CN101282232A - Remote equipment management method, equipment and system - Google Patents

Abstract

The embodiment of the invention relates to a method, equipment and a system for managing remote equipment in the technical field of communication. The method is applied to a system for communication connection of a management device and a network terminal device through a network access device, and comprises the following steps: the method comprises the steps that a management device receives a first access address of a network terminal device reported by the network terminal device; the management equipment acquires a second access address corresponding to a first access address of the network terminal equipment from the network access equipment, wherein the network access equipment forwards data according to the address corresponding relation between the first access address and the second access address; and the management equipment sends a management request to the network terminal equipment by using the obtained second access address. In the embodiment of the invention, the access address information is interacted through the management equipment, so that the risk that the network terminal equipment is easily attacked due to address theft can be reduced.

Description

A remote device management method, device and system

technical field

The present invention relates to the field of communication technology, in particular to a remote device management method, device and system.

Background technique

As a broadband access technology, Digital Subscriber Line (DSL) has been widely used. The corresponding DSL network structure is shown in Figure 1, mainly including: Auto-Configuration Server (ACS), and Customer Premises Equipment (CPE) as a broadband network terminal (such as a gateway) or a LAN device (such as IPTV) and so on.

The network structure based on DSL technology as shown in Figure 1 can support the realization of various broadband service applications, such as VoIP (Voice over IP), IPTV (IP TV), etc.; wherein, the CPE as an IP application terminal is for For IP-based devices formed by various broadband service applications or combinations of applications, the ACS is responsible for automatically configuring the CPE, so that the normal operation of the CPE can be guaranteed without the need for users to configure the CPE; the ACS can use Remote Procedure Call (Remote Procedure Call, RPC) method to realize the modification and setting of CPE parameters.

At present, in the DSL system, the CPE (such as the gateway) connected to the digital subscriber line access multiplexer (Digital Subscriber Line Access Multiplexer, DSLAM) as a broadband network terminal can directly complete the process of automatic configuration and management with the ACS. The CPE (such as IPTV) as a LAN device in the LAN can complete the process of automatic configuration and management through the gateway connected to it and the ACS.

Wherein, in the prior art, as shown in Figure 2, the flow chart of the prior art method, the CPE sends its own access address (such as ConnectionRequest URL) to the gateway through the DHCP protocol through the DHCP message; After accessing the address, generate the proxy access address (GatewayProxy ConnectionRequest URL) corresponding to the access address. The proxy access address is used to provide the address for the ACS to actively access the CPE from the public network (that is, the gateway receives the ACS from the public network. After sending the HTTP Get request corresponding to the proxy access address, it will be automatically forwarded to the connection request URL of the CPE); the gateway will send the generated proxy access address to the CPE; after receiving the proxy access address, the CPE will determine whether It is consistent with the one received before, if not, it will notify ACS through Inform, so that when ACS needs to actively communicate with CPE, it will use HTTP protocol to send HTTP GET request to the proxy access address corresponding to CPE. After the request reaches the gateway, The gateway automatically redirects the request to the connection request URL of the CPE. After the CPE receives the HTTP Get request forwarded by the gateway, after authentication and other processes, the CPE confirms that it wants to communicate with the ACS, then the CPE sends an HTTP "200 (OK)" or "204 (No Content)" status code to the ACS. The ACS sends a response message, and then the CPE establishes a CPE WAN Management Protocol (CPE WAN Management Protocol, CWMP) session with the ACS through the Inform RPC method. Among them, URL (Uniform Resource Locator) represents the Uniform Resource Locator. Among them, HTTP (Hypertext Transfer Protocol) means Hypertext Transfer Protocol.

However, in the above scheme, since the CPE and the gateway use the LAN internal protocol (such as DHCP) to exchange connection request URLs, these internal protocol messages are exchanged in plain text and are carried out in a broadcast manner, so it is easy to obtain the connection request of the CPE by monitoring means URL information, making the CPE vulnerable to attacks. In addition, in order to monitor the change of the public network address of the gateway, the CPE must obtain the URL of the gateway proxy connection request from the gateway through regular rotation training, which increases the burden on the CPE and the gateway.

Contents of the invention

An embodiment of the present invention provides a remote device management method. The management device communicates with the network terminal device through a network access device, including: the management device receives the first access address of the network terminal device reported by the network terminal device, And obtain a second access address corresponding to the first access address of the network terminal device from the network access device, wherein the network access device The data is forwarded according to the address correspondence relationship of the incoming address; the management device uses the obtained second access address to send a management request to the network terminal device.

An embodiment of the present invention also provides a management device, the management device is connected to a network terminal device via a network access device, wherein the management device includes:

a first obtaining unit, configured to obtain information including a first access address of the network terminal device from the network terminal device;

The second obtaining unit is configured to obtain, from the network access device, a second access address corresponding to the first access address of the network terminal device, wherein the network access device uses the first access address Forwarding data corresponding to the address corresponding to the second access address;

A management request unit, configured to initiate a management request to the network terminal device according to the second access address.

The embodiment of the present invention also provides a remote device management system, the system includes: the system includes: a management device, which communicates with a network terminal device through a network access device, wherein,

The management device is configured to obtain the first access address of the network terminal device from the network terminal device, and obtain the second access address corresponding to the first access address of the network terminal device from the network access device. The network access device forwards and/or redirects the received management request to the first access address by using the obtained second access address to send a management request to the network terminal device.

The embodiment of the present invention also provides a network access device, the network access device includes:

a correspondence storage unit, configured to store the address correspondence between the first access address of the network terminal device and the second access address for the management device to access the network terminal device;

a data forwarding unit, configured to forward data according to the address correspondence in the address correspondence storage unit;

An address providing unit, configured to provide the management device with a second access address corresponding to the first access address of the network terminal device.

It can be seen from the technical solutions provided by the above-mentioned embodiments of the present invention that the embodiments of the present invention mainly obtain the first access address of the network terminal device through the management device (automatic configuration server or service configuration server or operation support system), and obtain the first access address of the network terminal device from the network The access device obtains a second access address corresponding to the first access address, and uses the obtained second access address to initiate a management request to the network terminal device. Since the protocol used by the management device to exchange information with network terminals and network access devices is more secure than the protocol used inside the LAN (typically such as DHCP), the exchange of access address information through the management device can reduce address theft. The risk of causing network terminal devices to be vulnerable to attacks.

Description of drawings

FIG. 1 is a schematic diagram of a DSL network structure in the prior art;

Fig. 2 is a prior art method flow chart;

Fig. 3 is a method flowchart of an embodiment of the present invention;

Fig. 4 is a method flowchart of another embodiment of the present invention;

Fig. 5 is a system block diagram of an embodiment of the present invention.

Detailed ways

The embodiment of the present invention realizes the access, configuration, management and maintenance of the terminal equipment in the local area network by the management equipment (such as the automatic configuration server, the service configuration server or the operation support system OSS), which can reduce the address theft and make the network terminal equipment in the local area network Risk of vulnerability to attack.

The access methods in the embodiments of the present invention include but are not limited to one or more of the following combinations: Cable/Digital Subscriber Line (Cable/DSL) access, Passive Optical Network (PON) access (including various types of PON ), Internet Protocol (IP) access, fiber optic hybrid coaxial twisted pair access, wireless access (such as WAN, WiMax, WiFi), etc. Correspondingly, the network access device of the LAN in the embodiment of the present invention has address mapping (or conversion) functions, and may also have functions such as protocol conversion, including but not limited to: IP gateway, home gateway, PBX, wireless gateway, etc. Correspondingly, the management device in the embodiment of the present invention can have the functions of configuring, modifying, managing and maintaining the device parameters of the remote device, and can be an independent entity (such as an automatic configuration server, a service configuration server, etc.) or an operation support system Functional components in (Operations Support System, OSS); devices that can be managed include but are not limited to broadband network terminals (such as various gateways) or devices in a local area network (such as user premises equipment), and these devices can be terminal devices with fixed interfaces Can be a terminal device supporting a wireless protocol and/or having a wireless interface.

In the remote device management method provided by the embodiment of the present invention, the system to which the method is applied includes a management device coupled to a network terminal device via a network access device, wherein

The management device receives the first access address of the network terminal device reported by the network terminal device (such as the access address ConnectionRequest URL of the CPE); the management device obtains the first access address of the network terminal device from the network access device; The second access address corresponding to the address (such as the proxy access address GatewayProxy ConnectionRequest URL), wherein the network access device forwards data according to the address correspondence between the first access address and the second access address; The management device sends a management request to the network terminal device by using the obtained second access address.

Wherein, the network terminal device and the network access device exchange identities of both parties to establish an association relationship.

Wherein, the method further includes: the management device compares the identity of the network terminal device obtained from the network terminal device with the identity of the network terminal device obtained from the network access device, and determines that the The association relationship between the network terminal device and the network access device.

Wherein, the method further includes: if the network access device does not have an address correspondence of the network terminal device, establishing a corresponding address correspondence.

Wherein, the management device determines that the network access device has not established an address correspondence relationship for the network terminal device with respect to the first address, and then accesses the network according to the first access address of the network terminal device. The device configures the corresponding address correspondence.

Wherein, the method further includes: the management device configures corresponding address correspondences for the network access device according to the first access address of the network terminal device reported by the network terminal device.

Wherein, the management device uses the first access address of the network terminal device reported by the network terminal device to update the corresponding address correspondence in the network access device.

Wherein, the management device obtains the second address corresponding to the first address of the network terminal device according to the configuration of the network access device.

Wherein, the management device sends the first access address of the network terminal device reported by the network terminal device to the network access device; and receives the first access address of the network terminal device returned by the network access device. The second access address corresponding to the access address.

Wherein, the manner in which the management device obtains information from the network access device and the network terminal device includes: using a customer premises equipment wide area network management protocol and/or remote procedure call.

In the following, the technical solutions of the embodiments of the present invention will be further described in conjunction with examples.

In the solutions described in the following embodiments, the ConnectionRequest URL indicates the access address of the CPE, which is usually a private network address, and may also be a public network address. We assume that the IP address of the CPE is 192.168.0.2, the access address ConnectionRequest URL of the CPE is 192.168.0.2:1234/RemoteManagement, the private network side (or LAN side) address of the gateway connected to the CPE is 192.168.0.1, and the public network The IP address of the side (or WAN side) is 202.96.123.124.

Embodiment one

In this embodiment, an automatic configuration server (ACS) is used as an example to provide configuration management functions for CPEs and gateways. The technical solution of this embodiment includes: the ACS obtains the access address ConnectionRequest URL of the CPE; the ACS obtains the GatewayProxyConnectionRequest URL corresponding to the access address ConnectionRequest URL of the CPE of the network terminal device according to the configuration of the network access device; thus, When the ACS needs to actively communicate with the CPE, it uses the HTTP protocol to send an HTTP GET request to the proxy access address corresponding to the CPE. After the request reaches the gateway, the gateway automatically forwards or redirects the request to the connection request URL of the CPE. After the CPE receives the HTTP GET request of the ACS mapped by the gateway, the subsequent steps can use the general process to realize the communication with the ACS. 200 (OK)" or "204 (No Content)" status code to send a response message to the ACS, and then the CPE establishes a CWMP session with the ACS through the Inform RPC method.

Referring to FIG. 3 , it is a flow chart of the method in Embodiment 1 of the present invention.

Step 301: The CPE and the gateway establish the identities of the communication and interaction parties to realize the association.

Here, the communication connection between the CPE and the gateway is implemented through the DHCP protocol between the CPE and the gateway to realize association. The exchanged DHCP message contains the identifications of both parties, where the identifications may be the device ID, the product number of the device, and the like. Through this step, the gateway can obtain the identity of the CPE (such as the device ID of the CPE), and save the obtained identity of the CPE, wherein the gateway can add this information to the ManageableDevice table of the gateway data model so as to provide external device query, Manage maintenance. At the same time, the CPE can also obtain the identity of the gateway (such as the device ID of the gateway) through this step.

In addition, it is worth noting that if the gateway originally did not have the ConnectionRequest URL of the CPE's access address, the information about the ConnectionRequest URL of the CPE's access address saved on the gateway is empty at this time, because the CPE did not send this information in the DHCP message. to the gateway.

Wherein, step 301 is optional, because in subsequent steps, if the ACS does not need to determine the association relationship between the CPE and the gateway, it is not necessary to exchange the identity information of the two parties.

Step 302: CPE establishes a connection with the ACS, and the CPE reports the access address ConnectionRequest URL of the CPE to the ACS; in addition, the CPE can also report the identity of the CPE (such as the ID of the CPE) and the identity of the gateway (such as the device ID of the gateway) to the ACS ).

Here, since the ACS address can be preset by the operator or equipment provider on the CPE, or the CPE can obtain the ACS address through broadcasting, or can actively obtain the ACS address from the network, the CPE can initiate a connection to the ACS, Through this connection, the ACS can use the CPE WAN Management Protocol (CPE WAN Management Protocol, CWMP) protocol to obtain the access address ConnectionRequest URL information of the CPE. At the same time, the ACS can also obtain the CPE ID and gateway ID information through this connection. In a specific implementation, the ACS can also obtain the ConnectionRequest URL information in the data model on the CPE through TR-069 RPC.

Step 303: The ACS establishes a connection with the gateway, and obtains information associated with the CPE from the gateway.

Here, the ACS establishes a connection with the gateway according to the identity of the gateway reported by the CPE (such as the device ID of the gateway), and uses the CWMP protocol to obtain the associated CPE information stored in the ManageableDevice table in the gateway data model from the gateway, including CPE ID, CPEConnectionRequest URL information. Wherein, as described in step 301, the access address ConnectionRequest URL information of the CPE saved on the gateway is empty at this time, and the ConnectionRequest URL information obtained by the ACS is also empty.

Step 304: The ACS compares the identity of the CPE (such as the device ID of the CPE) obtained from the CPE and the gateway, and determines the relationship between the CPE and the gateway.

Step 305: ACS compares whether the access address ConnectionRequest URL of the CPE obtained from the CPE and the gateway is consistent, and if they are consistent, execute step 305.1, otherwise go to step 305.2.

Step 305.1: If the CPE access address ConnectionRequest URL obtained from the CPE and the gateway are consistent, then determine that the gateway has implemented address mapping for the CPE access address ConnectionRequest URL.

Here, according to the address mapping relationship, the ACS uses the CWMP protocol to find the proxy access address (or public network side or WAN side) corresponding to the ConnectionReques URL (IP address and port) saved on the gateway (such as the NAT table of the gateway) from the gateway. ) mapping address or mapping port, such as port 4321. Based on this, the ACS determines that the access address (ConnectionRequest URL) 192.168.0.2:1234/RemoteManagement of the CPE is mapped by the gateway to the proxy access address (GatewayProxy ConnectionRequest URL) 202.96.123.124:4321/RemoteManagement on the public network side or the WAN side.

Step 305.2: If the access address ConnectionRequest URL of the CPE obtained from the CPE is inconsistent with that obtained from the gateway, it is determined that port mapping is required, and there are two cases at this time:

1) If the CPE access address ConnectionRequest URL obtained from the gateway is empty, it means that the gateway has not implemented port mapping for the CPE access address ConnectionRequest URL, then the ACS can use the CWMP method according to the CPE access address ConnectionRequest URL The IP address and port establishes a port mapping for the CPE. Then, the ACS uses the ConnectionRequest URL obtained from the CPE to update the access address ConnectionRequest URL of the CPE saved on the gateway. For example, port 4321 of the gateway is mapped to port 1234 of the CPE, so that the access address (ConnectionRequest URL) of the CPE (ConnectionRequest URL) 192.168.0.2:1234/RemoteManagement is mapped by the gateway to the proxy access address (GatewayProxy ConnectionRequest URL) 202.96.123.124:4321/RemoteManagement.

2) If the access address ConnectionRequest URL of the CPE obtained from the gateway is not empty, it means that the gateway has previously done port mapping for the old ConnectionRequest URL of the CPE, but because the CPE has changed its own ConnectionRequest URL, a new one has been generated. ConnectionRequest URL, so ACS saves the IP address and port in the gateway according to the old ConnectionRequest URL of the CPE found from the gateway, such as finding the corresponding entry in the NAT table, and according to the new ConnectionRequest URL obtained from the CPE The IP address and port information of the entry are refreshed. Then, the ACS uses the new ConnectionRequest URL obtained from the CPE to update the old ConnectionRequestURL of the CPE saved on the gateway.

For example:

The new ConnectionRequest URL obtained from the CPE is: 192.168.0.2:1234/RemoteManagement

The old ConnectionRequest URL of the CPE obtained from the gateway is: 192.168.0.5:5678/RemoteManagement

Then ACS finds the corresponding entry in the NAT table on the gateway according to the IP address 192.168.0.5 and port 5678 of the old ConnectionRequest URL of the CPE obtained from the gateway, such as

*: 4321->192.168.0.5: 5678, (indicating that the packet sent to port 4321 on the WAN side of the gateway is mapped to port 5678 with IP address 192.168.0.5 on the LAN side)

ACS then updates the entries in the found NAT table according to the IP address 192.168.0.2 and port 1234 in the new ConnectionRequest URL obtained from the CPE, changing it to

*: 4321->192.168.0.2: 1234, (Identifies that the message sent to port 4321 on the WAN side of the gateway is mapped to port 1234 on the LAN side with an IP address of 192.168.0.2)

In this way, the access address (ConnectionRequest URL) 192.168.0.2:1234/RemoteManagement of the CPE is mapped by the gateway to the proxy access address (GatewayProxy ConnectionRequest URL) 202.96.123.124:4321/RemoteManagement on the public network side or the WAN side.

Step 306: When the ACS needs to actively communicate with the CPE, it uses the HTTP protocol to send an HTTP GET request to the proxy access address GatewayProxy ConnectionRequest URL.

The ACS determines the proxy access address GatewayProxy ConnectionRequest URL corresponding to the access address ConnectionRequest URL of the CPE through the above steps. When the ACS needs to actively communicate with the CPE, the ACS uses the HTTP protocol to send an HTTP GET request to the proxy access address GatewayProxy ConnectionRequestURL. entry), and automatically map the request to the ConnectionRequest URL of the CPE, that is, the gateway automatically forwards or redirects the request to the ConnectionRequest URL of the CPE. After the CPE receives the HTTP GET request from the ACS, the following steps can follow the current method of TR-069 to realize the communication with the ACS. For example, after authentication and other processes, if the CPE determines to communicate with the ACS, the CPE will send a response message to the ACS in the form of an HTTP "200 (OK)" or "204 (No Content)" status code, and then the CPE will pass the Inform The RPC method establishes a CWMP session with the ACS.

Wherein, the relationship between the CPE and the gateway in the above solution can be described by using the data model (or called ManageableDevice table) shown in Table 1. Of course, the description of the relationship between the CPE and the gateway is not limited to the method shown in Table 1, as long as it includes the corresponding relationship between the public network side address and the CPE address, it can use other formats or increase/decrease options.

Table 1

Internet GatewayDevice ManagementServer ManageableDevice object - Save the information of the CPE associated with the gateway - 1.2 Manufacturer UI A string of length 6 bytes - Unique identifier for the CPE - 1.2 Serial number A string of length 64 bytes - Product serial number of CPE - 1.2 Product Class A string of length 64 bytes - CPE device type - 1.2 ConnectionRequestURL A string of length 256 bytes CPE's ConnectionRequest URL

Embodiment two

In this embodiment, an automatic configuration server (ACS) is used as an example to provide configuration management functions for CPEs and gateways. The technical solution of this embodiment includes: the ACS obtains the address ConnectionRequest URL of the CPE, and provides the address ConnectionRequest URL of the CPE to the gateway, and the gateway is responsible for port mapping or URL redirection of the address ConnectionRequest URL of the CPE. After going to the CPE address ConnectionRequest URL provided by the ACS, if no address correspondence is established for the CPE, generate the proxy access address GatewayProxy ConnectionRequest URL corresponding to the ConnectionRequest URL; and feed back the proxy access address GatewayProxy ConnectionRequest URL to the ACS.

Referring to FIG. 4 , it is a flow chart of the method in Embodiment 2 of the present invention.

Steps 401 to 404 are basically the same as steps 301 to 304 in Embodiment 1, and will not be repeated here. The difference between this embodiment and the first embodiment will be described in detail below.

Step 405: After the ACS establishes the association relationship between the CPE and the gateway, it will obtain the ConnectionRequest URL and the identity of the CPE (such as the device ID of the CPE) from the CPE and provide it to the gateway.

Here, the ACS uses the CWMP protocol to send the ConnectionRequest URL obtained from the CPE and the identity of the CPE (such as the device ID of the CPE) to the gateway.

Step 406: The gateway determines the mapping relationship or corresponding relationship between the address ConnectionRequest URL of the CPE and the proxy access address GatewayProxy ConnectionRequest URL of the public network side after receiving the identity of the CPE (such as the device ID of the CPE) and the ConnectionRequest URL sent by the ACS.

Here, after the gateway receives the identity of the CPE (such as the device ID of the CPE) and the ConnectionRequest URL sent by the ACS, it searches for the corresponding entry according to the identity of the CPE (such as the device ID of the CPE), including the following two situations:

A) If the identity of the CPE is not found to establish the mapping relationship or corresponding relationship between the device and the gateway, the gateway generates the corresponding proxy access address GatewayProxy ConnectionRequest URL for the address ConnectionRequest URL of the CPE, and uses the identity of the CPE, the access address of the CPE The address ConnectionRequest URL and the corresponding proxy access address GatewayProxyConnectionRequest URL are stored in the table, and the identifier (such as the device ID of the CPE) indicates that the gateway has not yet.

B) If an entry corresponding to the identity of the CPE (such as the device ID of the CPE) is found, there are the following two possibilities:

B-1) If the ConnectionRequest URL in the entry is different from the ConnectionRequest URL received by the gateway, it indicates that the ConnectionRequestURL of the CPE has changed, and the gateway updates the old one in the entry with the received ConnectionRequest URL information CPE address ConnectionRequest URL information.

B-2) If the access address ConnectionRequest URL in the entry is the same as the ConnectionRequest URL received by the gateway, it indicates that the access address ConnectionRequest URL of the CPE has not changed, and the gateway does not need to refresh the entry address ConnectionRequest URL information of the CPE.

Step 407: After determining the mapping relationship or corresponding relationship between the address of the CPE and the address on the public network side, the gateway feeds back the address on the public network side to the ACS.

Here, the gateway can use the CWMP protocol to send the public network side address GatewayProxy ConnectionRequest URL corresponding to the CPE address ConnectionRequest URL to the ACS.

The ACS obtains the proxy access address GatewayProxy ConnectionRequestURL through the above steps.

Step 408: When the ACS needs to actively communicate with the CPE, it uses the HTTP protocol to send an HTTP GET request to the proxy access address GatewayProxy ConnectionRequest URL.

After the request arrives at the gateway, according to the address mapping relationship (such as the entry in the NAT table), the gateway automatically forwards or redirects the request to the ConnectionRequest URL of the CPE. After the CPE receives the HTTP GET request of the ACS mapped by the gateway, the subsequent steps can use the general process to realize the communication with the ACS. 200 (OK)" or "204 (No Content)" status code to send a response message to the ACS, and then the CPE establishes a CWMP session with the ACS through the Inform RPC method.

Table 2

CPE ID GatewayProxyConnectionRequest URL ConnectionRequest URL CPE1 ID 202.96.123.124:4321 192.168.0.2:1234/RemoteManagement CPE2 ID 202.96.123.124:5678 192.168.0.6:6543/RemoteManagementDre1 CPE3 ID 202.96.123.124:8543 192.168.0.8:2645/RemoteManagementDre2

table 3

Internet Gateway DeviceManagement ServerManageable Device object - Save the information of the CPE associated with the gateway - 1.2 Manufacturer OUI A string of length 6 bytes - The unique identifier of the CPE - 1.2 Serial Number A string of length 64 bytes - Product serial number of CPE - 1.2 Product Class A string of length 64 bytes - CPE device type - 1.2 ConnectionRequest URL A string of length 256 bytes CPE's ConnectionRequestURL GatewayProxyConnectionRequestURL A string of length 256 bytes CPE's GatewayProxyConnection RequestU RL

In this embodiment, the corresponding relationship between the access address ConnectionRequest URL of the CPE on the gateway and the proxy access address GatewayProxy ConnectionRequest URL generated by the gateway mapping can be referred to in Table 2. According to this corresponding relationship, the gateway maps or redirects the message sent to the proxy access address GatewayProxy ConnectionRequest URL received from the public network side (or the wide area network WAN side) to the corresponding ConnectionRequest URL. In addition, in Embodiment 1, the corresponding relationship between the access address ConnectionRequest URL of the CPE on the gateway and the proxy access address GatewayProxy ConnectionRequest URL generated by gateway mapping can also refer to Table 2.

In this embodiment, the access address of the network terminal and the corresponding proxy access address can be added to the data model of the gateway so as to facilitate the access query, management and maintenance of the management device, see the gateway data model shown in Table 3 ( Or called ManageableDevice table) to describe.

Refer to the system block diagram of the embodiment of the present invention shown in FIG. 5 .

The embodiment of the present invention also provides a management device that communicates with a network terminal device through a network access device, wherein the management device includes:

A first obtaining unit, configured to obtain information including a first access address of the network terminal device from the network terminal device, wherein the network access device uses the first access address and the second The corresponding relationship of the access address forwards the data;

a second obtaining unit, configured to obtain, from the network access device, a second access address corresponding to the first access address of the network terminal device;

A management request unit, configured to initiate a management request to the network terminal device according to the second access address.

Optionally, the management device also includes:

An address configuration unit, configured to configure corresponding address correspondences for the network access device according to the first access address of the network terminal device obtained by the first obtaining unit;

The address obtaining unit is configured to obtain the second access address corresponding to the first access address of the network terminal device according to the configuration result of the configuration unit.

Optionally, the address setting unit includes:

An address updating unit, configured to update the address correspondence of the network access device.

Optionally, the second acquisition unit includes:

a sending module, configured to send the first access address of the network terminal device obtained by the first obtaining unit to the network access device;

The receiving module is configured to receive the second access address corresponding to the first access address of the network terminal device returned by the network access device.

Optionally, the management device also includes:

The associating unit is configured to compare the identities of the network terminal equipment obtained from the network terminal equipment and the network access equipment respectively, and determine the association relationship between the network terminal equipment and the network access equipment.

An embodiment of the present invention also provides a remote device management system, the remote management system includes: a management device coupled to a network terminal device via a network access device, wherein,

The management device is configured to obtain the first access address of the network terminal device from the network terminal device, and obtain the second access address corresponding to the first access address of the network terminal device from the network access device. address, using the second access address to send a management request to the network terminal device;

The network access device is configured to forward and/or redirect the received management request to the network terminal device at the first access address.

The embodiment of the present invention also provides a network access device, the network access device is respectively coupled to a network terminal device and a management device, wherein

a correspondence storage unit, configured to store the address correspondence between the first access address of the network terminal device and the second access address for the management device to access the network terminal device;

a data forwarding unit, configured to forward data according to the address correspondence in the correspondence storage unit;

An address providing unit, configured to provide the management device with the second access address corresponding to the first access address of the network terminal device.

Wherein, the management device mentioned in the above embodiment includes but not limited to: automatic configuration server, service configuration server, operation support system (OSS) and so on.

Wherein, the first access address mentioned above may represent the access address of the network terminal equipment, such as the access address ConnectionRequest URL of the CPE, and the second access address may represent the connection address ConnectionRequest URL of the network access device and the CPE Corresponding proxy access address GatewayProxy ConnectionRequest URL.

It can be seen from the above-mentioned technical solutions provided by the embodiments of the present invention that exchanging the access address information of the network terminal device and the access address information of the network access device through the management device can reduce address theft and make the network terminal device in the local area network Risk of vulnerability to attack. In addition, adopting the technical solutions provided by the embodiments of the present invention does not require round training of network access devices (such as gateways), and can effectively reduce the burden of network terminal equipment (CPE) and network access devices (such as gateways).

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (15)

1. A remote device management method, characterized in that the method is applied to a system in which the management device communicates with the network terminal device through the network access device, the method comprising: The management device receives the first access address of the network terminal device reported by the network terminal device; The management device obtains from the network access device a second access address corresponding to the first access address of the network terminal device, wherein the network access device obtains the second access address corresponding to the first access address and the second access address The address correspondence of the access address forwards the data; The management device sends a management request to the network terminal device by using the obtained second access address. 2. method according to claim 1, is characterized in that, described method also comprises: The network terminal device and the network access device exchange identities of both parties to establish an association relationship. 3. method according to claim 2, is characterized in that, described method also comprises: The management device compares the identity of the network terminal device obtained from the network terminal device with the identity of the network terminal device obtained from the network access device, and determines that the network terminal device and the network access device Enter the association relationship of the device. 4. method according to claim 1, is characterized in that, described method also comprises: The management device performs corresponding address correspondence configuration on the network access device according to the first access address of the network terminal device. 5. The method according to any one of claims 1 to 4, wherein the management device obtains the second access address corresponding to the first access address of the network terminal device according to the configuration result. 6. The method according to claim 1, wherein the management device uses the first access address of the network terminal device reported by the network terminal device to update the corresponding address in the network access device Correspondence. 7. The method according to any one of claims 1 to 4, wherein the management device obtains the second access address corresponding to the first access address of the network terminal device from the network access device The steps specifically include: The management device obtains the second address corresponding to the first address of the network terminal device from the network access device. 8. The method according to any one of claims 1 to 4, wherein the management device obtains the second access address corresponding to the first access address of the network terminal device from the network access device The steps specifically include: The management device sends the first access address of the network terminal device reported by the network terminal device to the network access device; The management device receives the second access address corresponding to the first access address of the network terminal device returned by the network access device. 9. A management device, which is connected to a network terminal device through a network access device, is characterized in that the management device includes: a first obtaining unit, configured to obtain information including a first access address of the network terminal device from the network terminal device; The second obtaining unit is configured to obtain, from the network access device, a second access address corresponding to the first access address of the network terminal device, wherein the network access device uses the first access address and The corresponding relationship of the second access address forwards data; A management request unit, configured to initiate a management request to the network terminal device according to the second access address. 10. The management device according to claim 9, wherein the second acquiring unit comprises: A configuration unit, configured to configure corresponding address correspondences for the network access device according to the first access address of the network terminal device obtained by the first obtaining unit; The address obtaining unit is configured to obtain the second access address corresponding to the first access address of the network terminal device according to the configuration result of the configuration unit. 11. The management device according to claim 10, wherein the management device further comprises: An address updating unit, configured to update the address correspondence of the network access device. 12. The management device according to claim 9, wherein the second acquiring unit comprises: a sending module, configured to send the first access address of the network terminal device obtained by the first obtaining unit to the network access device; The receiving module is configured to receive the second access address corresponding to the first access address of the network terminal device returned by the network access device. 13. The management device according to any of claims 9 to 11, 12, wherein the management device further comprises: The associating unit is configured to compare the identities of the network terminal equipment obtained from the network terminal equipment and the network access equipment respectively, and determine the association relationship between the network terminal equipment and the network access equipment. 14. A remote device management system, said system comprising: a management device, connected to a network terminal device through a network access device, characterized in that, The management device is configured to obtain the first access address of the network terminal device from the network terminal device, and obtain the second access address corresponding to the first access address of the network terminal device from the network access device. Incoming address, using the second access address to send a management request to the network terminal device; The network access device is configured to forward and/or redirect the received management request to the first access address. 15. A network access device, characterized in that, the network access device comprises: a correspondence storage unit, configured to store the address correspondence between the first access address of the network terminal device and the second access address for the management device to access the network terminal device; a data forwarding unit, configured to forward data according to the address correspondence in the relational storage unit; An address providing unit, configured to provide the management device with the second access address corresponding to the first access address of the network terminal device.

Images