A communication network access side application terminal self-configuration method, an access control method and related system

Abstract

The application discloses a kind of communication network access side application terminal self-configuration method and access control method and related system, belong to communication technical field, self-configuration method is applied in application terminal, client generates client ID, carries out interaction and verification by with the client query message, client response message etc. of second client, avoid illegal user, improve the self-configuration flexibility of application terminal access network and the dynamic adjustment self-adaptive ability of access gateway parameter, simultaneously by address occupation message, avoid the conflict of multiple devices occupying same IP address from happening;Access control method is applied in routing exchange control equipment, by server generates server ID, by listening to the interactive message between client and confirming whether gateway announcement message is self-generated etc., can timely find the illegal user in local area network, eliminate the security risk in the process of server address allocation, avoid the emergence of illegal imitated server software, guarantee network communication normal security.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically to a self-configuration method for application terminals on the access side of a communication network, an access control method, and a related system. Background Technology

[0002] Dynamic Host Configuration Protocol (DHCP) is an application-layer protocol primarily used within a local area network (LAN) to automatically assign IP addresses, configure subnet masks, default gateways, and DNS servers for network application terminals. The entire configuration process is automated, with all configuration information centrally managed on one or a group of DHCP servers. DHCP can alleviate IP address shortages to some extent, reduce the workload of manual configuration for users, avoid errors during manual configuration, and improve work efficiency.

[0003] In dedicated communication networks, application terminals access the service gateway interface of network switching control equipment via the service LAN to conduct data communication within and outside the network. Some of these routing and switching control devices use the standard DHCP service mode, requiring administrators to configure parameters such as the DHCP address pool. However, because the standard DHCP service lacks an access control mechanism during address allocation, it presents several security vulnerabilities in practical applications. For example, in existing Windows and Linux operating systems, a client selecting the "Obtain an IP address automatically" option can obtain an IP address from a network containing a DHCP server. However, this allows unauthorized users to easily obtain an IP address from the DHCP server and access internal and external networks. Malicious users can also set up an unauthorized DHCP server to redistribute already allocated IP addresses, potentially causing conflicts between two or more devices with the same IP address. If an unauthorized DHCP server allows a device to access its lease address pool and issues its own DHCP option, legitimate domain names on the network will fail to resolve.

[0004] The remaining routing and switching control devices do not use the standard DHCP service mode, and there is no DHCP server configured in the access-side LAN. Application terminals in the access-side LAN need to be manually configured by users with information such as IP address, subnet mask and default gateway. At this time, due to the lack of a corresponding access control mechanism, as long as the network parameters of the application terminal are configured correctly, it can access the network to send and receive data. Ultimately, this allows unauthorized users to easily access the network to carry out malicious operations such as eavesdropping or attacks.

[0005] Therefore, how to reduce the workload and error probability of manual configuration by users, and how to enable application terminals to adapt to the dynamic adjustment of network side parameters and control the access of application terminals are problems that urgently need to be solved by those skilled in the art. Summary of the Invention

[0006] In view of the above problems, the present invention is proposed to provide a communication network access side application terminal self-configuration method, access control method and related system that overcomes or at least partially solves the above problems.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] In a first aspect, embodiments of the present invention provide a self-configuration method for application terminals on the access side of a communication network, applicable to multiple application terminals, each application terminal corresponding to a client software deployed; wherein, the application terminals are divided into target application terminals in a state of waiting to join the network and non-target application terminals that have joined the network; the client software corresponding to the target application terminal is a first client; the client software corresponding to the non-target application terminal is a second client; The self-configuration method includes: When the target application terminal starts running, the corresponding first client generates a client ID and switches to a state of waiting to join the network; The first client receives the gateway notification message, generates an available address pool that can access the local area network, and sends a client query message to the second client; If the first client does not receive the client response message sent by the second client, then a candidate IP address is selected from the available address pool, and an address occupancy message is sent to the second client. If the first client does not receive a client response message corresponding to the address occupancy message, the candidate IP address is determined as the network access communication address and converted to a network access status.

[0009] In one embodiment, before the first client generates the client ID, the method further includes: The first client obtains the device parameters under the current operating environment, and generates the current registration code based on the device parameters and the registration code generation algorithm; The first client matches and verifies the current registration code with a pre-saved registration code, which is generated when the first client is first installed and run. If the current registration code fails to match the pre-saved registration code, the first client will be prohibited from running.

[0010] In one embodiment, after sending the client query message to the second client, the method further includes: If the first client receives the client response message from the second client within the detection time, then the client response message is parsed and the first client's list of clients joining the network is updated. The first client filters out occupied IP addresses from the available address pool based on the updated list of clients joining the network; If the first client confirms that all IP addresses in the local area network are occupied, it will switch from the waiting-to-join-network state to the dormant state.

[0011] In one embodiment, after the first client switches to a network-connected state, the system further includes: The first client that has already joined the network receives the client query message and address occupancy message from the third client, updates the list of clients that have joined the network, and checks whether the candidate IP address in the address occupancy message corresponding to the third client is the same as the network communication address. The first client that has been connected to the network is the first client that has been converted to the connected state, and the third client is the client that is in the waiting state to be connected to the network.

[0012] In one embodiment, the self-configuration method further includes: The first client already connected to the network obtains the source address of the IP packet and matches the source address with the IP address stored in the list of clients already connected to the network; wherein the sender of the IP packet is located within the local area network and the receiver is the first client already connected to the network, and the IP packet is used to encapsulate the client response packet, the client query packet and / or the address occupancy packet; If the match fails, the first client already connected to the network will send an abnormal address alarm message.

[0013] In one embodiment, after the first client switches to a network-connected state, the system further includes: The first client already connected to the network detects the sending interval and address information of the gateway notification message; When it is determined that the sending interval is not less than a preset duration, or when it is determined that the address information of the gateway notification message is updated, the first client that has already joined the network is converted to a waiting-to-join-the-network state.

[0014] Secondly, embodiments of the present invention provide a communication network access side application terminal access control method, applied to the server software of a routing and switching control device; The access control method includes: When the routing and switching control device starts up automatically, the server software generates a server ID, converts it to a service status, and sends a gateway announcement message. The server determines the legitimacy of the first client by using a valid verification message, which is generated by the first client based on the verification flag in the gateway announcement message. The server parses the client response messages between clients and updates the list of clients that have joined the network corresponding to the server. The server determines whether the gateway announcement message is a self-generated gateway announcement message, and generates an alarm message when the gateway announcement message is not the self-generated gateway announcement message. The self-generated gateway announcement message is the gateway announcement message generated by the server. The server listens for abnormal address alarm messages and generates address alarm information corresponding to the abnormal address alarm messages; The server detects whether the current configuration parameters of the service gateway interface of the routing and switching control device have changed, and resets the list of network-connected clients corresponding to the server when the current configuration parameters have changed.

[0015] Thirdly, embodiments of the present invention provide a communication network access-side application terminal self-configuration and access control system, comprising a dedicated communication network consisting of an application terminal and a routing and switching control device, wherein a client deployed on the application terminal and a server deployed on the routing and switching control device implement a self-configuration method and an access control method through information interaction, wherein: The client is used to execute a self-configuration method for a communication network access side application terminal as described in any of the first aspects; The server is used to execute a communication network access side application terminal access control method as described in the second aspect.

[0016] The beneficial effects of the above-described technical solutions provided in the embodiments of the present invention include at least the following: 1. Interacting with clients already connected to the local area network via clients deployed on application terminals can help improve the self-configuration flexibility and security of application terminals accessing the network, as well as their adaptive ability to dynamically adjust access gateway parameters. It can also promptly detect abnormal communication addresses and issue alarms, while helping to improve the efficiency of IP address recycling within the local area network.

[0017] 2. By deploying a server in the routing and switching control equipment to verify the first client and to monitor and parse client response messages in real time, as well as to generate gateway announcement messages, abnormal address alarm messages, and current configuration parameters, the server helps to eliminate security risks based on the access control mechanism during the address allocation process, prevent the emergence of illegally impersonated server software, and ensure the normal and secure operation of network communication. It can also help improve the self-configuration flexibility and security of application terminals accessing the network, as well as their adaptive ability to dynamically adjust access gateway parameters. At the same time, it can help improve the efficiency of IP address recycling within the local area network.

[0018] 3. The client deployed on the application terminal and the server of the routing and switching control equipment can prevent unauthorized users from accessing the network to carry out malicious operations such as eavesdropping or attacks by interactively verifying and updating the list of clients entering the network. An abnormal address detection and alarm mechanism has been added. This reduces the workload and error probability of manual configuration for users, while realizing the adaptive capability of the application terminal to dynamically adjust network-side parameters on the spot, as well as the access control capability of the routing and switching control equipment for the application terminal. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the dedicated communication network access side network structure provided in an embodiment of the present invention; Figure 2 This is a diagram illustrating the deployment and interaction of the self-configurable access control software provided in this embodiment of the invention. Figure 3 This is a state transition diagram of the application terminal client provided in this embodiment of the invention; Figure 4 This is a state transition diagram of the server in the routing and switching control device provided in this embodiment of the invention; Figure 5 This is a diagram of the interaction messages between the client and the server provided in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] In dedicated communication networks, a typical access-side network structure is as follows: Figure 1 As shown, application terminals access the service gateway interface of the network switching control equipment through the service LAN to conduct data communication within and outside the network. The routing and switching control equipment does not provide DHCP service (even if some routing and switching control equipment does provide DHCP service, it uses the standard DHCP service mode and requires administrators to configure parameters such as the DHCP address pool). There is also no DHCP server configured within the access-side LAN; application terminals within the access-side LAN require users to manually configure information such as IP address, subnet mask, and default gateway.

[0023] As long as the network parameters of the application terminal are configured correctly, it can access the network to send and receive data. There is no corresponding access control mechanism, which allows unauthorized users to easily access the network and carry out malicious operations such as eavesdropping or attacks. Furthermore, if the gateway interface parameters on the access side change, the application terminal's communication address cannot be automatically adjusted in time, leading to communication failures.

[0024] Therefore, a self-configuration method for access-side application terminals, an access control method, and a related system are needed to reduce the workload and error probability of manual configuration by users, while enabling application terminals to dynamically adjust network-side parameters on the spot, as well as enabling routing and switching control equipment to control the access of application terminals.

[0025] Based on this, embodiments of the present invention disclose a self-configuration method for application terminals on the access side of a communication network, an access control method, and a related system, such as... Figure 2 The diagram shows the deployment and interaction relationship of the self-configured access control software.

[0026] Example 1: This invention provides a self-configuration method for application terminals on the access side of a communication network. This method mainly involves application terminals, which exist in three states: awaiting network access, already connected to the network, and dormant. Each application terminal corresponds to a client software deployment. Application terminals are categorized into target application terminals in the awaiting network access state and non-target application terminals already connected to the network. In specific implementation, this method can be implemented through a first client deployed on the target application terminal and a second client deployed on the non-target application terminals, thereby restricting unauthorized user intrusion and resolving issues such as manual configuration errors and conflicts caused by multiple devices occupying the same IP address.

[0027] The state transition diagram of the client within the application terminal can be found in [reference needed]. Figure 3 The following is combined with Figure 3 This paper details the specific implementation method of an application terminal self-configuration method on the access side of a communication network.

[0028] The first client starts automatically when the target application terminal is powered on, generates a random client ID, sets it as the network access control IP address, enters the network access waiting state, and listens for gateway announcement messages at the same time.

[0029] After receiving the gateway notification message, the first client generates a pool of available addresses for access to the local area network (LAN), sends client query messages to probe all second clients on the LAN, and starts a probe timer. Upon receiving the client query message, the second client sends a client response message. The first client receives and parses the response message, updates the corresponding list of incoming clients with the client ID, IP address, MAC address, and other information from the second client's response message, and removes duplicate IP addresses from the available address pool.

[0030] If the first client discovers that all local area network addresses have been used up after probing, it enters a sleep state and starts a sleep timer. After the sleep timer expires, it returns to the waiting state to join the network. Otherwise, it randomly selects a spare address from the available address pool and sends an address occupancy message to indicate that it intends to use the reserved address.

[0031] If the second client receives an address occupancy message and detects that the address conflicts with its own address, it will immediately send a client response message to the outside world.

[0032] If the first client receives a client response message with the same backup address within a specified time (default is 3 seconds), it will select a new address and resend the address occupancy message. Otherwise, it will set the candidate IP address as the network access communication IP address, actively send a client response message to the outside world, and then switch to the network access status.

[0033] The first client that has joined the network (i.e. the first client that has been converted to the network-joined state) continuously listens for the gateway announcement messages from the server and checks whether the gateway information has changed. If it has changed, it clears the original list of clients that have joined the network and converts back to the waiting-to-join state.

[0034] It is understood that the embodiments of the present invention help improve the self-configuration flexibility and security of application terminals accessing the network, as well as their adaptive ability to dynamically adjust access gateway parameters, and at the same time help improve the efficiency of IP address recycling within the local area network.

[0035] Example 2: This invention also provides an access control method for an application terminal on the access side of a communication network, applied to a routing and switching control device. The method is implemented by a server deployed in the routing and switching control device, and the state transition diagram of the server in the routing and switching control device is shown below. Figure 4 As shown below, in conjunction with Figure 4 The method is described in detail.

[0036] The server automatically starts and transitions to service state when the routing and switching control device is powered on. The server automatically identifies the business gateway interface as the access gateway, obtains its interface IP address and subnet mask, and uses them as the server's communication IP address. It periodically (by default, every 15 seconds) sends gateway announcement messages from this interface and receives valid verification messages generated by the first client based on the gateway announcement messages.

[0037] The server verifies the valid verification message. If the verification passes, the first client is deemed valid; otherwise, the first client is prohibited from running.

[0038] Meanwhile, during the exchange of messages between clients and between the server and clients, the server listens for and parses the client response messages in real time to update the list of third-party network-connected clients, ensuring that the list always reflects the latest status of all clients within the local area network.

[0039] The server listens for gateway notification messages in real time and determines whether the message is generated by itself. If not, it indicates that there are multiple or fake servers in the local area network. The server promptly issues an alarm and records the server impersonation event in the log.

[0040] The server periodically checks whether the configuration parameters of the business gateway interface have changed. If a change has occurred, the server will clear the list of third-party clients for this interface, send a new gateway announcement message, and regenerate a new list of third-party clients.

[0041] Based on the above embodiments, the server-side of the routing and switching control device can eliminate security risks during the server-side address allocation process based on the access control mechanism, preventing the emergence of unauthorized impersonating servers and ensuring normal and secure network communication. It can also help improve the self-configuration flexibility and security of application terminals accessing the network, as well as their adaptive capability to dynamic adjustments of access gateway parameters. Simultaneously, it can help improve the efficiency of IP address recycling within the local area network. Each client and server has its own corresponding list of network-connected clients, and the contents of the first, second, and third lists of network-connected clients are identical.

[0042] Example 3: This invention also provides a self-configuration method and access control system for application terminals on the access side of a communication network. The system includes a communication network comprised of application terminals and routing / switching control equipment. A client deployed on the application terminal and a server deployed on the routing / switching control equipment respectively implement the self-configuration method in Embodiment 1 and the access control method in Embodiment 2 through information interaction. The interaction messages between the server (i.e., server software) and the client (i.e., client software) are as follows: Figure 5 As shown. In this embodiment of the invention, the client and server communicate using UDP multicast messages, and both use the same fixed UDP port number (default is 9099).

[0043] Next, the method will be described in detail: Specifically, both the first and second clients have three states: waiting to join the network, already joined the network, and dormant.

[0044] During the initial installation and initial runtime of the client (i.e., the first client and the second client) and the server, multiple device parameters of the runtime environment need to be obtained, such as basic information like the operating system UUID, CPU serial number, and network card ID. Based on these parameters, a machine code is generated through hash calculation. The software installer or administrator is then prompted to use dedicated registration code generation software to input the aforementioned machine code to obtain the corresponding software registration code. The operator then inputs the software registration code into the software's runtime window, and the software saves it to the default path as a basis for runtime verification.

[0045] When the client starts up and runs subsequently, it needs to automatically obtain the aforementioned parameters of the runtime environment to generate machine code. Then, it calculates the current registration code using a built-in registration code generation algorithm and matches it with the registration codes saved in the default path. If the current registration code fails to match, it exits directly, thus preventing the software from being copied and run arbitrarily. In this embodiment of the invention, the server also needs to generate the current registration code when it starts up and match it with the pre-saved registration code. If the match fails, the server exits directly.

[0046] When the target application terminal powers on, the first client generates a client ID greater than 0 based on the current time, the target application terminal's MAC address, and a random offset value. At the same time, it temporarily sets the IP address of the target application terminal's network card to one of the private reserved addresses of 169.254.0.0 / 16 and uses it as the network access control IP address, enabling it to have basic external communication capabilities. Then, it enters the waiting-to-join-the-network state and listens for the server's gateway announcement messages.

[0047] The server starts automatically when the routing and switching control device powers on, with an ID of 0 to distinguish it from the first client, and then enters the service state. The server automatically identifies the service gateway interface of the routing and switching control device as the access gateway, obtains its interface IP address and subnet mask and uses them as the server's communication IP address, and periodically sends gateway announcement messages from this interface. The gateway announcement message contains a flag that requires the first client to send a valid verification message.

[0048] The first client sends a valid verification message to the server as needed based on the identifier bit. This message includes basic information about its operating environment, machine code, registration code, etc., which are then sent to the server for verification. If the server fails to verify the first client's machine code or registration code, it indicates that the first client's version status is inconsistent or that verification spoofing has occurred. Subsequent messages from the first client are discarded, and the first client will be unable to access the network.

[0049] When the first client receives the gateway notification message and passes the verification, it parses the message and records the IP address and subnet mask of the current gateway. It then generates an available address pool for accessing the local area network using a bitwise AND operation algorithm, probes all second clients on the local area network, starts a probe timer, and sends client query messages to the second clients.

[0050] After receiving the client query message sent by the first client, the second client sends a client response message to the outside world.

[0051] If the first client receives the client response message from the second client within the detection duration set by the probe timer, then all client response messages are parsed, and the client ID, IP address, MAC address, and other information are updated in the network client list corresponding to the first client. At the same time, the already occupied IP address is removed from the available address pool to avoid reusing IP addresses.

[0052] If the first client finds that the local area network addresses have been exhausted after the probe, it needs to issue a "No available addresses" prompt message so that the application terminal operator can understand the current network status in a timely manner. At the same time, it enters a sleep state and starts a sleep timer. After the sleep timer ends, the first client returns to the waiting state to join the network.

[0053] If the first client does not receive a client response message from the second client within the probe duration, the first client randomly selects an IP address from the available address pool as its candidate IP address and sends an address occupancy message to the second client, indicating that it intends to use the occupied address. The address occupancy message must include at least the client ID.

[0054] After receiving the address occupancy message, the second client checks whether the IP address conflicts with its own IP address. If there is a conflict, it immediately sends a client response message to the first client.

[0055] If the first client receives a client response message corresponding to the address occupancy message within three seconds within the first preset time period, it will determine the size of the client ID, and the client with the larger ID will automatically obtain the right to occupy the address, while the client with the smaller ID will take avoidance measures.

[0056] If the first client does not receive a client response message corresponding to the address occupancy message within three seconds within the first preset time period, it indicates that the candidate IP address is not occupied. At this time, the candidate IP address is used as the network access communication IP address, and a client response message is actively sent to the outside world. Then, the client is converted to the network access status, i.e., the first client has entered the network.

[0057] Furthermore, when a new client in the pending network state joins the network, i.e., when the third client joins the network, the first and second clients already in the network will both receive the client query message and address occupancy message from the third client, and send client response messages, etc.

[0058] Meanwhile, the first client that has joined the network also updates its own list of joined clients in real time based on the client response message.

[0059] In addition, the first client that has joined the network uses the packet filtering function to match the source address of the IP packet with the list of clients joining the network to determine whether the source address is stored in the list of the first clients joining the network; if the source address is not stored in the list of clients joining the network, an abnormal address alarm message is sent to the server.

[0060] To maintain its network-connected status, the first client already connected to the network needs to continuously monitor the server's gateway announcement messages. If the first client receives a gateway announcement message within a second preset time period, or if the address in the received gateway announcement message remains unchanged, it maintains its network-connected status. If the first client does not receive a gateway announcement message within the second preset time period, or if the address in the received gateway announcement message changes, it clears its original parameters and reverts to the pending network connection status.

[0061] Meanwhile, the server also listens for gateway announcement messages, client query messages, client response messages, address occupancy messages, and abnormal address alarm messages.

[0062] Specifically, the server-side message listening includes: the server parsing the client response messages between clients, updating the client ID, IP address, MAC address and other information to the third-party network access client list, so that the third-party network access client list always contains the latest status of all clients in the local area network.

[0063] The server listens for gateway announcement messages and determines whether the message is generated by itself. If not, it indicates that there are multiple or fake servers in the network. The server promptly issues an alarm and records the server impersonation event in the log.

[0064] The server periodically checks whether the configuration parameters of the business gateway interface have changed. If a change has occurred, the server will clear the list of third-party clients for this interface, send a new gateway announcement message, and regenerate a new list of third-party clients.

[0065] In this embodiment of the invention, to further enhance the restriction on unauthorized user intrusion, the gateway announcement message, client response message, client query message, address occupancy message, and abnormal address alarm message are also equipped with an access control code string for verifying the legality of the message, so as to realize the legality verification of the communication message.

[0066] Specifically, the sender of the aforementioned message dynamically generates an access control code string containing matrix coordinates, encryption method, and encrypted access control code based on the access control two-dimensional matrix. The access control two-dimensional matrix uses a 64-bit matrix. The array has a size of 64, with each matrix element representing a randomly generated 2-byte access control code. The receiver decrypts the access control code using the corresponding decryption method based on the encryption method, and then determines whether the access control code matches based on the matrix coordinates. If decryption fails or the access control code does not match, the message is discarded.

[0067] Multiple encryption methods can coexist between the client and the server. The sender can randomly generate matrix coordinates and encryption methods. Furthermore, the client and the server have independent access control two-dimensional matrix binary files, and changes to the access control two-dimensional matrix can be achieved by uniformly updating the binary files.

[0068] The server and client can also provide their respective real-time updated lists of network-connected clients as communication whitelists to the security protection control modules of their respective routing and switching control devices and the security protection control modules inside the application terminals, thereby ensuring that legitimate users can access the dedicated communication network normally and restricting unauthorized users' access to the network.

[0069] By providing the list of network-accessible clients to the security protection and control module, the client can refuse communication to clients outside the list within the local area network, and at the same time record abnormal address alarm events in the log and issue alarm information.

[0070] The server can also refuse packets from clients outside the server's list of clients to enter the local area network, or it can issue an alarm message after detecting interactive packets generated by clients outside the communication whitelist. The IP address, MAC address, etc. in the alarm message are configured as parameters for denying communication in the underlying forwarding module, thereby enhancing the inherent security capabilities of the routing and switching control device.

[0071] Based on the above embodiments, the first client generates a client ID upon startup and enters a pending network access state. Simultaneously, the server enters a service state and sends a gateway notification message to verify the legitimacy of the first client, thereby controlling the access client. After the first client passes the verification, it generates an available address pool and selects a candidate IP address from the available address pool through client query messages and client response messages with the second client. It then sends an address occupancy message. If no client response message is received, it indicates that the candidate IP address is not occupied, and it is determined as the network access communication address. This effectively avoids the problem of multiple devices conflicting due to multiple outgoing IP addresses.

[0072] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0073] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A self-configuration method for an application terminal on the access side of a communication network, characterized in that, It is applied to multiple application terminals, with each application terminal corresponding to a client software deployment; wherein, the application terminals are divided into target application terminals in the state of waiting to join the network and non-target application terminals that have joined the network; the client software corresponding to the target application terminal is the first client; the client software corresponding to the non-target application terminal is the second client; The self-configuration method includes: When the target application terminal starts running, the corresponding first client generates a client ID and switches to a state of waiting to join the network; The first client receives the gateway notification message, generates an available address pool that can access the local area network, and sends a client query message to the second client; If the first client does not receive the client response message sent by the second client, then a candidate IP address is selected from the available address pool, and an address occupancy message is sent to the second client. If the first client does not receive a client response message corresponding to the address occupancy message, the candidate IP address is determined as the network access communication address and converted to a network access status.

2. The self-configuration method for an application terminal on the access side of a communication network as described in claim 1, characterized in that, Before the first client generates the client ID, the process also includes: The first client obtains the device parameters under the current operating environment, and generates the current registration code based on the device parameters and the registration code generation algorithm; The first client matches and verifies the current registration code with a pre-saved registration code, which is generated when the first client is first installed and run. If the current registration code fails to match the pre-saved registration code, the first client will be prohibited from running.

3. The self-configuration method for an application terminal on the access side of a communication network as described in claim 1, characterized in that, After sending the client query message to the second client, the method further includes: If the first client receives the client response message from the second client within the detection time, then the client response message is parsed and the first client's list of clients joining the network is updated. The first client filters out occupied IP addresses from the available address pool based on the updated list of clients joining the network; If the first client confirms that all IP addresses in the local area network are occupied, it will switch from the waiting-to-join-network state to the dormant state.

4. The self-configuration method for an application terminal on the access side of a communication network as described in claim 3, characterized in that, After the first client switches to a network-connected state, it also includes: The first client that has already joined the network receives the client query message and address occupancy message from the third client, updates the list of clients that have joined the network, and checks whether the candidate IP address in the address occupancy message corresponding to the third client is the same as the network communication address. The first client that has been connected to the network is the first client that has been converted to the connected state, and the third client is the client that is in the waiting state to be connected to the network.

5. The self-configuration method for an application terminal on the access side of a communication network as described in claim 4, characterized in that, The self-configuration method further includes: The first client already connected to the network obtains the source address of the IP packet and matches the source address with the IP address stored in the list of clients already connected to the network; wherein the sender of the IP packet is located within the local area network and the receiver is the first client already connected to the network, and the IP packet is used to encapsulate the client response packet, the client query packet and / or the address occupancy packet; If the match fails, the first client already connected to the network will send an abnormal address alarm message.

6. The self-configuration method for an application terminal on the access side of a communication network as described in claim 4, characterized in that, After the first client switches to a network-connected state, it also includes: The first client already connected to the network detects the sending interval and address information of the gateway notification message; When it is determined that the sending interval is not less than a preset duration, or when it is determined that the address information of the gateway notification message is updated, the first client that has already joined the network is converted to a waiting-to-join-the-network state.

7. A method for controlling the access of an application terminal on the access side of a communication network, characterized in that, Applied to server-side software for routing and switching control equipment; The access control method includes: When the routing and switching control device starts up automatically, the server software generates a server ID, converts it to a service status, and sends a gateway announcement message. The server determines the legitimacy of the first client by using a valid verification message, which is generated by the first client based on the verification flag in the gateway announcement message. The server parses the client response messages between clients and updates the list of clients that have joined the network corresponding to the server. The server determines whether the gateway announcement message is a self-generated gateway announcement message, and generates an alarm message when the gateway announcement message is not the self-generated gateway announcement message. The self-generated gateway announcement message is the gateway announcement message generated by the server. The server listens for abnormal address alarm messages and generates address alarm information corresponding to the abnormal address alarm messages; The server detects whether the current configuration parameters of the service gateway interface of the routing and switching control device have changed, and resets the list of network-connected clients corresponding to the server when the current configuration parameters have changed.

8. A self-configuration and access control system for application terminals on the access side of a communication network, characterized in that, include: In a dedicated communication network consisting of application terminals and routing and switching control equipment, the client deployed on the application terminal and the server deployed on the routing and switching control equipment implement self-configuration and access control methods through information exchange, wherein: The client is used to execute a self-configuration method for a communication network access side application terminal as described in any one of claims 1-6; The server is used to execute the communication network access side application terminal access control method as described in claim 7.

9. The communication network access-side application terminal self-configuration and access control system as described in claim 8, characterized in that, Access control codes used to verify the validity of gateway announcement messages, client response messages, client query messages, address occupancy messages, and abnormal address alarm messages are set in the network.

Images