive network access requests initiated by users.

[0182] A network access request is used to represent network information initiated by a user terminal based on user operations to obtain network access permissions and resource allocation when accessing the network, or network information automatically generated by the user terminal for obtaining network access permissions and resource allocation. The network access request carries a user identifier, user address, and access method identifier.

[0183] User identifiers are used to identify the identity information of users who have network access requests. They are key information used by network access management systems to identify, authenticate, and distinguish different users.

[0184] The user address is used to represent the logical or physical location information of a user with a network access request in the network, and is the basis for the network access management system to forward network access requests.

[0185] Access method identifier is a feature information used to characterize the access technology type of a user terminal accessing the network. It is used by the network access management system to determine the access technology type of the user terminal, so that the network access management system can determine different authentication policies, resource allocation rules, etc. based on the access technology type.

[0186] The gateway device is also used to determine the user's target sub-region based on the user's address and to route network access requests to the target edge node corresponding to the target sub-region.

[0187] The target edge node is used to authenticate network access requests and obtain authentication results. When the authentication result indicates successful authentication, the target edge node also receives user session data from the gateway device and sends the session data to the corresponding target center node.

[0188] It should be noted that when the authentication result indicates successful authentication, the authentication and authorization module sends authentication and authorization information to the user's corresponding gateway module, enabling the gateway device to provide the user with the appropriate network services based on the authorization information. When the user begins using the corresponding network service, the gateway device also collects the user's session data and sends the session data to the corresponding target central node.

[0189] The target central node is used to quantify network access resources based on session data and obtain the quantification results of network access resources.

[0190] In some embodiments, the target edge node may include a processing module, which is used to perform access authentication on network access requests, obtain authentication results, and receive user session data sent by the gateway device when the authentication result indicates that the authentication is successful, and send the session data to the corresponding target center node.

[0191] In other embodiments, the target edge node may include a protocol processing module and an authentication and authorization module. The protocol processing module is used to perform structured parsing of the network access request to obtain the user's authentication information. The authentication and authorization module is used to verify the authentication information based on the user's preset authentication information and obtain the authentication result.

[0192] The method by which the protocol processing module performs structured parsing of network access requests is the same as the method in step S3031 above for performing structured parsing of network access requests through the target edge node, and will not be described again here.

[0193] The authentication result includes either a successful authentication of the user's network access request or a failed authentication of the user's network access request. Specifically, when the user's target preset authentication message matches the authentication message, the authentication result indicates that the user's network access request has been successfully authenticated; when the preset authentication message and the authentication message do not match, the authentication result indicates that the user's network access request has failed.

[0194] In one feasible implementation, the target center node corresponding to the target edge node stores the preset authentication messages for users within a preset area. The authentication and authorization module verifies the authentication messages by requesting the preset authentication messages obtained from the target center node. If a target preset authentication message matches the authentication message, the authentication and authorization module determines that the user's network access request is authenticated; if the preset authentication message and the authentication message do not match, the authentication and authorization module determines that the user's network access request is not approved.

[0195] In another feasible implementation, the preset authentication message includes a first preset authentication message and a second preset authentication message. The first preset authentication message is a preset authentication message stored in the local cache of the edge node within a first time period, and the second preset authentication message is a preset authentication message obtained by the authentication and authorization module from the central node. The authentication and authorization module first verifies the authentication information based on the first preset authentication information. If the first preset authentication information and the authentication information do not match, the authentication and authorization module then verifies the authentication information based on the second preset authentication information.

[0196] Specifically, the authentication and authorization module first verifies the authentication information based on the first preset authentication information. If a match exists between the target first preset authentication information and the authentication information, the authentication and authorization module determines that the user's network access request authentication is successful. If the first preset authentication information and the authentication information do not match, the authentication and authorization module verifies the authentication information based on the second preset authentication information. The authentication and authorization module requests the second preset authentication information obtained from the target central node and verifies the authentication information. If a match exists between the target second preset authentication information and the authentication information, the authentication and authorization module determines that the user's network access request authentication is successful. If the second preset authentication information and the authentication information do not match, the authentication and authorization module determines that the user's network access request authentication is unsuccessful.

[0197] By caching the preset authentication information of active users in the edge nodes, active users can complete authentication through the authentication and authorization module in the edge nodes, which improves the authentication speed, reduces the authentication latency, and thus improves the user experience.

[0198] In some embodiments, when a user begins using the corresponding network service, the gateway device is further configured to collect the user's session data, generate a quantization request corresponding to the session data, and send the quantization request to the protocol processing module. The protocol processing module is further configured to perform structured parsing of the quantization request, extract the resource quantization core field corresponding to the quantization request, and send the resource quantization core field to the target central node.

[0199] The session data includes session establishment time, uplink resource quantification value, downlink resource quantification value, and access duration.

[0200] In one feasible implementation, the method by which the protocol processing module performs structured parsing of the quantization request can be the same as the method in step S3031 above for performing structured parsing of the network access request through the target edge node, and will not be described again here.

[0201] After sending the core fields of resource quantization to the target central node, the protocol processing module can perform resource quantization on the core fields of resource quantization through the target central node to obtain the network access resource quantization results.

[0202] In some embodiments, the target central node includes a resource quantification module, which is used to perform resource quantification on the user's session data based on resource quantification rules and core resource quantification fields, and obtain network access resource quantification results.

[0203] Among them, the resource quantification rules are used to characterize the quantification rules for the session duration corresponding to the user's network service, the quantification rules for the session resources used, or the quantification rules for the session duration and the session resources used.

[0204] The method by which the resource quantification module quantifies session data based on resource quantification rules and core resource quantification fields is the same as the method by which the target center node quantifies session data based on resource quantification rules and core resource quantification fields in step S3043 above, and will not be repeated here.

[0205] In other embodiments, the resource quantization module is further configured to mark user session data as abnormal data when abnormality is detected. The resource quantization module is also configured to perform resource quantization on the user session data according to the minimum resource quantization rule to obtain network access resource quantization results.

[0206] Among them, the minimum resource quantification rule is used to characterize resource quantification with a preset abnormal quantification value.

[0207] In one feasible implementation, the resource quantification module quantifies the user's session data according to the minimum resource two-user rule in the same way as the target center node quantifies the user's session data according to the minimum resource two-user rule in the above embodiment, and will not be described again here.

[0208] In some embodiments, the target central node may further include a database module, which is used to store second preset authentication information of multiple users and to store the network access resource quantification results corresponding to the user's session data.

[0209] In some embodiments, the target central node may further include a protocol processing module and an authentication and authorization module. If an edge node malfunctions, the protocol processing module of the target central node can perform structured parsing of the network access request to obtain the user's authentication information. The authentication and authorization module of the target central node can verify the authentication information based on the user's preset authentication information and obtain the authentication result. The authentication information includes the parsed user identifier, user address, and access method identifier.

[0210] Even when an edge node malfunctions, the central node can still authenticate network access requests, which can prevent authentication failures caused by edge node malfunctions from affecting user experience and thus improve the reliability of the network access management system.

[0211] Before authenticating, authorizing, and quantifying user network access through the network access management system, it is necessary to deploy, orchestrate, register services, configure routes, and initialize the various modules to be processed in the network access management system, thereby obtaining the network access management system in this embodiment of the application.

[0212] In this embodiment, the module to be processed may include one or more of a protocol processing module, an authentication and authorization module, a resource quantification module, and a database module. The module to be processed may also include an interface protocol module and a configuration query module.

[0213] It should be noted that each module to be processed in the network access management system has been pre-packaged into a dedicated independent container. By writing a dedicated Dockerfile for each module and explicitly declaring the broadband network dependency environment, multiple independent modules are obtained to complete the corresponding functions.

[0214] By encapsulating different modules into independent containers, the coupling between modules is reduced. When upgrading or modifying a single module, it is not necessary to upgrade or modify the entire network access management system, which reduces the difficulty of upgrading and modification and improves the applicability of the network access management system.

[0215] An orchestration platform is a management platform built on a container orchestration engine (Kubernetes) for multiple independent containers. The orchestration platform can be used to allocate resources to different modules to be processed based on preset resource configuration parameters.

[0216] The orchestration platform allocates resources to each module to be processed based on a preset deployment architecture, completing the deployment of the preset architecture and the allocation of resources. The preset deployment architecture can be a hybrid deployment structure based on edge nodes and central nodes.

[0217] In one feasible implementation, the orchestration platform can allocate corresponding resources to each module to be processed in the network access management system based on the preset resource configuration parameters corresponding to each module to be processed.

[0218] In another feasible implementation, the edge nodes in the network access management system may include a first edge node and at least one second edge node, and the central node in the network access management system may include a first central node and at least one second central node. The orchestration platform may allocate corresponding resources to each module in the first edge node, second edge node, first central node, and second central node of the network access management system based on the preset resource configuration parameters corresponding to each module.

[0219] The first edge node, also known as the main edge node, is used to obtain network access requests from users in a preset area in real time, process the network access requests, and obtain authentication information based on the network access requests.

[0220] The second edge node, also known as the backup edge node, is used to continuously synchronize the operating status of the primary edge node. In the event of a primary edge node failure, the backup edge node can directly take over the tasks of the primary edge node and obtain the corresponding authentication information. This avoids interruptions to the authentication service due to primary edge node failure, ensuring service continuity and improving the practicality of the network access management system.

[0221] In some embodiments, the gateway device can distribute network access requests from users within a sub-region to a first edge node and a second edge node based on a preset distribution weight. By distributing network access requests from users within the same sub-region to different edge nodes, the load of the edge nodes in that sub-region can be balanced, avoiding problems such as increased authentication latency or unstable operation of edge nodes due to excessive load on a single edge node.

[0222] The orchestration platform deploys different modules in corresponding locations based on a preset deployment architecture. After allocating resources to each module to be processed, it can perform service registration and obtain routing configurations between modules in the network access management system. Service registration is used when a module to be processed starts up, and the module actively sends its module information, interface information, deployment information, etc., to the service registration center. In this embodiment, the function of the service registration center can be implemented through the interface registration module.

[0223] The interface information of each module to be processed will be introduced in the subsequent embodiments, and will not be repeated here.

[0224] Routing configuration is used to characterize the rules for forwarding business requests between modules to be processed.

[0225] In some embodiments, the target central node may further include an interface registration module, which may be a service registration center. The interface registration module is used to register the module to be processed with services and configure the routing between the module to be processed.

[0226] In other embodiments, the interface registration module is further configured to receive service registration requests sent by the modules to be processed, and to verify the service information corresponding to the service registration requests to obtain a service routing table. The interface registration module is also configured to send the service routing table to the modules to be processed, enabling the modules to forward business requests based on the service routing table.

[0227] The service registration request includes service information such as module information, interface information, and deployment information corresponding to the module to be processed. The service routing table is used to represent the forwarding rules of business requests between the modules to be processed. Business requests include network access requests and quantization requests.

[0228] After registering services and configuring routes for each module to be processed, the initial configuration of each module in the network access management system can be performed.

[0229] The initialization configuration is used to configure the parameters in each module to be processed.

[0230] In some embodiments, the target central node also includes a configuration query module, which can be used to configure parameters for other modules to be processed.

[0231] Specifically, the configuration query module can be used to perform a first initialization configuration on the protocol processing module. The first initialization configuration includes sending protocol processing parameters to the protocol processing module based on a first preset interface. For example, the first preset interface can be a Dynamic Control Command interface.

[0232] The protocol processing parameters include structured parsing rules and timeout retransmission rules corresponding to different business requests.

[0233] For example, the timeout retransmission rule includes that if the gateway device does not send a quantization request within a preset time, the protocol processing module will send a timeout retransmission request to the gateway device.

[0234] The configuration query module is also used to perform a second initialization configuration on the authentication and authorization module. The second initialization configuration includes sending an initial authentication policy to the authentication and authorization module based on a second preset interface. For example, the second preset interface may be an authentication policy configuration interface (AuthPolicyConfig).

[0235] The initial authentication strategy includes authentication strategies such as account password authentication strategy, IP binding strategy, and MAC whitelist strategy.

[0236] The configuration query module is also used to perform third initialization configuration on the database module. This third initialization configuration includes sending initial business data to the database module based on a third preset interface. For example, the third preset interface may be a configuration data create, read, update, delete, or configdata CRUD interface.

[0237] The initial business data includes authentication data, such as second authentication data, as well as gateway device parameters, package billing templates, module configuration data, etc.

[0238] The configuration query module is also used to perform a fourth initialization configuration on the resource quantification module. This fourth initialization configuration includes sending initial billing rules to the resource quantification module based on a fourth preset interface. For example, the fourth preset interface may be a billing policy configuration (BillingPolicyConfig) interface.

[0239] The initial billing rules include free trial limits, package billing rules, tiered billing rules for exceeding the package limit, and billing cycle configuration.

[0240] By deploying, orchestrating, registering services, configuring routes, and initializing the various modules to be processed in the network access management system as described above, the network access management system in this embodiment of the application can be obtained.

[0241] In some embodiments, after deploying, orchestrating, registering services, configuring routes, and initializing the modules to be processed in the network access management system, the orchestration platform can also check the modules, nodes, and multiple clusters corresponding to the same module in the network access management system. By verifying the availability of the interfaces of each module, the success rate of interface calls, checking the primary / backup switching rate of nodes, the data consistency of multiple independent containers corresponding to the module, and verifying the synchronization of data in multiple clusters corresponding to the same module, the network access management system in this embodiment can be obtained when the preset conditions are met.

[0242] By examining multiple aspects of the network access management system, a corresponding network access management system is obtained when the conditions are met, thus making the system more practical.

[0243] In some embodiments, when the edge node includes a first edge node and a second edge node, the first edge node may include independent containers corresponding to at least two protocol processing modules and independent containers corresponding to at least two authentication and authorization modules, and the second edge node may include independent containers corresponding to at least two protocol processing modules and independent containers corresponding to at least two authentication and authorization modules.

[0244] A module group can consist of at least two independent containers within the same module. Any one independent container within this group, or a designated independent container, can be designated as the primary service provider. The remaining independent containers can synchronize session data, cache information, and configuration parameters with the primary service provider. In the event of an anomaly in the primary service provider instance, a new primary service provider can be selected from the remaining independent containers. This enables rapid self-healing at the module level, ensuring service continuity between modules and improving the reliability and stability of the network access management system.

[0245] In other embodiments, the central node may include a first central node and a second central node. The first central node may include at least two resource quantization modules, at least two database modules, at least two configuration query modules, and at least two interface registration modules. The second central node may include at least two resource quantization modules, at least two database modules, at least two configuration query modules, and at least two interface registration modules.

[0246] Let's take a group of modules as an example, consisting of three independent containers, for illustration. Figure 4 This is a schematic diagram of the architecture of a network access management system provided in an embodiment of this application.

[0247] like Figure 4As shown, the network access management system 400 includes a gateway device 401, an edge node 402, and a central node 403. The edge node 402 includes a first edge node 4021 and a second edge node 4022, and the central node 403 includes a first central node 4031 and a second central node 4032.

[0248] Both the first edge node 4021 and the second edge node 4022 include a group of protocol processing modules and a group of authentication and authorization modules. The group of protocol processing modules includes three protocol processing modules, and the group of authentication and authorization modules includes three authentication and authorization modules.

[0249] Both the first central node 4031 and the second central node 4032 include a group of resource quantization modules, a group of database modules, a group of configuration query modules, and a group of interface registration modules. The resource quantization module group includes three resource quantization modules, the database module group includes three database modules, the configuration query module group includes three configuration query modules, and the interface registration module group includes three interface registration modules.

[0250] In some embodiments, for each independent container corresponding to the module to be processed, the orchestration platform can perform trend prediction of the load index based on the load index corresponding to the independent container, obtain the prediction results of each independent container, and enable the orchestration platform to adjust the container instance of the independent container.

[0251] In one feasible implementation, a load prediction model is deployed in the orchestration platform. This load prediction model can predict the trend of load indicators based on the load indicators corresponding to independent containers and obtain the prediction results of each independent container.

[0252] In this embodiment, load metrics for a preset number of days are sampled using a sliding sampling method based on a preset step size to obtain sample data. An initial load prediction model is constructed based on a Long Short-Term Memory (LSTM) network and a Seasonal and Trend Decomposition using LOESS (STL) algorithm. The sample data is input into the initial load prediction model, and the model is trained. When training conditions are met, the load prediction model is obtained. These training conditions can include reaching a threshold number of training iterations or model convergence.

[0253] For example, the preset step size can be 15 minutes, 30 minutes, or 60 minutes, etc. The preset number of days can be 30 days, 60 days, 100 days, etc.

[0254] Different independent containers have different load metrics. When an independent container is a protocol processing module, the load metrics can be session concurrency, number of requests per second, request success rate, etc. When an independent container is a resource quantization module, the load metrics can be the number of quantized resource requests per second, the number of quantized requests to be processed, the number of quantized results generated, etc.

[0255] Session concurrency is used to characterize the total number of connections established with the protocol processing module.

[0256] The quantity of quantification results generated is used to characterize the number of quantification results generated by the resource quantification module.

[0257] In one feasible implementation, when the independent container is a protocol processing module, if the predicted session concurrency corresponding to the protocol processing module is greater than a first session load threshold, the orchestration platform can increase the number of container instances for the protocol processing module. If the predicted session concurrency corresponding to the protocol processing module is less than a second session load threshold, the orchestration platform reduces the number of container instances for the protocol processing module. The first session load threshold is greater than the second session load threshold, and both the first and second session load thresholds can be empirical values.

[0258] It is understandable that when a user establishes a session, it involves the user's network access authentication, authorization, and billing of session data. When the session concurrency exceeds the first session load threshold, the load pressure on multiple modules in the network access management system will increase accordingly. Therefore, the number of container instances for each module in the network access management system can be expanded to improve the processing efficiency of the network access management system.

[0259] Similarly, when the session concurrency is less than the second session load threshold, the load pressure on multiple modules in the network access management system will decrease accordingly. Therefore, the number of container instances in each module of the network access management system can be reduced, thereby improving the resource utilization of the network access management system and avoiding resource waste.

[0260] In some embodiments, when configuring container instances for each module in the network access management system, priority can be given to reducing non-critical redundant container instances in core nodes and idle container instances in edge nodes to ensure the authentication, authorization, and billing functions of the network access management system.

[0261] In other embodiments, the orchestration platform can also set a reduction cooldown period. When the duration for which each module needs to be reduced is longer than the cooldown period, the container instances of each module are reduced to avoid frequent reductions affecting the authentication, authorization, and billing functions of the network access management system.

[0262] In another feasible implementation, when the independent container is a resource quantization module, if the prediction result corresponding to the resource quantization module indicates that the amount of quantization result generated is greater than a first quantization result load threshold, the orchestration platform expands the number of container instances for the resource quantization module. If the prediction result corresponding to the resource quantization module indicates that the amount of quantization result generated is less than a second quantization result load threshold, the orchestration platform reduces the number of container instances for the resource quantization module; wherein, the first quantization result load threshold is greater than the second quantization result load threshold, and the first quantization result load threshold and the second quantization result load threshold can be an empirical value.

[0263] By monitoring the load metrics of the modules in the network access management system through the orchestration platform, the number of container instances in each module is dynamically adjusted to ensure that the number of container instances in each module meets business requirements, thereby improving the applicability of the network access management system.

[0264] The following examples provide a detailed description of the interfaces between modules in the network access management system.

[0265] In this embodiment, the network access management system includes a protocol processing module, an authentication and authorization module, a resource quantification module, a database module, an interface protocol module, and a configuration query module.

[0266] In one specific implementation, the interface between the protocol processing module and the authentication and authorization module can be an authentication request (AuthRequest) interface and an authentication response (AuthReply) interface. The AuthRequest interface can be used to transmit network access requests; that is, the protocol processing module can send the structured and parsed network access request to the authentication and authorization module through the AuthRequest interface. The AuthReply interface can be used to return the authentication result; that is, the authentication and authorization module can return the authentication result to the protocol processing module through the AuthReply interface.

[0267] In one specific implementation, the interface between the protocol processing module and the resource quantification module can be an AccountRequest interface and an AccountReply interface. The AccountRequest interface is used to transmit user session data; that is, the protocol processing module can send the structured and parsed quantification request to the resource quantification module through the AccountRequest interface. The AccountReply interface can be used to provide feedback on the resource quantification results; that is, the resource quantification module can return the resource quantification results to the protocol processing module through the AccountReply interface.

[0268] In one specific implementation, the interface between the authentication and authorization module and the database module can be a Get User Information (GetUserInfo) interface and an Update Authentication Result (UpdateAuthResult) interface. The GetUserInfo interface can be used to transmit a request to obtain preset authentication information and the obtained preset authentication information. That is, the authentication and authorization module can send a request to obtain the user's corresponding preset authentication information to the database module through the GetUserInfo interface, and the database module can return the obtained preset authentication information to the authentication and authorization module through the GetUserInfo interface. The preset authentication information includes the user identifier, the user's stored authentication information, and the user's corresponding authorization policy.

[0269] The UpdateAuthResult interface can be used to update a user's authentication result. In other words, the authentication and authorization module can send the user's authentication result to the database module through the UpdateAuthResult interface, thereby updating the user's authentication result. The database module can then return the first update result to the authentication and authorization module through the UpdateAuthResult interface. This first update result can be either successful or failed.

[0270] In one specific implementation, the interface between the resource quantification module and the database module can be a SaveAccountData interface and a GetBillingPolicy interface. The SaveAccountData interface is used to update the user's resource quantification results. That is, the resource quantification module can send the user's resource quantification results to the database module through the SaveAccountData interface, thereby updating the user's resource quantification results. The database module can then return the updated results to the resource quantification module through the SaveAccountData interface. The resource quantification results include user identifier, session identifier, session duration, session traffic usage, and session cost. The second update result includes whether the resource quantification result update was successful or failed.

[0271] The GetBillingPolicy interface can be used to transmit resource quantification rules. In other words, the resource quantification module can use the GetBillingPolicy interface to send a request to the database module to retrieve the resource quantification rules corresponding to the user, and the database module can use the GetBillingPolicy interface to send the corresponding resource quantification rules to the resource quantification module. For example, resource quantification rules may include resource quantification packages and resource quantification rates.

[0272] In one specific implementation, the interface between the interface registration module and other modules can be a service registration (ServiceRegister) interface and a service query (ServiceQuery) interface. The ServiceRegister interface allows other modules to send service registration requests to the interface registration module, and the interface registration module can send the service registration result back to the other modules via the ServiceRegister interface. The service registration result includes successful and unsuccessful registration.

[0273] The ServiceQuery interface can be used by modules other than the interface registration module to query services. In other words, modules other than the interface registration module can send service query requests to the interface registration module through the ServiceQuery interface, allowing the interface registration module to send the service query results back to each module via the ServiceQuery interface. The service query request includes the service name, and the service query results include a list of services.

[0274] In one specific implementation, the interface between the configuration query module and the database module can be a configuration data creation, reading, updating, and deleting (ConfigDataCRUD) interface and a query online information (QueryOnlineInfo) interface. The ConfigDataCRUD interface can be used to process the configuration data in the database module. The configuration query module can send configuration data processing operation requests to the database module through the ConfigDataCRUD interface, enabling the database module to process the configuration data based on the processing operation requests. The database module then sends the processing operation results back to the configuration query module through the ConfigDataCRUD interface. For example, the processing operations include adding, deleting, and modifying configuration data.

[0275] The QueryOnlineInfo interface can be used to query user information. The configuration query module can send a user information query request to the database module through the QueryOnlineInfo interface, enabling the database module to perform the user information query based on the request. The database module then sends the query results back to the configuration query module through the QueryOnlineInfo interface.

[0276] In one specific implementation, the interface between the configuration query module and the authentication and authorization module can be an authentication policy configuration (AuthPolicyConfig) interface and a get authentication statistics (GetAuthStats) interface. The AuthPolicyConfig interface can be used to obtain authentication rules. The authentication and authorization module can send an authentication rule configuration request to the configuration query module through the AuthPolicyConfig interface, so that the configuration query module can obtain the user's authentication rules based on the authentication rule configuration request. The configuration query module then sends the authentication rules to the authentication and authorization module through the AuthPolicyConfig interface.

[0277] The GetAuthStats interface can be used to retrieve authentication statistics. The configuration query module can send a request for authentication statistics to the authentication and authorization module via the GetAuthStats interface, causing the authentication and authorization module to send the authentication statistics to the configuration query module via the GetAuthStats interface. The request for authentication statistics includes the statistical period and the user group. The authentication statistics include the dataset within the statistical period and the update time of the authentication statistics.

[0278] In one specific implementation, the interface between the configuration query module and the resource quantization module can be a Billing Policy Configuration (BillingPolicyConfig) interface and a QueryBillingData interface. The BillingPolicyConfig interface can be used to retrieve resource quantization rules. The resource quantization module can send a request to the configuration query module to retrieve resource quantization rules through the BillingPolicyConfig interface, causing the configuration query module to send the resource quantization rules to the resource quantization module through the BillingPolicyConfig interface. The request to retrieve resource quantization rules includes the content of the resource quantization rules, their effective time, expiration time, user groups, etc.

[0279] The QueryBillingData interface can be used to query a user's resource quantification results. The configuration query module can send a request to the resource quantification module via the QueryBillingData interface to retrieve the resource quantification results, causing the resource quantification module to send the results back to the configuration query module via the QueryBillingData interface. The request for retrieving resource quantification results includes the user identifier, query period, and data type. The resource quantification results include data details and the generation time of the results.

[0280] In one specific implementation, the interface between the configuration query module and the protocol processing module can be a Dynamic Control Command (DynamicControlCommand) interface. This interface allows the configuration query module to send dynamic control commands to the gateway device via the protocol processing module. The protocol processing module can then send the execution results of these commands back to the configuration query module through the Dynamic ControlCommand interface. Dynamic control commands include bandwidth adjustment commands, forced disconnection commands, etc. The execution results of these commands include the execution result and the device response time.

[0281] In one specific implementation, the interface between the configuration query module and the interface registration module can be a Configuration Service Register (ConfigServiceRegister) interface and a ThirdPartyQueryProxy interface. The configuration query module can send service registration requests and service query requests to the interface registration module through the ConfigServiceRegister interface. This allows the interface registration module to perform service registration and service queries based on the requests, respectively. The interface registration module can then send the service registration and query results back to the configuration query module through the ConfigServiceRegister interface.

[0282] The ThirdPartyQueryProxy interface can be used to retrieve query requests from other devices. The configuration query module can send service query requests from other devices to the interface registration module via the ThirdPartyQueryProxy interface. This allows the interface registration module to perform service queries based on these requests. The interface registration module can then send the service query results to the configuration query module via the ConfigServiceRegister interface, thus obtaining the service query results from other devices. These other devices can be third-party systems, such as group-level operation support systems. The service query requests from other devices include the other device identifier, query type, query conditions, and permission identifier.

[0283] Through the interfaces between the modules described above, the network access management system can realize the process of user network access authentication, authorization, and billing.

[0284] Figure 5 This is a schematic diagram of the structure of a network access management device provided in an embodiment of this application. Figure 5 The network access management device 500 shown includes a processing module 501, a communication module 502, and a storage module 503.

[0285] The processing module 501 can be a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The processor can include application processors and baseband processors. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0286] For example, the processing module 501 can be as follows: Figure 2 The processor 201 shown; the communication module 502 can be as follows: Figure 2 The communication interface 203 shown; the storage module 503 can be as follows: Figure 2 The internal memory 202 shown.

[0287] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0288] This application provides a computer program product containing instructions that, when run on a computer, causes the computer to execute the network access management method described in the above method embodiments.

[0289] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the network access management method in the method flow shown in the above method embodiments.

[0290] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof, or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0291] Since the network access management device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above methods, the technical effects obtained can also be referred to the above method embodiments. The embodiments of the present invention will not be repeated here.

[0292] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0293] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0294] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0295] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network access management method, characterized in that, The system is applied to a network access management system, which includes a central node, multiple edge nodes, and at least one gateway device in a preset area of ​​a network access scenario. The central node is a node matched to the center of the preset area. The preset area is divided into multiple sub-areas, and each sub-area corresponds to an edge node. The central node in the preset area corresponds to the multiple edge nodes. The method includes: The gateway device receives network access requests initiated by users; the network access requests carry the user identifier, user address, and access method identifier. Based on the user address, the target sub-region of the user is determined, and the network access request is routed to the target edge node corresponding to the target sub-region. The network access request is authenticated through the target edge node, and the authentication result is obtained. If the authentication result indicates that the authentication is successful, the network access resources are quantified through the target center node corresponding to the target edge node to obtain the network access resource quantification result.

2. The method according to claim 1, characterized in that, The step of authenticating the network access request through the target edge node and obtaining the authentication result includes: The network access request is structured and parsed through the target edge node to obtain the user's authentication information; the authentication information includes the parsed user identifier, user address, and access method identifier. The authentication information is verified based on the user's preset authentication information through the target edge node, and the authentication result is obtained.

3. The method according to claim 2, characterized in that, The preset authentication information includes first preset authentication information and second preset authentication message; the first preset authentication information is the preset authentication information within a first time period in the local cache of the edge node. The second preset authentication information is the preset authentication information obtained by the edge node from the central node; The step of verifying the authentication information based on the user's preset authentication information through the target edge node and obtaining the authentication result includes: Verify the authentication information based on the first preset authentication information, and obtain the authentication result; The method further includes: If the target preset authentication information matches the authentication information, it is determined that the user's network access request authentication is successful; If the first preset authentication information does not match the authentication information, the authentication information is verified based on the second preset authentication information. If the target second preset authentication information matches the authentication information, it is determined that the user's network access request authentication is successful; If the second preset authentication information does not match the authentication information, it is determined that the user's network access request authentication failed.

4. The method according to claim 3, characterized in that, The method further includes: If a user's network access request authentication fails, the gateway device returns an authentication failure message to the user.

5. The method according to any one of claims 1-4, characterized in that, If the authentication result indicates that the authentication is successful, the method further includes: The gateway device collects the user's session data, generates a quantization request, and sends the quantization request to the target edge node; the session data includes session establishment time, uplink resource quantization value, downlink resource quantization value, and access duration; The target edge node performs structured parsing on the quantization request, extracts the core resource quantization field corresponding to the quantization request, and sends the core resource quantization field to the target center node. The step of quantifying network access resources through the target center node corresponding to the target edge node and obtaining the network access resource quantization result includes: Through the target central node, based on the resource quantification rules and the core fields of the resource quantification, the user's session data is quantified to obtain the network access resource quantification result; the resource quantification rules are used to characterize the quantification rules of the session duration and / or the resources used by the session corresponding to the user's network service.

6. The method according to claim 5, characterized in that, The method further includes: The target central node stores the quantification results of network access resources corresponding to the user's session data in the database.

7. The method according to claim 5 or 6, characterized in that, The method further includes: If the target central node detects that the user's session data is abnormal, the user's session data will be marked as abnormal data. Through the target central node, the user's session data is quantified according to the minimum resource quantization rule to obtain the network access resource quantization result; the minimum resource quantization rule is used to characterize resource quantization with a preset abnormal quantization value.

8. The method according to claim 5 or 6, characterized in that, After determining the user's target sub-region based on the user address, the method further includes: If the target edge node corresponding to the target sub-region is abnormal, the network access request is routed to the target center node corresponding to the target edge node through the gateway device; The network access request is authenticated by the target central node, and the authentication result is obtained.

9. A network access management system, characterized in that, The network access management system includes a central node, multiple edge nodes, and a gateway device in a preset area of ​​the network access scenario; the central node is the node matched to the center of the preset area, the preset area is divided into multiple sub-areas, each sub-area corresponds to an edge node, and the central node in the preset area corresponds to the multiple edge nodes. The gateway device is used to receive network access requests initiated by users; the network access request carries a user identifier, a user address, and an access method identifier; The gateway device is further configured to determine the user's target sub-region based on the user address, and route the network access request to the target edge node corresponding to the target sub-region; The target edge node is used to perform access authentication on the network access request and obtain the authentication result; The target edge node is also configured to receive the user's session data sent by the gateway device and send the session data to the corresponding target center node when the authentication result indicates that the authentication is successful; The target central node is used to quantify network access resources based on the session data and obtain the network access resource quantification result.

10. The system according to claim 9, characterized in that, The target edge node includes a protocol processing module and an authentication and authorization module; The protocol processing module is used to perform structured parsing of the network access request and obtain the user's authentication information; The authentication information includes the parsed user identifier, user address, and access method identifier; The authentication and authorization module is used to verify the authentication information based on the user's preset authentication information and obtain the authentication result.

11. The system according to claim 10, characterized in that, The preset authentication information includes first preset authentication information and second preset authentication message; the first preset authentication information is the preset authentication information within a first time period in the local cache of the edge node. The second preset authentication information is the preset authentication information obtained by the authentication and authorization module from the central node; If the target first preset authentication information matches the authentication information, the authentication authorization module is used to determine that the user's network access request authentication is successful; If the first preset authentication information does not match the authentication information, the authentication authorization module is used to verify the authentication information based on the second preset authentication information; If the target second preset authentication information matches the authentication information, the authentication authorization module is used to determine that the user's network access request authentication is successful; If the second preset authentication information does not match the authentication information, the authentication authorization module is used to determine that the user's network access request authentication fails.

12. The system according to claim 10 or 11, characterized in that, If the authentication result indicates that the authentication was successful. The gateway device is also used to collect the user's session data, generate a quantization request, and send the quantization request to the protocol processing module; the session data includes session establishment time, uplink resource quantization value, downlink resource quantization value, and access duration; The protocol processing module is further configured to perform structured parsing on the quantization request, extract the core resource quantization field corresponding to the quantization request, and send the core resource quantization field to the target central node.

13. The system according to claim 12, characterized in that, The target central node includes a resource quantification module; The resource quantification module is used to perform resource quantification on the user's session data based on resource quantification rules and the core fields of resource quantification, and obtain the network access resource quantification result. The resource quantification rules are used to characterize the quantification rules of the session duration and / or the resources used by the session corresponding to the user's network service.

14. The system according to claim 12 or 13, characterized in that, The resource quantification module is also used to mark the user's session data as abnormal data if abnormal session data of the user is detected. The resource quantization module is further configured to perform resource quantization on the user's session data according to the minimum resource quantization rule, and obtain the network access resource quantization result; the minimum resource quantization rule is used to characterize resource quantization with a preset abnormal quantization value.

15. The system according to claim 13 or 14, characterized in that, The target central node includes a database module; The database module is used to store the second preset authentication information of multiple users; The database module is also used to store the network access resource quantification results corresponding to the user's session data.

16. The system according to any one of claims 13-15, characterized in that, The target central node includes the protocol processing module and the authentication and authorization module; If the edge node is abnormal, the protocol processing module of the target center node is used to perform structured parsing of the network access request to obtain the user's authentication information; the authentication information includes the parsed user identifier, user address, and access method identifier; The authentication and authorization module of the target central node is used to verify the authentication information based on the user's preset authentication information and obtain the authentication result.

17. The system according to any one of claims 9-16, characterized in that, The modules to be processed include one or more of the following: protocol processing module, authentication and authorization module, resource quantification module, and database module. The target central node includes an interface registration module, which is used to register services for the modules to be processed and to obtain routing configurations between the modules to be processed.

18. The system according to claim 17, characterized in that, The interface registration module is further configured to receive a service registration request sent by the module to be processed, and to verify the service information corresponding to the service registration request to obtain a service routing table; wherein, the service information in the service registration request includes module information, interface information and deployment information corresponding to the module to be processed; the service routing table is used to characterize the forwarding rules of service requests among the modules to be processed; the service requests include the network access request and the quantization request. The interface registration module is also used to send the service routing table to the processing module so that the processing module forwards the service request based on the service routing table.

19. The system according to any one of claims 9-18, characterized in that, The target center node includes a configuration query module; The configuration query module is used to perform a first initialization configuration on the protocol processing module; the first initialization configuration includes sending protocol processing parameters to the protocol processing module based on a first preset interface; the protocol processing parameters include the structured parsing rules corresponding to the business request; The configuration query module is further configured to perform a second initialization configuration on the authentication and authorization module; the second initialization configuration includes sending an initial authentication policy to the authentication and authorization module based on a second preset interface; the initial authentication policy includes an account password authentication policy; The configuration query module is also used to perform a third initialization configuration on the database module; the third initialization configuration includes sending initial business data to the database module based on a third preset interface; the initial business data includes the preset authentication data; The configuration query module is also used to perform a fourth initialization configuration on the resource quantification module; the fourth initialization configuration includes sending initial billing rules to the resource quantification module based on a fourth preset interface.

20. The system according to any one of claims 9-19, characterized in that, The protocol processing module, the authentication and authorization module, the resource quantification module, the database module, the interface registration module, and the configuration query module are all encapsulated as independent containers; each independent container includes at least one container instance. For each independent container, the orchestration platform performs trend prediction of the load index based on the load index corresponding to the independent container, obtains the prediction result, and enables the orchestration platform to adjust the container instance of the independent container.

21. The system according to claim 20, characterized in that, The load metrics corresponding to the protocol processing module include session concurrency; the load metrics corresponding to the resource quantization module include the amount of quantization results generated. When the independent container is the protocol processing module, if the prediction result corresponding to the protocol processing module indicates that the session concurrency is greater than the first session load threshold, the orchestration platform expands the number of container instances of the protocol processing module. If the prediction result indicates that the session concurrency is less than the second session load threshold, the orchestration platform reduces the number of container instances of the protocol processing module; wherein, the first session load threshold is greater than the second session load threshold; The independent container is the resource quantization module. If the prediction result corresponding to the resource quantization module indicates that the amount of quantization result generated is greater than the first quantization result load threshold, the orchestration platform expands the number of container instances of the resource quantization module. If the prediction result corresponding to the resource quantization module indicates that the amount of quantization result generated is less than the second quantization result load threshold, the orchestration platform reduces the number of container instances of the resource quantization module; wherein, the first quantization result load threshold is greater than the second quantization result load threshold.

22. The system according to any one of claims 9-21, characterized in that, The edge node includes a first edge node and at least one second edge node. The first edge node includes at least two independent containers corresponding to the protocol processing module and at least two independent containers corresponding to the authentication and authorization module. The second edge node includes at least two independent containers corresponding to the protocol processing module and at least two independent containers corresponding to the authentication and authorization module.

23. A server, characterized in that, The server includes a communication interface, a processor, and a memory. The memory stores at least one computer program, which is loaded and executed by the processor to implement the network access management method as described in any one of claims 1 to 8, or to implement the network access management system as described in any one of claims 9 to 22.

24. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the network access management method as described in any one of claims 1 to 8, or to implement the network access management system as described in any one of claims 9 to 22.

25. A computer program product, characterized in that, The computer program product includes a computer program or instructions that, when executed by a processor, implement the network access management method as described in any one of claims 1 to 8, or implement the network access management system as described in any one of claims 9 to 22.

Images