WO2010045833A1

WO2010045833A1 - Method, system and device for processing messages in wireless service network

Info

Publication number: WO2010045833A1
Application number: PCT/CN2009/074105
Authority: WO
Inventors: 郭贤志
Original assignee: 成都市华为赛门铁克科技有限公司
Priority date: 2008-10-22
Filing date: 2009-09-22
Publication date: 2010-04-29
Also published as: CN101374110B; CN101374110A

Abstract

A method, system and device for processing messages in a wireless service network are disclosed in the embodiments of the present invention. The method is applied in an Access Point (AP) device which is configured with a plurality of wireless service networks, wherein, each wireless service network is identified by a Basic Service Set (BSS), and each BSS has a different Virtual Local Area Network Interface (VLANIF). The method includes the following steps of: receiving a message interacting between the VLANIF of the BSS and an external network interface; acquiring a first safety zone to which the VLANIF adds and a second safety zone to which the external network interface adds; processing the message according to the security strategy between the first and the second safety zones. In the embodiments of the present invention, the access control to different BSS is conveniently realized, and the system cost and the configuration complexity are reduced. In addition, the flexibility of the access control is increased by setting different security strategies.

Description

Method, system and device for processing messages in wireless service network

The present invention relates to the field of communications technologies, and in particular, to a packet processing method, system, and device in a wireless service network. Background technique

Currently, WIFI (wireless fidelity) wireless LAN applications have become more and more popular. From mobile phones, PCs, and laptops to other WIFI mobile devices, more and more users need to connect to the Internet via a WIFI network. Early devices can only support the creation of a BSS (Basic Service Set), that is, an AP (Access Point) can only provide users with a "wireless network" and all users on the network. The permissions are basically the same. With the popularity of current wireless networks, there is a need for an AP to provide multiple wireless networks.

For example, organizations will have visitors with WIFI devices, and these WIFI devices need to be connected to the Internet. In the prior art, in order to meet the Internet access requirements of these non-trusted users, multiple wireless networks are usually provided on the same AP. For example, create two BSSs on the same AP, one of which is called Public and is used by visitors, and the other is called Corporate and is used by internal users. Visitors can only join the Public network, and then they can access the Internet but not the internal network. Internal users can access the internal network after joining the Corporate network. Each BSS in this instance is equivalent to a virtual AP and has its own SSID.

(Service Set Identifier,), MAC (Media Access Control) address, authentication settings, and encryption settings, and use different security policies.

In order to implement isolation and access control between the above virtual APs, VLANs are generally used in the prior art.

(Virtual Local Area Network, virtual office i or network) technology. Take the networking environment shown in Figure 1 as an example. Each VLAN is assigned a VLAN. Different VLANs cannot access each other. On the AP The row port is a "trunk port" that can be used to transfer data from different VALNs. The Publ ic network belongs to VLAN1, and the Corporate network and the intranet authentication server (Authent ication Server) belong to VLAN 2. Because they belong to different VLANs, Publ ic network users cannot access the corporate wireless network and the authentication server of the intranet, that is, different BSS access control is implemented by dividing different VLANs.

The inventors have found that the implementation in the prior art has the following problems:

In existing BSS applications, additional VLAN-enabled switches and APs and switches need to be deployed, which increases system cost and configuration complexity. In addition, when access control of different BSSs is implemented by VLAN division, the implementation of access control is not flexible enough. Summary of the invention

The embodiments of the present invention provide a method, a system, and a device for processing a message in a wireless service network, which reduce the cost and configuration complexity of the system.

An embodiment of the present invention provides a method for processing a packet in a wireless service network, which is applied to an access point AP device configured with multiple wireless service networks, where each of the wireless service networks is distinguished by a basic service set BSS. Each BSS is configured with a different virtual LAN interface VLANIF, and the method includes:

Receiving a message exchanged between the VLANIF and the external network interface in the BSS;

Obtaining a first security zone to which the VLAN I F is added, and a second security zone to which the external network interface is added;

The message is processed according to a security policy between the first security zone and the second security zone.

An embodiment of the present invention further provides an access point AP device, where the AP device is configured with multiple wireless service networks, and each of the wireless service networks is distinguished by a basic service set BSS, and each BSS has a different virtual The LAN interface VLANIF, the AP device includes:

a message receiving unit, configured to receive an interaction between the VLAN IF and an external network interface in the BSS Message

a security area obtaining unit, configured to acquire a first security area to which the VLANIF is added, and a second security area to which the external network interface joins;

And a packet processing unit, configured to process the packet according to a security policy between the first security zone and the second security zone.

The embodiment of the present invention further provides a network system, including a user terminal and an access point AP device, where the AP device is configured with multiple wireless service networks, and each of the wireless service networks is distinguished by a basic service set BSS. Each BSS has a different VLAN interface VLANIF,

The user terminal is configured to access a BSS and send, by using a VLANIF of the BSS, a message that needs to be sent to an external network to the AP device, and receive an external device that is sent by the AP device through a VLANIF of the BSS. Network message;

The AP device is configured to receive a packet exchanged between the VLANIF and an external network interface in the BSS, obtain a first security zone to which the VLANIF is added, and a second security zone to which the external network interface joins. And processing the packet according to a security policy between the first security area and the second security area.

Embodiments of the present invention have the following advantages over the prior art:

In the embodiment of the present invention, a VLANIF is set for different BSSs, and the packets sent by the VLANIF in the BSS are received, and the packets are processed according to security policies between different security zones. This eliminates the need to deploy switches and easily implements access control for different BSSs, reducing system cost and configuration complexity. In addition, the flexibility of access control is improved by setting different security policies. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor. 1 is a schematic diagram of implementing access control of different BSSs by VLAN division in the prior art; FIG. 2 is a flowchart of a method for processing messages in a wireless service network according to an embodiment of the present invention;

3 is a flowchart of a method for configuring an AP according to an embodiment of the present invention;

4 is a schematic diagram of access control of different BSSs according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for processing a packet sent by a BSS to an external network according to an embodiment of the present invention. FIG. 6 is a flowchart of a method for processing a packet sent by an external network to a BSS according to an embodiment of the present invention. Schematic diagram of the AP device;

FIG. 8 is another schematic structural diagram of an AP device according to an embodiment of the present invention. The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. example. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

An embodiment of the present invention provides a method for processing a wireless service network, which is applied to an AP device configured with multiple wireless service networks, where each wireless service network is distinguished by a BSS, and each BSS has a different VLANIF (VLAN Interface). The method is as shown in Figure 1, including:

Step s201: Receive a packet exchanged between the VLANIF in the BSS and the external network interface. Step s 202: Obtain a first security zone to which the VLANIF is added, and a second security zone to which the external network interface is added.

Step s203: Process the packet according to the security policy between the first security zone and the second security zone.

In the above method provided by the embodiment of the present invention, VLANIF is set for different BSS, and the BSS is received. The packets sent by the VLANIF are processed according to the security policy of different security zones. Therefore, access control of different BSSs can be easily implemented without deploying a switch, which reduces system cost and configuration complexity. In addition, the flexibility of access control is improved by setting different security policies.

In the embodiment of the present invention, the VLANIF is configured for the BSS, and the VLANIF of the BSS is added to the security zone to implement access control of the BSS. After the BSS is created on the AP, the BSS is assigned a VLAN and the corresponding VLANIF interface is created. The VLANs are divided into different VLANs. Different BSSs cannot access each other. This allows VLANs to be isolated from each other. User terminals in the BSS network cannot access other networks, such as the Internet or the internal network, without other configurations. When sending a packet to another network, the BSS must first add the VLANIF of the BSS to the security zone and configure the security policy in the security zone. Only when the packet to be sent in the BSS meets the security policy of the security zone, the packet is sent. Can be sent to other networks.

In the embodiment of the present invention, the specific method for performing BSS configuration on the AP is as shown in FIG. 3, and includes the following steps:

Step s 301. Create a BSS on the AP.

Step s 302: Assign a VLAN to the BSS, and create a VLANIF at the same time.

Step s 303: Configure an IP address for the VLANIF on the AP, and configure a DHCP (Dynamic Host Configuration Protocol) server of the VLANIF. The DHCP server is configured to allocate an IP address to a user terminal that subsequently accesses the BSS.

Step s 304: Add VLAN I F to a specific security zone.

Specifically, the security zone may be a DMZ (Demi l tar ized Zone) domain.

Step s 305: Configure security policies between different security zones, and access of the BSS to other networks is controlled by security zones between security zones.

Specifically, the security policy can be configured through an ACL (Acs s Control List, access control list) or other methods. The specific content of the security policy can be: Allow IP addresses to be specific A packet of a user terminal of a network segment (such as 192.168.*.*) passes, allows a specific type of packet to pass, and allows a packet of a user terminal having a specific MAC (Medium Acces s Control) address to pass. and many more.

The specific implementation manners of the embodiments of the present invention are described below in conjunction with a specific network scenario. Take the networking environment shown in Figure 4 as an example. Add VLANIF1 of the Publ ic BSS to the default (Defaul t) domain, add VLANIF2 of the Corpora te BSS to the Trust (Trs t) domain, and connect the AP to the Publ ic network. The interface Port tl is added to the untrusted (Untrus t) domain, and the interface 2 connected to the Corpera te network on the AP is added to the DMZ domain. The above default domain, trust domain, untrusted domain, and DMZ domain belong to a security zone.

The role of the DMZ domain is to connect servers that allow external access, such as "TOB" servers and "E-ma i l" servers, to the DMZ domain. A DMZ domain is equivalent to a relatively independent area that is neither part of an internal network nor an external network, and is generally between an internal network and an external network. Its use is: In actual use, some hosts need to provide external services. In order to better provide high-quality services and at the same time effectively protect the security of the internal network, these hosts that need to be opened to the outside are placed in the DMZ domain. In addition, it is separated from the internal network equipment, and corresponding firewall measures are taken according to different needs, so that the internal network can be protected while providing friendly services.

In the embodiment of the present invention, in conjunction with the network scenario shown in FIG. 4, the access control method of the BSS network to other networks is illustrated by using the access control of the packets sent by the external network in the BSS as an example. , including the following steps:

Step s501: Receive a packet sent by using a VLANIF.

Specifically, it is assumed that the AP receives the packet sent by the user terminal in the Publ ic BSS from the VLANIF1, and the destination address of the packet belongs to the Publ ic network.

Step s502: Determine whether the inbound interface VLANIF1 used by the received packet belongs to the security zone, and then continue, otherwise proceed to step s509.

Specifically, in the embodiment of the present invention, the area configured on the AP belongs to the security zone. Therefore, the VLANIF1 belongs to the Defaul t domain, and the AP determines that the VLANIF1 belongs to the security zone. For the inbound interface If the packet does not belong to the security zone, go to step s509.

Step s503: Search for a route according to the destination address, and determine an outgoing interface of the packet.

Specifically, the AP determines, according to the destination address of the packet and the local routing table, that the outbound interface used for sending the packet is Port1.

Step s504: Determine whether the message out interface Por t l is legal, if yes, continue, otherwise proceed to step s509.

Specifically, because the Por t l is actually present, the AP determines that the interface is legal. For the outbound interface that does not exist, go to step s 509.

Step s505: Determine whether the interface belongs to the security zone, and then continue, otherwise proceed to step s509.

Specifically, because Por tl belongs to the Untrus t domain, the AP determines that the interface Port l belongs to the security zone. For the packets whose inbound interface is not in the security zone, go to step s509.

Step s506: Perform packet matching filtering according to the security policy between the security zone to which the inbound interface belongs and the security zone to which the outbound interface belongs.

Specifically, the AP performs packet matching filtering according to the security policy between the Def aul t domain and the Untrus t domain.

Step s507: Determine whether the packet conforms to the security policy, and then continue, otherwise proceed to step s 509. Step s508: Forward the packet to the outbound interface, and end the packet forwarding process.

Specifically, when the AP determines that the packet meets the security policy between the security zone to which the inbound interface belongs and the security zone to which the outbound interface belongs, the AP forwards the message to the outbound interface Por tl.

Step s5Q9: Discard the packet or not process the packet.

Through the above steps, the access control of the 4 艮 text sent to the external network in the BSS is realized. In the foregoing method provided by the embodiment of the present invention, a VLANIF is set for a different BSS, and a packet sent by the VLANIF in the BSS is received, and the packet is processed according to a security policy between different security zones. The access control of different BSSs is easily implemented, which reduces the cost and configuration complexity of the system. In addition, the flexibility of access control is improved by setting different security policies.

In the embodiment of the present invention, the access control of the packet sent by the external network to the BSS is taken as an example, The access control method of the other network to the BSS network, as shown in FIG. 6, includes the following steps: Step s601: Receive a packet sent by an external network.

Specifically, it is assumed that the AP receives a packet from the Publ ic network from the Por tl, and the destination address of the packet belongs to the Publ ic BSS.

Step s602: Determine whether the inbound interface Por tl used to receive the message belongs to the security zone, and then continue, otherwise proceed to step s 609.

Specifically, in the embodiment of the present invention, the area configured on the AP belongs to the security area. Therefore, since Por tl belongs to the Untrus t domain, the AP determines that Por tl belongs to the security zone. For the packet whose inbound interface is not in the security zone, go to step s 609.

Step s603: Search for a route according to the destination address, and determine the outbound interface VLANIF used to send the packet.

Specifically, the AP determines that the outgoing interface of the packet is VLANIF1 according to the destination address of the packet and the local routing table.

Step s604: Determine whether the outbound interface VLANIF1 of the packet is legal, and then continue, otherwise proceed to step s609.

Specifically, because VLANIF1 does exist, the AP determines that the interface is legal. For the outbound interface that does not exist, go to step s609.

Step s605: Determine whether the interface VLANIF1 belongs to the security zone, and then continue, otherwise proceed to step s609.

Specifically, the VLANIF1 belongs to the Defaul t domain, and the AP determines that the interface VLANIF1 belongs to the security zone. For the message that the outgoing interface does not belong to the security zone, go to step s 609.

Step s606: Perform matching filtering according to the security policy between the security zone to which the inbound interface belongs and the security zone to which the outbound interface belongs.

Step s607: Determine whether the packet conforms to the security policy, and then continue, otherwise proceed to step s 609. Step s608: Forward the packet to the outbound interface, and end the packet forwarding process. Specifically, when the AP determines that the packet matches the security policy between the security zone and the security zone to which the interface belongs, it forwards the packet to the outbound interface, that is, VLANIF1.

Step s6Q9: Discard the packet or not process the packet.

Through the above steps, access control of the external network to the BSS is implemented. The foregoing is a description of the specific implementation manner of the embodiment of the present invention by using the inter-transfer between the Defaul t domain and the Untrus t domain as an example. For the inter-forwarding method of other inter-domain packets, the packet is in the Defaul t domain. Similar to the mutual forwarding between Untrus t domains, the description is not repeated here.

In the foregoing method provided by the embodiment of the present invention, a VLANIF is set for different BSSs, and the packets sent by the VLANIF in the BSS are received, and the packets are processed according to security policies between different security zones. Therefore, access control of different BSSs can be easily implemented without deploying a switch, which reduces system cost and configuration complexity. In addition, access control flexibility is enhanced by setting different security policies.

The embodiment of the present invention further provides a network system, including a user terminal and an AP device. The AP device is configured with multiple wireless service networks, and each wireless service network is distinguished by a BSS. Each BSS has a different VLANIF.

The user terminal is configured to access the BSS and send the packet that needs to be sent to the external network to the AP device through the VLANIF of the BSS, and receive the packet sent by the AP device from the external network through the VLANIF of the BSS;

The AP device is configured to receive the packet exchanged between the VLANIF and the external network interface in the BSS, obtain the first security zone that the VLANIF joins, and the second security zone that the external network interface joins, according to the first security zone and the first security zone. The security policy between the two security zones processes the packets.

An embodiment of the present invention further provides an AP device. The AP device is configured with multiple wireless service networks, and each wireless service network is distinguished by a BSS, and each BSS has a different VLANIF. Specifically, as shown in FIG. 7, the AP device includes:

The message receiving unit 10 is configured to receive a packet exchanged between the VLAN I F and the external network interface in the BSS;

The security area obtaining unit 20 is configured to acquire a first security area to which the VLANIF is added, and The second security zone to which the external network ^ wife mouth is added;

The packet processing unit 30 is configured to process the packet according to the security policy between the first security zone and the second security zone.

In another embodiment of the present invention, as shown in FIG. 8, the device further includes:

The configuration unit 40 is configured to allocate a VLAN for multiple BSSs, and create a corresponding VLANIF for each BSS, and add each VLANIF to a specific security zone, and set a security policy between the security zone to which the VLANIF joins and the security zone to which the external network port joins. .

In addition, the security area obtaining unit 20 of the AP device may further include:

The first obtaining sub-unit 21 is configured to: when the user terminal in the BSS sends the packet to the external network through the VLANIF, obtain the first security zone to which the inbound interface VLANI F of the packet is added, according to the packet The destination address determines the outbound interface of the packet, that is, the external network interface, and obtains the second security zone to which the external network interface of the interface is added.

The second obtaining sub-unit 22 is configured to: when the packet is sent by the external network to the user terminal in the BSS through the VLANIF, obtain the inbound interface of the packet, that is, the second security zone that is added by the external network interface, according to the packet. The destination address determines the outbound interface of the packet, that is, VLANIF, and obtains the first security zone to which the outbound VLANIF is added.

In addition, the packet processing unit 30 of the AP device is specifically configured to: when determining that the packet meets the requirements of the security policy between the first security zone and the second security zone, forward the packet to the destination address of the packet; The text is processed.

In the above system and device provided by the embodiment of the present invention, a VLANIF is set for different BSSs for processing. Thus, the access control to different BSSs is easily realized, and the P-bar reduces the cost and configuration complexity of the system. In addition, the flexibility of access control is improved by setting different security policies.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by hardware or by software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk). And the like, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

The above disclosure is only a few specific embodiments of the present invention, but the present invention is not limited thereto, and any changes that can be considered by those skilled in the art should fall within the protection scope of the present invention.

Claims

Claim

A method for processing a message in a wireless service network, characterized in that, in an access point AP device configured with multiple wireless service networks, each of the wireless service networks is distinguished by a basic service set BSS, Each BSS is configured with a different virtual local area network (VLANIF) VLANIF, and the method includes: receiving a message exchanged between the VLANIF and an external network interface in the BSS;

Obtaining a first security zone to which the VLANIF is added, and a second security zone to which the external network interface is added;

The method according to claim 1, wherein the receiving the message between the VLANIF and the external network interface in the BSS further includes:

Allocating a virtual local area network VLAN to the plurality of BSSs, and creating corresponding VLANIFs for each BSS;

Add the VLANIF to a specific security zone;

Set a security policy between the security zone to which the VLANI F joins and the security zone to which the external network interface joins.

The method of claim 1, wherein the packet is the first security that the VLANIF joins when the user terminal sends the packet sent by the user terminal to the external network through the VLANIF. The area, and the second security area to which the external network interface joins include:

Obtain the first security zone to which the inbound interface of the packet is added by VL AN I F;

And determining, according to the destination address of the packet, an external network interface of the outbound interface of the packet; and acquiring a second security zone that is added by the external network interface of the outbound interface.

The method according to claim 1, wherein, when the packet is a packet sent by the external network to the user terminal in the BSS through the VLANIF, the acquiring the first security zone to which the VLANIF is added, And the second security area added by the external network interface includes:

Obtaining the second security zone to which the external network interface of the inbound interface of the packet is added; The outbound interface VLAN IF of the packet is determined according to the destination address of the packet; and the first security zone to which the outbound interface VLAN IF is added is obtained.

The method according to claim 1 or 2, wherein processing the packet according to the security policy between the first security zone and the second security zone comprises:

Determining that the packet meets the requirements of the security policy between the first security zone and the second security zone, and forwarding the packet to the destination address of the packet; otherwise, the packet is not processed. .

The method according to claim 5, wherein the security policy includes a preset filtering condition; determining that the packet meets a security policy between the first security zone and the second security zone The request includes: matching the packet according to the preset filtering condition in the security policy, and determining that the packet meets the requirements of the security policy between the first security zone and the second security zone when the matching succeeds .

An access point AP device, wherein the AP device is configured with multiple wireless service networks, and each of the wireless service networks is distinguished by a basic service set BSS, and each BSS has a different virtual local area network. Interface VLANIF, the AP device includes:

a message receiving unit, configured to receive a message exchanged between the VLAN I F and an external network interface in the BSS;

The access point AP device according to claim 7, further comprising: a configuration unit, configured to allocate a virtual local area network VLAN to the plurality of BSSs, and create a corresponding VLANIF for each BSS, and the VLAN is The IF joins a specific security zone, and sets a security policy between the security zone to which the VLAN IF joins and the security zone to which the external network interface joins.

9. The access point AP device of claim 7, wherein the secure area is acquired The unit includes:

a first acquiring sub-unit, configured to: when the user terminal is a packet sent by the user terminal in the BSS to the external network through the VLANIF, obtain the first security zone to which the inbound interface VLANIF of the packet is added, according to the report The destination address of the packet determines the external network interface of the outbound interface of the packet, and obtains the second security zone to which the external network port of the outbound interface is added;

a second obtaining sub-unit, configured to: when the external network is a packet sent by the external network to the user terminal in the BSS through the VLANIF, obtain the second security area that is added by the external network interface of the inbound interface of the packet, The destination address of the packet determines the outbound interface VLANIF of the packet, and obtains the first security zone to which the outbound interface VLAN IF joins.

The access point AP device according to claim 7, wherein the packet processing unit is specifically configured to:

When it is determined that the packet meets the requirements of the security policy between the first security zone and the second security zone, the packet is forwarded to the destination address of the packet; otherwise, the packet is not processed.

A network system, comprising a user terminal and an access point AP device, wherein the AP device is configured with multiple wireless service networks, and each of the wireless service networks is distinguished by a basic service set BSS, BSSs have different VLAN interfaces VLANIF,

The user terminal is configured to access a BSS and send, by using a VLANIF of the BSS, a packet that needs to be sent to an external network to the AP device, and receive, by the AP device, an external device that is sent by using a VLAN IF of the BSS. Network message;

The AP device is configured to receive a message exchanged between the VLANIF and the external network interface in the BSS, obtain the first security zone to which the VLANIF is added, and the second security zone to which the external network interface joins, according to The security policy between the first security zone and the second security zone processes the packet.

The network system according to claim 11, wherein the AP device comprises: a message receiving unit, configured to receive a message exchanged between a VLAN IF and an external network interface in the BSS; a security area obtaining unit, configured to acquire a first security area to which the VLANIF is added, and a second security area to which the external network interface is added;