CN107659948B

CN107659948B - Method and device for controlling access of AP (access point)

Info

Publication number: CN107659948B
Application number: CN201710859522.0A
Authority: CN
Inventors: 柯葳
Original assignee: Hangzhou H3C Technologies Co Ltd
Current assignee: Hangzhou H3C Technologies Co Ltd
Priority date: 2017-09-21
Filing date: 2017-09-21
Publication date: 2021-06-11
Anticipated expiration: 2037-09-21
Also published as: CN107659948A

Abstract

The embodiment of the application provides a method and a device for controlling access of an AP (access point), and belongs to the technical field of communication. The method is applied to the AC, the AC belongs to an AC group, the AC group also comprises other ACs, and each AC in the AC group shares license files, and the method comprises the following steps: acquiring the available access number of each AC in the AC group; when detecting that a first AC in the other ACs has a fault, determining a second available access number which needs to be taken over locally according to a first available access number of the first AC and a preset taking-over rule; determining the sum of the second available access number and a local current third available access number to obtain a fourth available access number to be used; and performing AP access control according to the fourth available access number. The invention can reduce the deployment cost of the wireless local area network.

Description

Method and device for controlling access of AP (access point)

Technical Field

The present application relates to the field of communications technologies, and in particular, to a method and an apparatus for controlling access to an AP.

Background

A wireless lan is usually provided with a plurality of APs (Access points) and a plurality of ACs (Access controllers). In the centralized forwarding mode, the AC may undertake a lot of state maintenance and data forwarding work for the APs, that is, one AC may access a plurality of APs. The AC will be configured with a corresponding license file that is a file that authorizes the AP to be allowed access to the AC. The user may determine, by way of purchase, the number of APs that the AC may access, which will be written to the license file of the AC. When the AP accesses the AC, the AC judges whether the number of the currently accessed AP reaches the number, if not, the AP is allowed to access, and if so, the AP is refused to access.

In order to prevent an AC from failing to operate normally due to a failure of an AC, a management server of the AC and a redundant AC are usually installed in the network. The license file may be installed in the management server and authorize the number of APs that can be accessed for each AC. When detecting that a certain AC has a fault, the management server authorizes the number of the AC to a redundant AC, and the redundant AC can perform AP access management according to the number. In the solution based on the prior art, a management server of the AC needs to be set in the wireless lan, resulting in higher deployment cost of the wireless lan.

Disclosure of Invention

An object of the embodiments of the present application is to provide a method and an apparatus for controlling access to an AP, so as to achieve a technical effect of reducing deployment cost of a wireless local area network. The specific technical scheme is as follows:

in a first aspect, a method for controlling access to an AP is provided, where the method is applied to access an AC, the AC belongs to an AC group, the AC group further includes other ACs, and each AC in the AC group shares a license file, and the method includes:

acquiring the available access number of each AC in the AC group;

when detecting that a first AC in the other ACs has a fault, determining a second available access number which needs to be taken over locally according to a first available access number of the first AC and a preset taking-over rule;

determining the sum of the second available access number and a local current third available access number to obtain a fourth available access number to be used;

performing AP access control according to the fourth available access number

In a second aspect, an apparatus for controlling access to an AP is provided, where the apparatus is applied to an AC, the AC belongs to an AC group, the AC group further includes other ACs, and each AC in the AC group shares a license file, and the apparatus includes:

an obtaining module, configured to obtain an available access number of each AC in the AC group;

the first determining module is used for determining a second available access number which needs to be taken over locally according to the first available access number of the first AC and a preset taking-over rule when the first AC in the other ACs is detected to have a fault;

a second determining module, configured to determine a sum of the second available access number and a local current third available access number, to obtain a fourth available access number to be used;

and the control module is used for carrying out AP access control according to the fourth available access number.

The method for controlling access to the AP provided by the embodiment of the present invention may be applied to an AC, where the AC belongs to an AC group, the AC group further includes other ACs, each AC in the AC group shares a license file, the AC may obtain an available access number of each AC in the AC group, when a failure of a first AC in the other ACs is detected, determine a second available access number that needs to be locally taken over according to the first available access number of the first AC and a preset takeover rule, then determine a sum of the second available access number and a local current third available access number to obtain a fourth available access number to be used, and further perform AP access control according to the fourth available access number. Based on the scheme, when a certain AC in the AC group breaks down, other ACs in the group can automatically take over the available access number of the AC without setting a management server, so that the deployment cost of the wireless local area network is reduced. Of course, it is not necessary for any product or method of the present application to achieve all of the above-described advantages at the same time.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a flowchart of a method for controlling access to an AP according to an embodiment of the present invention;

fig. 2 is a flowchart of a method for determining an available access number that needs to be taken over according to an embodiment of the present invention;

fig. 3 is a schematic structural diagram of an apparatus for controlling AP access according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of an AC according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

The embodiment of the invention provides a method for controlling access of an AP (access point), which can be applied to an AC (access controller), wherein the AC belongs to a certain AC group, and the AC group can also comprise other ACs. A dedicated communication tunnel may be created between any two ACs in the group of ACs so that any two ACs in the group of ACs may communicate. The AC group typically belongs to the same user, and the number of ACs included in the AC group may be determined by the belonging user.

The configuration personnel can configure the shared license file of the AC group through a configuration command. The shared license file can be installed on a certain AC in the AC group, and other ACs can know the number of APs (which may be called authorized APs) that can be accessed by the AC group through communication with the AC, so as to calculate the number of locally available accesses. Or license files may be installed in each AC, each license file may include the number of authorized APs of the AC, and any AC may acquire the number of authorized APs of other ACs, so as to obtain the number of authorized APs of the AC group.

In the embodiment of the present invention, a configuration process of an AC group is described by taking an example in which a license file is installed in each AC.

In practice, a configuration person may set configuration information in each AC within the AC group via a configuration command, which may include the number of available accesses (also referred to as license shares) for the AC, the identity of other ACs in the AC group to which it belongs, and identity information for each AC. Wherein the number of available accesses is used to indicate the number of APs that the AC can actually access, and the number of available accesses may be different from the number of authorized APs in the license file of the AC. The available access number can be percentage or specific quantity, when the available access number is percentage, the sum of the available access numbers of all the ACs in the AC is less than or equal to 100%; when the number of available accesses is a specific number, the sum of the number of available accesses of each AC in the AC is less than or equal to the sum of the number of authorized APs of each AC in the AC. The number of available accesses is stored in a storage space other than the license file. The identity information of the AC may indicate whether the AC is a backup device, and whether the backup device is set in the AC group may be set by a configuration staff according to needs, which is not limited in this embodiment. It should be noted that, when the AC is a backup device, the license share of the AC may be configured to be 0. The configuration information in each AC in the AC group remains consistent.

The AC may store the configuration information, and then may query license information of other ACs in the AC group in a broadcast manner, where the license information may include expiration time of a license file, the number of authorized APs, and the like. For the case that the available access number is a percentage, the AC may determine the total number of authorized APs in the AC group according to the obtained number of authorized APs of each AC, further multiply the total number by the available access number configured locally to obtain the number of locally actually accessible APs, and perform AP access control based on the number.

It should be noted that, in the AC group, when the license file is installed or uninstalled on any AC, other ACs need to be notified by broadcast, so that the other ACs update the total number of authorized APs in the AC group in time. For example, a license file is installed on an AC, a first notification message broadcast-sent by the AC to other ACs may carry an identifier of the AC and the number of authorized APs of the license file, and after receiving the first notification message, the other ACs may add the number of authorized APs to the stored total number to obtain the total number of the number of authorized APs of the current AC group; and after receiving the first notification message, the other ACs may subtract the number of the authorized APs corresponding to the AC from the stored total number to obtain the total number of the authorized APs in the current AC group.

In addition, the number of available accesses of each AC may also be determined by means of automatic allocation. The specific process can be as follows: for any AC in the AC group, the AC may obtain specifications (such as processing capacity, etc.) of other ACs, and then determine an available access number (the available access number is a percentage) corresponding to each AC according to a load balancing principle. With automatic allocation, no backup devices will be set in the AC group. If the backup equipment needs to be set, the configuration is needed by the user.

As shown in fig. 1, the method for controlling access to an AP may include the following steps:

step 101, obtaining the available access number of each AC in the AC group.

In an implementation, for any one of the AC groups, the AC may obtain the number of available accesses for other ACs in the AC group. The number of available accesses may be pre-stored in the AC, which may then locally retrieve the number of available accesses of other AC pre-stored. Or, the AC may broadcast a request message to other ACs in the AC group to which the AC belongs, and after receiving the request message, the other ACs may send the available access number of the AC to the AC. The AC may then store the number of available accesses for other transmissions.

Step 102, when detecting that a first AC of the other ACs fails, determining a second available access number that needs to be taken over locally according to the first available access number of the first AC and a preset takeover rule.

In implementation, a dedicated communication tunnel may be created between any two ACs in the AC group, and it may be detected whether other ACs have failed through the communication tunnel. For example, a heartbeat message may be sent between the ACs through the communication tunnel, and if it is detected that the heartbeat message of a certain AC is interrupted, it may be determined that the AC fails; or, a disconnection event may be detected through the communication tunnel, and if a disconnection event of an AC is detected, it is determined that the AC has a failure; or, the system signal of each AC may also be detected through the communication tunnel, and if the system signal of a certain AC is detected to be interrupted, it may be determined that the AC has a fault.

A take-over rule may also be pre-stored in each AC, which may be set by a technician. When an AC (which may be referred to as a second AC) detects that a first AC of other ACs fails, the second AC may determine a second available access number that needs to be locally taken over according to the available access number of the first AC (i.e., the first available access number) and a preset takeover rule.

Optionally, for a case that the AC group is provided with the backup device, the backup device may take over all available access numbers of the failed AC, and the corresponding processing procedure is as follows: acquiring local identity information, and if the identity information indicates that the identity information is backup equipment, taking the first available access number of the first AC as a second available access number which needs to be taken over locally; and if the identity information indicates that the self is the non-backup equipment, determining a second available access number which needs to be taken over locally according to the identity information of the available AC in other ACs.

In implementation, when the second AC detects that the first AC fails, the second AC may obtain the identity information of the second AC to determine whether the second AC is a backup device. If the identity information indicates that the first AC is the backup device, the first available access number of the first AC is used as a second available access number that needs to be taken over locally, that is, all available access numbers of the first AC are taken over, and then a second notification message may be sent to other ACs, where the second notification message may carry the identity information of the backup device to notify other ACs that the taking over processing is not needed. If the identity information indicates that the device is a non-backup device, a second available access number which needs to be taken over locally can be determined according to the identity information of the available AC in other ACs. For example, the identity information may be backup equipment or non-backup equipment, and after the second AC detects that backup equipment exists in other ACs, it is determined that the number of second available accesses that need to be taken over locally is 0; alternatively, the identity information may be a takeover device or an un-takeover device, where the un-takeover device does not take over the number of available accesses of other ACs, then the second AC may determine the number of takeover devices in other ACs, take the inverse of the number as the second number of available accesses that needs to be taken over locally,

optionally, if a backup device exists in the other ACs, the backup device takes over, and if no backup device exists in the other ACs, the available AC shares the available access number of the first AC, and the corresponding processing procedure may be as follows: acquiring identity information of available AC in other AC; if the available AC does not have the AC with the identity information of the backup equipment, determining a second available access number which needs to be taken over locally according to the first available access number and the local taking-over weight; if the AC with the identity information of the backup device exists in the available ACs, the number of the available accesses which need to be taken over locally is 0.

In implementation, when any AC in the AC group detects that the first AC fails, a third notification message carrying local identity information may be sent to other ACs. If the second AC determines that the second AC is not the backup device, it may further determine whether a backup device exists in the other ACs, for example, the second AC may analyze third notification messages sent by the other ACs, and determine whether a third notification message carrying the identity information of the backup device exists. If so, it may be determined that the number of available accesses that need to be taken over locally is 0. If the backup device does not exist, and a second available access number which needs to be taken over locally can be determined according to the first available access number and the local takeover weight.

In practice, the takeover mode may be various, optionally, an equal division mode may be adopted, and the corresponding processing procedure may be as follows: determining a number of ACs available in the AC group; the inverse of the number of AC's available is taken as the local take-over weight.

In an implementation, the second AC may detect the available ACs in the AC group, and then count the number of available ACs, and use the inverse of the number as the local takeover weight. For example, if the number of available ACs is N, then the local takeover weight is 1/N.

Alternatively, the second AC may determine the local takeover weight based on the specifications (e.g., processing power, etc.) of the other ACs, and then based on load balancing. For example, there are 3 available ACs, A, B, C each, with a processing power proportional relationship of 1:2:3, then a takes over weight of 1/6, B takes over weight of 1/3, and C takes over weight of 1/2.

The second AC may obtain a local takeover weight and may then calculate the product of the first number of available accesses and the local takeover weight as a second number of available accesses that the local needs to take over.

Optionally, before obtaining the local identity information, it may be determined whether there are other available ACs, and the corresponding processing procedure may be as follows: determining whether an available AC exists in other ACs, and if so, executing the step of acquiring local identity information; if not, the first number of available accesses of the first AC is taken as the second number of available accesses that needs to be taken over locally.

In implementation, when the second AC detects that the first AC fails, it may determine whether an available AC exists in the other ACs through a communication tunnel with the other ACs, and if so, may send a fourth notification message to the available AC in a broadcast manner, where the fourth notification message may be used to notify the available AC "it is known that there is some AC failure, negotiate how to switch license shares", and may perform the step of acquiring local identity information; if not, it may be said that only the local access is available in the AC group, and the first available access number of the first AC is used as the second available access number that the local needs to take over.

Step 103, determining the sum of the second available access number and the local current third available access number to obtain a fourth available access number to be used.

In an implementation, after the second AC determines the second available access number, a sum of the second available access number and a third local current available access number may be calculated to obtain a fourth available access number to be used.

And step 104, performing access control on the AP according to the fourth available access number.

In implementation, for the case that the number of available accesses is a specific number, after the second AC determines a fourth number of available accesses to be used, the fourth number of available accesses is an upper limit of the number of APs that can actually be accessed locally. For the case that the number of available accesses is a percentage, the second AC may multiply the total number of authorized APs of the AC group by the fourth number of available accesses, resulting in an upper limit on the number of APs that can actually be accessed locally. When some AP accesses the second AC, the second AC judges whether the number of the currently accessed AP reaches the upper limit of the number, if not, the AP is allowed to access, and if so, the AP is refused to access.

Optionally, after the failure of the first AC is recovered, the other ACs may also perform a switchback process, and the corresponding process may be as follows: and when a fault recovery message sent by the first AC is received, performing access control on the AP according to the third available access number, and performing offline processing on the second available access number AP in the locally accessed AP.

In an implementation, after the first AC recovers from the failure, the first AC may send a failure recovery message (the failure recovery message may also be referred to as a license recovery request message) to other ACs in the AC group, and after receiving the failure recovery message, the second AC may modify the currently used available access number from the fourth available access number to the third available access number, and then perform AP access control according to the third available access number. Optionally, the second AC may also perform offline processing on the second available access number AP in the locally accessed AP. Wherein, for the case that the available access number is a percentage, the second AC may multiply the second available access number by the total number of authorized APs of the AC group, determine the number of APs that need to be offline, and then offline the APs based on the number.

The embodiment of the present invention further provides a method for determining an available access number that needs to be taken over, as shown in fig. 2, the method may include the following steps:

in step 201, a failure of a first AC of the other ACs is detected.

Step 202, determine whether there is an available AC among other ACs.

If yes, go to step 203; if not, step 207 is performed.

Step 203, local identity information is obtained.

Step 204, determine whether the identity information represents a backup device.

If yes, go to step 207; if the identity information indicates that it is a non-backup device, step 205 is performed.

Step 205, determine if there is a backup device in other ACs.

If not, go to step 206; if so, step 208 is performed.

And step 206, determining a second available access number which needs to be taken over locally according to the first available access number of the first AC and the local takeover weight.

Step 207, the first number of available accesses of the first AC is used as the second number of available accesses that needs to be taken over locally.

Step 208, determine the number of available accesses that need to be taken over locally is 0.

The method for controlling access to the AP provided by the embodiment of the present invention may be applied to an AC, where the AC belongs to an AC group, the AC group further includes other ACs, each AC in the AC group shares a license file, the AC may obtain an available access number of each AC in the AC group, when a failure of a first AC in the other ACs is detected, determine a second available access number that needs to be locally taken over according to the first available access number of the first AC and a preset takeover rule, then determine a sum of the second available access number and a local current third available access number to obtain a fourth available access number to be used, and further perform AP access control according to the fourth available access number. Based on the scheme, when a certain AC in the AC group breaks down, other ACs in the group can automatically take over the available access number of the AC without setting a management server, so that the deployment cost of the wireless local area network is reduced.

Based on the same technical concept, an embodiment of the present invention further provides an apparatus for controlling access to an access point AP, where the apparatus is applied to an AC, the AC belongs to an AC group, the AC group further includes other ACs, and each AC in the AC group shares a license file, as shown in fig. 3, the apparatus includes:

an obtaining module 310, configured to obtain an available access number of each AC in the AC group;

a first determining module 320, configured to determine, when it is detected that a first AC of the other ACs fails, a second available access number that needs to be locally taken over according to a first available access number of the first AC and a preset takeover rule;

a second determining module 330, configured to determine a sum of the second available access number and a local current third available access number, to obtain a fourth available access number to be used;

a control module 340, configured to perform AP access control according to the fourth available access number.

Optionally, the first determining module 320 is specifically configured to:

acquiring local identity information, and if the identity information indicates that the identity information is backup equipment, taking the first available access number of the first AC as a second available access number which needs to be taken over locally; and if the identity information indicates that the self is the non-backup equipment, determining a second available access number which needs to be taken over locally according to the identity information of the available AC in the other ACs.

Optionally, the first determining module 320 is specifically configured to:

acquiring identity information of the available AC in the other ACs;

if the available AC does not have the AC with the identity information of the backup equipment, determining a second available access number which needs to be taken over locally according to the first available access number and the local taking-over weight;

if the AC with the identity information of the backup device exists in the available ACs, the number of the available accesses which need to be taken over locally is 0.

Optionally, the first determining module 320 is specifically configured to:

determining a number of ACs available in the AC group;

taking the inverse of the number of available ACs as a local takeover weight.

Optionally, the first determining module 320 is specifically configured to:

and determining the product of the first available access number and the local takeover weight, and taking the product as a second available access number which needs to be taken over locally.

Optionally, the first determining module 320 is specifically configured to:

determining whether an available AC exists in the other ACs, and if so, executing the step of acquiring local identity information; if not, the first number of available accesses of the first AC is used as a second number of available accesses which need to be taken over locally.

Optionally, the control module 340 is further configured to:

and when a fault recovery message sent by the first AC is received, performing AP access control according to the third available access number, and performing offline processing on the second available access number AP in the locally accessed AP.

The embodiment of the present invention further provides an AC, as shown in fig. 4, which includes a processor 401, a communication interface 402, a memory 403, and a communication bus 404, where the processor 401, the communication interface 402, and the memory 403 complete mutual communication through the communication bus 404,

a memory 403 for storing a computer program;

a processor 401, configured to execute the program stored in the memory 403, so as to cause the node apparatus to perform the following steps, where the steps include:

acquiring the available access number of each AC in the AC group;

and performing AP access control according to the fourth available access number.

Optionally, the determining, according to the first available access number of the first AC and a preset takeover rule, a second available access number that needs to be locally taken over includes:

Optionally, the determining, according to the identity information of the other ACs, a second available access number that needs to be locally taken over includes:

acquiring identity information of the available AC in the other ACs;

Optionally, the method further includes:

determining a number of ACs available in the AC group;

taking the inverse of the number of available ACs as a local takeover weight.

Optionally, the determining, according to the first available access number and the local takeover weight, a second available access number that needs to be taken over locally includes:

Optionally, before acquiring the local identity information, the method further includes:

Optionally, after performing AP access control according to the fourth available access number, the method further includes:

The machine-readable storage medium may include a RAM (Random Access Memory) and may also include a NVM (Non-Volatile Memory), such as at least one disk Memory. Additionally, the machine-readable storage medium may be at least one memory device located remotely from the aforementioned processor.

The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also a DSP (Digital Signal Processing), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other Programmable logic device, discrete Gate or transistor logic device, discrete hardware component.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.

The above description is only for the preferred embodiment of the present application, and is not intended to limit the scope of the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A method for controlling access of an Access Point (AP), the method is applied to an Access Controller (AC), the AC belongs to an AC group, the AC group further comprises other ACs, and each AC in the AC group shares a license file, and the method comprises the following steps:

acquiring the available access number of each AC in the AC group;

determining the sum of the second available access number and a local current third available access number to obtain a fourth available access number;

2. The method of claim 1, wherein determining a second number of available accesses that need to be taken over locally according to the first number of available accesses of the first AC and a preset takeover rule comprises:

3. The method of claim 2, wherein the determining the second number of available accesses that need to be locally taken over according to the identity information of the other ACs comprises:

acquiring identity information of the available AC in the other ACs;

4. The method of claim 3, further comprising:

determining a number of ACs available in the AC group;

taking the inverse of the number of available ACs as a local takeover weight.

5. The method of claim 3, wherein determining a second number of available accesses that need to be taken over locally according to the first number of available accesses and a local takeover weight comprises:

6. The method of claim 2, wherein before obtaining the local identity information, further comprising:

7. The method of claim 1, wherein after performing AP access control according to the fourth available access number, further comprising:

and when a fault recovery message sent by the first AC is received, carrying out AP access control according to the third available access number, and carrying out offline processing on the second available access number of APs in the locally accessed APs.

8. An apparatus for controlling access of an Access Point (AP), the apparatus being applied to an Access Controller (AC), the AC belonging to an AC group, the AC group further including other ACs, each AC in the AC group sharing a license file, the apparatus comprising:

a second determining module, configured to determine a sum of the second available access number and a local current third available access number, to obtain a fourth available access number;

9. The apparatus of claim 8, wherein the first determining module is specifically configured to:

10. The apparatus of claim 9, wherein the first determining module is specifically configured to:

acquiring identity information of the available AC in the other ACs;

11. The apparatus of claim 10, wherein the first determining module is specifically configured to:

determining a number of ACs available in the AC group;

taking the inverse of the number of available ACs as a local takeover weight.

12. The apparatus of claim 10, wherein the first determining module is specifically configured to:

13. The apparatus of claim 9, wherein the first determining module is specifically configured to:

14. The apparatus of claim 8, wherein the control module is further configured to:

15. An access controller, AC, comprising a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor being caused by the machine-executable instructions to: carrying out the method steps of any one of claims 1 to 7.