CN106209750A - A kind of network allocation method, server, network access equipment and system - Google Patents

Abstract

The embodiment of the present invention provides a kind of network allocation method, server, network access equipment and system, and wherein method includes: server, when client request access network, obtains the unique identification of the described client that network access equipment is forwarded；Server, according to the corresponding relation of the unique identification set with network type, determines the objective network type corresponding to described unique identification；Server returns the information characterizing described objective network type to described network access equipment, in order to described network access equipment, according to described information, will carry out network access in sub-network corresponding for described client distribution to described objective network type.The network allocation method that the embodiment of the present invention provides can make the network type that user's switching the most convenient, simple is accessed.

Description

A kind of network allocation method, server, network access equipment and system

Technical field

The present invention relates to networking technology area, be specifically related to a kind of network allocation method, server, network Access device and system.

Background technology

At present according to using net demand, partition the network into into the different sub-network of multiple network type (as can be by One network is divided into multiple different types of VLAN), and the access of the sub-network of each network type is set Authority, thus according to the access rights of user, by user's distribution to the network class corresponding with its access rights In the sub-network of type, it is achieved the isolation of different user accesses, and becomes a kind of novel lifting network security Mode.As, enterprise network can according to the demand of enterprise self, enterprise network is marked off as exploitation net, Multiple sub-networks such as Office Network, administrative network, experience net, exploitation net only has the enterprise of Enterprise product development authority Industry employee may have access to, and Office Network is available for the enterprise staff of entirety and accesses, and administrative network is intended for having administration The enterprise staff of authority accesses, and experiences net and is available for the guest access of nonbusiness employee.

When the user accessing network is carried out network allocation, it is presently mainly the network in access network and connects Enter equipment (such as switch) place, the network type corresponding to port of binding network access equipment；When with When family accesses network by certain Single port of network access equipment, it is only capable of accessing the network bound in this port Sub-network corresponding to type；With the port 1 binding exploitation net of the network access equipment of enterprise network, port As a example by net is experienced in 2 bindings, then, when user is by the port 1 access enterprise networks network of network access equipment, only may be used Have access to the exploitation net of enterprise network, and access less than other kinds of sub-network；Set by network insertion During standby port 2 access enterprise networks network, only may have access to the experience net of enterprise network, and access less than other The sub-network of type.

The present inventor finds in research process, the existing port binding net at network access equipment The network allocation mode of network type, existing problem is: certain one end of user access network access device Mouthful time, can only distribute to sub-network corresponding to the network type bound in this port, if user needs Change the network type accessed, then have to switch over the network access equipment that changed network type is corresponding Port on carry out network insertion；This allow for user switching accessed network time, exist frequently Find the operation of the corresponding ports of network access equipment, cause operation during user's handover network extremely onerous.

Summary of the invention

In view of this, the embodiment of the present invention provides a kind of network allocation method, server, network insertion to set Standby and system, the numbest with operation when solving the user's handover network existing for the existing network method of salary distribution Tired problem.

For achieving the above object, the following technical scheme of embodiment of the present invention offer:

A kind of network allocation method, is applied to server, and described method includes:

When client request access network, the described client that acquisition network access equipment is forwarded is only One property mark；

According to the corresponding relation of the unique identification set with network type, determine described unique identification institute Corresponding objective network type；

The information characterizing described objective network type is returned, in order to described network to described network access equipment Access device is according to described information, by subnet corresponding for described client distribution to described objective network type Network carries out network access.

The embodiment of the present invention also provides for a kind of network allocation method, is applied to network access equipment, described side Method includes:

When client request access network, obtain the unique identification of described client；

Described unique identification is forwarded to server, in order to described server is according to the uniqueness mark set Know the corresponding relation with network type, determine the objective network type corresponding to described unique identification；

Receive the information characterizing described objective network type that described server sends；

According to described information, by sub-network corresponding for described client distribution to described objective network type Carry out network access.

The embodiment of the present invention also provides for a kind of server, including:

Mark forwards acquisition module, for when client request access network, obtaining network access equipment The unique identification of the described client forwarded；

Objective network determination type module, for corresponding with network type according to the unique identification set Relation, determines the objective network type corresponding to described unique identification；

Characterization information sending module, characterizes described objective network class for returning to described network access equipment The information of type, in order to described network access equipment is according to described information, by the distribution of described client to described The sub-network that objective network type is corresponding carries out network access.

The embodiment of the present invention also provides for a kind of network access equipment, including:

Identifier acquisition module, for when client request access network, obtaining the unique of described client Property mark；

Forwarding module, for being forwarded to server by described unique identification, in order to described server according to The unique identification set and the corresponding relation of network type, determine the mesh corresponding to described unique identification Mark network type；

Characterization information receiver module, for receiving the sign described objective network type that described server sends Information；

Distribution module, for according to described information, by the distribution of described client to described objective network type Corresponding sub-network carries out network access.

The embodiment of the present invention also provides for a kind of network distribution system, including:

Network access equipment, for when client request access network, obtaining the unique of described client Property mark, described unique identification is forwarded to server, receive described server send sign described in The information of objective network type, and according to described information, by the distribution of described client to described objective network The sub-network that type is corresponding carries out network access；

Server, for obtaining the unique identification of the described client that network access equipment is forwarded, root According to the corresponding relation of the unique identification set with network type, determine corresponding to described unique identification Objective network type, returns the information characterizing described objective network type to described network access equipment.

Based on technique scheme, in the network allocation method that the embodiment of the present invention provides, network insertion sets Standby each port unbound sub-network, network access equipment can be according to the client set in server Network type corresponding to unique identification, dynamic distribution client is corresponding to corresponding network type Sub-network carries out network access；When client needs handover network, it is only necessary to change server sets The network type corresponding to unique identification of this client, accessed without client end alteration The port of network access equipment, the embodiment of the present invention provide network allocation method can make user the most convenient, Simply switch the network type accessed.

Accompanying drawing explanation

In order to be illustrated more clearly that the embodiment of the present invention or technical scheme of the prior art, below will be to reality Execute the required accompanying drawing used in example or description of the prior art to be briefly described, it should be apparent that below, Accompanying drawing in description is only embodiments of the invention, for those of ordinary skill in the art, not On the premise of paying creative work, it is also possible to obtain other accompanying drawing according to the accompanying drawing provided.

The structural representation of the network distribution system that Fig. 1 provides for the embodiment of the present invention；

The signaling process figure of the network allocation method that Fig. 2 provides for the embodiment of the present invention；

Another signaling process figure of the network allocation method that Fig. 3 provides for the embodiment of the present invention；

The flow chart of the network allocation method that Fig. 4 provides for the embodiment of the present invention；

Another flow chart of the network allocation method that Fig. 5 provides for the embodiment of the present invention；

Another flow chart of the network allocation method that Fig. 6 provides for the embodiment of the present invention；

The another flow chart of the network allocation method that Fig. 7 provides for the embodiment of the present invention；

Another flow chart again of the network allocation method that Fig. 8 provides for the embodiment of the present invention；

Another again flow chart of the network allocation method that Fig. 9 provides for the embodiment of the present invention；

The another another flow chart of the network allocation method that Figure 10 provides for the embodiment of the present invention；

Another another flow chart of the network allocation method that Figure 11 provides for the embodiment of the present invention；

The structured flowchart of the server that Figure 12 provides for the embodiment of the present invention；

The structured flowchart of the characterization information sending module that Figure 13 provides for the embodiment of the present invention；

Another structured flowchart of the characterization information sending module that Figure 14 provides for the embodiment of the present invention；

The structured flowchart of the network access equipment that Figure 15 provides for the embodiment of the present invention；

The structured flowchart of the characterization information receiver module that Figure 16 provides for the embodiment of the present invention；

Another structured flowchart of the characterization information receiver module that Figure 17 provides for the embodiment of the present invention.

Detailed description of the invention

Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out Clearly and completely describe, it is clear that described embodiment is only a part of embodiment of the present invention, and It is not all, of embodiment.Based on the embodiment in the present invention, those of ordinary skill in the art are not doing Go out the every other embodiment obtained under creative work premise, broadly fall into the scope of protection of the invention.

The structural representation of the network distribution system that Fig. 1 provides for the embodiment of the present invention, with reference to Fig. 1, this net Network distribution system may include that network access equipment 1 and server 2；Network access equipment 1 is network insertion Node, can select switch to realize, it is clear that may be used without other the equipment with network access facility Realize；The server 2 equipment for realizing network allocation decision logic set by the embodiment of the present invention, Server 2 can be single server, it is also possible to for the server farm being made up of multiple servers；

Based on network distribution system shown in Fig. 1, Fig. 2 shows the network allocation side that the embodiment of the present invention provides The signaling process figure of method, shown in Fig. 1 and Fig. 2, this flow process may include that

Step S10, network access equipment, when client request access network, obtain described client only One property mark；

Optionally, the unique identification of client can be that client is initiating network to network access equipment Carry during access request；Can also be client after initiating network insertion request to network access equipment, Retransmit after network access equipment request unique identification；

Optionally, the unique identification of client can be the device identification of the subscriber equipment loading client, The mark of client can also be uniquely identified for the ID etc. of client owning user；Equipment mark Knowledge can be that MAC (Media Access Control, media interviews control) address etc. can uniquely identify The mark of subscriber equipment (mobile phone that subscriber equipment such as user is used, computer etc.), ID is permissible For user name, ID (identity number) card No., employee's number etc. can uniquely identify the mark of user.

Described unique identification is forwarded to server by step S11, network access equipment；

Step S12, described server are according to the corresponding relation of the unique identification set with network type, really Fixed objective network type corresponding to described unique identification；

Step S13, described server return to described network access equipment and characterize described objective network type Information；

Step S14, described network access equipment are according to described information, by the distribution of described client to described The sub-network that objective network type is corresponding carries out network access.

Optionally, the information characterizing described objective network type can be corresponding to described objective network type Network identity；The embodiment of the present invention can be arranged corresponding to the sub-network of each network type in the server Network identity, after determining the objective network type corresponding to the unique identification of described client, can be by Determined by network identity corresponding to objective network type be back to described network access equipment, in order to institute State network access equipment and sub-network corresponding for described client distribution to described network identity will carry out network Access；As the sub-network of each network type can be numbered by the embodiment of the present invention in the server, really After the objective network type corresponding to unique identification of fixed described client, can by determined by target network The numbering of the sub-network of network type sends to network access equipment, in order to network access equipment is by described client End distribution carries out network access to the sub-network of this numbering；

Optionally, the information characterizing described objective network type can be directly to comprise described objective network class The information of type；The embodiment of the present invention also can arrange the sub-network institute of each network type at network access equipment Corresponding network identity；Server is determining the objective network corresponding to the unique identification of described client After type, can be directly to objective network type determined by the return of described network access equipment；Network insertion Equipment is according to the network identity corresponding to the sub-network of each network type set, it may be determined that go out described target The network identity of the sub-network of network type, by subnet corresponding for described client distribution to this network identity Network carries out network access.

It can be seen that in the network allocation method of embodiment of the present invention offer, each end of network access equipment Mouth unbound sub-network, network access equipment can be according to the uniqueness mark of the client set in server Network type corresponding to knowledge, in the sub-network that dynamic distribution client to corresponding network type is corresponding Carry out network access；When client needs handover network, it is only necessary to this client set in change server The network type corresponding to unique identification of end, the network insertion accessed without client end alteration The port of equipment, the network allocation method that the embodiment of the present invention provides can make user the most convenient, simple The network type that switching is accessed.

Optionally, the embodiment of the present invention, when client access network, can carry out authentication to client, Client can carry the unique identification of described client in the authentication information that switch sends, with The carrying out of network allocation flow process continuous after an action of the bowels.Fig. 3 shows the network allocation method that the embodiment of the present invention provides Another signaling process figure, shown in Fig. 1 and Fig. 3, this flow process may include that

Step S20, network access equipment, when client request access network, obtain the body of described client Part checking information, described authentication information comprises unique identification and the identity information of described client；

Optionally, in embodiments of the present invention, client can initiate network insertion to network access equipment While request, send unique identification and the identity information comprising described client to network access equipment Authentication information；

Optionally, in client after network access equipment sends network insertion request, network access equipment Authentication information can be asked to client, after client receives this request, can will comprise described client Unique identification and identity information authentication information send to network access equipment.

Optionally, identity information can be ID (such as user name) and the user cipher etc. of client The information of checking user identity；If unique identification uses ID, then identity letter be can be used directly ID in breath uses as the unique identification of described client；If unique identification uses dress Carry the device identification of the subscriber equipment of client, then in authentication information in addition to comprising identity information, Also need to comprise device identification, using the device identification by comprising in authentication information as described client Unique identification use.

Described authentication information is forwarded to server by step S21, described network access equipment；

Step S22, described server are verifying that according to described identity information the identity of described client is legal After, according to the corresponding relation of the unique identification set with network type, determine described unique identification institute Corresponding objective network type；

Optionally, legal mode can be by authentication information to verify the identity of described client ID and the user cipher of client mate, if the match is successful, then can determine that described client Identity legal, if mating unsuccessful, then can determine that the identity of described client is illegal；

After the identity determining described client is legal, it may be determined that described client need to distribute to sub-network Network type, i.e. according to the corresponding relation of unique identification and the network type set in server, really The objective network type that unique identification that fixed described authentication information is comprised is corresponding；

Step S23, described server return to described network access equipment and characterize described objective network type Information；

Step S24, described network access equipment are according to described information, by the distribution of described client to described mesh The sub-network that mark network type is corresponding carries out network access.

Optionally, the authentication mode that the embodiment of the present invention is used can be MAB (MAC Authentication Bypass, MAC bypass certification) checking, and dot1X checking；

Wherein, MAB checking is a kind of based on device identification certification to exempt from 1X ad hoc mode；Dot1X is The abbreviation of IEEE 802.1X, is access control based on Client/Server and authentication protocol.

Optionally, a network can be divided into multiple VLAN that network type is different by the embodiment of the present invention (Virtual Local Area Network, VLAN), and each network class is set in the server Unique identification corresponding to the VLAN of type, and then when there is the client accessing network, server can Unique identification according to this client determine this client need to distribute to the objective network type of VLAN, So that network access equipment will enter in VLAN corresponding for this client distribution to this objective network type Row network accesses.

Below with the angle of server, the network allocation method providing the embodiment of the present invention is introduced, Network allocation method described below can be with above-described signaling process content mutually to should refer to.

The flow chart of the network allocation method that Fig. 4 provides for the embodiment of the present invention, this network allocation method can be answered In server；With reference to Fig. 4, the method may include that

Step S100, client request access network time, obtain network access equipment forwarded described The unique identification of client；

Step S110, corresponding relation according to unique identification and the network type set, determine described in only Objective network type corresponding to one property mark；

Step S120, to described network access equipment return characterize described objective network type information, with Toilet states network access equipment according to described information, by the distribution of described client to described objective network type Corresponding sub-network carries out network access.

In the network allocation method that the embodiment of the present invention provides, each port of network access equipment is the most unbound Sub-network, network access equipment can be according to corresponding to the unique identification of the client set in server Network type, carries out network visit in the sub-network that dynamic distribution client to corresponding network type is corresponding Ask；When client needs handover network, it is only necessary to the uniqueness of this client set in change server Network type corresponding to mark, without the port of the network access equipment that client end alteration is accessed, The network allocation method that the embodiment of the present invention provides can make user's switching the most convenient, simple be accessed Network type.

Optionally, server can arrange the network identity corresponding to sub-network of each network type further, Server, after determining the objective network type corresponding to described unique identification, can further determine that described Network identity corresponding to objective network type, thus by the network mark corresponding to described objective network type Know be back to described network access equipment so that described network access equipment described client can be distributed Network access is carried out to the sub-network that described network identity is corresponding.

Corresponding, Fig. 5 shows another flow chart of the network allocation method that the embodiment of the present invention provides, joins According to Fig. 5, the method may include that

Step S200, client request access network time, obtain network access equipment forwarded described The unique identification of client；

Step S210, corresponding relation according to unique identification and the network type set, determine described in only Objective network type corresponding to one property mark；

Step S220, corresponding relation according to network type Yu the network identity of sub-network, determine described mesh The network identity of mark sub-network corresponding to network type；

Step S230, to described network access equipment return described network identity, in order to described network insertion Equipment will carry out network access in sub-network corresponding for described client distribution to described network identity.

Optionally, the embodiment of the present invention also can arrange the sub-network of each network type at network access equipment Corresponding network identity；Server is determining the target network corresponding to the unique identification of described client After network type, can directly the information comprising described objective network type be sent to network access equipment；With Just network access equipment is according to the network identity corresponding to the sub-network of each network type set, and determines institute State the network identity of sub-network corresponding to objective network type so that network access equipment can be by described client The end distribution sub-network that extremely described network identity is corresponding carries out network access.

Corresponding, Fig. 6 shows another flow chart of the network allocation method that the embodiment of the present invention provides, joins According to Fig. 6, the method may include that

Step S300, client request access network time, obtain network access equipment forwarded described The unique identification of client；

Step S310, corresponding relation according to unique identification and the network type set, determine described in only Objective network type corresponding to one property mark；

Step S320, return to described network access equipment and comprise the information of described objective network type, with The network access equipment corresponding relation according to the network type set with the network identity of sub-network stated by toilet, Determine the network identity of sub-network corresponding to described objective network type so that described network access equipment Sub-network corresponding for described client distribution to described network identity will carry out network access.

Optionally, client can to network access equipment initiate network insertion request time, carry described in only One property mark；Network access equipment, after obtaining described network insertion request, can resolve and wherein carry only One property mark, is forwarded to server by this unique identification；

Optionally, network access equipment also can receive client send network insertion request after, to Described client asks the unique identification of this client, thus after this request of described client end response, Receive the unique identification that described client sends, and then the unique identification that network access equipment will receive It is forwarded to server.

Optionally, server also can carry out authentication to described client, is only verifying described client End identity legal after, just determine and described client can be carried out network allocation, and then determine described client The objective network type corresponding to unique identification of end；Concrete, described client can be in request access network During network, send authentication information to network access equipment, and comprise described in this authentication information The unique identification of client and identity information；

Corresponding, Fig. 7 shows the another flow chart of the network allocation method that the embodiment of the present invention provides, joins According to Fig. 7, the method may include that

Step S400, client request access network time, obtain network access equipment forwarded described The authentication information of client, described authentication information comprise described client unique identification and Identity information；

Optionally, in embodiments of the present invention, client can initiate network insertion to network access equipment While request, send authentication information to network access equipment, and carry in authentication information The unique identification of described client and identity information；

Optionally, client also can receive described after initiating network insertion request to network access equipment The request of the acquisition authentication information that network access equipment sends, thus described client will be comprised only The authentication information of one property mark and identity information sends to described network access equipment；

Step S410, described server are verifying that according to described identity information the identity of described client is legal After, according to the corresponding relation of the unique identification set with network type, determine described unique identification institute Corresponding objective network type；

Step S420, described server return to described network access equipment and characterize described objective network type Information, in order to described network access equipment is according to described information, by the distribution of described client to described mesh The sub-network that mark network type is corresponding carries out network access.

Optionally, identity information can include ID and the user cipher of described client, if choosing By ID as the unique identification of described client, then server can verify described ID And after user cipher coupling, according to the corresponding relation of the ID set with network type, determine described Objective network type corresponding to ID；

If an enterprise staff A is when request accesses enterprise network, the client that can be used by enterprise staff A End, the switch at the access of enterprise network sends the user name (such as employee number etc.) of employee A and uses Family password；User name and the user cipher of employee A are forwarded to server, server authentication employee by switch After the user name of A and user cipher coupling, can be using the user name of employee A as the uniqueness of described client Mark uses；And according to the user name set in server and the corresponding relation of network type, determine employee A Corresponding objective network type, thus the information characterizing the objective network type of employee A is sent to exchange Machine；Employee A distribution is visited to enterprise's sub-network corresponding with described objective network type by switch Ask.

Optionally, identity information can include ID and the user cipher of described client, if choosing With loading the device identification of subscriber equipment of described client as the unique identification of described client, then Server can be after verifying described ID and user cipher coupling, according to the device identification set and net The corresponding relation of network type, determines the objective network type corresponding to described device identification；

If an enterprise staff A is when request accesses enterprise network, the client that can be used by enterprise staff A End, the switch at the access of enterprise network sends the user name (such as employee number etc.) of employee A, uses The device identification (such as MAC Address) of family password and the presently used subscriber equipment of enterprise staff A； The user name of employee A, user cipher and described device identification are forwarded to server by switch, and server is tested After the user name of card employee A and user cipher coupling, can using described device identification as described client only One property mark uses；And according to the device identification set in server and the corresponding relation of network type, really The objective network type corresponding to device identification of the presently used subscriber equipment of staffing work A, thus by table The information of the objective network type levying employee A sends to switch；Employee A is distributed to described by switch Enterprise's sub-network that objective network type is corresponding conducts interviews.

Optionally, the mode that the identity of client described in server authentication is the most legal can select MAB to test Card, and dot1X checking；The embodiment of the present invention can first use MAB verification mode, verifies described client Identity the most legal, according to MAB verification mode verify described client identity legal, then can root According to the corresponding relation of the unique identification set with network type, determine the unique identification of described client Corresponding objective network type, verifies that according to MAB verification mode the identity of described client is illegal, The identity that then can use dot1X verification mode checking client is the most legal；According to dot1X verification mode Verify that the identity of described client is legal, then can be corresponding with network type according to the unique identification set Relation, determines the objective network type corresponding to the unique identification of described client, tests according to dot1X Card mode verifies that the identity of described client is illegal, then be rejected by the network insertion of described client.

Optionally, owing to Internet resources are limited, the network allocation method that the embodiment of the present invention provides is applicable Use the mode of cable access network in described client, i.e. use wired mode to access in described client During network, can according to the unique identification of described client, by the distribution of described client to described uniquely Property objective network type corresponding to mark sub-network in carry out network access；If described client uses nothing Line mode access network, then can be directly by the son accessed for wireless mode of described client distribution to setting Network carries out network access；

Obviously, no matter client selects wired or wireless mode access network, and the embodiment of the present invention provides Network allocation method also can be the most applicable.

Optionally, server can be the server farm being made up of multiple servers, this server farm May include that authentication server and data cache server etc.；Wherein data cache server is mainly used in Carry out the unique identification of client and the storage of the network type of correspondence, the most also can store each network The network identity of the sub-network of type；Authentication server is mainly used in called data caching server being deposited The corresponding relation of storage, thus carry out the objective network type corresponding to unique identification of described client Determine, the most also can determine that the network identity of sub-network corresponding to described objective network type, it is judged that institute State the identity of client the most legal etc..

Use the network allocation method that the embodiment of the present invention provides, when client needs handover network, only The network type corresponding to unique identification of this client set in server need to be changed, without The port of the network access equipment that client end alteration is accessed, the network allocation side that the embodiment of the present invention provides Method can make the network type that user's switching the most convenient, simple is accessed.

Below with the angle of network access equipment, the network allocation method providing the embodiment of the present invention is carried out Introducing, network allocation method described below can be with above-described signaling process content mutually to should refer to.

Another flow chart, this network allocation side again of the network allocation method that Fig. 8 provides for the embodiment of the present invention Method can be applicable to network access equipment, and with reference to Fig. 8, the method may include that

Step S500, client request access network time, obtain the unique identification of described client；

Step S510, described unique identification is forwarded to server, in order to described server is according to setting The corresponding relation of unique identification and network type, determine the target network corresponding to described unique identification Network type；

Step S520, receive described server send characterize described objective network type information；

Step S530, according to described information, the distribution of described client is corresponding to described objective network type Sub-network in carry out network access.

Optionally, server can arrange the network identity corresponding to sub-network of each network type further, Server, after determining the objective network type corresponding to described unique identification, can further determine that described The network identity of the sub-network corresponding to objective network type, thus by corresponding to described objective network type The network identity of sub-network be back to described network access equipment so that described network access equipment can Sub-network corresponding for described client distribution to described network identity will carry out network access.

Corresponding, Fig. 9 shows the another flow chart again of the network allocation method that the embodiment of the present invention provides, This network allocation method can be applicable to network access equipment, and with reference to Fig. 9, the method can include

Step S600, client request access network time, obtain the unique identification of described client；

Step S610, described unique identification is forwarded to server, in order to described server is according to setting The corresponding relation of unique identification and network type, determine the target network corresponding to described unique identification Network type, and make described server according to the corresponding relation of network type Yu the network identity of sub-network, Determine the network identity of sub-network corresponding to described objective network type；

Step S620, receive described server return described network identity；

Step S630, the distribution of described client will be carried out network to sub-network corresponding to described network identity Access.

Optionally, the embodiment of the present invention also can arrange the sub-network of each network type at network access equipment Corresponding network identity；Server is determining the target network corresponding to the unique identification of described client After network type, can directly the information comprising described objective network type be sent to network access equipment；With Just network access equipment is according to the network identity corresponding to the sub-network of each network type set, it may be determined that The network identity of the sub-network that described objective network type is corresponding so that network access equipment can be by described visitor The end distribution sub-network that extremely described network identity is corresponding in family carries out network access.

Corresponding, Figure 10 shows the another another flow chart of the network allocation method that the embodiment of the present invention provides, With reference to Figure 10, the method may include that

Step S700, client request access network time, obtain the unique identification of described client；

Step S710, described unique identification is forwarded to server, in order to described server is according to setting The corresponding relation of unique identification and network type, determine the target network corresponding to described unique identification Network type；

Step S720, receive described server send the information comprising described objective network type；

Step S730, corresponding relation according to the network identity of network type and the sub-network set, determine The network identity of the sub-network corresponding to described objective network type；

Step S740, the distribution of described client will be carried out network to sub-network corresponding to described network identity Access.

Optionally, client can to network access equipment initiate network insertion request time, carry described in only One property mark；Concrete, when client request access network, client can set to described network insertion Preparation SCN Space Cable Network access request, and in this network insertion is asked, carry the unique identification of described client, So that described network access equipment is when client request access network, get described client only One property mark.

Optionally, network access equipment also can receive client send network insertion request after, to Described client asks the unique identification of this client, thus after this request of described client end response, Receive the unique identification that described client sends, and then the unique identification that network access equipment will receive It is forwarded to server；Concrete, when client request access network, client can connect to described network Enter equipment and send network insertion request, after network access equipment obtains described network insertion request, can be to institute State client and ask the unique identification of described client；After this request of described client end response, can be by institute State unique identification to send to described network access equipment, so that described network access equipment is in client During request access network, get the unique identification of described client.

Optionally, the embodiment of the present invention, when client access network, can carry out authentication to client； Client is when asking access network, and network access equipment can obtain the authentication information of described client, Described authentication information comprises unique identification and the identity information of described client；

Corresponding, Figure 11 shows the another the most further flow chart of the network allocation method that the embodiment of the present invention provides, With reference to Figure 11, the method may include that

Step S800, client request access network time, obtain described client send authentication Information, described authentication information comprises unique identification and the identity information of described client；

Optionally, client can be while initiating network insertion request to network access equipment, to network Access device sends authentication information, and carries the uniqueness of described client in authentication information Mark and identity information；Concrete, when client request access network, client can be to described network Access device sends network insertion request, and carries and comprise described client in this network insertion is asked Unique identification and the authentication information of identity information；

Optionally, client also can receive described after initiating network insertion request to network access equipment The request of the acquisition authentication information that network access equipment sends, thus described client will be comprised only The authentication information of one property mark and identity information sends to described network access equipment；Concrete, During client request access network, client can send network insertion request to described network access equipment, After network access equipment obtains described network insertion request, described client can be asked to described client Authentication information；After this request of described client end response, the uniqueness mark of described client can be comprised Know and the authentication information of identity information sends to described network access equipment.

Step S810, described authentication information is forwarded to server；

Step S810, described server according to described identity information verify described client identity legal, And according to the corresponding relation of the unique identification set with network type, determine that described unique identification institute is right After the objective network type answered, receive the information characterizing described objective network type that described server sends；

Step S820, according to described information, the distribution of described client is corresponding to described objective network type Sub-network in carry out network access.

The application examples provided the embodiment of the present invention below is introduced, to have multiple heterogeneous networks As a example by the enterprise network of the VLAN of type；When employee A needs to be switched to administrative network from exploitation net, can be Server is changed the vlan network type corresponding to MAC Address of work computer of employee A, can be by The vlan network type that the MAC Address of the work computer of employee A is corresponding is changed to administrative network by developing net；

When employee A (if the network type of prior art handover access, then needs to change to tool on its station Carry out network insertion on the station position of the network type corresponding port after having and switching, and the present invention implements Example can be on the basis of not changing station position, it is achieved the network type that switching is accessed), made by it Client access original switch ports themselves time, can to switch submit to employee A employee's user name, Employee's password and the MAC Address of work computer；

The MAC Address of employee's user name of employee A, employee's password and work computer is forwarded by switch To server；

After employee's user name of server authentication employee A and employee's password match, it may be determined that be currently accessed user Legal, the work computer of employee A can be determined according to vlan network type corresponding to MAC Address set Objective network type corresponding to MAC Address be administrative network；Optionally, server can first use MAB to test Card mode verifies that the identity of employee A is the most legal, after checking identity is legal, can carry out succeeding target network The determination of type, after checking identity is illegal, can further use dot1X verification mode to verify employee A Identity the most legal；After using dot1X verification mode checking identity legal, succeeding target net can be carried out The determination of network type, after using dot1X verification mode checking identity illegal, can directly refuse employee A's Access；

(network numbering is as network mark with vlan network numbering according to the vlan network type set for server The one known can preferred form of this) corresponding relation, it may be determined that the vlan network numbering of administrative network, and should Vlan network numbering is forwarded to switch；

Switch can be numbered according to described vlan network, and the network work computer of employee A initiated is visited Ask and distribute to administrative network, access so that employee A can realize network in administrative network.

It can be seen that in the network allocation method of embodiment of the present invention offer, each end of network access equipment Mouth unbound sub-network, network access equipment can be according to the uniqueness mark of the client set in server Network type corresponding to knowledge, in the sub-network that dynamic distribution client to corresponding network type is corresponding Carrying out network access, the mode of the network type that user's switching is accessed is the most convenient, simple.

The server provided the embodiment of the present invention below is introduced, and server described below can be with upper Literary composition with server side describe network allocation method mutually to should refer to.

The structured flowchart of the server that Figure 12 provides for the embodiment of the present invention, with reference to Figure 12, this server can To include:

Mark forwards acquisition module 100, for when client request access network, obtaining network insertion and set The unique identification of the standby described client forwarded；

Objective network determination type module 110, right for according to unique identification and the network type set Should be related to, determine the objective network type corresponding to described unique identification；

Characterization information sending module 120, characterizes described objective network for returning to described network access equipment The information of type, in order to described client, according to described information, is distributed to institute by described network access equipment State and the sub-network that objective network type is corresponding carries out network access.

Optionally, the information characterizing described objective network type sent, can be described objective network The network identity of the sub-network corresponding to type；Corresponding, Figure 13 shows what the embodiment of the present invention provided The optional structure of one of characterization information sending module 120, with reference to Figure 13, characterization information sending module 120 can To include:

Network identity determines unit 1201, for corresponding with the network identity of sub-network according to network type Relation, determines the network identity of sub-network corresponding to described objective network type；

Network identity transmitting element 1202, for returning described network identity to described network access equipment, So that described network access equipment will enter in sub-network corresponding for described client distribution to described network identity Row network accesses.

Optionally, the information characterizing described objective network type sent, can be to comprise described target The information of network type；Corresponding, Figure 14 shows that the characterization information that the embodiment of the present invention provides sends mould The optional structure of another kind of block 120, with reference to Figure 14, characterization information sending module 120 may include that

Comprise information transmitting unit 1211, comprise described target network for returning to described network access equipment The information of network type, in order to described network access equipment is according to the network of the network type set with sub-network The corresponding relation of mark, determines the network identity of sub-network corresponding to described objective network type so that Described network access equipment will carry out net in sub-network corresponding for described client distribution to described network identity Network accesses.

Optionally, mark forwards the institute that acquisition module 100 can be forwarded specifically for acquisition network access equipment Stating the authentication information of client, described authentication information comprises the unique identification of described client And identity information；

Corresponding, objective network determination type module 110 can be specifically for verifying according to described identity information After the identity of described client is legal, according to the corresponding relation of the unique identification set with network type, Determine the objective network type corresponding to described unique identification.

Optionally, described identity information can include ID and the user cipher of described client；? During using described ID as the unique identification of described client, objective network determination type module 110 Can be after verifying described ID and user cipher coupling, according to the ID set and network type Corresponding relation, determine the objective network type corresponding to described ID；

Optionally, in the device identification of subscriber equipment to load described client as described client During unique identification, objective network determination type module 110 can verify that described ID and user are close After code coupling, according to the corresponding relation of the device identification set with network type, determine described device identification Corresponding objective network type.

The network access equipment provided the embodiment of the present invention below is introduced, and network described below connects Enter equipment can with above with network access equipment angle describe network allocation method mutually to should refer to.

The structured flowchart of the network access equipment that Figure 15 provides for the embodiment of the present invention, with reference to Figure 15, network Access device may include that

Identifier acquisition module 200, for when client request access network, obtaining described client only One property mark；

Forwarding module 210, for being forwarded to server by described unique identification, in order to described server root According to the corresponding relation of the unique identification set with network type, determine corresponding to described unique identification Objective network type；

Characterization information receiver module 220, for receiving the sign described objective network class that described server sends The information of type；

Distribution module 230, for according to described information, by the distribution of described client to described objective network class The sub-network that type is corresponding carries out network access.

Optionally, the information characterizing described objective network type can be corresponding to described objective network type The network identity of sub-network；Figure 16 shows the characterization information receiver module 220 that the embodiment of the present invention provides The optional structure of one, with reference to Figure 16, characterization information receiver module 220 may include that

Mark receive unit 2201, for receive described server return with described objective network type institute The network identity of corresponding sub-network；

Optionally, server can be after determining described objective network type, according to network type and sub-network The corresponding relation of network identity, determine the network identity of sub-network corresponding to described objective network type, Thus network identity sends to network access equipment determined by inciting somebody to action；

Corresponding, distribution module 230 is particularly used in the distribution of described client corresponding to described network identity Sub-network in carry out network access.

Optionally, the information characterizing described objective network type can be to comprise described objective network type Information；Figure 17 shows that the another kind of the characterization information receiver module 220 that the embodiment of the present invention provides is optional Structure, with reference to Figure 17, characterization information receiver module 220 may include that

Comprise information receiving unit 2211, for receive described server send comprise described objective network The information of type；

Corresponding, distribution module 230 is particularly used in the network according to the network type set with sub-network The corresponding relation of mark, determines the network identity of sub-network corresponding to described objective network type；By institute State in the client distribution sub-network that extremely described network identity is corresponding and carry out network access.

Optionally, identifier acquisition module 200 is particularly used in when client request access network, obtains The authentication information that described client sends, described authentication information comprises the unique of described client Property mark and identity information；

Corresponding, forwarding module 210 can will comprise the unique identification of described client and the body of identity information Part checking information sends to server, in order to described server is verifying described visitor according to described identity information After the identity of family end is legal, according to the corresponding relation of the unique identification set with network type, determine institute State the objective network type corresponding to unique identification.

Optionally, described identity information may include that ID and the user cipher of described client； Corresponding, characterization information receiver module 220 can be at ID and user cipher described in described server authentication After coupling, receive the information characterizing described objective network type that described server sends；

Optionally, the embodiment of the present invention can described ID as the unique identification of described client, Corresponding, described objective network type is the network type corresponding to described ID；On the other hand, The embodiment of the present invention can also load the device identification of the subscriber equipment of described client as described client Unique identification, corresponding, described objective network type is the network class corresponding to described device identification Type.

The embodiment of the present invention is also provided with a kind of network distribution system, and network distribution system described below can Can be with above description mutually to should refer to.

The structure of the network distribution system that the embodiment of the present invention provides can refer to shown in Fig. 1, including: network connects Enter equipment 1 and server 2；

Wherein, network access equipment 1, for when client request access network, obtaining described client Unique identification, described unique identification is forwarded to server, receive described server send table Levy the information of described objective network type, and according to described information, by the distribution of described client to described mesh The sub-network that mark network type is corresponding carries out network access；

Server 2, for obtaining the unique identification of the described client that network access equipment is forwarded, root According to the corresponding relation of the unique identification set with network type, determine corresponding to described unique identification Objective network type, returns the information characterizing described objective network type to described network access equipment.

Optionally, the Function Extension of network access equipment 1 and server 2 can refer to appropriate section above and retouches Stating, here is omitted.

In the network distribution system that the embodiment of the present invention provides, each port of network access equipment is the most unbound Sub-network, network access equipment can be according to corresponding to the unique identification of the client set in server Network type, carries out network visit in the sub-network that dynamic distribution client to corresponding network type is corresponding Asking, the mode of the network type that user's switching is accessed is the most convenient, simple.

In this specification, each embodiment uses the mode gone forward one by one to describe, and each embodiment stresses Being the difference with other embodiments, between each embodiment, identical similar portion sees mutually. For device disclosed in embodiment, owing to it corresponds to the method disclosed in Example, so describing Fairly simple, relevant part sees method part and illustrates.

Professional further appreciates that, respectively shows in conjunction with what the embodiments described herein described The unit of example and algorithm steps, it is possible to electronic hardware, computer software or the two be implemented in combination in, In order to clearly demonstrate the interchangeability of hardware and software, the most general according to function Describe composition and the step of each example.These functions perform with hardware or software mode actually, Depend on application-specific and the design constraint of technical scheme.Professional and technical personnel can be to each specific Should be used for use different methods to realize described function, but this realization is it is not considered that beyond this The scope of invention.

The method described in conjunction with the embodiments described herein or the step of algorithm can directly use hardware, The software module that processor performs, or the combination of the two implements.Software module can be placed in and deposit at random Reservoir (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electric erasable can Well known in programming ROM, depositor, hard disk, moveable magnetic disc, CD-ROM or technical field In any other form of storage medium.

Described above to the disclosed embodiments, makes professional and technical personnel in the field be capable of or uses The present invention.Multiple amendment to these embodiments will be aobvious and easy for those skilled in the art See, generic principles defined herein can without departing from the spirit or scope of the present invention, Realize in other embodiments.Therefore, the present invention is not intended to be limited to the embodiments shown herein, And it is to fit to the widest scope consistent with principles disclosed herein and features of novelty.

Claims (14)

1. a network allocation method, it is characterised in that be applied to server, described method includes:

When client request access network, the described client that acquisition network access equipment is forwarded is only One property mark；

According to the corresponding relation of the unique identification set with network type, determine described unique identification institute Corresponding objective network type；

The information characterizing described objective network type is returned, in order to described network to described network access equipment Access device is according to described information, by subnet corresponding for described client distribution to described objective network type Network carries out network access.

Network allocation method the most according to claim 1, it is characterised in that described to described network Access device returns the information of the described objective network type of sign and includes:

According to the corresponding relation of network type Yu the network identity of sub-network, determine described objective network type The network identity of corresponding sub-network；

Described network identity is returned, in order to described network access equipment is by described to described network access equipment The client distribution sub-network that extremely described network identity is corresponding carries out network access.

Network allocation method the most according to claim 1, it is characterised in that described to described network Access device returns the information of the described objective network type of sign and includes:

The information comprising described objective network type is returned, in order to described network to described network access equipment Access device, according to the corresponding relation of the network type set with the network identity of sub-network, determines described mesh The network identity of mark sub-network corresponding to network type so that described network access equipment is by described client The end distribution sub-network that extremely described network identity is corresponding carries out network access.

4. according to the network allocation method described in any one of claim 1-3, it is characterised in that described in obtain The unique identification taking the described client that network access equipment is forwarded includes:

Obtain the authentication information of the described client that network access equipment is forwarded, described authentication Information comprises unique identification and the identity information of described client；

The described corresponding relation according to the unique identification set with network type, determines described uniqueness mark Objective network type corresponding to knowledge includes:

After the identity verifying described client according to described identity information is legal, according to the uniqueness set Mark and the corresponding relation of network type, determine the objective network type corresponding to described unique identification.

Network allocation method the most according to claim 4, it is characterised in that described identity information bag Include ID and the user cipher of described client；

When the unique identification using described ID as described client, described according to described body After described in part Information Authentication, the identity of client is legal, according to the unique identification set and network type Corresponding relation, determines that the objective network type corresponding to described unique identification includes:

After verifying described ID and user cipher coupling, according to the ID set and network class The corresponding relation of type, determines the objective network type corresponding to described ID.

Network allocation method the most according to claim 4, it is characterised in that described identity information bag Include ID and the user cipher of described client；

In the device identification of the subscriber equipment to load described client as the uniqueness mark of described client During knowledge, described after the identity verifying described client according to described identity information is legal, according to set Unique identification and the corresponding relation of network type, determine the objective network corresponding to described unique identification Type includes:

After verifying described ID and user cipher coupling, according to the device identification set and network class The corresponding relation of type, determines the objective network type corresponding to described device identification.

7. a network allocation method, it is characterised in that be applied to network access equipment, described method bag Include:

When client request access network, obtain the unique identification of described client；

Described unique identification is forwarded to server, in order to described server is according to the uniqueness mark set Know the corresponding relation with network type, determine the objective network type corresponding to described unique identification；

Receive the information characterizing described objective network type that described server sends；

According to described information, by sub-network corresponding for described client distribution to described objective network type Carry out network access.

Network allocation method the most according to claim 7, it is characterised in that the described clothes of described reception The information characterizing described objective network type that business device sends includes:

Receive the network mark with the sub-network corresponding to described objective network type that described server returns Know；

Described according to described information, by subnet corresponding for described client distribution to described objective network type Network carries out network access include:

Sub-network corresponding for described client distribution to described network identity will carry out network access.

Network allocation method the most according to claim 7, it is characterised in that the described clothes of described reception The information characterizing described objective network type that business device sends includes:

Receive the information comprising described objective network type that described server sends；

Described according to described information, by subnet corresponding for described client distribution to described objective network type Network carries out network access include:

According to the corresponding relation of the network type set with the network identity of sub-network, determine described target network The network identity of the sub-network corresponding to network type；

Sub-network corresponding for described client distribution to described network identity will carry out network access.

10. according to the network allocation method described in any one of claim 7-9, it is characterised in that described in obtain The unique identification taking described client includes:

Obtaining the authentication information that described client sends, described authentication information comprises described client The unique identification of end and identity information；

Described described unique identification be forwarded to server include:

The authentication information of the unique identification comprising described client and identity information is sent to service Device, in order to described server according to described identity information verify described client identity legal after, root According to the corresponding relation of the unique identification set with network type, determine corresponding to described unique identification Objective network type.

11. network allocation methods according to claim 10, it is characterised in that described identity information Including: the ID of described client and user cipher；Described network access equipment is at described server After verifying described ID and user cipher coupling, receive the described target of sign that described server sends The information of network type；

Wherein, when the unique identification using described ID as described client, described target network Network type is the network type corresponding to described ID；To load the subscriber equipment of described client Device identification as the unique identification of described client time, described objective network type is described equipment Network type corresponding to mark.

12. 1 kinds of servers, it is characterised in that including:

Mark forwards acquisition module, for when client request access network, obtaining network access equipment The unique identification of the described client forwarded；

Objective network determination type module, for corresponding with network type according to the unique identification set Relation, determines the objective network type corresponding to described unique identification；

Characterization information sending module, characterizes described objective network class for returning to described network access equipment The information of type, in order to described network access equipment is according to described information, by the distribution of described client to described The sub-network that objective network type is corresponding carries out network access.

13. 1 kinds of network access equipments, it is characterised in that including:

Identifier acquisition module, for when client request access network, obtaining the unique of described client Property mark；

Forwarding module, for being forwarded to server by described unique identification, in order to described server according to The unique identification set and the corresponding relation of network type, determine the mesh corresponding to described unique identification Mark network type；

Characterization information receiver module, for receiving the sign described objective network type that described server sends Information；

Distribution module, for according to described information, by the distribution of described client to described objective network type Corresponding sub-network carries out network access.

14. 1 kinds of network distribution systems, it is characterised in that including:

Network access equipment, for when client request access network, obtaining the unique of described client Property mark, described unique identification is forwarded to server, receive described server send sign described in The information of objective network type, and according to described information, by the distribution of described client to described objective network The sub-network that type is corresponding carries out network access；

Server, for obtaining the unique identification of the described client that network access equipment is forwarded, root According to the corresponding relation of the unique identification set with network type, determine corresponding to described unique identification Objective network type, returns the information characterizing described objective network type to described network access equipment.