CN102158567A - Equipment configuration method, policy server and network address translation (NAT) equipment - Google Patents

Abstract

The invention provides a device configuration method, a policy server and a network address conversion device. The method includes: after the policy server receives the login request from the user, it performs AAA authentication on the user to verify the user's authority level; when the authority level is to allow login, the user is allowed to log in to the policy server; After success, when the policy server receives the configuration request from the user and the permission level is to allow configuration, it will send the ALG application layer gateway software package carried in the configuration request to the CGN operator-level network address translation device to enable the user-defined ALG function on the CGN device. The invention enables the user to operate the behavior characteristics of the NAT device according to the user's needs, and enables the NAT device to perform different operations and processing on the user's message according to the strategy configured by the user, thereby improving the flexibility of control.

Description

Device configuration method, policy server and network address translation device

technical field

The invention relates to a device configuration method, a policy server and a network address conversion device.

Background technique

A Network Address Translation (NAT) device is a device used to rewrite the source IP address or/and destination IP address when an IP data packet passes through a router or firewall. Users allocate "private network" IP addresses and hand over "public network" IP addresses to NAT, and users uniformly access the Internet through the IP addresses translated by NAT, thus greatly saving public network IP addresses. Carrier Grade NAT (CGN) device is a NAT device deployed in the carrier network, which provides address translation function for multiple users.

In the prior art, the CGN equipment is deployed in the operator's network and is managed by the operator, and the supported Application Layer Gateway (Application Layer Gateway, ALG) is all developed by the equipment manufacturer. The administrator enables or disables the ALG supported on the CGN device through manual configuration. Therefore, all users can use the same ALG policy and type. In addition, the mapping between the port and the address in the routing address is also manually configured on the CGN device by the administrator after the user applies to the operator.

It can be seen that in the prior art, all users usually can only use the built-in ALG of the CGN device, and the types and quantities of applications supported by the built-in ALG are limited. If the user wants to develop a new application by himself, then this new application will not be able to be used because it is restricted by the CGN equipment. Moreover, if the user wants to provide a service to the public network, such as a web service, he also needs to ask the operator to configure port-to-address mapping for himself.

Therefore, based on the existing CGN equipment, the user cannot directly control the behavior of the NAT equipment according to his needs, thus lacking flexibility.

Contents of the invention

The invention provides a device configuration method, a policy server and a network address translation device, which are used to enable users to flexibly control the behavior characteristics of the NAT devices they want to use.

One aspect of the present invention provides a device configuration method, which includes:

After receiving the login request from the user, the policy server performs AAA authentication on the user to verify the authority level of the user;

When the permission level is to allow login, enable the user to log in to the policy server;

After the login is successful, when the policy server receives the configuration request from the user and the permission level is to allow configuration, it sends the ALG application layer gateway software package carried in the configuration request to the CGN operator level on the network address translation device, so as to enable the user-defined ALG function on the CGN device.

Another aspect of the present invention provides another device configuration method, which includes:

Receive ALG packages from the policy server;

Install the ALG package to enable user-defined ALG functions.

Another aspect of the present invention provides a policy server, including:

The user interaction module is used to receive login requests and configuration requests from users;

The authority authentication module is used to perform AAA authentication on the user according to the login request received by the user interaction module to verify the user's authority level, and when the authority level is to allow login, the user is logged in to said policy server;

A strategy delivery module, configured to download the ALG software package carried in the configuration request when the user interaction module receives a configuration request from the user and the permission level verified by the permission authentication module is to allow configuration. sent to the CGN device, so as to enable the user-defined ALG function on the CGN device.

Another aspect of the present invention provides a network address translation device, which includes:

A receiving module, configured to receive the ALG software package from the policy server;

The configuration module is used to install the ALG software package received by the receiving module, so as to enable user-defined ALG functions.

The invention enables the user to operate the behavior characteristics of the NAT device according to the user's requirement, and enables the NAT device to perform different operations and processing on the user's message according to the strategy configured by the user, thereby improving the flexibility of control.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a flow chart of Embodiment 1 of the device configuration method of the present invention;

FIG. 2 is a flow chart of Embodiment 2 of the device configuration method of the present invention;

FIG. 3 is a schematic structural diagram of an embodiment of the communication system of the present invention;

FIG. 4 is a schematic structural diagram of the policy server 10 shown in FIG. 3;

FIG. 5 is a schematic structural diagram of the authority authentication module 12 shown in FIG. 4;

FIG. 6 is a schematic structural diagram of the CGN device 30 shown in FIG. 3 .

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Fig. 1 is a flowchart of Embodiment 1 of the device configuration method of the present invention. As shown in the figure, the method includes:

Step 110, after receiving the login request from the user, the policy server performs AAA authentication on the user to verify the user's authority level.

Specifically, the policy server may receive a login request from a user based on a Web protocol or a Secure Shell Protocol (Secure Shell Protocol, SSH for short) or other existing security protocols. Thereafter, a user authority verification request may be sent to the authentication system first, and then the authentication system searches for the authority level of the user according to the user authority verification request and replies to the policy server. Wherein, the authentication system is an authentication, authorization, and accounting (Authentication, Authorization, Accounting, AAA for short) system.

Step 120, when the permission level is to allow login, enable the user to log in to the policy server.

Step 130, after the login is successful, when the policy server receives the configuration request from the user and the permission level is to allow configuration, it sends the ALG application layer gateway software package carried in the configuration request to On the CGN carrier-class network address translation device, to enable the user-defined ALG function on the CGN device.

Thereafter, the CGN device installs the received ALG software package on the CGN device, so as to control the ALG operation. The CGN device in the embodiment of the present invention is provided with a software development kit (Software Development Kit, referred to as: SDK) function, which can receive and install the ALG software package configured by the user.

The method described in this embodiment enables the user to operate the behavior characteristics of the NAT device according to his own needs, and enables the NAT device to perform different operations and processing on the user's message according to the policy configured by the user, thereby improving the flexibility of control.

FIG. 2 is a flow chart of Embodiment 2 of the device configuration method of the present invention, as shown in the figure, including the following steps:

Step 210, receiving the ALG software package from the policy server.

Wherein, the ALG software package is carried in the configuration request sent to the policy server by the user after successful login.

Step 220, install the ALG software package to enable user-defined ALG functions.

In addition, optionally, the following steps may be further included:

Step 230, setting the program development interface, so that the user can develop the ALG software package based on the program development interface, and install it through the program development interface.

The method described in this embodiment enables the user to operate the behavior characteristics of the NAT device according to his own needs, and enables the NAT device to perform different operations on the user's message according to the policy configured by the user, thereby improving the flexibility of control, and Enables customization of the Network Address Translation device.

FIG. 3 is a schematic structural diagram of an embodiment of the communication system of the present invention. In order to implement the above method, as shown in the figure, the system includes: a policy server 10, an authentication system 20, and a CGN device 30. For example, the server can be remotely accessed through broadband ( Broadband Remote Access Server, referred to as: BRAS) communicates with users in the private network. Wherein, as shown in Figure 4, the policy server 10 includes: a user interaction module 11, an authority authentication module 12 and a policy delivery module 13, and its working principle is as follows:

After the user interaction module 11 of the policy server 10 receives the login request from the user, the authority authentication module 12 performs AAA authentication on the user according to the login request received by the user interaction module 11 to verify the user's authority level . Specifically, as shown in FIG. 5 , the authority authentication module 12 first sends a user authority verification request to the authentication system 20 through the sending unit 1201; Then, the authority authentication module 12 receives the authority level of the user replied by the authentication system 20 through the receiving unit 1202 . When the authority level is to allow login, the user is enabled to log in to the policy server 10 .

After the login is successful, when the user interaction module 11 receives a configuration request from the user and the permission level verified by the permission authentication module 12 is to allow configuration, the policy issuing module 13 will send the configuration request carried in the configuration request The ALG software package is delivered to the CGN device 30 .

Thereafter, as shown in Figure 6, the CGN device 30 receives the ALG software package from the policy server 10 through the receiving module 31; then the configuration module 32 installs the ALG software package received by the receiving module 31 to enable user-defined ALG function.

In addition, the CGN device 30 may be further provided with a program development interface 33 for providing a program development interface, so that users can develop ALG software packages based on the program development interface, and install them through the program development interface, Therefore, the customization performance of the CGN device 30 is improved.

The system described in this embodiment enables the user to operate the behavior characteristics of the NAT device according to his own needs, and enables the NAT device to perform different operations and processing on the user's message according to the policy configured by the user, thereby improving the flexibility of control.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (9)

1. A device configuration method, characterized in that, comprising: After receiving the login request from the user, the policy server performs AAA authentication on the user to verify the authority level of the user; When the permission level is to allow login, enable the user to log in to the policy server; After the login is successful, when the policy server receives the configuration request from the user and the permission level is to allow configuration, it sends the ALG application layer gateway software package carried in the configuration request to the CGN operator level on the network address translation device, so as to enable the user-defined ALG function on the CGN device. 2. The method according to claim 1, wherein the verification of the user's authority level comprises: Send a user permission verification request to the authentication system; The authentication system looks up the user's authority level according to the user authority verification request and replies to the policy server. 3. The method according to claim 1, wherein the policy server receiving the login request from the user comprises: the policy server receiving the login request from the user based on the Web protocol or the SSH secure shell protocol. 4. A device configuration method, characterized in that, comprising: Receive ALG packages from the policy server; Install the ALG package to enable user-defined ALG functions. 5. The method according to claim 4, characterized in that, the method also includes setting a program development interface, so that the user can develop the ALG software package based on the program development interface, and through the program development interface for installation. 6. A policy server, characterized in that, comprising: The user interaction module is used to receive login requests and configuration requests from users; The authority authentication module is used to perform AAA authentication on the user according to the login request received by the user interaction module to verify the user's authority level, and when the authority level is to allow login, the user is logged in to said policy server; A strategy delivery module, configured to download the ALG software package carried in the configuration request when the user interaction module receives a configuration request from the user and the permission level verified by the permission authentication module is to allow configuration. sent to the CGN device, so as to enable the user-defined ALG function on the CGN device. 7. The policy server according to claim 6, wherein the authority authentication module comprises: a sending unit, configured to send a user authority verification request to the authentication system; A receiving unit, configured to receive the authority level of the user replied by the authentication system. 8. A network address translation device, characterized in that it comprises: A receiving module, configured to receive the ALG software package from the policy server; The configuration module is used to install the ALG software package received by the receiving module, so as to enable user-defined ALG functions. 9. The network address translation device according to claim 8, wherein the network address translation device further comprises: a program development interface for providing a program development interface, so that users can develop programs based on the program development interface ALG software package and install it through the program development interface.

Images