WO2016201780A1 - Gateway management method and apparatus - Google Patents

Abstract

The present invention provides a gateway management method and apparatus. The method comprises: acquiring a network access packet of a terminal, and searching for a preset management policy corresponding to the packet; in a case in which the preset management policy of the packet is found, recording the preset management policy of the packet to a 5-tuple flow table, and again acquiring the network access packet of the terminal, and making a search to determine whether the packet has a record in the 5-tuple flow table; in a case in which the packet has a record in the 5-tuple flow table, processing the packet according to the preset management policy. The problems of complex technical operations and low efficiency of controlling network access behaviors of a user in a local area network are resolved, thereby improving the efficiency, and effectively controlling device costs without adding hardware devices.

Description

Gateway management method and device Technical field

The present invention relates to the field of communications, and in particular to a gateway management method and apparatus.

Background technique

For the management of the company, preventing employees from conducting online chats, watching online movies, P2P downloads, playing online games and stock trading during work hours can not only improve the efficiency of employees, but also greatly reduce the network. The burden can be described as two-fold. Implementing the online behavior management function on the enterprise route can effectively restrain and standardize the employee's work behavior and improve work efficiency. It is an electronic aid to administrative management.

In the related art, the Radius protocol is used for authentication, and the process is complicated; the edge acquisition control unit increases the data synchronization work, and the system overhead is large; the classification information is based on the Uniform Resoure Locator (URL) information and transmission control. The Transmission Control Protocol (TCP) port and the destination IP address are not intuitive enough compared to the application-based classification, and the requirements for maintenance personnel are high.

In addition, on the basis of the ordinary router, the hardware module is added to realize the judgment of the online behavior, thereby achieving the purpose of controlling the online behavior of all users in the local area network. The addition of hardware modules has led to increased equipment costs and is not suitable for cost-sensitive SMEs.

In the related art, the technical operation for controlling the online behavior of users in the local area network is complicated, the efficiency is low, and the cost is high. Currently, an effective solution has not been proposed.

Summary of the invention

The present invention provides a gateway management method and apparatus, which solves at least the technical operation of controlling the online behavior of users in a local area network in the related art, which is complicated in operation, low in efficiency, and high in cost.

According to an embodiment of the present invention, a gateway management method is provided, including:

Obtaining an Internet packet of the terminal, and searching whether the packet has a record in the quintuple flow table, where the quintuple flow table is a preset management policy for finding the packet In the case that the preset management policy of the packet is generated;

And if the packet is recorded in the quintuple flow table, the packet is processed according to the preset management policy.

In the embodiment of the present invention, the searching for the preset management policy corresponding to the packet includes:

Identifying a service application of the packet according to the feature information of the packet;

And searching for a preset management policy corresponding to the packet according to the feature information and the service application.

In the embodiment of the present invention, the feature information of the packet includes at least one of the following:

IP address, port number, domain name.

In the embodiment of the present invention, the preset management policy includes at least one of the following:

Executing an execution action corresponding to the application service, where the performing action includes one of: forwarding, blocking, and speed limiting;

The execution action corresponding to the application service is executed within a preset time period.

In the embodiment of the present invention, before the preset management policy corresponding to the packet is found, the method includes:

Obtaining user information received by the terminal, and authenticating the terminal;

When the authentication is passed, the IP address of the packet is recorded to the IP address authentication table, where the IP address authentication table is used to authenticate the packet of the IP address.

In the embodiment of the present invention, when the authentication IP address of the IP address authentication table is released, the IP address is deleted on the IP address authentication table.

In the embodiment of the present invention, if the packet is not recorded in the quintuple flow table, the preset management policy corresponding to the packet is searched;

In the case that the preset management policy of the packet is found, the preset management policy of the packet is recorded in the quintuple flow table.

In the embodiment of the present invention, in the case that the packet has a flag indicating that the packet is reported in the quintuple flow table, the preset management policy corresponding to the packet is searched;

When the preset management policy of the packet is found, the preset management policy of the packet is recorded to the quintuple flow table.

In the embodiment of the present invention, if the data stream corresponding to the packet is not received within the preset time threshold, the record of the packet in the quintuple flow table is deleted.

In the embodiment of the present invention, the quintuple flow table includes at least one of the following:

The source IP address of the packet, the source port of the packet, the destination IP address of the packet, the destination port of the packet, the transport layer protocol, the execution action of the default management policy corresponding to the packet, and whether the flag of the packet is reported.

According to another embodiment of the present invention, a gateway management apparatus is further provided, including:

Obtaining a module, configured to obtain an Internet packet of the terminal, and to find whether the packet has a record in the quintuple flow table, where the quintuple flow table is to find the packet Recording in the case of a preset management policy Generated by the preset management policy of the packet;

The processing module is configured to process the packet according to the preset management policy if the packet has a record in the quintuple flow table.

In the embodiment of the present invention, the device further includes:

The identification module is configured to identify a service application of the packet according to the feature information of the packet;

The locating module is configured to search for a preset management policy corresponding to the packet according to the feature information and the service application.

In the embodiment of the present invention, the device further includes:

a receiving module, configured to acquire user information received by the terminal, and perform authentication on the terminal;

The authentication module is configured to record the IP address of the packet to the IP address authentication table, where the IP address authentication table is used to authenticate the packet of the IP address.

In the embodiment of the present invention, the quintuple flow table includes at least one of the following:

The source IP address of the packet, the source port of the packet, the destination IP address of the packet, the destination port of the packet, the transport layer protocol, the execution action of the default management policy corresponding to the packet, and whether the flag of the packet is reported.

According to the present invention, the Internet access message of the terminal is obtained, and the preset management policy corresponding to the packet is searched. When the preset management policy of the packet is found, the preset management policy of the packet is recorded to the quintuple. The flow table obtains the Internet packet of the terminal again, and finds whether the packet has a record in the quintuple flow table. If the packet has a record in the quintuple flow table, according to the preset The management policy processes the packet and solves the technical operation of controlling the online behavior of users in the local area network. The technical operation is complicated, the efficiency is low, and the cost is high. The efficiency is improved, the hardware equipment is not increased, and the equipment cost is effectively controlled.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of a gateway management method according to an embodiment of the present invention;

2 is a structural block diagram of a gateway management apparatus according to an embodiment of the present invention;

3 is a schematic diagram of an online behavior management application system according to a preferred embodiment of the present invention;

4 is a block diagram showing the principle of online behavior management according to a preferred embodiment of the present invention;

FIG. 5 is a schematic flowchart of a process for processing an online behavior management message according to a preferred embodiment of the present invention; FIG.

6 is a schematic diagram of an administrator configuration in accordance with a preferred embodiment of the present invention;

7 is a schematic diagram of a policy search process according to a preferred embodiment of the present invention;

FIG. 8 is a flow chart showing an IP address release process according to a preferred embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

A gateway management method is provided in this embodiment. FIG. 1 is a flowchart of a gateway management method according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:

Step S102: Obtain an Internet packet of the terminal, and find whether the packet has a record in the quintuple flow table, where the quintuple flow table is in a case where a preset management policy of the packet is found. , recording the preset management policy generated by the message;

Step S104: If the packet has a record in the quintuple flow table, the packet is processed according to the preset management policy.

Through the above steps, the Internet access packet of the terminal is obtained, and the preset management policy corresponding to the packet is searched, and the preset management policy of the packet is recorded to the quintuple flow table, and the subsequently received packet is in the quintuple. Whether there is a record in the flow table. If the packet has a record in the quintuple flow table, the packet is processed according to the preset management policy, so that the packet does not need to be parsed every time. And the record solves the technical operation of controlling the online behavior of users in the local area network, the operation is complicated, the efficiency is low, the cost is high, the efficiency is improved, the hardware equipment is not increased, and the equipment cost is effectively controlled.

In this embodiment, the preset management policy corresponding to the packet is: the service application of the packet is identified according to the feature information of the packet; and the packet is searched according to the feature information and the service application. Corresponding preset management strategy. The feature information of the packet includes at least one of the following: an IP address, a port number, and a domain name.

In this embodiment, the preset management policy may be in multiple manners, and different preset management policies may be formulated according to the application service of the packet, the access time, the user group rights to which the source address of the packet belongs, and the like. For example, The preset management policy includes at least one of the following: performing an execution action corresponding to the application service, where the performing action includes one of: forwarding, blocking, and speed limiting; performing, in the preset time period, performing an application corresponding to the application service The execution action.

In this embodiment, the user information received by the terminal is obtained, and the terminal is authenticated. If the authentication is passed, the IP address of the packet is recorded to an IP address authentication table, where the IP address authentication table is used for The packet of the IP address is authenticated.

In this embodiment, when the authentication IP address of the IP address authentication table is released, the IP address is deleted on the IP address authentication table.

In this embodiment, the quintuple flow table includes at least one of the following: a source IP address of the packet, and a source end of the packet. Indicates the destination IP address of the packet, the destination port of the packet, the transport layer protocol, the execution action of the default management policy corresponding to the packet, and whether the flag of the packet is reported.

If the packet is not recorded in the quintuple flow table, the preset management policy corresponding to the packet is searched; if the preset management policy of the packet is found, the pre-record of the packet is recorded. Set the management strategy to the quintuple flow table. If the packet has a flag indicating that the packet is reported in the quintuple flow table, the preset management policy corresponding to the packet is searched; if the preset management policy of the packet is found, Record the default management policy of the packet to the quintuple flow table.

If the data stream corresponding to the packet is not received within the preset time threshold, the record of the packet in the quintuple flow table is deleted.

In the embodiment, a gateway management device is also provided, which is used to implement the foregoing embodiments and preferred embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

2 is a structural block diagram of a gateway management apparatus according to an embodiment of the present invention. As shown in FIG. 2, the apparatus includes

The obtaining module 22 is configured to obtain the Internet access message of the terminal, and find whether the packet has a record in the quintuple flow table, where the quintuple flow table is a preset management policy for finding the packet. In the case of recording the preset management policy of the message;

The processing module 24 is configured to process the packet according to the preset management policy if the packet has a record in the quintuple flow table.

The device obtains the Internet access packet of the terminal, searches for a preset management policy corresponding to the packet, and records the preset management policy of the packet to the quintuple flow table, and the subsequent received packet is in the quintuple. Whether there is a record in the flow table. If the packet has a record in the quintuple flow table, the packet is processed according to the preset management policy, so that the packet does not need to be parsed every time. And the record solves the technical operation of controlling the online behavior of users in the local area network, the operation is complicated, the efficiency is low, the cost is high, the efficiency is improved, the hardware equipment is not increased, and the equipment cost is effectively controlled.

In this embodiment, the device further includes:

The identification module is configured to identify a service application of the packet according to the feature information of the packet;

The locating module is configured to search for a preset management policy corresponding to the packet according to the feature information and the service application.

In this embodiment, the device further includes:

a receiving module, configured to acquire user information received by the terminal, and perform authentication on the terminal;

The authentication module is configured to record the IP address of the packet to the IP address authentication table, where the IP address authentication table is used to authenticate the packet of the IP address.

In this embodiment, the quintuple flow table includes at least one of the following:

The source IP address of the packet, the source port of the packet, the destination IP address of the packet, the destination port of the packet, the transport layer protocol, the execution action of the default management policy corresponding to the packet, and whether the flag of the packet is reported.

The invention will now be described in detail in accordance with preferred embodiments and embodiments.

Preferred embodiment 1

The preferred embodiment provides a method for implementing user online behavior management, and belongs to the field of broadband access communication. In particular, it relates to a method for implementing online behavior management of users on a small and medium-sized enterprise gateway device.

The preferred embodiment implements functions such as user authentication, application control (blocking or speed limiting). It can implement fine-grained control of users' online behaviors, create user groups, bind different policy templates to different user groups, and control Internet access rights. The policy template is based on the specific application of the user's online behavior (such as QQ, Youku video, PPLIVE, etc.). When the time period setting is combined with the user grouping, it is possible to specify the schedule of what user's online behavior is restricted. . The method has its own authentication system (web authentication). The user does not need to install the client, and the terminal (computer or mobile phone) user accessing the network must be authenticated to connect with the Internet. Convenient for network administrators to operate and maintain.

The system consists of a policy library management module, an in-depth packet parsing module, and a packet forwarding module. The deep packet parsing module implements the judgment of the user's online behavior, and is implemented by software. It does not need to add hardware modules, and can effectively control the cost of the router, and is particularly suitable for small and medium-sized enterprises that are sensitive to management costs.

The technical problem to be solved by the preferred embodiment is to overcome the problem of implementing the user online behavior management function for the small and medium-sized enterprise gateway in the prior art, and providing a passive optical network (Passive Optical Network, PON for short) uplink. A high-efficiency, easy-to-operate, low-cost user online behavior management method is implemented on a small enterprise gateway device. The preferred embodiment records the user's recent online behavior. The same online behavior of the user can be processed in the packet forwarding module without the participation of the deep packet parsing module and the policy library management module, thereby improving the packet forwarding rate. The preferred embodiment has a web authentication function, and the user terminal does not need to install a client, and is suitable for an application scenario in which the intranet accesses the Internet. The online behavior is based on a specific application classification, and supports user group configuration and is convenient for management. The method is implemented by software, and does not require a gateway device to separately add a hardware module, thereby effectively controlling the cost of the gateway device.

The online behavior management system described in the preferred embodiment includes the following modules:

A, policy library management module

B. Deep packet parsing module

C. Message forwarding module

The policy library management module includes a configuration submodule, a database submodule, and a user authentication submodule. The network administrator can operate the web configuration interface of the enterprise gateway to implement user information (including user name, password, user group, etc., disabled or activated state), user group (including user group name, bound policy template, and time). The configuration of the template, including the time period template (including the template name and start and end time), the policy template (including the template name, and the policy actions of one or a certain type of application), which are stored in the database according to the table structure of the database. The policy template includes applications (supporting an application or a certain type of application, such as QQ, Thunder download, Youku video, P2P class, video class, game class, etc.) and actions (forwarding, blocking, speed limit, etc.). The specific configuration method is to classify the user into a user group. The user group is bound to the policy template and the time period template. The policy template takes effect in the corresponding time period.

The deep packet parsing module includes a Deep Packet Inspection (DPI) engine and a feature library to analyze the online behavior of the user. Can identify the most common online applications. Based on the analysis result, the policy configuration corresponding to the database in the policy library management module is searched, and the packet forwarding module is notified to implement the function of blocking or limiting the speed of the user's online behavior.

The packet forwarding module includes a packet intercepting submodule, an IP address authentication table, and a quintuple flow table. It implements functions such as user Inernet access packet interception, IP address authentication record, and quintuple flow table record. The IP address authentication table records the IP address authentication status. If the authentication is passed, the quintuple table is processed. If not, the user authentication sub-module of the policy library management module is notified for authentication. The quintuple flow table records the source IP address, the source port, the destination IP address, the destination port, and the transport layer protocol (that is, the quintuple), the policy action, and whether the packet needs to be sent to the deep packet parsing module. Wait. If the quintuple information of a record in the quintuple flow table can be matched, the packet can be directly forwarded according to the policy action in the quintuple flow table. In this case, the policy library management module is required to notify the quintuple flow table, send the packet to the deep packet parsing module, parse the query policy library management module, and then notify the five yuan. The group flow table performs the current policy action.

Preferred embodiment 2

The preferred embodiment provides a method for implementing a user's online behavior management by a small and medium-sized enterprise gateway, including the following steps:

The first step: the user accesses the Internet through the enterprise gateway. The forwarding module intercepts the Internet packet of the user and searches for the IP address authentication table. If the IP address is authenticated, the process proceeds to the next step; if the IP address is not authenticated, the enterprise gateway pushes the web authentication interface to the user terminal, and the user inputs the username and password. authenticating. The user authentication sub-module in the policy library management module checks the legality of the user accessing the Internet. After the authentication is passed, the user's IP address is saved in the user information in the database, and the IP address authentication table is recorded, and the next step is processed. If the authentication fails, the packet is discarded and the user is prohibited from accessing the Internet.

The second step is to search for the quintuple flow table. If there is a packet record and the mark does not need to be sent to the deep packet parsing module, the action is performed according to the policy action (forward, discard, or rate limit) in the flow table. If the tag needs to send a deep packet parsing module or a record without the packet, go to the next step.

Step 3: The packet is sent to the deep packet parsing module to extract the feature information in the packet content, such as the IP address, the port number, the domain name, and the like, and identify the service application of the user's online behavior. The characteristics of some messages may change frequently, such as qq application, different qq client versions, different login server addresses, and different message characteristics. The deep packet parsing module must ensure that the user's application is correctly determined based on the constantly changing feature information of the packet. Therefore, the version of the signature database needs to be continuously updated, and the message characteristics of the Internet application are backward compatible. For some business applications, multiple messages may be required to be identified. After the message parsing action is completed, proceed to the next step.

Step 4: According to the result of the message parsing, the application of the user (source IP address) is searched in the database of the policy library management module (the result of deep packet parsing, such as QQ, Thunder download, Youku video, etc.) at the current moment. The policy (forward, block, or rate limit, etc.), and notify the packet forwarding module to proceed to the next step.

Step 5: The message forwarding module writes a quintuple flow table, records the message quintuple information and policy actions, and performs policy actions on the message.

Step 6: If the user's IP address is released, the Dynamic Host Configuration Protocol (DHCP) module notifies the packet forwarding module, deletes the entry of the IP address authentication table, and notifies the database to delete the user information. IP address.

In the preferred embodiment, it has the characteristics of high efficiency, easy operation, and low cost. The high efficiency is reflected in the preferred embodiment to maintain the quintuple flow table, which can reduce the packet depth parsing process, the packet deep parsing process, consume CPU resources, and increase the delay of packet processing, so the quintuple flow table The existence of the message can improve the efficiency of message forwarding; there is only one database for recording user information and policies, that is, the database sub-module in the policy library management module, there is no data synchronization problem between multiple databases, and the system overhead is reduced. The user terminal does not need to be installed with a client. The preferred embodiment has a web authentication function, and the user authentication process is simpler. The user and the user group are managed at two levels, and the service classification is based on a specific service application. It is convenient for network administrators to operate; low cost is embodied in this method, which is realized by software, and does not need to add hardware modules to effectively control the cost of the enterprise gateway.

Preferred embodiment 3

3 is a schematic diagram of an online behavior management application system according to a preferred embodiment of the present invention. As shown in FIG. 3, a company internal terminal accesses a company intranet, and an enterprise gateway dynamically allocates an IP address to a user terminal. Users accessing the external network need to pass the enterprise gateway device. The online behavior management is completely implemented by the enterprise gateway device, and the user terminal does not need to install the client.

4 is a block diagram showing the principle of the composition of the online behavior management according to a preferred embodiment of the present invention. FIG. 5 is a schematic diagram of the processing flow of the online behavior management message according to a preferred embodiment of the present invention. As shown in FIG. 4 and FIG. 5, the preferred embodiment is applied. The specific implementation process is as follows:

After the packet forwarding module intercepts the user's Internet access packet, it searches the IP address authentication table to determine whether the user's IP address has been authenticated. If there is no authentication, the authentication process is entered.

The authentication is completed in the policy library management module, and the user name and password entered in the user authentication web page are saved in the database. The user name and password are compared. After the authentication is passed, the user IP address is saved in the user information of the database, and the IP address authentication table is written. If the authentication fails, the intercepted user's Internet message is discarded.

Find the quintuple flow table. If the packet has a record in the quintuple flow table and does not need to be sent, it is forwarded according to the policy action in the quintuple flow table; if there is no record in the quintuple flow table or needs to be If the packet is sent, the packet is sent to the deep packet parsing module.

After receiving the packet, the deep packet parsing module parses the application, URL information, and the like of the packet by the DPI engine and the signature database. According to the application type, the policy library management module finds the current policy action.

The quintuple information of the packet, the application of the user's online behavior, the URL information, and the policy action are notified to the packet forwarding module, the quintuple flow table is written, and the flag of the deep packet parsing module is set to be non-true, and according to The policy action forwards the message. The aging of the quintuple flow table is implemented by a timer. If no flow arrives after a period of time, the flow record is deleted from the quintuple flow table.

The policy library management module maintains a timer to check whether the time period template is valid. If the effective time period template of the user group binding is changed, the quintuple flow table of the packet forwarding module is notified, and the packet is sent to the flag position. true.

FIG. 6 is a schematic diagram of an administrator configuration according to a preferred embodiment of the present invention. As shown in FIG. 6, the specific implementation process is as follows:

The web administrator can configure or read the online behavior management parameters through the web page. The configuration method is as follows: The user joins the user group, and the user group binds the policy template and the corresponding time period template. The activation status in the user information can be activated or disabled by the network administrator. The IP address supports multiple, and supports the same user to log in on multiple terminals. The IP address and authentication status are read-only. The policy template takes effect during the corresponding time period template time.

FIG. 7 is a schematic diagram of a policy search process according to a preferred embodiment of the present invention. As shown in FIG. 7, the specific implementation process is as follows:

Query the user information of the user group in the database according to the source IP address of the packet and the application of the deep packet parsing module. If the IP address of the user is the same as the source IP address of the packet, the policy template bound to the user group is queried. And the time period template, the policy template that is valid at the current time is obtained, and the policy action of the application in the policy template and the quintuple information of the packet are written into the quintuple flow table, and the message is forwarded according to the policy action.

FIG. 8 is a schematic diagram of a process for releasing an IP address according to a preferred embodiment of the present invention. As shown in FIG. 8, the specific implementation process is as follows:

After DHCP releases the user IP address, it notifies the online behavior management module to delete the IP record in the IP address authentication table and delete the user's IP address in the database.

Preferred embodiment 4

For example, if a company uses the gateway device to which the present invention is applied, the actual application process of the preferred embodiment is described in detail by taking the online behavior of the employee of the company's finance department, Zhang San, as an example.

According to the company's regulations, employees of the finance department are not allowed to log in to the Youku website during the working hours from 9:00 am to 5:00 pm. The network administrator of the company provided Zhang San with the account zhangsan and password zhangs for accessing the Internet, and added the user zhangsan to the user group finance department. The user group finance department binds the policy template p1 and the time period template t1. P1 is configured to block Youku, applications that are not configured are allowed by default, and t1 is configured for working hours, which is Monday to Friday from 9:00 to 17:00.

Zhang San's computer obtains the internal network IP address 192.168.1.10 through the gateway. Zhang San tried to log in to the Youku website after going to work. Find the user authentication table based on the source IP address 192.168.1.10 in the request packet. Since there is no record of the client in the user authentication table, the gateway will push the WEB authentication page to Zhang San's computer. After Zhang San enters his account zhangsan and password zhangs, the user information recorded in the database is verified. After the verification is passed, In the user authentication table, the account zhangsan is recorded with the corresponding IP address 192.168.1.10. And recorded in the database user information, the user zhangsan corresponds to the IP address 192.168.1.10.

Then, the quintuple flow table is searched according to the quintuple information in the request packet, and the matching entry of the quintuple information of the packet is not found in the record, and the deep packet parsing module needs to be sent to analyze the eigenvalue of the packet. It is judged that the application is Youku website, and then look up the database, and find that the user IP address 192.168.1.10 is not allowed to log in to Youku at the current time. So the system writes the quintuple information and the blocking action of Zhang San's request to log in the Youku website message into the quintuple flow table. According to the quintuple flow table, Youku application is blocked.

Zhang San found that he could not watch videos on Youku and tried to log in to Sina.com. The request packet first looks up the authentication table, and finds that the IP address 192.168.1.10 corresponds to the user zhangsan has passed the authentication. Then look for the quintuple flow table, no matching message is found, and then send the deep message parsing module. After parsing out the Sina website, check the user IP address 192.168.1.10 in the database at the current moment. The quintuple information of the message and the allowed actions are written into the quintuple flow table. According to the quintuple flow table, Zhang San can log in to Sina.

Before the quintuple flow table entry aging, Zhang San once again logged into the Sina website to find the matching record when searching for the quintuple flow table. The message can be directly forwarded without parsing the deep packet parsing module and searching the database. Strategic action. Therefore, the message processing speed can be improved.

If Zhang San computer no longer uses the IP address 192.168.1.10 and becomes 192.168.1.20, the account zhangsan, IP address 192.168.1.10 previously passed in the IP address authentication table is deleted, and the user zhangsan in the database The IP address in it is also deleted. When Zhang San accesses the Internet, he needs to re-authenticate the user.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

Embodiments of the present invention also provide a storage medium. Optionally, in this embodiment, the foregoing storage medium may be configured to store program code for performing the method steps of the above embodiment:

Optionally, in this embodiment, the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory. A variety of media that can store program code, such as a disc or a disc.

Optionally, in the embodiment, the processor executes the method of the above embodiment according to the stored program code in the storage medium.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

According to the foregoing technical solution provided by the embodiment of the present invention, the Internet access packet of the terminal is obtained, and the preset management policy corresponding to the packet is searched. When the preset management policy of the packet is found, the pre-recording of the packet is recorded. Set the management policy to the quintuple flow table, and obtain the Internet packet of the terminal again, and find out whether the packet has a record in the quintuple flow table, and the packet has a record in the quintuple flow table. In this case, the packet is processed according to the preset management policy, and the technical operation for controlling the online behavior of the user in the local area network is complicated, the efficiency is low, and the cost is high, thereby achieving the purpose of improving efficiency and effectively controlling equipment cost. .

Claims (14)

A gateway management method includes: Obtaining an Internet packet of the terminal, and searching whether the packet has a record in the quintuple flow table, where the quintuple flow table is a preset management policy for finding the packet In the case that the preset management policy of the packet is generated; And if the packet is recorded in the quintuple flow table, the packet is processed according to the preset management policy. The method according to claim 1, wherein the finding the preset management policy corresponding to the message comprises: Identifying a service application of the packet according to the feature information of the packet; And searching for a preset management policy corresponding to the packet according to the feature information and the service application. The method according to claim 2, wherein the feature information of the message comprises at least one of the following: IP address, port number, domain name. The method of claim 2, wherein the preset management policy comprises at least one of the following: Executing an execution action corresponding to the application service, where the performing action includes one of: forwarding, blocking, and speed limiting; The execution action corresponding to the application service is executed within a preset time period. The method of claim 1, wherein before the finding the preset management policy corresponding to the packet, the method comprises: Obtaining user information received by the terminal, and authenticating the terminal; When the authentication is passed, the IP address of the packet is recorded to the IP address authentication table, where the IP address authentication table is used to authenticate the packet of the IP address. The method of claim 5 wherein said method comprises: When the authentication IP address of the IP address authentication table is released, the IP address is deleted on the IP address authentication table. The method of claim 1 wherein said method comprises: And if the packet is not recorded in the quintuple flow table, searching for a preset management policy corresponding to the packet; In the case that the preset management policy of the packet is found, the preset management policy of the packet is recorded in the quintuple flow table. The method of claim 1 wherein said method comprises: And in the case that the packet has a flag indicating that the packet is reported in the quintuple flow table, searching for a preset management policy corresponding to the packet; When the preset management policy of the packet is found, the preset management policy of the packet is recorded to the quintuple flow table. The method of claim 1 wherein said method comprises: If the data stream corresponding to the packet is not received within the preset time threshold, the record of the packet in the quintuple flow table is deleted. The method according to any one of claims 1 to 9, wherein the quintuple flow table comprises at least one of the following: The source IP address of the packet, the source port of the packet, the destination IP address of the packet, the destination port of the packet, the transport layer protocol, the execution action of the default management policy corresponding to the packet, and whether the flag of the packet is reported. A gateway management device includes: Obtaining a module, configured to obtain an Internet packet of the terminal, and to find whether the packet has a record in the quintuple flow table, where the quintuple flow table is to find the packet In the case of a preset management policy, the preset management policy of the message is generated; The processing module is configured to process the packet according to the preset management policy if the packet has a record in the quintuple flow table. The apparatus of claim 11 wherein said apparatus further comprises: The identification module is configured to identify a service application of the packet according to the feature information of the packet; The locating module is configured to search for a preset management policy corresponding to the packet according to the feature information and the service application. The apparatus of claim 11 wherein said apparatus further comprises: a receiving module, configured to acquire user information received by the terminal, and perform authentication on the terminal; The authentication module is configured to record the IP address of the packet to the IP address authentication table, where the IP address authentication table is used to authenticate the packet of the IP address. The apparatus according to any one of claims 11 to 13, wherein the quintuple flow table comprises at least one of the following: The source IP address of the packet, the source port of the packet, the destination IP address of the packet, the destination port of the packet, the transport layer protocol, the execution action of the default management policy corresponding to the packet, and whether the flag of the packet is reported.

Images