WO2011041963A1

WO2011041963A1 - Method, apparatus and system for controlling user to access network

Info

Publication number: WO2011041963A1
Application number: PCT/CN2010/075908
Authority: WO
Inventors: 张世伟; 符涛; 许志军
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-10-10
Filing date: 2010-08-11
Publication date: 2011-04-14
Also published as: CN102045313A; CN102045313B

Abstract

The present invention discloses a method, apparatus and system for controlling a user to access a network. The method includes: the node used for access control receives a data package of a user accessing the network node in an identifier and locator separation network; the destination address and destination port of the data package are obtained, and if the destination address and destination port belong to the addresses and ports of the destination network elements which need to execute an access control, then the source address and source port of the data package are obtained; the node used for access control researches the corresponding access authority of the source address and source port according to the obtained source address and source port of the data package and the corresponding relation information between the recorded source address, source port and the authority for accessing the network node; if the corresponding access authority of the source address and source port is found, the node used for access control controls the communication from the user to the network node according to the authority. The present invention solves the problem of the network management user in a Legacy Internet network (LIN) accessing the Subscriber Identifier and Locator Separation Network (SILSN) core network element, and guarantees the security of the core network.

Description

Method, device and system for controlling user access to a network

Technical field

The present invention relates to the field of communication technologies, and relates to a method and system for controlling a user access identity and a network node in a location separation network under the framework of identity identification and location separation networks.

Background technique

The IP address in the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol widely used in the existing Internet has a dual function, and serves as the location identifier of the network terminal of the communication terminal host network layer in the network topology. And as the identity of the transport layer host network interface. The TCP/IP protocol was not designed at the beginning of the host. However, as host mobility becomes more prevalent, the semantic overload defects of such IP addresses are becoming increasingly apparent. When the IP address of the host changes, not only the route changes, but also the identity of the communication terminal host changes. This causes the routing load to become heavier and heavy, and the change of the host ID causes the application and connection to be interrupted. The purpose of identification and location separation is to solve the problem of semantic overload of IP address and serious routing load, security, etc., to separate the dual functions of IP address, realize dynamic redistribution of mobility, multiple townships, and IP addresses. Support for mitigating routing load and mutual visits between different network areas in the next generation Internet.

At present, a variety of network architectures with identity and location separation are proposed, including HIP, LISP and Beijing Jiaotong University, both of which are identity and location separation networks. This paper describes the identity and location separation network architecture as an example.

In order to solve the above problems, ZTE proposes an identity and location separation network architecture. As shown in Figure 1, for convenience of description, the user identity and location separation network is simply referred to as SILSN (Subscriber Identifier & Locator Separation Network). ), the traditional Internet is simply referred to as LIN (legacy Internet Network).

In FIG. 1, the SILSN is composed of an Access Service Node (ASN) and a User Equipment (UE), an Identity & Location Register (ILR), and an Inter-working Service Node (Inter-working Service Node, ISN) and other components. among them The ASN is used to implement the access of the user terminal and bear the functions of charging and switching. The ILR is responsible for the location registration and identity of the user. The ISN is used to communicate with the traditional Internet. The ISN and the ASN can also be physically set. UE1 is a traditional Internet user and UE2 is a user of SILSN. In this paper, the network composed of network nodes such as ASN, ILR, and ISN is called the core network of SILSN (also called backbone network).

As shown in FIG. 1 , the LIN network and the SILSN core network coexist in the communication system. When the user in the LIN network sends data to the external network, according to the final destination of the data packet sent by the user terminal UE1 in the LIN, the UE1 may send the data. Packets are divided into the following two types:

The first type is when the LIN user accesses the SILSN user, such as UE1-XJE2, which is the most common access mode;

This type of packet is sent to the SILSN user, that is, the final destination is outside the SILSN core network. In this case, the network nodes in the core network only serve to encapsulate and forward, and do not analyze the actual content of the data packets. Therefore, the first data packet does not affect the performance of the core network of the SILSN. The security of the core network node has a significant impact;

The second type is a traditional Internet LIN user accessing a network node within the SILSN core network, that is, the final destination is a network node within the SILSN core network, such as UE1->ASN2. This method is mainly for the remote management and diagnosis of the SILSN network. In the initial stage of SILSN network construction, the administrator of the SILSN may not be in the coverage area of the SILSN. For example, the administrator of the SILSN is on vacation in the field. If the SILSN fails. For remote diagnostics, testing, and control, the SILSN core network node must be accessible via LIN;

Since the final destination of the data packet sent by the SILSN administrator user is the network node in the core network, the network node in the core network not only needs to parse its content, but also performs corresponding processing according to the content, such as modification configuration, fault diagnosis, testing and control. Etc., the above operations have a great impact on the normal operation of the SILSN network. Once a malicious user in the LIN pretends to be maliciously controlled by the SILSN administrator, the SILSN network will be seriously affected. Therefore, the LIN user must be strictly authenticated. And limit the user's behavior mode according to user permissions.

For the convenience of description, the SILSN administrator is referred to as the administrator below. That is to say, the administrators mentioned in this document are administrators of SILSN, and do not include administrators of other networks such as LIN. In order to protect the security of the SILSN core network, SILSN only provides users of SILSN and users of LIN interworking, and prohibits LIN users from accessing network nodes in these core networks, such as ASN, ILR, ISN, but there is currently no way to avoid LIN user access. Method of network nodes in the SILSN core network. Summary of the invention

Embodiments of the present invention provide a method, apparatus, and system for controlling user access to a network, which can protect the security of the identity identification and the location separation network.

In order to solve the above problems, the present invention provides a method of controlling user access to a network, which includes:

The node for access control receives the user access identity and the data packet of the network node in the location separation network;

Obtaining the destination address and the destination port of the data packet. If the destination address and the destination port belong to the address and port of the destination network element to be accessed, the source address and the source port of the data packet are obtained.

The node for access control searches for the source address and the source port according to the obtained source address and source port of the data packet and the source address of the record, the source port, and the corresponding relationship information of accessing the network node authority. Access rights; and

If the access authority corresponding to the source address and the source port is found, the access control node controls communication between the user and the network node according to the permission.

The method can also have features:

The address and port to be controlled by the access means: the address and port of one or more core network management node (CNMP) nodes configured, and/or the configured identity and the address of the network node in the location separated network port.

The method further includes:

If the source address and the source port of the data packet are not found in the open state table, the node for access control determines whether the format of the data packet conforms to a format of a predetermined network management request data packet. ;

If yes, verify that the user is a network administrator; If it is a network administrator, the user is allowed to communicate with the network node.

The method further includes the node for access control dropping the data packet in any of the following cases:

The node for access control finds the source address and the source port of the data packet in the recorded correspondence information, and the access rights corresponding to the source address and the source port are not open;

The node for access control determines that the format of the data packet does not conform to a format of a predetermined network management request data packet;

The node for access control determines that the format of the data packet conforms to a format of a predetermined network management request data packet, but the verification determines that the user is not a network administrator.

The method further includes:

If the user is a network administrator, if the user determines that the user is a network administrator, the node for access control is determined according to the configured network node information accessible by the network administrator. Whether the user has the right to access the network node;

If there is permission to access the network node, the user is allowed to communicate with the network node, otherwise the data packet is discarded.

The method can also have features:

The step of the node for access control controlling the communication between the user and the network node according to the authority includes: allowing the user to communicate with the network node when the permission is open, otherwise , discard the packet.

The method further includes:

Adding a source address and a source port of the data packet to an open state table when the total number of times the node for access control discards the data packet having the same source address and the source port exceeds a preset threshold value, And configuring the access authority corresponding to the source address and the source port as a mask;

The node for access control receives a source address and a source with a corresponding access right as a mask Drop the packet directly after the packet.

The method may also have the following features: The step of verifying whether the user is a network administrator includes:

The node for access control sends an administrator identity request to the identity location register, carrying the user identity of the user;

Receiving an administrator identity authentication response, the administrator identity authentication response including a result of the identity location register authenticating the user identity according to the configured network administrator identity;

Determining whether the user is a network administrator according to the authentication result in the administrator identity authentication response.

The method can also have features:

The network management request packet includes an administrator identifier.

The node for access control sends an administrator identity request to the identity location register, and the step of carrying the user identity of the user includes: the node for access control is extracted from the network management request packet An administrator identifier, sent to the identity location register;

The administrator identity authentication response is the result of the identity location register authenticating the user identity based on the configured administrator identifier and the received administrator identifier.

The method further includes:

The node for access control further adds a source address and a source port of the data packet to the open state table, and configures the access authority corresponding to the source address and the source port to be frozen.

The method further includes:

If it is determined that the user is a network administrator, the node for access control further modifies the source address of the data packet in the open state table and the access permission corresponding to the source port to be open.

The method further includes:

If it is determined that the user is not a network administrator, the node for access control will be open The state table contains the record deletion of the source address and source port of the packet.

The method may further have the following: the step of allowing the user to communicate with the network node includes:

The encryption method of the letter;

The communication between the network node and the user is established by using the encryption method.

The method may also have the following features: the node used for access control is a combination of an interworking gateway and a core network management node, or the node used for access control is an interworking gateway.

Correspondingly, the node for access control in a network system provided by the present invention includes: a receiving module, configured to: receive a data packet of a network node in a user access identity and a location separation network in a traditional Internet;

The obtaining module is configured to: obtain a destination address and a destination port of the data packet, and determine, by determining an address and a port of the destination network element that needs to perform access control, and obtain a data packet received by the receiving module. Source address and source port;

And a search module, configured to: search for a source address and a source port of the data packet in a correspondence between the source address of the record, the source port, and the access authority of the network node; and

a control module, configured to: find, by the lookup module, a source address and a source port of the data packet, and an access right corresponding to the source address and the source port is open, allowing the user to communicate with the network node .

The node further includes:

a first determining module, configured to: when the source address and the source port of the data packet are not found in the open state table, determine whether the format of the data packet meets a predetermined network management request data packet. Format;

a first verification module, configured to: when the first determining module determines that the format of the data packet conforms to a format of a predetermined network management request data packet, verify whether the user is a network administrator; The control module is further configured to: allow the user to communicate with the network node when the first verification module verifies that it is a network administrator.

The node further includes:

a second determining module, configured to: if the source address and the source port of the data packet are not found in the open state table, the node for access control determines whether the format of the data packet meets a pre-determination The format of the specified network management request packet;

a second verification module, configured to: if the second determining module determines that the format of the data packet conforms to a format of a predetermined network management request data packet, and verifies whether the user is a network administrator, when the verification determines that When the user is a network administrator, it is determined according to the configured network node information that the network administrator can access, whether the user has the right to access the network node;

The control module is further configured to: allow the user to communicate with the network node when the second verification module determines that the user has permission to access the network node.

The node may also have characteristics: The control module is further configured to discard the data packet in any of the following cases:

Finding, by the recorded correspondence information, a source address and a source port of the data packet, and the access rights corresponding to the source address and the source port are not open;

Determining that the format of the data packet conforms to a format of a predetermined network management request data packet, but the risk certificate determines that the user is not a network administrator;

Determining that the format of the data packet conforms to a format of a predetermined network management request data packet, and verifying that the user is a network administrator, but determining that the user does not have the right to access the network node.

The node further includes:

a fourth configuration module, configured to: add a source address and a source port of the data packet when the total number of times the control module discards data packets having the same source address and source port exceeds a preset threshold Go to the open state table, and configure the access rights corresponding to the source address and the source port to be masked;

Discard the module, which is set to: Receive the source address and source port with the corresponding access rights as masked The data packet is discarded directly.

The node may also have a feature, and the second verification module includes:

a sending unit, configured to: send an administrator identity request to the identity location register, and carry the user identity of the user;

a receiving unit, configured to: receive an administrator identity authentication response, where the administrator identity authentication response includes a result of authenticating, by the identity location register, the user identity according to the configured identity of the network administrator; as well as

And a determining unit, configured to: determine, according to the authentication result in the administrator identity authentication response, whether the user is a network administrator.

The node further includes:

a first configuration module, configured to: when the first determining module determines that the format of the data packet conforms to a format of a predetermined network management request data packet, adding a source address and a source port of the data packet to the The open state table is configured, and the access rights corresponding to the source address and the source port are configured to be frozen.

The node further includes:

a second configuration module, configured to: when the first verification module determines that the user is a network administrator, modify the source address of the data packet in the open state table and the access permission corresponding to the source port to be open .

The node further includes:

And a third configuration module, configured to: when the verification module determines that the user is not a network administrator, delete the record that includes the source address and the source port of the data packet in the open state table.

The node may also have characteristics, and the control module further includes: a force. Secret mode

And an establishing unit, configured to: establish communication between the network node and the user by using an encryption manner obtained by the acquiring unit.

The system can also have features: The address and port of the destination network element to be subjected to access control are: the address and port of one or more core network management node (CNMP) nodes configured, and/or the configured identity identifier and the network node in the location separation network Address and port.

The present invention also provides an identity identification and location separation network system that includes the nodes described above for access control.

Using the above method, device and system, the method for the network management user located in the LIN to access the SILSN core network element is solved, and the security of the core network is ensured. In an embodiment, it is also possible that an ordinary user in the LIN cannot access the SILSN core network element node. In an embodiment, the attack from the ordinary user in the LIN on the CNMP (through the port control in the ISN) can also be prevented; and the encrypted transmission of the network management flow between the UE1 and the CNMP can be implemented. In addition, all core network nodes only accept management packets from CNMP, which helps the security of core network element management. BRIEF abstract

FIG. 1 is a schematic diagram of a network diagram of two types of data packets that a LIN user accesses a SILSN in a SILSN network architecture in the prior art;

2 is a schematic diagram of a network accessing a SILSN core network element by an administrator of a SILSN located in a LIN according to an embodiment of the present invention;

3 is a schematic diagram of a network architecture based on CNMP further refinement according to an embodiment of the present invention; FIG. 4 is a timing diagram of a method for controlling a user access identity and a network node in a location separation network in Embodiment 1;

5 is a flowchart of a method for controlling a user access identity and a network node in a location separation network in Embodiment 2;

6 is a schematic structural diagram of a node for access control in an identity identification and location separation network system according to an embodiment of the present invention;

7 is another schematic structural diagram of a node for access control in the embodiment shown in FIG. 6. FIG. 8 is a schematic structural diagram of a risk module in the embodiment shown in FIG.

FIG. 9 is another schematic structural diagram of a node for access control in the embodiment shown in FIG. 7; FIG. FIG. 10 is another schematic structural diagram of a node for access control in the embodiment shown in FIG. 9. FIG. 11 is a schematic structural diagram of a control module in the embodiment shown in FIG. 6. Preferred embodiment of the invention

Specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

In the SILSN network, the ISN plays the role of the SILSN network and the LIN network interworking. When the users in the LIN network and the users in the SILSN core network access each other, the SILSN intranet addressing mode and the LIN addressing mode are different. The ISN is responsible for converting the data format and the addressing space of the two parties, wherein the addressing space is a user identity (AID, also referred to as an access identifier) space and a public network IP address space.

The ISN maps the data packet of the user equipment in the SILSN with the AID as the data packet identified by the one or more public network IP addresses and port numbers of the LIN network, and the address space formed by the one or more public network IP addresses is recorded as SI, therefore, for users in the SILSN, no matter how their identity AID changes, when the data packet is sent to LIN through ISN conversion, all user's identity AID will be mapped to an IP address and port in S1. No. Therefore, for the users in the LIN network, the users in the SILSN they see are all in the S1 space, so that the users in the LIN network access the users in the SILSN network, and actually only access the address of the S1 space.

In order to protect the security of the network element in the SILSN core network, the ISN cannot allow the LIN user to directly access the network element address of the SILSN core network, and only allows access to the SILSN user. That is, the user in the LIN can only access the address space within the S1 range.

As mentioned above, in order to facilitate the SILSN administrator to operate the SILSN core network element in an emergency, it is necessary to provide the SILSN administrator with the ability to access the core network element in the LIN network, and to ensure that the SILSN administrator can manage the SILSN from the LIN. At the same time, it is also necessary to prevent ordinary users in the LIN from accessing the core network element.

Since the data traffic for network management in SILSN is generally much smaller than the data traffic for services, and most network management measures (such as remote diagnosis, testing, and control) are initiated from within SILSN, that is, network management in SILSN. Most of the traffic comes from inside the SILSN. The network management traffic for managing SILSN network elements from LIN is very small, just as a supplement to remote management. It is used in emergency situations and requires equipment manufacturer support, or the administrator who has experience in an emergency is not in the network management office. This kind of situation is usually rare, so the data traffic is generally small and does not need to be processed too much. In order to facilitate the unified control and management of such data traffic, centralized management is implemented. For this purpose, a core network management node (Core Network Management Proxy, CNMP) is introduced in this embodiment, and the administrator in the LIN is implemented by CNMP. SILSN network management, as shown in Figure 2:

Core Network Management Proxy (CNMP) for processing

The ISN is configured to receive a data packet sent by a user in the LIN, and determine whether the data packet is sent to the CNMP data packet, and if yes, forward the data packet to the CNMP; otherwise, determine whether the destination address is in the S1 range. If the ISN converts the data packet, the destination address is converted to the AID, and then forwarded to the ASN, and then sent to the destination user of the SILSN. If the address is not in the range of S1, it is directly discarded. Normally accessing the users in the SILSN, but not accessing the network nodes in the core network, the ISN needs to distinguish between two types of data packets. By identifying whether the data packets sent by the UE1 are type one or type two, the embodiment is preferably in the security restriction measure. Next, if a specific message format, control the same source address to send the first data packet, etc., by the ISN to identify whether the destination address of the data packet is CNMP address, to distinguish whether the data flow from the LIN network to the SILSN management. In the present invention, the address of the CNMP is an IP address, which may be an IPv4 or IPv6 address.

Of course, other embodiments may be used, such as using different data packet formats, or using the agreed identifier to make the ISN identify whether it is a data packet sent to CNMP.

Optionally, in order to further prevent the user in the LIN network from attacking the SILSN network, the ISN only accepts the data packet whose destination address is in the S1 space or the destination address is the CNMP address, and discards other data packets. The ISN decides whether to submit it to CNMP for processing based on the source address of the packet and the open information of the port.

If it is not handed over to the CNMP, it is determined that the destination address in the data packet initiated by the user equipment is the address of the CNMP, and is considered to be the second type of data packet; when the address of the data packet is not the CNMP address but the destination address When in the S1 space, it is considered to be the first type of data packet and will be pressed. The first type of data packet is processed, and after being queried for the destination user location, and re-encapsulated, it is forwarded to the ASN currently registered by the destination user.

If the CNMP is processed for processing, the CNMP identifies the identity of the initiator, and the initiator can be identified by interacting with the ILR. When CNMP judges that the initiator of the data packet is the administrator of the SILSN, CNMP forwards the data packet to the managed core network element.

Optionally, after the ISN sends the data packet to the CNMP, the CNMP may further perform identity authentication on the initiator by interacting with the ILR. After the identity authentication of the initiator is passed, a secure tunnel is established between the initiator and the CNMP. Through the secure tunnel, the CNMP can forward the message sent by the initiator to the managed NE to the corresponding managed NE. .

FIG. 3 is a schematic diagram of a network architecture based on CNMP further refinement in the embodiment of the present invention. After the type 2 packet is sent from the UE1, the format of the network management request packet is determined by the ISN1, and the source address and port are not When it belongs to the restricted range, it is handled by CNN1 by CNN; after receiving the packet, CNMP extracts the user identity in the data packet, and then CNMP sends this identity to ILR to identify the identity of user UE1 by ILR. Determine whether UE1 is the administrator user identity of the SILSN, and then notify CNMP of the result of the user identity.

In order to prevent the ordinary user in the LIN from accessing the administrator of the SILSN, if the CNMP determines that the initiator of the data packet is the administrator of the SILSN, and forwards the data packet to the managed core network element, it may also include the following Steps:

The CNMP notifies the ISN1 to open the source address and port corresponding to the data packet sent by the UE1, and then further enables the ILR to authenticate the identity of the UE1 through the message interaction with the UE1 via CNMP, and then the ILR notifies the CNMP of the result of the identity authentication; Afterwards, the CNMP forwards the data packet sent by the subsequent UE1 to the CNMP to the managed core network element, such as ASN2.

After the ILR authenticates the identity of the UE1, the ILR can further check whether the UE1 has the right to manage the managed core network element, such as the ASN2 right. If the ILR does not pass the identity authentication of the UE1 or the ILR does not check the UE1. With the authority to manage the managed core network elements, CNMP notifies the ISN to perform anti-attack processing, such as "closing" or "masking" the open source address of UE1 and the corresponding port; If CNMP finds that a LIN user repeatedly initiates a network management request to CNMP, but the identity authentication fails multiple times, CNMP can notify the ISN of the source address and port number of the data packet sent by the ISN when the number of failures exceeds a certain number of thresholds. Change the status to "Shield";

For users in the "masked" state, the ISN will no longer forward any packets from this user to CNMP. Further, in order to prevent users located in the LIN from sending data packets frequently to initiate a denial of service attack (such as DOS attack) on CNMP, the source address and source port of the data packet sent by the source address of the administrator user may be saved on the ISN. The status of these states can be saved in a LIN SILSN administrator to manage the user's source address and source port in the Open State Table (OPT), the ISN checks if the user source address is in OPT. When the ISN receives the data packet from the LIN user, it extracts the source address of the data packet, and then checks the open state of the source address and the source port at the OPT;

If the status is "open", the user's data is directly forwarded to CNMP. If the status is "frozen", the packet is discarded. If the status is "masked", the packet is discarded and alarmed;

If the user source address is not in the OPT, put the source address/source port number of the user carried in the data packet into the OPT, and change its status to "freeze";

The subsequent ISN can change the state of the source address/source port of the user in the OPT according to the CNMP instruction, such as changing "freeze" to "open" or "mask".

In summary, in this embodiment, in order to prevent an ordinary user from the LIN from attacking the core network element, the ISN forwarding the data packet to the CNMP includes the following scenarios:

1. The data packet whose destination address is not the address of CNMP is not forwarded to CNMP;

2. For a packet whose destination address is CNMP and whose source address/source port is in the OPT, if its status is "open", it is unconditionally forwarded to the corresponding managed NE.

3. For a packet whose destination address is CNMP and the source address/source port is in the OPT, if the status is "masked", the user behavior is counted in the log, the packet is discarded, and an alarm is selected according to the condition;

4. For a packet whose destination address is CNMP and the source address/source port is in the OPT, if the status is "freeze", the packet is discarded;

5. For a packet whose destination address is CNMP and the source address/source port is not in the OPT, The ISN forwards only the first packet sent by the source address/source port to CNMP, and puts the source address/source port into the OPT, and its state is set to "frozen".

It should be noted that, in actual application, the functions of the core network management node and the interworking gateway may be set on one node in the SILSN network, such as the interworking gateway in the network architecture in the present invention, through internal logic. The interface is used for communication, and the method and the process are the same as those of the core network management node and the interworking gateway. The description is omitted here. For convenience of description, the above two cases are used to implement the access control node. Referred to as a node for access control.

In order to make the technical solutions provided by the present invention more clear to those skilled in the art, the specific application scenarios are taken as an example for description:

Embodiment 1 Description, as shown in Figure 4:

Step 401: The user UE1 located in the LIN needs to access the core network node in the SILSN network, and sends a network management request message to the ISN, where the network management request message may be encapsulated in an IP data packet, and the destination address is the address of the CNMP. After the ISN receives the network management request message, if it is detected that the receiver of the message is CNMP, step 402 is performed;

It should be noted that CNMP should pre-specify the format of this network management request message. When the ISN finds that the source address/source port of the data packet from LIN is not in the OPT, CNMP checks whether the data is in this message format, if not throw away. If yes, extract the source address port and use the source address port as the index in the OPT to generate a record, set its status to "frozen", and then no longer receive the user UE1 sent before receiving the CNMP open port command. Other messages to avoid user-initiated denial of service attacks.

Step 402: The ISN receives the network management request message, and sends the message to the CNMP. Step 403: The CNMP directly extracts the access identifier of the user in the network management request message.

AID, then sent to the ILR via "Identify Administrator Identity Request";

Step 404: The ILR determines, according to the AID, whether the user UE1 has an administrator identity, and returns an "identify administrator identity response" to the CNMP. If the AID is not the administrator's identity, the ILR is used. The identification of the administrator identity response notification CNMP fails. If the AID is the administrator identifier, the CNP can be notified by the verification AID to continue the service;

Step 405: After receiving the identification of the administrator identity, the CNMP notifies the ISN to open the source address and port corresponding to the user UE1 through the "port control message", and if it fails, notifies the ISN to close the user. Source port and destination port corresponding to UE1;

Step 406: After the ISN receives the port control message, if the CNMP requests the port to be shut down abnormally, the ISN determines the number of times the source address is abnormally closed, and determines whether the source address is to be blacklisted according to a preset threshold. Mask, and then delete the source address and source port number in the "source address temporary mask entry", save the source address to temporarily block the table space, and the process ends;

If the CNMP requires the ISN to open the port normally, the ISN opens the corresponding source port and the destination port, and allows the ISN to forward the message sent by the user UE1 to the CNMP, and step 407 is performed;

Step 407: The CNMP performs authentication on the user UE1 by interacting with the ILR, and checks whether the core network element address that the user UE1 wants to manage and the core network element address that is pre-configurable to the user in the ILR are consistent. If the authentication and the managed NE addresses are the same, continue.

If the authentication is passed, UE1 performs step 408;

If the authentication fails or the core network element that the UE1 requires to manage is inconsistent with the manageable network element address set by the UE1 in the ILR, the CNMP sends a "port control" message to the ISN, and the ISN is required to close the source address and the source port, and the process ends;

Step 408: After the normal authentication is passed, the UE1 sends a specific network management message to the corresponding network element, such as the ASN, via the CNMP, and the CNMP forwards the message to the ASN, and the CNMP also sends the ASN message to the UE1.

Optionally, if the encryption key has been negotiated in the authentication process in step 407, the message sent by the UE1 to the ASN may also be sent to the CNMP in an encrypted manner, and the CNMP may also encrypt the data sent by the ASN. Give UE1;

The authentication process of the step 407 can be authenticated by using the authentication method of the prior art. Step 409: The CNMP forwards the message sent by the UE1 to the corresponding network element, such as an ASN, and sends a corresponding message to the CNMP with the ASN. Step 410: After the network management process is completed, the managed network element, such as the ASN, sends a "process end" message to the CNMP, and the CNMP corresponding network management process is terminated.

Step 411: After receiving the "End of Process" message, CNMP sends a "port control" message to the ISN, requesting the ISN to properly close the port.

After receiving the message, the ISN closes the corresponding port and no longer receives and forwards other messages except the XI format to the SNM.

The method provided in this embodiment controls the access of the traditional network user that initiates the access request, controls the access rights of the network node in the core network of the SILSN according to the result of the identity verification, protects the security of the core network, and implements the common user in the LIN. The purpose of the SILSN core network element node cannot be accessed. At the same time, the ISN port control is used to prevent attacks from CNMP from ordinary users in the LIN. The transmission security is improved by the encrypted transmission of the network management flow between the UE and the CNMP.

Embodiment 2

This embodiment is described by an application example initiated by a common user of a LIN network, as shown in FIG. 5:

Step 501: The ISN receives a data packet of the LIN and extracts its destination address.

Step 502: The ISN determines whether the destination address of the data packet is a CNMP address. If yes, step 503 is performed; otherwise, step 507 is performed.

Step 503: When the destination address is a CNMP address, extract a source address and a source port number of the data packet.

Step 504: Determine whether the source address and the port number are in the OPT. If yes, execute step 505. Otherwise, go to step 508.

Step 505, further determining whether the status is "open", if it is "open", executing step 506, if not "open", executing step 510.

Step 506: If it is open, forward the data packet to CNMP.

Step 507: When the destination address is not the CNMP address, the first type of data packet is processed, and details are not described herein again. Step 508: If the source address of the data packet is not in the OPT, determine whether it is a network management request message, if yes, execute step 509, otherwise perform step 510.

Step 509: When determining that it is a network management request message, the ISN puts the source address and port into the OPT, and sets the status to "freeze", and sends the data packet to CNMP.

Step 510: Discard the data packet.

In the above application example, the destination address of all data from the ISN from the LIN network can only be an address in the S1 space or a CNMP address;

CNMP handles access, authentication, and encryption functions from the network management user of LIN. Only the network management users who pass the CNMP and ILR authentication can access the SILSN core network element. The ordinary users from LIN can only access the S1 space address.

The ISN opens and closes the source address port from the LIN user according to the instruction sent by the CNMP;

After receiving the first UE1 packet sent to the CNMP packet, the ISN freezes the source address port of the UE1, and then the ASN does not receive other data packets whose source address is the user UE1 before receiving the CNMP "port control" to open the port. ;

CNMP and ILR should compare the manageable NE addresses of network management users, and do not allow users to access core network addresses that are not administrator rights.

Only CNMP believes that the identity is the administrator's user, and CNMP forwards the user data packet to the ILR for user authentication.

Only when the ILR authentication is passed and the network management user who manages the network element address corresponding to the core network is enabled, CNMP forwards the user data packet to the corresponding core network element.

CNMP can selectively encrypt and decrypt the data of UE1 and CNMP.

It should be noted that the present invention is described by taking the identity identification and location separation network architecture proposed by ZTE as an example, but is not limited thereto, and is applicable to other network architectures in which multiple identity and location are separated, such as HIP, LISP, and Beijing. The transportation university proposed to belong to the identity identification and location separation network. Because the implementation methods are similar, they will not be described here.

The method provided in this embodiment controls the access of the traditional network user that initiates the access request, controls the access rights of the network node in the core network of the SILSN according to the result of the identity verification, protects the security of the core network, and implements the common user in the LIN. Unable to access SILSN core network element section The purpose of the point.

As shown in FIG. 6, an embodiment of the present invention provides an identity identification and location separation network system, including a node for access control, where the user access control node includes:

The receiving module 601 is configured to receive a data packet of a user access identifier in the traditional Internet and a network node in the location separation network;

The obtaining module 602 is configured to obtain a source address and a source port of the data packet received by the receiving module, where the searching module 603 is configured to search for a source address, a source port, and a correspondence relationship between the source port and the access authority of the network node. The source address and source port of the data packet;

The control module 604 is configured to find, by the lookup module 603, the source address and the source port of the data packet, and the access rights corresponding to the source address and the source port are open, allowing the user to communicate with the network node. . Optionally, as shown in FIG. 7, the node for access control may further include: a first determining module 701, configured to find, in the open state table, a source address and a source of the data packet. And determining whether the data packet is a predetermined network management request data packet;

The first verification module 702 is configured to verify, when the determining module 701 determines that the predetermined network management request data packet is the network administrator;

The control module 604 is further configured to allow the user to communicate with the network node when the verification module verifies that it is a network administrator. Further, the node for access control further includes:

a second determining module, configured to: if the source address and the source port of the data packet are not found in the open state table, the node used for access control determines whether the data packet is a predetermined network management Request packet

a second verification module, if yes, verifying whether the user is a network administrator, and when the verification determines that the user is a network administrator, the node for access control is accessible only to the configured network administrator The network node information determines whether the user has the right to access the network node; The control module is further configured to: at the verification module, determine that the user has the right to access the network node, and allow the user to communicate with the network node. Further, the control module 604 is further configured to discard the data packet in any of the following situations: if the source address and the source port of the data packet are found in the recorded correspondence information, and the source address and The access rights corresponding to the source port are not open.

Determining that the data packet is not a predetermined network management request data packet;

Determining that the format of the data packet is a predetermined network management request data packet, but verifying that the user is not a network administrator;

The data packet is judged to be a predetermined network management request packet, and the verification determines that the user is a network administrator, but determines that the user does not have the right to access the network node. . Optionally, the node for access control further includes: a fourth configuration module, configured to: when the total number of times the control module discards data packets having the same source address and source port exceeds a preset threshold The source address and the source port of the data packet are added to the open state table, and the access rights corresponding to the source address and the source port are configured as a mask; and the discarding module is configured to receive the source with the corresponding access right as a mask. The address and source port packets are discarded directly. Further, as shown in FIG. 8, the verification module 702 may further include: a sending unit 7021, configured to send an administrator identity request to the identity location register, and carry the user identity of the user;

The receiving unit 7022 is configured to receive an administrator identity identification response, where the administrator identity authentication response includes a result of authenticating, by the identity location register, the user identity according to the configured identity of the network administrator.

The determining unit 7023 is configured to determine, according to the authentication result in the administrator identity authentication response, whether the user is a network administrator. Optionally, as shown in FIG. 9, the node used for access control may further include: The first configuration module 901 is configured to: when the first determining module determines that the data packet meets a predetermined network management request data packet, add a source address and a source port of the data packet to the open state table, And configuring the access rights corresponding to the source address and the source port to be frozen.

Optionally, as shown in FIG. 10, the node for access control may further include: a second configuration module 1001, configured to: when the first verification module determines that the user is a network administrator, The source address of the data packet and the access authority corresponding to the source port in the open state table are modified to be open. The third configuration module 1002 is configured to delete, when the verification module determines the user is not a network administrator, the record that includes the source address and the source port of the data packet in the open state table. Further, as shown in FIG. 11, the control module 604 may further include: an encryption method;

The establishing unit 6042 is configured to establish communication between the network node and the user by using an encryption manner obtained by the acquiring unit 6041.

The system provided by the embodiment controls the access of the traditional Internet user that initiates the access request, controls the access rights of the network node in the core network of the SILSN according to the result of the identity verification, protects the security of the core network, and implements the common user in the LIN. The purpose of the SILSN core network element node cannot be accessed. At the same time, the ISN port control is used to prevent attacks from CNMP from ordinary users in the LIN. The transmission security is improved by the encrypted transmission of the network management flow between the UE and the CNMP.

A person skilled in the art can understand that all or part of the steps carried by the method of the foregoing embodiment can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium. , including one or a combination of the steps of the method embodiments.

In addition, each functional unit in each embodiment of the present invention may be implemented in the form of hardware, or may be implemented in the form of a software functional module. The integrated modules, if implemented in the form of software functional modules and sold or used as separate products, may also be stored in a computer readable storage medium.

The above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like. The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Industrial applicability

The method and system of the present invention solves the method for the network management user located in the LIN to access the core network element of the SILSN, thereby ensuring the security of the core network. In an embodiment, it is also possible that the internal user in the LIN cannot access the SILSN core network element node. In an embodiment, the CNMP attack from the ordinary user in the LIN (through the port control in the ISN) can also be prevented; and the encrypted transmission of the network management flow between the UE1 and the CNMP can be implemented. In addition, all core network nodes only accept management packets from CNMP, which helps the security of core network element management.

Claims

Claim

A method of controlling user access to a network, comprising:

If the access authority corresponding to the source address and the source port is found, the node of the access control controls the communication of the user to the network node according to the authority.

2. The method according to claim 1, wherein

3. The method of claim 1 further comprising:

If yes, verify that the user is a network administrator;

If it is a network administrator, the user is allowed to communicate with the network node.

4. The method of claim 3, the method further comprising: the node for access control discarding the data packet in any of the following cases:

The node for access control finds the source address and the source port of the data packet in the recorded correspondence information, and the access rights corresponding to the source address and the source port are not open; The node for access control determines that the format of the data packet does not conform to a format of a predetermined network management request data packet;

5. The method of claim 1 further comprising:

If the user is a network administrator, if the user determines that the user is a network administrator, the node for access control is determined according to the configured network node information accessible by the network administrator. Whether the user has the right to access the network node; if there is permission to access the network node, the user is allowed to communicate with the network node, otherwise the data packet is discarded.

6. The method of claim 1 wherein

The step of the node for access control controlling the communication of the user to the network node according to the permission includes: allowing the user to communicate with the network node when the permission is open, otherwise , discard the packet.

7. The method of claim 4 or 5, further comprising:

The node for access control directly discards the data packet with the source address and the source port with the corresponding access rights as masked.

The method according to claim 3 or 5, wherein the step of verifying whether the user is a network administrator comprises:

9. The method according to claim 8, wherein

The network management request packet includes an administrator identifier.

The node for access control sends an administrator identity request to the identity location register, and the step of carrying the user identity of the user includes: the node for access control extracting the packet from the network management request packet Admin identifier, sent to the identity location register;

The administrator identity authentication response is a result of the identity location register authenticating the user identity based on the configured administrator identifier and the received administrator identifier.

10. The method of claim 5, further comprising:

11. The method of claim 10, further comprising:

12. The method of claim 10, further comprising:

If it is determined that the user is not a network administrator, the node for access control deletes the record in the open state table that includes the source address and the source port of the data packet.

13. The method according to claim 6, wherein the step of allowing the user to communicate with the network node comprises: The encryption method of the letter;

The method according to claim 1, wherein the node for access control is a combination of an interworking gateway and a core network management node, or the node for access control is an interworking gateway.

15. A node for access control in a network system, the node comprising:

a receiving module, configured to: receive a data packet of a network node in a user access identity and a location separation network in a traditional Internet;

16. The node of claim 15, the node further comprising:

a first determining module, configured to: when the source address and the source port of the data packet are not found in the open state table, determine whether the format of the data packet meets a predetermined network management request data packet. Is a; and

a first verification module, configured to: when the first determining module determines that the format of the data packet conforms to a format of a predetermined network management request data packet, verify whether the user is a network administrator;

The control module is further configured to: when the first verification module verifies that the user is a network administrator, allow the user to communicate with the network node.

17. The node of claim 15, the node further comprising:

a second verification module, configured to: if the second determining module determines that the format of the data packet conforms to a format of a predetermined network management request data packet, and verifies whether the user is a network administrator, when the verification determines that When the user is a network administrator, it is determined whether the user has the right to access the network node according to the configured network node information that the network administrator can access; the control module is further configured to: in the second verification module The user is allowed to communicate with the network node when the user is determined to have access to the network node.

18. The node according to claim 17, wherein

The control module is further configured to discard the data packet in any of the following cases:

The node according to claim 18, further comprising: a fourth configuration module, configured to: when the control module discards the total number of times of data packets having the same source address and source port exceeds a preset number of times When the value is wide, the source address and the source port of the data packet are added to the open state table, and the access rights corresponding to the source address and the source port are configured as masks; and the discarding module is set to: Access rights are blocked source and source ports The data packet is discarded directly.

The node according to claim 17, wherein the second verification module comprises: a sending unit, configured to: send an administrator identity request to the identity location register, and carry the user identity of the user;

21. The node of claim 16, the node further comprising:

22. The node of claim 21, the node further comprising:

The node according to claim 21, the node further comprising: a third configuration module, configured to: when the verification module determines that the user is not a network administrator, include the The source address of the packet and the record of the source port are deleted.

24. The node of claim 15 or 16, wherein the control module further comprises: a force. Secret mode

Establishing a unit, which is configured to: establish the network by using an encryption method obtained by the acquiring unit The communication of the node with the user.

The node according to claim 15, wherein the address and port of the destination network element to be subjected to access control are: an address and a port of one or more core network management node (CNMP) nodes configured, and/or Or, configure the identity and location of the network node's address and port in the network.

26. An identity and location separation network system, the system comprising a node for access control as claimed in any of claims 15-25.