WO2013075598A1

WO2013075598A1 - Method, network device and system for user access control

Info

Publication number: WO2013075598A1
Application number: PCT/CN2012/084636
Authority: WO
Inventors: 黄勇; 牛乐宏; 李长泰
Original assignee: 华为技术有限公司
Priority date: 2011-11-25
Filing date: 2012-11-15
Publication date: 2013-05-30
Also published as: CN103139023A

Abstract

Disclosed are a method, network device and system for user access control, which relate to the technical field of network communications. By determining an access gateway device for a user group to be accessed from at least two gateways, and sending to the determined access gateway device activation information which comprises a user group identifier of the user group to be accessed, the access gateway device provides on-line access service for the user group identified by the user group identifier, and can dynamically adjusts a user to access different gateway devices to be on-line, which can solve the problems of uneven online distribution of users and unbalanced BNG load. The embodiments of the present invention are mainly applied to the control process of user access gateways.

Description

Method, network device and system for user access control The application is submitted to the Chinese Patent Office on November 25, 2011, the application number is CN 201110381826.3, and the invention name is "user access control method, network device and system" Priority of the Chinese Patent Application, the entire contents of which is incorporated herein by reference. The present invention relates to the field of network communication technologies, and in particular, to a method, network device, and system for user access control. A broadband network gateway (BNG) device is a gateway device for broadband home users and small enterprises to access an Internet network. The BNG has the functions of authenticating and authenticating the access network of the user, allocating or assisting in allocating the IP address used by the user for Internet access, controlling the access bandwidth of the user, and performing charging for the user to access the Internet.

Users' Internet traffic passes through G devices. As the amount of Internet content increases, Internet traffic continues to grow, and BNG devices need to be continuously expanded to accommodate them. BNG expansion has resulted in more BNG equipment being placed at one site.

At present, in order to ensure that the user can enter the network normally, the user's information is configured on the BNG through network planning, and different BNGs in the same site independently process the online access services of different users. This configuration mode is static. If the user goes online unevenly, a large number of users will go online through the same BNG, which will cause some BNG load to be high and some BNG load to be low, resulting in load imbalance.

SUMMARY OF THE INVENTION Embodiments of the present invention provide a method, a network device, and a system for user access control, which can dynamically adjust and control user access to different gateway devices for online connection, which can solve the problem that the user is not online and the load of the gateway device is unbalanced.

In order to achieve the above object, embodiments of the present invention use the following technical solutions: A method for user access control, comprising:

Determining, by the at least two gateway devices, an access gateway device for the user group to be accessed; sending an activation message to the access gateway device, where the activation message includes the user group identifier of the user group to be accessed And providing the access gateway device with an online access service for the user identified by the user group identifier.

A network device for user access control, including:

a determining unit, configured to determine, from the at least two gateway devices, an access gateway device for the group of users to be accessed;

a first sending unit, configured to send an activation message to the access gateway device that is determined by the determining unit, where the activation message includes a user group identifier of the user group to be accessed, so that the access gateway The device provides an online access service for the user identified by the user group identifier.

A system for user access control, comprising a network device controlled by a user and at least two gateway devices, wherein:

The gateway device is configured to receive an activation message sent by the aggregation device, and provide an online access service for the user identified by the user group identifier.

The user access control method, the network device, and the system provided by the embodiment of the present invention determine an access gateway device for the user group to be accessed from at least two gateway devices, and send an activation to the access gateway device. The message is such that the access gateway device provides an online access service for the user identified by the user group identifier, so that the user can access any gateway device to go online, thereby avoiding a large number of users in the same gateway device. The situation of the load being unbalanced on the line is made, so that the user can get a better online service.

BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments or the description of the prior art will be briefly described below, and obviously, in the following description The drawings are only some of the embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work. 1 is a flowchart of a method for user access control according to an embodiment of the present invention; FIG. 2 is a flowchart of another method for user access control according to an embodiment of the present invention; Another flowchart of fault handling in a method of user access control;

4 is a flowchart of user data backup in another method for user access control according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of information exchange of user access control according to an embodiment of the present invention; FIG. 6 is a schematic diagram of information exchange of another user access control according to an embodiment of the present invention; FIG. 8 is a schematic diagram of information exchange of another user access control according to an embodiment of the present invention; FIG. 9 is a network for user access control according to an embodiment of the present invention; FIG. 10 is a block diagram showing the composition of another network device for user access control according to an embodiment of the present invention;

FIG. 11 is a block diagram of another network device for user access control according to an embodiment of the present invention;

FIG. 12 is a block diagram of another network device for user access control according to an embodiment of the present disclosure;

FIG. 13 is a structural block diagram of a system for user access control according to an embodiment of the present invention.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. example. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiment of the invention provides a method for user access control. As shown in FIG. 1, the method includes:

101. The aggregation device determines, from the at least two gateway devices, an access gateway for the user group to be accessed. Equipment.

The aggregation device is configured to determine the access gateway device for the user group to be accessed from the at least two gateway devices by using the following two methods, including:

The first method: the aggregation device acquires a static gateway allocation policy, and determines a corresponding access gateway device from the at least two gateway devices for the user group to be accessed according to the static gateway allocation policy.

The second method is: acquiring load information of the at least two gateway devices, and selecting, according to the load information, a gateway device with the smallest load from the at least two gateway devices as the user group to be accessed The access gateway device.

The static gateway allocation policy may be a policy preset in the networking, including a gateway allocation mode, where the gateway allocation mode is used to indicate a correspondence between a user group identifier of the user group to be accessed and a gateway device identifier. The specific static gateway allocation policy can be set according to the networking situation, which is not described in detail in this embodiment of the present invention. The uplink or downlink bandwidth of the device, the traffic usage ratio of the gateway device port, and the CPU usage of the gateway device are not limited in this embodiment of the present invention.

The implementation manner of acquiring the load information of the at least two gateway devices may be directly obtained by the aggregation device, including:

The aggregation device receives the load information periodically sent by the at least two gateway devices; or the aggregation device periodically queries the at least two gateway devices, and acquires load information of the at least two gateway devices.

In addition, the implementation manner of obtaining the load information of the at least two gateway devices may also be obtained by the aggregation device through other devices that are used for real-time monitoring of the load information of the gateway device, which is not described in detail in this embodiment of the present invention.

It should be noted that the first method and the second method may be used when a part of the at least two gateway devices has been accessed, and the foregoing first method may also be in the at least two The first method and the second method are used in the case where the user equipment is not connected to the user equipment. The embodiment of the present invention does not limit this. The aggregation device sends an activation message to the access gateway device, where the activation message includes the user group identifier of the user group to be accessed, so that the access gateway device is the user group identifier. The identified users provide online access services.

The user group identifier may be a service virtual local area network sVlan (Service Vi r tua l Loca l Area Network) identifier. The user group identifier used in the embodiment of the present invention is not limited to sVlan, and may also be other information that has the function of identifying the user group, such as PWE3 (Pseudo-Wi re-Imprint Edge to Edge). Pseudowire technology) logo, PVC (Permanent Vi r tua l Connect ion, ATM technology) logo, etc. This embodiment of the present invention does not limit this.

The online access service may include, but is not limited to, user access authentication and authentication, user IP address allocation, and the like.

The user access control method provided by the embodiment of the present invention determines an access gateway device for a user group to be accessed from at least two gateway devices, and sends an activation message to the access gateway device, so as to enable The access gateway device provides an online access service for the user identified by the user group identifier, so that the user can access any gateway device to go online, thereby preventing a large number of users from going online on the same gateway device. In the case of load imbalance, users can get better online services.

Another method for user-controlled access is provided in the embodiment of the present invention. As shown in FIG. 2, the method includes:

201. The aggregation device determines, from the at least two gateway devices, an access gateway device for the user group to be accessed.

The description of the step 201 is the same as that described in the step 101, and details are not described herein.

The aggregation device sends an activation message to the access gateway device, where the activation message includes the user group identifier of the user group to be accessed, so that the access gateway device is the user group identifier. The identified users provide online access services.

The description of the step 202 is the same as that described in the step 102, and details are not described herein. 203. Obtain load information of the at least two gateway devices.

The description of the implementation of the load information of the at least two gateway devices is the same as that described in the step 101, and details are not described herein.

The description of the load information is the same as that described in the step 102, and is not described in detail in the embodiment of the present invention.

204. Determine, according to the load information, whether the at least two gateway devices have a gateway device whose load exceeds a corresponding load threshold.

The load threshold may be set to different thresholds according to different load information. For example, the load threshold may be set to an upper limit of the number of users on the gateway without affecting the user experience, and the present invention. The embodiment does not limit this.

205. When a load of the first gateway device of the at least two gateway devices exceeds a corresponding load threshold, select a load from a gateway device in which the load does not exceed a corresponding load threshold. The smallest gateway device acts as the second gateway device.

206. Switch from one or more user groups that are accessed by the first gateway device to access from the second gateway device, so that the load of the first gateway device does not exceed its corresponding load threshold.

The switching from the one or more user groups that are accessed by the first gateway device to the accessing from the second gateway device may be implemented in the following manner, including:

Sending a deactivation message to the first gateway device, where the deactivation message includes a user group identifier of the part of the user group, so that the first gateway device stops identifying the user group identifier of the part of the user group. Users provide online access services.

Sending an activation message to the second gateway device, where the activation message includes a user group identifier of the part of the user group, so that the second gateway device can provide the user identified by the user group identifier of the partial user group Online access service.

The first gateway device stops providing an online access service for the user identified by the user group identifier of the partial user group, and the second gateway can provide the user group identified by the user group identifier of the partial user group. The implementation of the online access service is a well-known technology of the person skilled in the art, which is not described in detail in the embodiments of the present invention. The related description of the online access service is the same as that described in the foregoing step 102, and details are not described herein again. Optionally, after the aggregation device sends an activation message to the access gateway device, as shown in FIG. 3, the method further includes:

301. Detect a status of the at least two gateway devices.

302. When detecting that the third gateway device of the at least two gateway devices fails, the one or more user groups on the third gateway device are switched to the switching gateway device, where the switching gateway is The switching gateway device may be a gateway device whose one or more user groups on the third gateway do not exceed the corresponding threshold.

303. Send an activation message to the switching gateway device, where the activation information includes a user group identifier of one or more user groups on the third gateway, so that the switching gateway device is on the third gateway. The user identified by the user group identifier of one or more user groups provides an online access service.

Further, in order to ensure that the user on the failed gateway does not drop the line when the gateway is faulty, the user data may be backed up. After the aggregation device sends the activation message to the access gateway device, As shown in FIG. 4, the method further includes:

401. Allocating a corresponding backup gateway device to the accessed user group, where the backup gateway device is configured to be used when the gateway that provides the online access service for the accessed user group fails. The user group provides online access services.

402. Send a backup indication message to a gateway device that provides an online access service for the accessed user group, where the backup indication message includes a user group identifier of the accessed user group and the backup gateway device. The gateway device identifier, such that the gateway device that provides the online access service for the accessed user group, backs up the data of the user identified by the user group identifier of the accessed user group to the Backup on the gateway device.

The data of the user is a port of the user group where the user is located, and the gateway device that provides the online access service for the accessed user group sends a backup indication message. Can include: determining a backup method from a predetermined backup mode, The scheduled backup methods include hot standby and warm standby.

The hot standby is implemented by backing up data of the user on the primary gateway to the corresponding backup gateway, and maintaining the pending state of the user data on the corresponding backup gateway, so that when the primary gateway fails. The backup gateway can directly send the user data to ensure that the user does not drop the line. The implementation of the warm standby is to back up the data of the user on the primary gateway to the corresponding backup gateway, and record the user data on the corresponding backup gateway. Therefore, when the primary gateway fails, the corresponding backup gateway performs user data transmission only when receiving a command sent by the server instead of processing the user data by the primary gateway.

The user access control method provided by the embodiment of the present invention determines an access gateway device for a user group to be accessed from at least two gateway devices, and sends an activation message to the access gateway device, so as to enable The access gateway device provides an online access service for the user identified by the user group identifier, so that the user can access any gateway device to go online, which can solve the problem that the user goes online unevenly. In addition, according to the load situation of each gateway, the users of the overloaded gateway are switched to the gateway without overload, thereby achieving the balance of each gateway load. In the handover process, the overloaded gateway stops the service of the switched-out users, which saves the gateway resources.

In addition, the user access control method provided by the embodiment of the present invention, through the backup of the user data and the fault processing of the gateway device, enables the user to remain online during the failure of the gateway device, so that the user can get a better online. service.

For example, as shown in FIG. 5, it is a schematic diagram of information interaction of user access control according to an embodiment of the present invention. The aggregation device is a LAN switch. The user equipment (User Equipment, UE for short) is connected to the aggregation device through an access device, such as a Digital Subscriber Line Access Multiplexer (DSLAM).

501. The LAN switch connects the user group to be accessed by the user equipment UE1 in the DSLAM1 to the BNG1, and the LAN switch sends an activation message to the BNG1, where the activation message includes the user group identifier sVlan1 of the UE1.

Among them, sVlan (Service Virtual Local Area Network) is defined in IEEE 802.1Q. The user group identifier used in the embodiment of the present invention may not be limited to sVlan, and another example is PWE3 (Pseudo-Wire Emulation Edge to Edge). The pseudo-line pseudo-wire technology of the edge, and the PVC (Permanent Vi r tua l Connect ion, ATM technology) can be used as the user group identifier or other information having the function of identifying the user group, and the present invention is implemented. This example does not limit this

502. UPE1 sends a DHCP Di scover 4 message to DSLAM1.

503. The DSLAM1 is connected to the DHCP Di scover message, and the identifier information cVlan and sVlan1 of the UE are carried in the DHCP Di scover message and sent to the LAN Swi tch.

504. The LAN Swi tch sends the DHCP Di s cover message to Gl, BNG2, and BNG3.

505. After receiving the packet including the sVlan1, the G1, the BNG2, and the G3 determine whether the user group identified by the sVlan1 is activated locally; if the BNG1 is YES, and the BNG2 and the BNG3 are negative, the BNG1 performs the user access. The process, including authenticating the user, assigning an address to the user, and sending a DHCP Offer to the LAN Swi tch; BNG2, BNG3 4, the DHCP Di scover received is discarded.

506. The LAN Swi tch receives the DHCP Offer message, where the message includes cVlan1 and sVlan1, and sends the DHCP Offer message to the DSLAM1.

507. DSLAM1 correctly sends the DHCP Offer message to the port where UE1 is located.

508, UPE1 sends DHCP Reques t, and sends it to BNGL through DSLAM1 and LAN Swi tch.

509. BNG1 responds to DHCP ACK 4 message and forwards it to UPEL via LAN Swi tch and DSLAM1

510. The UE1 obtains an IP address and a gateway address by using a DHCP ACK message, and sends an ARP Reques t request to request a MAC address corresponding to the gateway address.

511. The BNG1 responds to the ARP Reques sent by the UE1.

512. The ARP Response message is sent to UE1 through DSLAM1.

The process of accessing the user group of UE1 to BNG1 is completed through 501 to 512. Further, as shown in FIG. 6, another information interaction diagram of user access control according to an embodiment of the present invention is provided.

601, LAN Swi tch obtains load information of BNG1, BNG2, and G3;

602, LAN Swi tch detects that the BNG1 load exceeds its corresponding load threshold, then from G2 and

In BNG3, BNG2 with lower load is selected for load migration, and the user group where UE1 is located is selected to be migrated out.

603. The LAN Swi tch sends a deactivation message to the BNG1, where the deactivation message includes sVlan1. 604. The LAN Swi tch sends an activation message to the BNG2, where the activation message includes sVlan1.

605. BNG2 sends a free ARP to LAN Swi tch.

606. The UE1 and the BNG2 complete the DHCP request process and the ARP request process.

The process of migrating the user group of the UE1 from the high-load BNG to the low-load BNG2 is completed through 601 to 606, which can solve the problem that the user access is uneven and the load between the BNGs is unbalanced. It should be noted that the specific implementation of 606 is the same as that of 502 to 512, and the implementation of the present invention will not be repeated herein.

Further, as shown in FIG. 7, another information interaction diagram of user access control according to an embodiment of the present invention is provided.

701. The LAN Swi tch determines the user group data of the BNG1 backup BNG1.

702. The LAN Swi tch sends a backup indication message to the BNG1, where the message includes an identifier of the sVlan1 and the backup target BNG2, for example, an IP address of the BNG2.

703. BNG1 backs up user data on BNG1 to BNG2.

The process of backing up user data on BNG1 to BNG2 is completed through 701 to 703. When BNG1 fails, BNG3 can directly process user services on BNG1, ensuring that users can still access the network normally.

Further, as shown in FIG. 8, FIG. 8 is a schematic diagram of information exchange of another user access control according to an embodiment of the present invention.

801. The LAN Swi tch receives the keepa live packet sent by BNG1, BNG2, and BNG3.

802. The LAN Swi tch does not receive the keepa live packet of the BNG1 and determines that the BNG1 is faulty. 803. The LAN Swi tch switches the user group where the user UE1 is located on the BNG1 to the corresponding backup gateway device BNG2; or, according to the load condition of receiving the BNG2 and the BNG3, select one of the low load according to the load level of the BNG2 and the BNG3. BNG is used to carry users on BNG1. The following is a description of the LAN Swi tch selected to switch the user group of the user UE1 on BNG1 to BNG2.

804. The LAN Swi tch sends an activation message to the BNG2, where the activation message carries sVlan1. 805. BNG2 sends a free ARP to LAN Swi tch.

806. The UE1 and the BNG2 complete the DHCP request process and the ARP request process.

Through 801 to 806, the process of switching the user group where UE1 is located to BNG2 when the G1 fails is completed, so that when the access gateway fails, the user can dynamically adjust through other gateways. online.

In addition, it should be noted that if G2 backs up the data of the user group sVlan1 in advance, the above 806 process can be omitted, that is, the user does not need to restart the online process, and the access to the network can be maintained through the BNG2.

The embodiment of the present invention provides a network device for user access control. As shown in FIG. 9, the network device includes: a determining unit 901 and a first sending unit 902.

The determining unit 901 is configured to determine, from the at least two gateway devices, an access gateway device for the user group to be accessed.

The first sending unit 902 is configured to send an activation message to the access gateway device that is determined by the determining unit 901, where the activation message includes a user group identifier of the user group to be accessed, so that the selection is performed. The gateway device provides an online access service for the user identified by the user group identifier.

Further, as shown in FIG. 10, the device includes: an obtaining unit 903, a determining unit 904, a selecting unit 905, and a first switching unit 906.

The obtaining unit 903 is configured to acquire load information of the at least two gateway devices.

The determining unit 904 is configured to determine, according to the load information acquired by the acquiring unit 903, whether the at least two gateway devices have a gateway device whose load exceeds a corresponding load threshold.

The selecting unit 905 is configured to: when the load of the first gateway device of the at least two gateway devices exceeds the corresponding load threshold, the load from the at least two gateway devices does not exceed the corresponding load threshold The gateway device with the smallest load is selected as the second gateway device.

The first switching unit 906 is configured to switch from one or more user groups accessed by the first gateway device to the second gateway device selected by the selecting unit 905, so that the first The load of the gateway device does not exceed its corresponding load threshold.

Further, as shown in FIG. 11, the device includes: an allocating unit 907 and a second transmitting unit 908. The allocating unit 907 is configured to allocate, to the user group that has been accessed, a backup gateway device, where the backup gateway device is configured to be used when the gateway that provides the online access service for the accessed user group fails. The incoming user group provides online access services.

The second sending unit 908 is configured to send a backup indication message to the gateway device that provides the online access service for the accessed user group, where the backup indication message includes the user group that has been accessed. The gateway device that provides the online access service for the accessed user group is backed up, and the data of the user identified by the user group identifier of the accessed user group is backed up to the backup gateway device.

Further, as shown in FIG. 12, the device further includes: a detecting unit 909, a second switching unit 910, and a third sending unit 911.

The detecting unit 909 is configured to detect a status of the at least two gateway devices.

The second switching unit 910 is configured to switch to one or more user groups on the third gateway device when the detecting unit 909 detects that the third gateway device in the at least two gateway devices fails. a gateway device, where the handover gateway device is a gateway device that does not fail in the at least two gateway devices.

a third sending unit 911, configured to send an activation message to the switching gateway device, where the activation information includes a user group identifier of one or more user groups on the third gateway, so that the switching gateway device can be The user identified by the user group identifier of one or more user groups on the third gateway provides an online access service.

The embodiment of the present invention further provides a system for user access control. As shown in FIG. 13 , the system includes: a network device controlled by a user access and at least two gateway devices, where the user access control The network device is a convergence device 1101, and the at least two gateway devices are a gateway device 1102a and a gateway device 1 102b.

The aggregation device 1101 is configured to determine, from the at least two gateway devices, a gateway device 110a to be accessed for the user group to be accessed, and send an activation message to the gateway device 1102a, where the activation message is sent. The user group identifier of the user group to be accessed is included.

The gateway device 1102a is configured to receive an activation message sent by the aggregation device 1101, and provide an online access service for the user identified by the user group identifier.

Further, the aggregation device 1101 is further configured to allocate a backup gateway device 1102b to the accessed user group, and send a backup indication message to the gateway device 1102a that is providing an online access service for the accessed user group.

The gateway device 1102a is further configured to receive a backup indication message sent by the aggregation device 1101, where the backup indication message includes a user group identifier of the accessed user group and the backup The gateway device identifier of the gateway device 1102b backs up the data of the user identified by the user group identifier of the accessed user group to the backup gateway device 1102b. And when detecting that the gateway device 1102a fails in the at least two gateway devices, switching one or more user groups on the gateway device 1102a to the switching gateway device 102b, and sending the activation to the switching gateway device 1102b. Message.

The gateway device 1102a is further configured to receive an activation message sent by the aggregation device 1101, where the activation information includes a user group identifier of one or more user groups on the gateway device 1102a, and is the gateway device 11 The user identified by the user group identifier of one or more user groups on 02b provides an online access service.

The user access control method, the network device, and the system provided by the embodiment of the present invention determine an access gateway device for the user group to be accessed from at least two gateway devices, and send an activation to the access gateway device. The message is such that the access gateway device provides an online access service for the user identified by the user group identifier, so that the user can access any gateway device to go online, which can solve the problem that the user goes online unevenly. In addition, according to the load situation of each gateway, the users of the overload gateway are switched to the gateway without overload, thereby achieving the balance of each gateway load. Moreover, during the handover process, the overload gateway stops serving the switched-out users, which saves the gateway resources.

In addition, the user access control method, the network device, and the system provided by the embodiment of the present invention, through the backup of the user data and the fault handling of the gateway device, enable the user to remain online during the failure of the gateway device, so that the user can Get a good online service.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is a better implementation. . Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer. A hard disk or optical disk or the like includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention. The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

Rights request

A method for user access control, comprising:

The user access control method according to claim 1, wherein the determining, by the at least two gateway devices, the access gateway device for the user group to be accessed, specifically:

Acquiring a static gateway allocation policy, and determining, according to the static gateway allocation policy, a corresponding access gateway device from the at least two gateway devices for the user group to be accessed.

The user access control method according to claim 1, wherein the determining the access gateway device for the user group to be accessed from the at least two gateway devices comprises:

Obtaining load information of the at least two gateway devices;

And selecting, according to the load information, a gateway device with the smallest load amount from the at least two gateway devices as the access gateway device for the user group to be accessed.

The method for user access control according to any one of claims 1 to 3, wherein after the sending the activation message to the access gateway device, the method further includes:

Obtaining load information of the at least two gateway devices;

Determining, according to the load information, whether the at least two gateway devices have a gateway device whose load exceeds a corresponding load threshold;

When the load of the first gateway device of the at least two gateway devices exceeds its corresponding load threshold, the least load is selected from the gateway devices in which the load does not exceed the corresponding load threshold. The gateway device acts as the second gateway device;

Switching from one or more user groups accessing the first gateway device to accessing from the second gateway device, such that the load of the first gateway device does not exceed its corresponding load threshold.

The method for user access control according to claim 4, wherein the one or more user groups that are to be accessed from the first gateway device are switched to be connected to the second gateway device. Into, including:

Sending a deactivation message to the first gateway device, where the deactivation message includes a user group identifier of the one or more user groups, so that the first gateway device stops being the one or more user groups The user identified by the user group identifier provides an online access service;

Sending an activation message to the second gateway device, where the activation message includes a user group identifier of the one or more user groups, such that the second gateway is a user group identifier of the one or more user groups. The identified users provide online access services.

The method of user access control according to any one of claims 1 to 5, wherein after the sending the activation message to the access gateway device, the method further includes:

Allocating a backup gateway device to the user group that has been accessed, the backup gateway device is configured to provide the accessed user group when the gateway device that provides the online access service for the accessed user group fails Online access service;

Sending a backup indication message to the gateway device that provides the online access service for the accessed user group, where the backup indication message includes the user group identifier of the accessed user group and the gateway of the backup gateway device The device identifier is configured to enable the gateway device that provides the online access service for the accessed user group, and back up data of the user identified by the user group identifier of the accessed user group to the backup gateway. On the device.

The method of user access control according to any one of claims 1 to 6, wherein after the sending the activation message to the access gateway device, the method further includes:

Detecting status of the at least two gateway devices;

And detecting, when the third gateway device of the at least two gateway devices fails, switching one or more user groups on the third gateway device to the switching gateway device, where the switching gateway device is to the switching gateway The device sends an activation message, where the activation information includes a user group identifier of one or more user groups on the third gateway, so that the switching gateway device is one or more user groups on the third gateway. The user identified by the user group identifier provides an online access service.

The user access control method according to claim 7, wherein the switching gateway device comprises: A backup gateway device corresponding to one or more user groups on the third gateway; and a gateway device corresponding to the threshold.

A network device for user access control, characterized in that:

The network device of the user access control according to claim 9, further comprising:

An obtaining unit, configured to acquire load information of the at least two gateway devices;

a determining unit, configured to determine, according to the load information acquired by the acquiring unit, whether the at least two gateway devices have a gateway device whose load exceeds a corresponding load threshold;

a selecting unit, configured to: when the load of the first gateway device of the at least two gateway devices exceeds a corresponding load threshold, the load from the at least two gateway devices does not exceed the corresponding load threshold Selecting the gateway device with the smallest load as the second gateway device;

a first switching unit, configured to switch from one or more user groups accessed by the first gateway device to the second gateway device selected from the selecting unit, so that the first gateway device The load does not exceed its corresponding load threshold.

An allocating unit, configured to allocate a backup gateway device to the accessed user group, where the backup gateway device is configured to be used when the gateway that provides the online access service for the accessed user group fails User groups provide online access services;

a second sending unit, configured to send a backup indication message to the gateway device that provides the online access service for the accessed user group, where the backup indication message includes the used, user, and , ' ― ' ― , I ? , , , , , , , , , , A gateway device that provides an online access service for the accessed user group, and backs up data of the user identified by the user group identifier of the accessed user group to the backup gateway device.

a detecting unit, configured to detect a status of the at least two gateway devices;

a second switching unit, configured to: when the detecting unit detects that the third gateway device of the at least two gateway devices fails, switch one or more user groups on the third gateway device to

Gateway device

a third sending unit, configured to send an activation message to the switching gateway device, where the activation information includes a user group identifier of one or more user groups on the third gateway, so that the switching gateway device can be The user identified by the user group identifier of one or more user groups on the third gateway provides an online access service.

A user access control system, comprising: the user access control network device and the at least two gateway devices according to any one of claims 9-12, wherein:

The gateway device is configured to receive an activation message sent by the network device, and provide an online access service for the user identified by the user group identifier.