WO2015124043A1 - 策略执行方法、系统、策略执行设备及控制设备 - Google Patents

策略执行方法、系统、策略执行设备及控制设备 Download PDF

Info

Publication number
WO2015124043A1
WO2015124043A1 PCT/CN2015/070338 CN2015070338W WO2015124043A1 WO 2015124043 A1 WO2015124043 A1 WO 2015124043A1 CN 2015070338 W CN2015070338 W CN 2015070338W WO 2015124043 A1 WO2015124043 A1 WO 2015124043A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
address
public network
network address
control device
Prior art date
Application number
PCT/CN2015/070338
Other languages
English (en)
French (fr)
Inventor
尹保国
张日华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2015124043A1 publication Critical patent/WO2015124043A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses

Definitions

  • the present invention relates to the field of network communication technologies, and in particular, to a policy execution method, a system, a policy execution device, and a control device.
  • an authentication device for authenticating a user identity for authenticating a user identity
  • a NAT device for converting a private network address to a public network address for converting a private network address to a public network address
  • policy enforcement device adopts a user name-based policy information configuration manner.
  • the authentication device After the user equipment accesses the private network, the authentication device transmits the correspondence between the user name and the private network address to the policy enforcement device, and the NAT device transmits the private network address of each connection of the user equipment to the policy execution device and the converted public network.
  • the policy execution device After receiving the packet transmitted by the user equipment, the policy execution device searches for the corresponding relationship according to the public network address and port number of the packet to obtain the user corresponding to the public network address and port number. Name, thereby obtaining policy information for processing the message according to the username.
  • the correspondence is transferred to the new policy enforcement device, resulting in poor scalability of the network architecture.
  • a policy execution method In the embodiment of the present invention, a policy execution method, a system, a policy execution device, and a control device are provided.
  • the existing policy execution mode is easy to consume a large amount of network transmission resources, and the scalability of the network architecture is poor.
  • a method for performing a policy comprising:
  • the policy execution device receives the user message
  • the policy execution device obtains a user name corresponding to the public network address of the user packet by using the control device, and the control device is configured to generate, according to the user information transmitted by the authentication device, and the address translation information transmitted by the network address translation NAT device.
  • the policy enforcement device executes a user policy corresponding to the username.
  • the method before the policy execution device receives the user packet, the method further includes:
  • the policy execution device receives an association relationship between the user name and a public network address delivered by the control device;
  • the policy execution device obtains, by using the control device, a user name corresponding to the public network address of the user packet, including:
  • the policy execution device searches for the association relationship according to the public network address of the user packet, and obtains a username corresponding to the public network address of the user packet.
  • the policy execution device obtains, by using the control device, a user name corresponding to the public network address of the user packet, including:
  • the policy execution device reports the public network address of the user packet to the control device;
  • Each public network address corresponding to each user name includes: a public network Internet protocol IP address and a port segment, where the port segment is a NAT device that converts the private network IP address of the user equipment into a public network IP address.
  • a method for performing a policy comprising:
  • the control device receives the user information transmitted by the authentication device, and the address translation information transmitted by the NAT device, where the user information includes a correspondence between a user name of the user equipment and a private network address, where the address translation information includes the user equipment. Correspondence between the private network address and the converted public network address;
  • the control device generates an association relationship between the user name and the public network address according to the user information and the address translation information, so that the policy execution device obtains the public network address corresponding to the received user packet according to the association relationship.
  • the user policy corresponding to the username is executed.
  • the method further includes:
  • control device sends the association relationship between the user name and the public network address to the policy execution device, so that the policy execution device searches for the association relationship according to the public network address of the user packet, and obtains the User name corresponding to the public network address of the user packet.
  • the method further includes:
  • the control device searches for the association relationship according to the public network address of the user packet, and obtains a username corresponding to the public network address of the user packet;
  • the control device sends the obtained username to the policy enforcement device.
  • Each public network address corresponding to each user name includes: a public network IP address and a port segment, where the port segment is the user when the NAT device converts the private network IP address of the user equipment into a public network IP address. A consecutive port number under the public network IP address assigned by the device.
  • a third aspect provides a policy execution system, where the system includes: an authentication device, a NAT device, a control device, and a policy execution device, where
  • the authentication device is configured to transmit user information to the control device, where the user information includes a correspondence between a user name of the user equipment and a private network address;
  • the NAT device is configured to transmit address translation information to the control device, where the address translation information includes a correspondence between a private network address of the user equipment and a converted public network address;
  • the control device is configured to generate an association relationship between the user name and the public network address according to the user information and the address translation information;
  • the policy execution device is configured to obtain, by using the association relationship generated by the control device, a user name corresponding to a public network address of the user packet, and perform a correspondence with the user name.
  • User policy is configured to obtain, by using the association relationship generated by the control device, a user name corresponding to a public network address of the user packet, and perform a correspondence with the user name.
  • the control device is further configured to send an association relationship between the username and a public network address to the policy execution device.
  • the policy execution device is configured to: after searching the association relationship according to the public network address of the user packet, obtain a user name corresponding to the public network address of the user packet.
  • the policy enforcement device is further configured to report the public network address of the user packet to the control device;
  • the control device is further configured to search for the association relationship according to the public network address of the user packet, obtain a user name corresponding to the public network address of the user packet, and send the obtained user name to the Policy enforcement device.
  • Each public network address corresponding to each user name includes: a public network IP address and a port segment, where the port segment is the user when the NAT device converts the private network IP address of the user equipment into a public network IP address. A consecutive port number under the public network IP address assigned by the device.
  • a fourth aspect provides a policy enforcement device, where the policy execution device includes:
  • a receiving unit configured to receive a user message
  • an obtaining unit configured to obtain, by using the control device, a user name corresponding to a public network address of the user packet received by the receiving unit, where the control device is configured to transmit the user information according to the authentication device and the network address translation NAT device
  • the address translation information includes a relationship between the user name and the public network address, where the user information includes a correspondence between the user name of the user equipment and the private network address, and the address translation information includes the private network address of the user equipment.
  • an execution unit configured to execute a user policy corresponding to the username obtained by the obtaining unit.
  • the receiving unit is further configured to receive an association relationship between the user name and a public network address delivered by the control device;
  • the obtaining unit is configured to search for the association relationship received by the receiving unit according to the public network address of the user packet, and obtain a user name corresponding to the public network address of the user packet.
  • the obtaining unit includes:
  • An address reporting subunit configured to report the public network address of the user packet to the control device
  • a user name obtaining sub-unit configured to receive a user name corresponding to the public network address of the user packet returned by the control device, where the user name is the control device, searching according to the public network address of the user packet The username obtained after the association.
  • Each public network address corresponding to each user name includes: a public network Internet protocol IP address and a port segment, where the port segment is a NAT device that converts the private network IP address of the user equipment into a public network IP address.
  • a control device comprising:
  • a receiving unit configured to receive user information transmitted by the authentication device, and address translation information transmitted by the NAT device, where the user information includes a correspondence between a user name of the user equipment and a private network address, where the address translation information includes Correspondence between the private network address of the user equipment and the translated public network address;
  • a generating unit configured to generate an association relationship between the user name and the public network address according to the user information and the address translation information received by the receiving unit, so that the policy execution device obtains the received user according to the association relationship After the user name corresponding to the public network address of the packet, the user policy corresponding to the user name is executed.
  • control device further includes:
  • a first sending unit configured to send, to the policy execution device, an association relationship between the user name and a public network address generated by the generating unit, so that the policy execution device is based on a public network address of the user packet After the association relationship is found, the user corresponding to the public network address of the user packet is obtained. name.
  • the receiving unit is further configured to receive a public network address of the user packet reported by the policy execution device;
  • the control device further includes:
  • a searching unit configured to search for the association relationship according to the public network address of the user packet received by the receiving unit, and obtain a user name corresponding to the public network address of the user packet;
  • a second sending unit configured to send the username obtained by the searching unit to the policy execution device.
  • Each public network address corresponding to each user name includes: a public network IP address and a port segment, where the port segment is the user when the NAT device converts the private network IP address of the user equipment into a public network IP address. A consecutive port number under the public network IP address assigned by the device.
  • a sixth aspect provides a policy enforcement device, where the policy execution device includes: a network interface and a processor, where
  • the network interface is configured to receive a user message
  • the processor is configured to obtain, by using a control device, a user name corresponding to a public network address of the user packet, and execute a user policy corresponding to the user name, where the control device is configured to transmit according to the authentication device
  • the user information and the address translation information transmitted by the network address translation NAT device are used to generate a relationship between the user name and the public network address, where the user information includes a correspondence between the user name of the user equipment and the private network address, and the address translation information includes Correspondence between the private network address of the user equipment and the converted public network address.
  • the network interface is further configured to receive an association relationship between the user name and a public network address delivered by the control device;
  • the processor is configured to search for the association relationship according to the public network address of the user packet, and obtain a username corresponding to the public network address of the user packet.
  • the processor is specifically configured to: use the network interface to set the public network address of the user packet Reporting to the control device, and receiving a user name corresponding to the public network address of the user packet returned by the control device, where the user name is the control device, searching according to the public network address of the user packet The username obtained after the association.
  • Each public network address corresponding to each user name includes: a public network Internet protocol IP address and a port segment, where the port segment is a NAT device that converts the private network IP address of the user equipment into a public network IP address.
  • a control device includes: a network interface and a processor, where
  • the network interface is configured to receive user information transmitted by the authentication device, and address translation information transmitted by the NAT device, where the user information includes a correspondence between a user name of the user equipment and a private network address, where the address translation information includes Corresponding relationship between the private network address of the user equipment and the converted public network address;
  • the processor is configured to generate an association between the user name and the public network address according to the user information and the address translation information, so that the policy execution device obtains the public network of the received user message according to the association relationship. After the username corresponding to the address, the user policy corresponding to the username is executed.
  • the network interface is further configured to send the association between the user name and the public network address to the policy execution device, so that the policy execution device searches for the association relationship according to the public network address of the user packet. After that, the user name corresponding to the public network address of the user packet is obtained.
  • the network interface is further configured to receive a public network address of the user packet reported by the policy execution device;
  • the processor is further configured to search for the association relationship according to the public network address of the user packet, and obtain a user name corresponding to the public network address of the user packet;
  • the network interface is further configured to send the username obtained by the processor to the policy execution device.
  • Each public network address corresponding to each user name in the system includes: a public network IP address and a port segment, where the port segment is a NAT device that converts the private network IP address of the user device into a public network IP address.
  • the control device receives the user information transmitted by the authentication device, and the address translation information transmitted by the NAT device, and generates an association between the user name and the public network address according to the user information and the address translation information, and the policy execution device according to the association After the relationship obtains the username corresponding to the public network address of the received user packet, the user policy corresponding to the obtained username is executed.
  • the authentication device and the NAT device do not need to transmit the saved user information and address translation information to each policy execution device, but only need to transmit the above information to the control device, and the control device centrally processes the information.
  • the relationship between the user name and the public network address can be generated, thereby reducing the amount of data transmission in the network and saving network transmission resources.
  • the authentication device and the NAT device do not need to be used.
  • the device is configured to transmit commands and transmit information for the new policy. That is, the authentication device and the NAT device do not need to be functionally modified, so the network architecture is easy to expand.
  • FIG. 1A is a schematic diagram of a network architecture to which an embodiment of the present invention is applied;
  • FIG. 1B is a flowchart of an embodiment of a method for executing a policy according to the present invention
  • FIG. 1C is a flow chart of another embodiment of a method for executing a policy according to the present invention.
  • FIG. 2 is a flow chart of another embodiment of a method for executing a policy according to the present invention.
  • FIG. 3 is a flow chart of another embodiment of a method for executing a policy according to the present invention.
  • FIG. 4 is a block diagram of an embodiment of a policy enforcement system of the present invention.
  • Figure 5 is a block diagram of an embodiment of a policy enforcement device of the present invention.
  • FIG. 6 is a block diagram of another embodiment of a policy enforcement device of the present invention.
  • FIG. 7 is a block diagram of an embodiment of a control device of the present invention.
  • FIG. 8 is a block diagram of another embodiment of a control device of the present invention.
  • FIG. 9 is a block diagram of another embodiment of a control device of the present invention.
  • Figure 10 is a block diagram of another embodiment of a control device of the present invention.
  • FIG. 1A is a schematic diagram of a network architecture in which an embodiment of the present invention is applied:
  • user equipment A accesses an authentication device through an intranet (also referred to as a private network) intranet, an authentication device connects to a NAT device, a NAT device connects to a policy enforcement device, and a policy enforcement device accesses the Internet (also referred to as an external network).
  • the Internet wherein the authentication device, the NAT device, and the policy enforcement device are all connected to the control device, and the policy execution device in the embodiment of the present invention may be specifically a route forwarding device, a switching device, a network security device, or the like.
  • the authentication device is used for authenticating and managing the identity of the user accessing the network through the user equipment, and recording the user name and the private network IP address;
  • the NAT device is configured to provide the Internet Protocol (IP) address of the private network into a public network.
  • IP Internet Protocol
  • the policy enforcement device is used to configure policy information based on the username.
  • FIG. 1B is a flowchart of an embodiment of a policy enforcement method according to the present invention.
  • the embodiment describes a policy execution process from a policy execution device side:
  • Step 101 The policy execution device receives the user message.
  • a user packet is a packet sent by a user equipment that accesses an intranet.
  • Step 102 The policy execution device obtains a user name corresponding to the public network address of the user packet by using the control device, where the control device is configured to generate the user name and the public network according to the user information transmitted by the authentication device and the address translation information transmitted by the NAT device. The association of addresses.
  • the user equipment when the user equipment is to access the intranet, that is, the user is logged in to the intranet through the user equipment, the user name and password are usually input.
  • the authentication device After the authentication device passes the authentication of the user name and password, the user equipment is assigned a private network IP address. Recording the user information including the correspondence between the user name and the assigned private network IP address, and transmitting the user information to the control device; and after the NAT device learns that the user device logs in, the private network address of the user device is converted into a public network. Address, record contains private network Address translation information corresponding to the address and the public network address, and transmitting the address conversion information to the control device.
  • the control device After the control device obtains the user information and the address translation information, the association between the user name and the public network address may be generated according to the foregoing information.
  • the control device may directly send the foregoing association relationship to the policy execution device, so that the policy execution device searches for the association relationship according to the public network address of the user packet, and obtains a user corresponding to the public network address of the user packet.
  • control device may send the generated association relationship to the policy execution device, or may send the generated association relationship to the policy execution device after receiving the message of the request association relationship sent by the policy execution device; or
  • the policy execution device may also send the public network address of the user packet to the control device, and the control device searches for the association relationship to obtain the user name corresponding to the public network address of the user packet, and sends the user name to the policy execution device.
  • Each public network address corresponding to each user name in the association relationship may include: a public network IP address and a port segment, where the port segment is a NAT device that converts the private network IP address of the user equipment into a public network IP address.
  • the NAT device can be pre-configured in the port pre-allocation mode, that is, a fixed-size port segment can be allocated to each user equipment of the login network.
  • the fixed size refers to the same number of port numbers in each port segment, and the user equipment is in the Each connection established during login uses the port number in the port segment; when the user device logs out, the NAT device can reclaim the port segment allocated for the user device.
  • the NAT device can allocate at least one port segment for each user equipment.
  • Step 103 The policy execution device executes a user policy corresponding to the obtained user name.
  • the policy execution device configures the user policy based on the user name, that is, the correspondence between the user name and the user policy is saved on the policy execution device, and in step 102, the policy execution device obtains the public network with the user message. After the username corresponding to the address, the user policy obtained by the user to search for the user name and the user policy is the user policy that the policy execution device needs to perform on the user packet.
  • the user policy may specifically include the security policy information, the user filtering policy information, the routing policy information, the bandwidth control policy information, and the like, which are not limited in this embodiment of the present invention.
  • the authentication device and the NAT device do not need to transmit the respective saved user information and address translation information to each policy enforcement device, but only need to transmit the above information to the control device, and the control device centrally processes the information. Generate the association between the username and the public network address. Therefore, the amount of data transmission in the network is reduced, and the network transmission resource is saved; and when a new policy execution device is added to the network architecture, the authentication device and the NAT device do not need to configure the transmission command for the new policy execution device and The transmission of information, that is, the authentication device and the NAT device, does not require functional changes, so the network architecture is easy to expand.
  • FIG. 1C is a flowchart of another embodiment of a policy enforcement method according to the present invention.
  • the embodiment describes a policy execution process from a control device side:
  • Step 111 The control device receives the user information transmitted by the authentication device, and the address translation information transmitted by the NAT device, where the user information includes a correspondence between the user name of the user equipment and the private network address, and the address translation information includes the private network address of the user equipment. Correspondence with the converted public network address.
  • the user equipment when the user equipment is to access the intranet, that is, the user is logged in to the intranet through the user equipment, the user name and password are usually input.
  • the authentication device After the authentication device passes the authentication of the user name and password, the user equipment is assigned a private network IP address. Recording the user information including the correspondence between the user name and the assigned private network IP address, and transmitting the user information to the control device; and after the NAT device learns that the user device logs in, the private network address of the user device is converted into a public network.
  • the address records the address translation information including the correspondence between the private network address and the public network address, and transmits the address conversion information to the control device.
  • Step 112 The control device generates an association relationship between the user name and the public network address according to the user information and the address translation information, so that the policy execution device obtains the user name corresponding to the public network address of the received user packet according to the association relationship, and then executes User policy corresponding to the username.
  • the association relationship between the user name and the public network address may be generated according to the foregoing information.
  • the control device may directly send the foregoing association relationship to the policy execution device, so that the policy execution device searches for the association relationship according to the public network address of the user packet, and obtains a user corresponding to the public network address of the user packet.
  • control device may send the generated association relationship to the policy execution device, or may send the generated association relationship to the policy execution device after receiving the message of the request association relationship sent by the policy execution device; or
  • the policy execution device may also send the public network address of the user packet to the control device, and the control device searches for the association relationship to obtain the user name corresponding to the public network address of the user packet, and sends the user name to the policy execution device.
  • Each public network address corresponding to each user name in the association relationship may include: public network IP address. An address and a port segment.
  • the port segment is a consecutive port number of the public network IP address assigned to the user equipment when the NAT device converts the private network IP address of the user equipment to the public network IP address.
  • the NAT device can be pre-configured in the port pre-allocation mode, that is, a fixed-size port segment can be allocated to each user equipment of the login network.
  • the fixed size refers to the same number of port numbers in each port segment, and the user equipment is in the Each connection established during login uses the port number in the port segment; when the user device logs out, the NAT device can reclaim the port segment allocated for the user device.
  • the NAT device can allocate at least one port segment for each user equipment.
  • the authentication device and the NAT device do not need to transmit the respective saved user information and address translation information to each policy enforcement device, but only need to transmit the above information to the control device, and the control device centrally processes the information.
  • the relationship between the user name and the public network address can be generated, thereby reducing the amount of data transmission in the network and saving network transmission resources.
  • the authentication device and the NAT device do not need to be used.
  • the device is configured to transmit commands and transmit information for the new policy. That is, the authentication device and the NAT device do not need to be functionally modified, so the network architecture is easy to expand.
  • FIG. 2 is a flow chart of another embodiment of a method for executing a policy according to the present invention:
  • Step 201 The authentication device transmits user information to the control device, where the user information includes a correspondence between the user name of the user equipment and the private network address.
  • the user equipment when the user equipment is to access the intranet, that is, when the user logs in to the intranet through the user equipment, the user name and password are usually input.
  • the authentication device After the authentication device passes the authentication of the user name and password, the user equipment is assigned a private network IP address and records.
  • the user information including the correspondence between the user name and the assigned private network IP address is transmitted to the control device.
  • the user of the user name "User A” logs in to the intranet through the user equipment, and after the authentication device passes the authentication of the user, the private network IP address assigned to the user equipment is 10.1.1.10. Record the user information shown in Table 1 below and send Table 1 to the control device:
  • Step 202 The NAT device transmits address translation information to the control device, where the address translation information includes a correspondence between the private network address of the user equipment and the converted public network address.
  • the NAT device learns that the user equipment is logged in, and converts the private network address of the user equipment into a public network address, and records the address translation including the correspondence between the private network address and the public network address. Information and transmit the address translation information to the control device.
  • the NAT device needs to allocate each connection established by the user equipment. A port number. Therefore, for each user equipment, the address translation information recorded by the NAT device specifically includes the correspondence between the private network IP address and the converted public network IP address and port number.
  • the NAT device needs to record address translation information that is consistent with the number of allocated port numbers, that is, one user equipment corresponds to multiple pieces of address translation information.
  • the NAT device may be pre-configured in a port pre-allocation mode, that is, a fixed-size port segment may be allocated to each user equipment of the login network, where the fixed size means that each port segment includes the same number of port numbers, and the user equipment Each connection established during login uses the port number in the port segment.
  • the NAT device can reclaim the port segment allocated for the user device. Therefore, for each user equipment, the address translation information recorded by the NAT device specifically includes the correspondence between the private network IP address and the converted public network IP address and the port segment, that is, one user equipment in the embodiment may only need one corresponding one. Address translation information.
  • the NAT device can also allocate multiple port segments for each user device, and the corresponding user device can correspond to the address translation information that is consistent with the number of port segments.
  • the NAT device converts the private network IP address "10.1.1.10” to the public network IP address "202.169.1.10", and the port segment allocated for the user equipment is [1000-2000], which is established by the user equipment. Each connection uses one of the port segments [1000-2000].
  • the NAT device can record the address translation information shown in Table 2 below and send Table 2 to the control device:
  • Private network IP address Public network IP address and port segment 10.1.1.10 202.169.1.10: [1000-2000]
  • Step 203 The control device generates an association relationship between the user name and the public network address according to the user information and the address translation information.
  • control device After the control device obtains the user information and the address translation information, the association between the user name and the public network address may be generated according to the foregoing information. Referring to FIG. 1A, the control device can integrate the above Table 1 and
  • Table 2 shows the associations shown in Table 3 below:
  • Step 204 The control device sends the association between the username and the public network address to the policy enforcement device.
  • the control device may directly send the association between the user name and the public network address to the policy execution device, where the control device may immediately send the generated association relationship to the policy execution device, or may receive the request association sent by the policy execution device. After the relationship message is sent, the generated association relationship is sent to the policy execution device.
  • control device when the association relationship is sent, can directly send the table 3 to the policy execution device, or the control device can also integrate the table 3, and only the correspondence between the user name and the public network IP address and port segment. It is sent to the policy execution device as an association, as shown in Table 4 below:
  • Step 205 The policy execution device receives the user message.
  • a user packet is a packet sent by a user equipment that accesses an intranet.
  • Step 206 After the policy execution device searches for the association relationship according to the public network address of the user packet, the user name corresponding to the public network address of the user packet is obtained.
  • the policy execution device saves the corresponding relationship between the user name and the public network address delivered by the control device. Therefore, after receiving the user packet, the policy execution device obtains the public network address of the user packet, including Public network IP address and port number, and use the public IP address and port number as keywords to search for the association relationship shown in Table 3 or Table 4 above, and obtain the corresponding user name in the matching record.
  • the matching record indicates that the public IP address of the record is the same as the public IP address of the user packet, and the port number of the user packet is in the range of the port segment in the record.
  • Step 207 The policy execution device executes a user policy corresponding to the obtained user name.
  • the policy execution device configures the user policy based on the user name, that is, the correspondence between the user name and the user policy is saved on the policy execution device, and in step 206, the policy execution device obtains the public network with the user message. After the username corresponding to the address, the user policy obtained by the user to search for the user name and the user policy is the user policy that the policy execution device needs to perform on the user packet.
  • the authentication device and the NAT device do not need to transmit the respective saved user information and address translation information to each policy enforcement device, but only need to transmit the above information to the control device, and the control device centrally processes the information.
  • the relationship between the user name and the public network address can be generated, thereby reducing the amount of data transmission in the network and saving network transmission resources.
  • the authentication device and the NAT device do not need to be used.
  • the device is configured to transmit commands and transmit information for the new policy. That is, the authentication device and the NAT device do not need to be functionally modified, so the network architecture is easy to expand.
  • the NAT device allocates a port segment for each user device according to the embodiment of the present invention, the number of address translation information that the NAT device needs to record is reduced as compared with the prior art and the port is allocated for each connection of each user device. At the same time, the network transmission resource for the NAT device to transmit address translation information to the control device is saved.
  • FIG. 3 it is a flowchart of another embodiment of a method for executing a policy according to the present invention:
  • Step 301 The authentication device transmits user information to the control device, where the user information includes a correspondence between a user name of the user equipment and a private network address.
  • the user equipment when the user equipment is to access the intranet, that is, when the user logs in to the intranet through the user equipment, the user name and password are usually input.
  • the authentication device After the authentication device passes the authentication of the user name and password, the user equipment is assigned a private network IP address and records.
  • the user information including the correspondence between the user name and the assigned private network IP address is transmitted to the control device. This step is consistent with the description of step 201 in conjunction with the example of FIG. 1A, and details are not described herein again.
  • Step 302 The NAT device transmits address translation information to the control device, where the address translation information includes a correspondence between the private network address of the user equipment and the converted public network address.
  • the NAT device learns that the user equipment is logged in, and converts the private network address of the user equipment into a public network address, and records the address translation including the correspondence between the private network address and the public network address. Information and transmit the address translation information to the control device.
  • the NAT device can be configured in the port pre-allocation mode, that is, the user equipment of each login network can be assigned a fixed-size port segment, and the fixed size refers to the same number of ports in each port segment. Slogan, the port number in the port segment is used for each connection established by the user device during login.
  • the NAT device can reclaim the port segment allocated for the user device, so for each user device, NAT
  • the address translation information recorded by the device specifically includes the mapping between the private network IP address and the translated public network IP address and the port segment. That is, a user equipment in this embodiment may only need one address translation information.
  • the NAT device can also allocate multiple port segments for each user device, and the corresponding user device can correspond to the address translation information that is consistent with the number of port segments. This step is consistent with the description of step 202 in conjunction with the example of FIG. 1A, and details are not described herein again.
  • Step 303 The control device generates an association relationship between the user name and the public network address according to the user information and the address translation information.
  • the control device After the control device obtains the user information and the address translation information, the association between the user name and the public network address may be generated according to the foregoing information. This step is consistent with the description of step 302 in conjunction with the example of FIG. 1A, and details are not described herein again.
  • Step 304 The policy execution device receives the user message.
  • Step 305 The policy execution device reports the public network address of the user packet to the control device.
  • control device does not need to send the association between the username and the public network address to the policy execution device, but when the policy execution device receives the user packet.
  • the public network address of the user packet is reported to the control device, including the public IP address and port number of the user packet, so that the control device can query the user name of the user packet.
  • Step 306 The control device searches for an association relationship according to the public network address of the user packet, and obtains a username corresponding to the public network address of the user packet.
  • the control device when the control device receives the public network IP address and port number of the user packet sent by the policy enforcement device, the public network IP address and port number are used as keywords to look up the table 3 The association relationship is obtained, and the corresponding user name is obtained in the matching record.
  • the public record IP address in the record is consistent with the public IP address of the user packet, and the user packet is The port number is in the range of port segments in the record.
  • Step 307 The control device sends the obtained username to the policy execution device.
  • Step 308 The policy execution device executes a user policy corresponding to the obtained user name.
  • the policy execution device configures the user policy based on the user name, that is, the correspondence between the user name and the user policy is saved on the policy execution device, and in step 307, the policy execution device obtains the user name sent by the control device. Find the user name and user policy based on the username The user policy obtained after the corresponding relationship is the user policy that the policy execution device needs to perform on the user packet.
  • the authentication device and the NAT device do not need to transmit the respective saved user information and address translation information to each policy enforcement device, but only need to transmit the above information to the control device, and the control device centrally processes the information.
  • the relationship between the user name and the public network address can be generated, thereby reducing the amount of data transmission in the network and saving network transmission resources.
  • the authentication device and the NAT device do not need to be used.
  • the device is configured to transmit commands and transmit information for the new policy. That is, the authentication device and the NAT device do not need to be functionally modified, so the network architecture is easy to expand.
  • the NAT device allocates a port segment for each user device according to the embodiment of the present invention, the number of address translation information that the NAT device needs to record is reduced as compared with the prior art and the port is allocated for each connection of each user device. At the same time, the network transmission resource for the NAT device to transmit address translation information to the control device is saved.
  • the present invention also provides an embodiment of a policy execution system, a policy execution device, and a control device.
  • FIG. 4 is a block diagram of an embodiment of a policy enforcement system of the present invention:
  • the system includes an authentication device 410, a NAT device 420, a control device 430, and a policy enforcement device 440.
  • the authentication device 410 is configured to transmit user information to the control device, where the user information includes a correspondence between a user name of the user equipment and a private network address.
  • the NAT device 420 is configured to transmit address translation information to the control device, where the address translation information includes a correspondence between a private network address of the user equipment and a converted public network address.
  • the control device 430 is configured to generate an association relationship between the user name and the public network address according to the user information and the address translation information.
  • the policy execution device 440 is configured to obtain, by using the association relationship generated by the control device, a user name corresponding to a public network address of the user packet, and execute the user name with the user name. The corresponding user policy.
  • the control device 430 may be further configured to send an association relationship between the username and a public network address to the policy execution device.
  • the policy execution device 440 may be specifically configured to search according to the public network address of the user packet. After the association relationship, a user name corresponding to the public network address of the user packet is obtained.
  • the policy enforcement device 440 may be further configured to report the public network address of the user packet to the control device;
  • the control device 430 may be further configured to: search for the association relationship according to the public network address of the user packet, obtain a user name corresponding to the public network address of the user packet, and send the obtained user name to The policy enforcement device.
  • Each public network address corresponding to each user name in the association relationship includes: a public network IP address and a port segment, where the port segment converts the private network IP address of the user equipment into a public network IP address. A consecutive port number under the public network IP address assigned to the user equipment.
  • FIG. 5 it is a block diagram of an embodiment of a policy enforcement device of the present invention:
  • the policy execution device includes a receiving unit 510, an obtaining unit 520, and an executing unit 530.
  • the receiving unit 510 is configured to receive a user message.
  • the obtaining unit 520 is configured to obtain, by using the control device, a user name corresponding to a public network address of the user packet received by the receiving unit, where the control device is configured to convert the NAT device according to the user information transmitted by the authentication device and the network address
  • the transmitted address translation information is used to generate a relationship between the user name and the public network address, where the user information includes a correspondence between the user name of the user equipment and the private network address, and the address translation information includes the private network address of the user equipment.
  • the executing unit 530 is configured to execute a user policy corresponding to the username obtained by the obtaining unit.
  • the receiving unit 510 may be further configured to receive an association relationship between the user name and a public network address delivered by the control device;
  • the obtaining unit 520 may be specifically configured to search for the association relationship received by the receiving unit according to the public network address of the user packet, and obtain a username corresponding to the public network address of the user packet.
  • the obtaining unit 520 may include (not shown in FIG. 5):
  • An address reporting subunit configured to report the public network address of the user packet to the control device
  • a user name obtaining sub-unit configured to receive a user name corresponding to the public network address of the user packet returned by the control device, where the user name is the control device, searching according to the public network address of the user packet The username obtained after the association.
  • Each public network address corresponding to each user name in the association relationship includes: a public network Internet protocol IP address and a port segment, where the port segment converts the private network IP address of the user equipment into a public network.
  • the IP address is a consecutive port number under the public network IP address allocated by the user equipment.
  • FIG. 6 a block diagram of another embodiment of a policy enforcement device of the present invention is shown:
  • the policy enforcement device includes a network interface 610 and a processor 620.
  • the network interface 610 is configured to receive a user message.
  • the processor 620 is configured to obtain, by using the control device, a user name corresponding to the public network address of the user packet, and execute a user policy corresponding to the user name, where the control device is configured to use the authentication device.
  • the user information transmitted and the address translation information transmitted by the network address translation NAT device are used to generate a relationship between the user name and the public network address, where the user information includes a correspondence between the user name and the private network address of the user equipment, and the address translation information
  • the mapping between the private network address of the user equipment and the converted public network address is included.
  • the network interface 610 is further configured to receive an association relationship between the user name and a public network address delivered by the control device;
  • the processor 620 may be specifically configured to search for the association relationship according to the public network address of the user packet, and obtain a username corresponding to the public network address of the user packet.
  • the processor 620 may be configured to report the public network address of the user packet to the control device by using the network interface, and receive a public network address returned by the control device and the user packet. a user name obtained by the control device after searching for the association relationship according to the public network address of the user packet.
  • Each public network address corresponding to each user name in the association relationship includes: a public network Internet protocol IP address and a port segment, where the port segment is a private network IP address of the user equipment of the NAT device. A consecutive port number under the public network IP address assigned to the user equipment when converted to a public network IP address.
  • the policy execution device provided in FIG. 5 and FIG. 6 can be applied in the scenario shown in FIG. 1A, in which the method embodiment is implemented in FIGS. 1A, 1B, 1C, FIG. 2, FIG. 3 and related descriptions.
  • FIG. 7 a block diagram of an embodiment of a control device of the present invention is shown:
  • the control device includes a receiving unit 710 and a generating unit 720.
  • the receiving unit 710 is configured to receive user information transmitted by the authentication device, and address translation information transmitted by the NAT device, where the user information includes a correspondence between a user name of the user equipment and a private network address, and the address translation information Corresponding relationship between the private network address of the user equipment and the converted public network address;
  • the generating unit 720 is configured to generate, according to the user information and the address translation information received by the receiving unit, an association relationship between the user name and the public network address, so that the policy execution device obtains and receives the received information according to the association relationship. After the user name corresponding to the public network address of the user packet, the user policy corresponding to the user name is executed.
  • each public network address corresponding to each user name in the association relationship may include: a public network IP address and a port segment, where the port segment converts the private network IP address of the user equipment by the NAT device. A consecutive port number under the public network IP address assigned to the user equipment when the public network IP address is used.
  • FIG. 8 a block diagram of another embodiment of a control device of the present invention is shown:
  • the control device includes a receiving unit 810, a generating unit 820, and a first transmitting unit 830.
  • the receiving unit 810 is configured to receive user information transmitted by the authentication device, and address translation information transmitted by the NAT device, where the user information includes a correspondence between a user name of the user equipment and a private network address, and the address translation information is Corresponding relationship between the private network address of the user equipment and the converted public network address;
  • the generating unit 820 is configured to generate an association relationship between the user name and the public network address according to the user information and the address translation information received by the receiving unit.
  • a first sending unit 830 configured to send, to the policy execution device, the generated by the generating unit The association between the user name and the public network address, so that the policy execution device searches for the association relationship according to the public network address of the user packet, and obtains a username corresponding to the public network address of the user packet. After that, the user policy corresponding to the username is executed.
  • each public network address corresponding to each user name in the association relationship may include: a public network IP address and a port segment, where the port segment converts the private network IP address of the user equipment by the NAT device. A consecutive port number under the public network IP address assigned to the user equipment when the public network IP address is used.
  • FIG. 9 a block diagram of another embodiment of a control device of the present invention is shown:
  • the control device includes a receiving unit 910, a generating unit 920, a searching unit 930, and a second transmitting unit 940.
  • the receiving unit 910 is configured to receive user information transmitted by the authentication device, and address translation information transmitted by the NAT device, where the user information includes a correspondence between a user name of the user equipment and a private network address, and the address translation information Corresponding relationship between the private network address of the user equipment and the converted public network address;
  • the generating unit 920 is configured to generate, according to the user information and the address translation information received by the receiving unit, an association relationship between the user name and the public network address, so that the policy execution device obtains and receives the received information according to the association relationship. After the user name corresponding to the public network address of the user packet, the user policy corresponding to the user name is executed;
  • the receiving unit 910 is further configured to receive a public network address of the user packet reported by the policy execution device;
  • the searching unit 930 is configured to search for the association relationship according to the public network address of the user packet received by the receiving unit, and obtain a user name corresponding to the public network address of the user packet;
  • the second sending unit 940 is configured to send the username obtained by the searching unit to the policy execution device.
  • each public network address corresponding to each user name in the association relationship may include: a public network IP address and a port segment, where the port segment converts the private network IP address of the user equipment by the NAT device. A consecutive port number under the public network IP address assigned to the user equipment when the public network IP address is used.
  • FIG. 10 it is a block diagram of another embodiment of a control device of the present invention:
  • the control device includes a network interface 1010 and a processor 1020.
  • the network interface 1010 is configured to receive user information transmitted by the authentication device, and address translation information transmitted by the NAT device, where the user information includes a correspondence between a user name of the user equipment and a private network address, where the address
  • the conversion information includes a correspondence between the private network address of the user equipment and the converted public network address;
  • the processor 1020 is configured to generate, according to the user information and the address translation information, an association relationship between a user name and a public network address, so that the policy execution device obtains the public information of the received user message according to the association relationship. After the user name corresponding to the network address, the user policy corresponding to the user name is executed.
  • the network interface 1010 may be further configured to send the association between the username and the public network address to the policy enforcement device, so that the policy execution device searches for the public network address according to the user packet. After the association relationship, the user name corresponding to the public network address of the user packet is obtained.
  • the network interface 1010 may be further configured to receive a public network address of the user packet reported by the policy execution device;
  • the processor 1020 is further configured to: search for the association relationship according to the public network address of the user packet, and obtain a user name corresponding to the public network address of the user packet;
  • the network interface 1010 may be further configured to send a username obtained by the processor to the policy execution device.
  • Each public network address corresponding to each user name in the association relationship includes: a public network IP address and a port segment, where the port segment converts the private network IP address of the user equipment into a public network IP address. A consecutive port number under the public network IP address assigned to the user equipment.
  • the control device provided in FIG. 7 to FIG. 10 can be applied to the scenario shown in FIG. 1A to implement the control in the method embodiment in FIGS. 1A, 1B, 1C, FIG. 2, FIG. 3 and related description.
  • the control device receives the user information transmitted by the authentication device and the address translation information transmitted by the NAT device, and generates a user name and a public according to the user information and the address translation information.
  • the policy execution device executes the user policy corresponding to the obtained user name.
  • the authentication device and the NAT device do not need to transmit the saved user information and address translation information to each policy execution device, but only need to transmit the above information to the control device, and the control device centrally processes the information.
  • the relationship between the user name and the public network address can be generated, thereby reducing the amount of data transmission in the network and saving network transmission resources.
  • the authentication device and the NAT device do not need to be used.
  • the device is configured to transmit commands and transmit information for the new policy. That is, the authentication device and the NAT device do not need to be functionally modified, so the network architecture is easy to expand.
  • the techniques in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, the technical solution in the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, which may be stored in a storage medium such as a ROM/RAM. , a disk, an optical disk, etc., including instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or portions of the embodiments.
  • a computer device which may be a personal computer, server, or network device, etc.

Abstract

本发明实施例公开了策略执行方法、系统、策略执行设备及控制设备，所述方法包括：策略执行设备接收用户报文；策略执行设备通过控制设备获得与所述用户报文的公网地址对应的用户名，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系；策略执行设备执行与所述用户名对应的用户策略。本发明实施例中认证设备和NAT设备只需将各自保存的用户信息和地址转换信息传输到控制设备，因此节省了网络传输资源；并且，当网络架构中增加新的策略执行设备时，由于认证设备和NAT设备为无需为传输各自保存的用户信息和地址转换信息进行功能改动，因此网络架构易于扩展。

Description

策略执行方法、系统、策略执行设备及控制设备
本申请要求于2014年2月24日提交中国专利局、申请号为201410065318.8、发明名称为“策略执行方法、系统、策略执行设备及控制设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络通信技术领域，特别涉及策略执行方法、系统、策略执行设备及控制设备。
背景技术
在传统的网络地址转换(Network Address Translation，NAT)网络架构中，通常会部署用于对用户身份进行认证的认证设备，用于将私网地址转换为公网地址的NAT设备，以及若干策略执行设备，其中，策略执行设备采用基于用户名的策略信息配置方式。当用户设备接入私网后，认证设备向策略执行设备传输用户名与私网地址的对应关系，同时NAT设备向策略执行设备传输用户设备的每条连接的私网地址与转换后的公网地址和端口号的对应关系；当策略执行设备接收到用户设备传输的报文后，根据报文的公网地址和端口号查找上述对应关系，以获得与该公网地址和端口号对应的用户名，从而根据用户名获得对该报文进行处理的策略信息。
发明人在对现有技术的研究过程中发现，由于认证设备和NAT设备需要分别向每个策略执行设备传输各自保存的对应关系，因此它们与策略执行设备之间的数据传输量较大，会消耗大量的网络传输资源；并且，当网络架构中增加新的策略执行设备时，认证设备和NAT设备上均需为新增策略执行设备配置新的传输命令，并根据该传输命令将各自保存的对应关系传输到新增策略执行设备，从而导致网络架构的可扩展性较差。
发明内容
本发明实施例中提供了策略执行方法、系统、策略执行设备及控制设备， 以解决现有策略执行方式容易消耗大量网络传输资源，且网络架构的可扩展性较差的问题。
为了解决上述技术问题，本发明实施例公开了如下技术方案：
第一方面，提供一种策略执行方法，所述方法包括：
策略执行设备接收用户报文；
所述策略执行设备通过控制设备获得与所述用户报文的公网地址对应的用户名，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
所述策略执行设备执行与所述用户名对应的用户策略。
结合第一方面，在第一方面的第一种可能的实现方式中，所述策略执行设备接收用户报文前，所述方法还包括：
所述策略执行设备接收所述控制设备下发的所述用户名与公网地址的关联关系；
所述策略执行设备通过控制设备获得与所述用户报文的公网地址对应的用户名，包括：
所述策略执行设备根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名。
结合第一方面，在第一方面的第二种可能的实现方式中，所述策略执行设备通过控制设备获得与所述用户报文的公网地址对应的用户名，包括：
所述策略执行设备将所述用户报文的公网地址上报给所述控制设备；
接收所述控制设备返回的与所述用户报文的公网地址对应的用户名，所述用户名为所述控制设备根据所述用户报文的公网地址查找所述关联关系后获得的用户名。
结合第一方面，或第一方面的第一种可能的实现方式，或第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，所述关联关系中与每个用户名对应的每个公网地址包含：公网互联网协议IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
第二方面，提供一种策略执行方法，所述方法包括：
控制设备接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
所述控制设备根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系，以使策略执行设备根据所述关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与所述用户名对应的用户策略。
结合第二方面，在第二方面的第一种可能的实现方式中，所述方法还包括：
所述控制设备向所述策略执行设备下发所述用户名与公网地址的关联关系，以使所述策略执行设备根据所述用户报文的公网地址查找所述关联关系后，获得与所述用户报文的公网地址对应的用户名。
结合第二方面，在第二方面的第二种可能的实现方式中，所述方法还包括：
所述控制设备接收所述策略执行设备上报的所述用户报文的公网地址；
所述控制设备根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名；
所述控制设备将获得的用户名发送给所述策略执行设备。
结合第二方面，或第二方面的第一种可能的实现方式，或第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
第三方面，提供一种策略执行系统，所述系统包括：认证设备、NAT设备、控制设备和策略执行设备，其中，
所述认证设备，用于向所述控制设备传输用户信息，所述用户信息包含用户设备的用户名与私网地址的对应关系；
所述NAT设备，用于向所述控制设备传输地址转换信息，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
所述控制设备，用于根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系；
所述策略执行设备，用于接收到用户报文时，通过所述控制设备生成的所述关联关系获得与所述用户报文的公网地址对应的用户名，并执行与所述用户名对应的用户策略。
结合第三方面，在第三方面的第一种可能的实现方式中，
所述控制设备，还用于向所述策略执行设备下发所述用户名与公网地址的关联关系；
所述策略执行设备，具体用于根据所述用户报文的公网地址查找所述关联关系后，获得与所述用户报文的公网地址对应的用户名。
结合第三方面，在第三方面的第二种可能的实现方式中，
所述策略执行设备，还用于将所述用户报文的公网地址上报给所述控制设备；
所述控制设备，还用于根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名，并将获得的用户名发送给所述策略执行设备。
结合第三方面，或第三方面的第一种可能的实现方式，或第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
第四方面，提供一种策略执行设备，所述策略执行设备包括：
接收单元，用于接收用户报文；
获得单元，用于通过控制设备获得与所述接收单元接收到的用户报文的公网地址对应的用户名，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
执行单元，用于执行与所述获得单元获得的用户名对应的用户策略。
结合第四方面，在第四方面的第一种可能的实现方式中，
所述接收单元，还用于接收所述控制设备下发的所述用户名与公网地址的关联关系；
所述获得单元，具体用于根据所述用户报文的公网地址查找所述接收单元接收到的所述关联关系，获得与所述用户报文的公网地址对应的用户名。
结合第四方面，在第四方面的第二种可能的实现方式中，所述获得单元包括：
地址上报子单元，用于将所述用户报文的公网地址上报给所述控制设备；
用户名获得子单元，用于接收所述控制设备返回的与所述用户报文的公网地址对应的用户名，所述用户名为所述控制设备根据所述用户报文的公网地址查找所述关联关系后获得的用户名。
结合第四方面，或第四方面的第一种可能的实现方式，或第四方面的第二种可能的实现方式，在第四方面的第三种可能的实现方式中，所述关联关系中与每个用户名对应的每个公网地址包含：公网互联网协议IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
第五方面，提供一种控制设备，所述控制设备包括：
接收单元，用于接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
生成单元，用于根据所述接收单元接收到的所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系，以使策略执行设备根据所述关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与所述用户名对应的用户策略。
结合第五方面，在第五方面的第一种可能的实现方式中，所述控制设备还包括：
第一发送单元，用于向所述策略执行设备下发所述生成单元生成的所述用户名与公网地址的关联关系，以使所述策略执行设备根据所述用户报文的公网地址查找所述关联关系后，获得与所述用户报文的公网地址对应的用户 名。
结合第五方面，在第五方面的第二种可能的实现方式中，
所述接收单元，还用于接收所述策略执行设备上报的所述用户报文的公网地址；
所述控制设备还包括：
查找单元，用于根据所述接收单元接收到的所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名；
第二发送单元，用于将所述查找单元获得的用户名发送给所述策略执行设备。
结合第五方面，或第五方面的第一种可能的实现方式，或第五方面的第二种可能的实现方式，在第五方面的第三种可能的实现方式中，所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
第六方面，提供一种策略执行设备，所述策略执行设备包括：网络接口和处理器，其中，
所述网络接口，用于接收用户报文；
所述处理器，用于通过控制设备获得与所述用户报文的公网地址对应的用户名，并执行与所述用户名对应的用户策略，其中，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系。
结合第六方面，在第六方面的第一种可能的实现方式中，
所述网络接口，还用于接收所述控制设备下发的所述用户名与公网地址的关联关系；
所述处理器，具体用于根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名。
结合第六方面，在第六方面的第二种可能的实现方式中，
所述处理器，具体用于通过所述网络接口将所述用户报文的公网地址上 报给所述控制设备，并接收所述控制设备返回的与所述用户报文的公网地址对应的用户名，所述用户名为所述控制设备根据所述用户报文的公网地址查找所述关联关系后获得的用户名。
结合第六方面，或第六方面的第一种可能的实现方式，或第六方面的第二种可能的实现方式，在第六方面的第三种可能的实现方式中，所述关联关系中与每个用户名对应的每个公网地址包含：公网互联网协议IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
第七方面，提供一种控制设备，所述控制设备包括：网络接口和处理器，其中，
所述网络接口，用于接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
所述处理器，用于根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系，以使策略执行设备根据所述关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与所述用户名对应的用户策略。
结合第七方面，在第七方面的第一种可能的实现方式中，
所述网络接口，还用于向所述策略执行设备下发所述用户名与公网地址的关联关系，以使所述策略执行设备根据所述用户报文的公网地址查找所述关联关系后，获得与所述用户报文的公网地址对应的用户名。
结合第七方面，在第七方面的第二种可能的实现方式中，
所述网络接口，还用于接收所述策略执行设备上报的所述用户报文的公网地址；
所述处理器，还用于根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名；
所述网络接口，还用于将所述处理器获得的用户名发送给所述策略执行设备。
结合第七方面，或第七方面的第一种可能的实现方式，或第七方面的第二种可能的实现方式，在第七方面的第三种可能的实现方式中，所述关联关 系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
本发明实施例中，控制设备接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，并根据用户信息和地址转换信息生成用户名与公网地址的关联关系，策略执行设备根据该关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与获得的用户名对应的用户策略。应用本发明实施例，认证设备和NAT设备无需向每个策略执行设备传输各自保存的用户信息和地址转换信息，而是只需要将上述信息传输到控制设备，并由控制设备集中对信息进行处理生成用户名与公网地址的关联关系即可，因此减少了网络中的数据传输量，节省了网络传输资源；并且，当网络架构中增加新的策略执行设备时，由于认证设备和NAT设备无需为该新增策略执行设备配置传输命令及传输信息，即认证设备和NAT设备无需进行功能改动，因此网络架构易于扩展。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，对于本领域普通技术人员而言，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1A为应用本发明实施例的网络架构示意图；
图1B为本发明策略执行方法的一个实施例流程图；
图1C为本发明策略执行方法的另一个实施例流程图；
图2为本发明策略执行方法的另一个实施例流程图；
图3为本发明策略执行方法的另一个实施例流程图；
图4为本发明策略执行系统的实施例框图；
图5为本发明策略执行设备的一个实施例框图；
图6为本发明策略执行设备的另一个实施例框图；
图7为本发明控制设备的一个实施例框图；
图8为本发明控制设备的另一个实施例框图；
图9为本发明控制设备的另一个实施例框图；
图10为本发明控制设备的另一个实施例框图。
具体实施方式
为了使本技术领域的人员更好地理解本发明实施例中的技术方案，并使本发明实施例的上述目的、特征和优点能够更加明显易懂，下面结合附图对本发明实施例中技术方案作进一步详细的说明。
参见图1A，为应用本发明实施例的网络架构示意图：
图1A中，用户设备A通过内网(也可称为私网)Intranet接入认证设备，认证设备连接NAT设备，NAT设备连接策略执行设备，策略执行设备接入互联网(也可称为外网)Internet，其中，认证设备、NAT设备和策略执行设备均与控制设备连接，本发明实施例中的策略执行设备可以具体为路由转发设备、交换设备、网络安全设备等。其中，认证设备用于对通过用户设备接入网络的用户身份进行认证管理，并记录用户名和私网IP地址；NAT设备用于提供将私网互联网协议(Internet Protocol，IP)地址转换为公网IP地址的功能；策略执行设备用于基于用户名配置策略信息。
下面结合图1A示出的网络架构对本发明实施例进行详细描述。
参见图1B，为本发明策略执行方法的一个实施例流程图，该实施例从策略执行设备侧对策略执行过程进行描述：
步骤101：策略执行设备接收用户报文。
结合图1A可知，本发明实施例中用户报文为接入Intranet的用户设备发出的报文。
步骤102：策略执行设备通过控制设备获得与用户报文的公网地址对应的用户名，其中控制设备用于根据认证设备传输的用户信息，以及NAT设备传输的地址转换信息生成用户名与公网地址的关联关系。
本发明实施例中，当用户设备要接入Intranet，即用户通过用户设备登录Intranet时，通常会输入用户名和密码，认证设备对用户名和密码验证通过后，为该用户设备分配私网IP地址，记录包含用户名和所分配的私网IP地址的对应关系的用户信息，并将该用户信息传输给控制设备；以及，NAT设备获知用户设备登录后，将该用户设备的私网地址转换为公网地址，记录包含私网 地址与公网地址的对应关系的地址转换信息，并将该地址转换信息传输给控制设备。
当控制设备获得用户信息和地址转换信息后，可以根据上述信息生成用户名及公网地址之间的关联关系。可选的，控制设备可以将上述关联关系直接下发给策略执行设备，以便策略执行设备根据用户报文的公网地址查找该关联关系，获得与所述用户报文的公网地址对应的用户名，其中，控制设备可以将生成的关联关系即刻发送给策略执行设备，也可以在接收到策略执行设备发送的请求关联关系的消息后，将生成的关联关系下发给策略执行设备；或者，策略执行设备也可以将用户报文的公网地址发送给控制设备，由控制设备查找关联关系获得与用户报文的公网地址对应的用户名，并将该用户名发送给策略执行设备。
其中，关联关系中与每个用户名对应的每个公网地址可以包含：公网IP地址和端口段，该端口段为NAT设备将用户设备的私网IP地址转换为公网IP地址时为该用户设备分配的该公网IP地址下的一段连续的端口号。可选的，NAT设备可以预先配置为端口预分配模式，即可以为每个登录网络的用户设备分配固定大小的端口段，固定大小指每个端口段中包含相同数量的端口号，用户设备在登录期间建立的每个连接都使用该端口段内的端口号；当用户设备退出登录时，NAT设备可以回收为该用户设备分配的端口段。可选的，NAT设备可以为每个用户设备分配至少一个端口段。
步骤103：策略执行设备执行与获得的用户名对应的用户策略。
本发明实施例中，策略执行设备上基于用户名配置用户策略，即策略执行设备上保存了用户名与用户策略之间的对应关系，在步骤102中策略执行设备获得与用户报文的公网地址对应的用户名后，根据该用户名查找用户名与用户策略之间的对应关系后获得的用户策略即为策略执行设备需要对用户报文执行的用户策略。
其中，用户策略可以具体包括安全策略信息、用户过滤策略信息、路由策略信息、带宽控制策略信息等，对此本发明实施例不进行限制。
由上述实施例可见，认证设备和NAT设备无需向每个策略执行设备传输各自保存的用户信息和地址转换信息，而是只需要将上述信息传输到控制设备，并由控制设备集中对信息进行处理生成用户名与公网地址的关联关系即 可，因此减少了网络中的数据传输量，节省了网络传输资源；并且，当网络架构中增加新的策略执行设备时，由于认证设备和NAT设备无需为该新增策略执行设备配置传输命令及传输信息，即认证设备和NAT设备无需进行功能改动，因此网络架构易于扩展。
参见图1C，为本发明策略执行方法的另一个实施例流程图，该实施例从控制设备侧对策略执行过程进行描述：
步骤111：控制设备接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，用户信息包含用户设备的用户名与私网地址的对应关系，地址转换信息包含用户设备的私网地址与转换后的公网地址的对应关系。
本发明实施例中，当用户设备要接入Intranet，即用户通过用户设备登录Intranet时，通常会输入用户名和密码，认证设备对用户名和密码验证通过后，为该用户设备分配私网IP地址，记录包含用户名和所分配的私网IP地址的对应关系的用户信息，并将该用户信息传输给控制设备；以及，NAT设备获知用户设备登录后，将该用户设备的私网地址转换为公网地址，记录包含私网地址与公网地址的对应关系的地址转换信息，并将该地址转换信息传输给控制设备。
步骤112：控制设备根据用户信息和地址转换信息生成用户名与公网地址的关联关系，以使策略执行设备根据关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与用户名对应的用户策略。
本发明实施例中，当控制设备获得用户信息和地址转换信息后，可以根据上述信息生成用户名及公网地址之间的关联关系。可选的，控制设备可以将上述关联关系直接下发给策略执行设备，以便策略执行设备根据用户报文的公网地址查找该关联关系，获得与所述用户报文的公网地址对应的用户名，其中，控制设备可以将生成的关联关系即刻发送给策略执行设备，也可以在接收到策略执行设备发送的请求关联关系的消息后，将生成的关联关系下发给策略执行设备；或者，策略执行设备也可以将用户报文的公网地址发送给控制设备，由控制设备查找关联关系获得与用户报文的公网地址对应的用户名，并将该用户名发送给策略执行设备。
其中，关联关系中与每个用户名对应的每个公网地址可以包含：公网IP 地址和端口段，该端口段为NAT设备将用户设备的私网IP地址转换为公网IP地址时为该用户设备分配的该公网IP地址下的一段连续的端口号。可选的，NAT设备可以预先配置为端口预分配模式，即可以为每个登录网络的用户设备分配固定大小的端口段，固定大小指每个端口段中包含相同数量的端口号，用户设备在登录期间建立的每个连接都使用该端口段内的端口号；当用户设备退出登录时，NAT设备可以回收为该用户设备分配的端口段。可选的，NAT设备可以为每个用户设备分配至少一个端口段。
由上述实施例可见，认证设备和NAT设备无需向每个策略执行设备传输各自保存的用户信息和地址转换信息，而是只需要将上述信息传输到控制设备，并由控制设备集中对信息进行处理生成用户名与公网地址的关联关系即可，因此减少了网络中的数据传输量，节省了网络传输资源；并且，当网络架构中增加新的策略执行设备时，由于认证设备和NAT设备无需为该新增策略执行设备配置传输命令及传输信息，即认证设备和NAT设备无需进行功能改动，因此网络架构易于扩展。
参见图2，为本发明策略执行方法的另一个实施例流程图：
步骤201：认证设备向控制设备传输用户信息，该用户信息包含用户设备的用户名与私网地址的对应关系。
本实施例中，当用户设备要接入Intranet，即用户通过用户设备登录Intranet时，通常会输入用户名和密码，认证设备对用户名和密码验证通过后，为该用户设备分配私网IP地址，记录包含用户名和所分配的私网IP地址的对应关系的用户信息，并将该用户信息传输给控制设备。
如图1A中，假设用户名为“用户A”的用户通过用户设备登录Intranet，认证设备对该用户认证通过后，为用户设备分配的私网IP地址为“10.1.1.10”，则认证设备可以记录如下表1所示的用户信息，并将表1发送给控制设备：
表1
用户名 私网IP地址
用户A 10.1.1.10
步骤202：NAT设备向控制设备传输地址转换信息，该地址转换信息包含用户设备的私网地址与转换后的公网地址的对应关系。
本实施例中，当用户设备要接入Intranet，NAT设备获知用户设备登录后，将该用户设备的私网地址转换为公网地址，记录包含私网地址与公网地址的对应关系的地址转换信息，并将该地址转换信息传输给控制设备。现有技术中，NAT设备在将用户设备的私网地址转换为公网地址时，除了要将私网IP地址转换为公网IP地址外，还需要为该用户设备所建立的每个连接分配一个端口号，因此对于每个用户设备，NAT设备所记录的地址转换信息中具体包括私网IP地址与转换后的公网IP地址和端口号的对应关系，当用户设备建立多个连接时，则NAT设备需要记录与所分配端口号的数量一致的地址转换信息，即一个用户设备对应了多条地址转换信息。
本实施例中，NAT设备可以预先配置为端口预分配模式，即可以为每个登录网络的用户设备分配固定大小的端口段，固定大小指每个端口段中包含相同数量的端口号，用户设备在登录期间建立的每个连接都使用该端口段内的端口号，当用户设备退出登录时，NAT设备可以回收为该用户设备分配的端口段。因此对于每个用户设备，NAT设备所记录的地址转换信息中具体包括私网IP地址与转换后的公网IP地址和端口段的对应关系，即本实施例中一个用户设备可以只需要对应一条地址转换信息。可选的，NAT设备也可以为每个用户设备分配多个端口段，则相应一个用户设备可以对应与端口段数量一致的地址转换信息。
如图1A中，假设NAT设备将私网IP地址“10.1.1.10”转换为公网IP地址“202.169.1.10”，且为用户设备分配的端口段为[1000-2000]，则用户设备建立的每条连接都使用该端口段[1000-2000]中的一个端口即可。NAT设备可以记录如下表2所示的地址转换信息，并将表2发送给控制设备：
表2
私网IP地址 公网IP地址和端口段
10.1.1.10 202.169.1.10:[1000-2000]
步骤203：控制设备根据用户信息和地址转换信息生成用户名与公网地址的关联关系。
当控制设备获得用户信息和地址转换信息后，可以根据上述信息生成用户名及公网地址之间的关联关系。结合图1A，控制设备可以整合上述表1和
表2，得到如下表3所示的关联关系：
表3
用户名 私网IP地址 公网IP地址和端口段
用户A 10.1.1.10 202.169.1.10:[1000-2000]
步骤204：控制设备向策略执行设备下发该用户名与公网地址的关联关系。
控制设备可以将用户名与公网地址的关联关系直接下发给策略执行设备，其中，控制设备可以将生成的关联关系即刻发送给策略执行设备，也可以在接收到策略执行设备发送的请求关联关系的消息后，将生成的关联关系下发给策略执行设备。
结合表3，在下发关联关系时，控制设备可以直接将表3下发给策略执行设备，或者控制设备也可以对表3进行整合，仅将用户名与公网IP地址和端口段的对应关系作为关联关系下发给策略执行设备，如下表4所示：
表4
用户名 公网IP地址和端口段
用户A 202.169.1.10:[1000-2000]
步骤205：策略执行设备接收到用户报文。
结合图1A可知，本发明实施例中用户报文为接入Intranet的用户设备发出的报文。
步骤206：策略执行设备根据用户报文的公网地址查找关联关系后，获得与用户报文的公网地址对应的用户名。
本实施例中，由于策略执行设备上保存了控制设备下发的用户名与公网地址的对应关系，因此在接收到用户报文后，策略执行设备获得该用户报文的公网地址，包括公网IP地址和端口号，并以公网IP地址和端口号为关键字查找如上表3或表4示出的关联关系，得到匹配的记录中对应的用户名，其中，从关联关系中查找到匹配的记录指该条记录中的公网IP地址与用户报文的公网IP地址一致，且用户报文的端口号在该记录中的端口段范围内。
步骤207：策略执行设备执行与获得的用户名对应的用户策略。
本发明实施例中，策略执行设备上基于用户名配置用户策略，即策略执行设备上保存了用户名与用户策略之间的对应关系，在步骤206中策略执行设备获得与用户报文的公网地址对应的用户名后，根据该用户名查找用户名与用户策略之间的对应关系后获得的用户策略即为策略执行设备需要对用户报文执行的用户策略。
由上述实施例可见，认证设备和NAT设备无需向每个策略执行设备传输各自保存的用户信息和地址转换信息，而是只需要将上述信息传输到控制设备，并由控制设备集中对信息进行处理生成用户名与公网地址的关联关系即可，因此减少了网络中的数据传输量，节省了网络传输资源；并且，当网络架构中增加新的策略执行设备时，由于认证设备和NAT设备无需为该新增策略执行设备配置传输命令及传输信息，即认证设备和NAT设备无需进行功能改动，因此网络架构易于扩展。进一步，由于本发明实施例NAT设备为每个用户设备分配端口段，与现有技术与为每个用户设备的每个连接都分配端口相比，减少了NAT设备需要记录的地址转换信息的数量，同时节省了NAT设备向控制设备传输地址转换信息的网络传输资源。
参见图3，为本发明策略执行方法的另一个实施例流程图：
步骤301：认证设备向控制设备传输用户信息，该用户信息包含用户设备的用户名与私网地址的对应关系。
本实施例中，当用户设备要接入Intranet，即用户通过用户设备登录Intranet时，通常会输入用户名和密码，认证设备对用户名和密码验证通过后，为该用户设备分配私网IP地址，记录包含用户名和所分配的私网IP地址的对应关系的用户信息，并将该用户信息传输给控制设备。本步骤结合图1A的示例与步骤201的描述一致，在此不再赘述。
步骤302：NAT设备向控制设备传输地址转换信息，该地址转换信息包含用户设备的私网地址与转换后的公网地址的对应关系。
本实施例中，当用户设备要接入Intranet，NAT设备获知用户设备登录后，将该用户设备的私网地址转换为公网地址，记录包含私网地址与公网地址的对应关系的地址转换信息，并将该地址转换信息传输给控制设备。本实施例中，NAT设备可以预先配置为端口预分配模式，即可以为每个登录网络的用户设备分配固定大小的端口段，固定大小指每个端口段中包含相同数量的端 口号，用户设备在登录期间建立的每个连接都使用该端口段内的端口号，当用户设备退出登录时，NAT设备可以回收为该用户设备分配的端口段，因此对于每个用户设备，NAT设备所记录的地址转换信息中具体包括私网IP地址与转换后的公网IP地址和端口段的对应关系，即本实施例中一个用户设备可以只需要对应一条地址转换信息。可选的，NAT设备也可以为每个用户设备分配多个端口段，则相应一个用户设备可以对应与端口段数量一致的地址转换信息。本步骤结合图1A的示例与步骤202的描述一致，在此不再赘述。
步骤303：控制设备根据用户信息和地址转换信息生成用户名与公网地址的关联关系。
当控制设备获得用户信息和地址转换信息后，可以根据上述信息生成用户名及公网地址之间的关联关系。本步骤结合图1A的示例与步骤302的描述一致，在此不再赘述。
步骤304：策略执行设备接收到用户报文。
步骤305：策略执行设备将用户报文的公网地址上报给控制设备。
本实施例与前述图2示出的实施例的不同在于，本实施例控制设备无需向策略执行设备下发用户名与公网地址的关联关系，而是在策略执行设备接收到用户报文时，主动向控制设备上报用户报文的公网地址，包括该用户报文的公网IP地址和端口号，以便由控制设备查询用户报文的用户名。
步骤306：控制设备根据用户报文的公网地址查找关联关系，获得与用户报文的公网地址对应的用户名。
结合前述实施例中的表3，当控制设备接收到策略执行设备发送的用户报文的公网IP地址和端口号时，以该公网IP地址和端口号为关键字查找表3示出的关联关系，得到匹配的记录中对应的用户名，其中，从关联关系中查找到匹配的记录指该条记录中的公网IP地址与用户报文的公网IP地址一致，且用户报文的端口号在该记录中的端口段范围内。
步骤307：控制设备将获得的用户名发送给策略执行设备。
步骤308：策略执行设备执行与获得的用户名对应的用户策略。
本发明实施例中，策略执行设备上基于用户名配置用户策略，即策略执行设备上保存了用户名与用户策略之间的对应关系，在步骤307中策略执行设备获得控制设备发送的用户名后，根据该用户名查找用户名与用户策略之 间的对应关系后获得的用户策略即为策略执行设备需要对用户报文执行的用户策略。
由上述实施例可见，认证设备和NAT设备无需向每个策略执行设备传输各自保存的用户信息和地址转换信息，而是只需要将上述信息传输到控制设备，并由控制设备集中对信息进行处理生成用户名与公网地址的关联关系即可，因此减少了网络中的数据传输量，节省了网络传输资源；并且，当网络架构中增加新的策略执行设备时，由于认证设备和NAT设备无需为该新增策略执行设备配置传输命令及传输信息，即认证设备和NAT设备无需进行功能改动，因此网络架构易于扩展。进一步，由于本发明实施例NAT设备为每个用户设备分配端口段，与现有技术与为每个用户设备的每个连接都分配端口相比，减少了NAT设备需要记录的地址转换信息的数量，同时节省了NAT设备向控制设备传输地址转换信息的网络传输资源。
与本发明策略执行方法的实施例相对应，本发明还提供了策略执行系统、策略执行设备及控制设备的实施例。
参见图4，为本发明策略执行系统的实施例框图：
该系统包括：认证设备410、NAT设备420、控制设备430和策略执行设备440。
其中，所述认证设备410，用于向所述控制设备传输用户信息，所述用户信息包含用户设备的用户名与私网地址的对应关系；
所述NAT设备420，用于向所述控制设备传输地址转换信息，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
所述控制设备430，用于根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系；
所述策略执行设备440，用于接收到用户报文时，通过所述控制设备生成的所述关联关系获得与所述用户报文的公网地址对应的用户名，并执行与所述用户名对应的用户策略。
在一个可选的实现方式中：
所述控制设备430，还可以用于向所述策略执行设备下发所述用户名与公网地址的关联关系；
所述策略执行设备440，可以具体用于根据所述用户报文的公网地址查找 所述关联关系后，获得与所述用户报文的公网地址对应的用户名。
在另一个可选的实现方式中：
所述策略执行设备440，还可以用于将所述用户报文的公网地址上报给所述控制设备；
所述控制设备430，还可以用于根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名，并将获得的用户名发送给所述策略执行设备。
在另一个可选的实现方式中：
所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
参见图5，为本发明策略执行设备的一个实施例框图：
该策略执行设备包括：接收单元510、获得单元520和执行单元530。
其中，接收单元510，用于接收用户报文；
获得单元520，用于通过控制设备获得与所述接收单元接收到的用户报文的公网地址对应的用户名，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
执行单元530，用于执行与所述获得单元获得的用户名对应的用户策略。
在一个可选的实现方式中：
所述接收单元510，还可以用于接收所述控制设备下发的所述用户名与公网地址的关联关系；
所述获得单元520，可以具体用于根据所述用户报文的公网地址查找所述接收单元接收到的所述关联关系，获得与所述用户报文的公网地址对应的用户名。
在另一个可选的实现方式中：
所述获得单元520可以包括(图5中未示出)：
地址上报子单元，用于将所述用户报文的公网地址上报给所述控制设备；
用户名获得子单元，用于接收所述控制设备返回的与所述用户报文的公网地址对应的用户名，所述用户名为所述控制设备根据所述用户报文的公网地址查找所述关联关系后获得的用户名。
在另一个可选的实现方式中：
所述关联关系中与每个用户名对应的每个公网地址包含：公网互联网协议IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
参见图6，为本发明策略执行设备的另一个实施例框图：
该策略执行设备包括：网络接口610和处理器620。
其中，所述网络接口610，用于接收用户报文；
所述处理器620，用于通过控制设备获得与所述用户报文的公网地址对应的用户名，并执行与所述用户名对应的用户策略，其中，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系。
在一个可选的实现方式中：
所述网络接口610，还可以用于接收所述控制设备下发的所述用户名与公网地址的关联关系；
所述处理器620，可以具体用于根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名。
在另一个可选的实现方式中：
所述处理器620，可以具体用于通过所述网络接口将所述用户报文的公网地址上报给所述控制设备，并接收所述控制设备返回的与所述用户报文的公网地址对应的用户名，所述用户名为所述控制设备根据所述用户报文的公网地址查找所述关联关系后获得的用户名。
在另一个可选的实现方式中：
所述关联关系中与每个用户名对应的每个公网地址包含：公网互联网协议IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址 转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
附图5、附图6所提供的策略执行设备，可以应用在附图1A所示的场景中，实现方法实施例中附图1A、1B、1C、附图2、附图3以及相关描述中策略执行设备的功能，附图5、附图6中策略执行设备的其他附加功能、以及与其他设备之间的交互过程，请参考附图1A、1B、1C、附图2、附图3的相关描述，在这里不再重复。
参见图7，为本发明控制设备的一个实施例框图：
该控制设备包括：接收单元710和生成单元720。
其中，接收单元710，用于接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
生成单元720，用于根据所述接收单元接收到的所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系，以使策略执行设备根据所述关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与所述用户名对应的用户策略。
可选的，所述关联关系中与每个用户名对应的每个公网地址可以包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
参见图8，为本发明控制设备的另一个实施例框图：
该控制设备包括：接收单元810、生成单元820和第一发送单元830。
其中，接收单元810，用于接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
生成单元820，用于根据所述接收单元接收到的所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系；
第一发送单元830，用于向所述策略执行设备下发所述生成单元生成的所 述用户名与公网地址的关联关系，以使所述策略执行设备根据所述用户报文的公网地址查找所述关联关系，并获得与所述用户报文的公网地址对应的用户名后，执行与所述用户名对应的用户策略。
可选的，所述关联关系中与每个用户名对应的每个公网地址可以包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
参见图9，为本发明控制设备的另一个实施例框图：
该控制设备包括：接收单元910、生成单元920、查找单元930和第二发送单元940。
其中，接收单元910，用于接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
生成单元920，用于根据所述接收单元接收到的所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系，以使策略执行设备根据所述关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与所述用户名对应的用户策略；
所述接收单元910，还用于接收所述策略执行设备上报的所述用户报文的公网地址；
查找单元930，用于根据所述接收单元接收到的所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名；
第二发送单元940，用于将所述查找单元获得的用户名发送给所述策略执行设备。
可选的，所述关联关系中与每个用户名对应的每个公网地址可以包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
参见图10，为本发明控制设备的另一个实施例框图：
该控制设备包括：网络接口1010和处理器1020。
其中，所述网络接口1010，用于接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
所述处理器1020，用于根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系，以使策略执行设备根据所述关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与所述用户名对应的用户策略。
在一个可选的实现方式中：
所述网络接口1010，还可以用于向所述策略执行设备下发所述用户名与公网地址的关联关系，以使所述策略执行设备根据所述用户报文的公网地址查找所述关联关系后，获得与所述用户报文的公网地址对应的用户名。
在另一个可选的实现方式中：
所述网络接口1010，还可以用于接收所述策略执行设备上报的所述用户报文的公网地址；
所述处理器1020，还可以用于根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名；
所述网络接口1010，还可以用于将所述处理器获得的用户名发送给所述策略执行设备。
在另一个可选的实现方式中：
所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将用户设备的私网IP地址转换为公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
附图7至附图10所提供的控制设备，可以应用在附图1A所示的场景中，实现方法实施例中附图1A、1B、1C、附图2、附图3以及相关描述中控制设备的功能，附图7至附图10中控制设备的其他附加功能、以及与其他设备之间的交互过程，请参考附图1A、1B、1C、附图2、附图3的相关描述，在这里不再重复。
由上述实施例可见，控制设备接收认证设备传输的用户信息，以及NAT设备传输的地址转换信息，并根据用户信息和地址转换信息生成用户名与公 网地址的关联关系，策略执行设备根据该关联关系获得与接收到的用户报文的公网地址对应的用户名后，执行与获得的用户名对应的用户策略。应用本发明实施例，认证设备和NAT设备无需向每个策略执行设备传输各自保存的用户信息和地址转换信息，而是只需要将上述信息传输到控制设备，并由控制设备集中对信息进行处理生成用户名与公网地址的关联关系即可，因此减少了网络中的数据传输量，节省了网络传输资源；并且，当网络架构中增加新的策略执行设备时，由于认证设备和NAT设备无需为该新增策略执行设备配置传输命令及传输信息，即认证设备和NAT设备无需进行功能改动，因此网络架构易于扩展。
本领域的技术人员可以清楚地了解到本发明实施例中的技术可借助软件加必需的通用硬件平台的方式来实现。基于这样的理解，本发明实施例中的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例或者实施例的某些部分所述的方法。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
以上所述的本发明实施方式，并不构成对本发明保护范围的限定。任何在本发明的精神和原则之内所作的修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (22)

  1. 一种策略执行方法，其特征在于，所述方法包括：
    策略执行设备接收用户报文；
    所述策略执行设备通过控制设备获得与所述用户报文的公网地址对应的用户名，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
    所述策略执行设备执行与所述用户名对应的用户策略。
  2. 根据权利要求1所述的方法，其特征在于，所述策略执行设备接收用户报文前，所述方法还包括：
    所述策略执行设备接收所述控制设备下发的所述用户名与公网地址的关联关系；
    所述策略执行设备通过控制设备获得与所述用户报文的公网地址对应的用户名，包括：
    所述策略执行设备根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名。
  3. 根据权利要求1所述的方法，其特征在于，所述策略执行设备通过控制设备获得与所述用户报文的公网地址对应的用户名，包括：
    所述策略执行设备将所述用户报文的公网地址上报给所述控制设备；
    接收所述控制设备返回的与所述用户报文的公网地址对应的用户名，所述用户名为所述控制设备根据所述用户报文的公网地址查找所述关联关系后获得的用户名。
  4. 根据权利要求1至3任意一项所述的方法，其特征在于，所述关联关 系中与每个用户名对应的每个公网地址包含：公网互联网协议IP地址和端口段，所述端口段为所述NAT设备将所述用户设备的私网IP地址转换为所述公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
  5. 一种策略执行方法，其特征在于，所述方法包括：
    控制设备接收认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
    所述控制设备根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系。
  6. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述控制设备向所述策略执行设备下发所述用户名与公网地址的关联关系。
  7. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述控制设备接收所述策略执行设备上报的所述用户报文的公网地址；
    所述控制设备根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名；
    所述控制设备将获得的用户名发送给所述策略执行设备。
  8. 根据权利要求5至7任意一项所述的方法，其特征在于，所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将所述用户设备的私网IP地址转换为所述公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
  9. 一种策略执行系统，其特征在于，所述系统包括：认证设备、网络地 址转换NAT设备、控制设备和策略执行设备，其中，
    所述认证设备，用于向所述控制设备传输用户信息，所述用户信息包含用户设备的用户名与私网地址的对应关系；
    所述NAT设备，用于向所述控制设备传输地址转换信息，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
    所述控制设备，用于根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系；
    所述策略执行设备，用于接收到用户报文时，通过所述控制设备生成的所述关联关系获得与所述用户报文的公网地址对应的用户名，并执行与所述用户名对应的用户策略。
  10. 根据权利要求9所述的系统，其特征在于，
    所述控制设备，还用于向所述策略执行设备下发所述用户名与公网地址的关联关系；
    所述策略执行设备，具体用于根据所述用户报文的公网地址查找所述关联关系后，获得与所述用户报文的公网地址对应的用户名。
  11. 根据权利要求9所述的系统，其特征在于，
    所述策略执行设备，还用于将所述用户报文的公网地址上报给所述控制设备；
    所述控制设备，还用于根据所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名，并将获得的用户名发送给所述策略执行设备。
  12. 根据权利要求9至11任意一项所述的系统，其特征在于，所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段，所述端口段为所述NAT设备将所述用户设备的私网IP地址转换为所述公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
  13. 一种策略执行设备，其特征在于，所述策略执行设备包括：
    接收单元，用于接收用户报文；
    获得单元，用于通过控制设备获得与所述接收单元接收到的用户报文的公网地址对应的用户名，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
    执行单元，用于执行与所述获得单元获得的用户名对应的用户策略。
  14. 根据权利要求13所述的策略执行设备，其特征在于，
    所述接收单元，还用于接收所述控制设备下发的所述用户名与公网地址的关联关系；
    所述获得单元，具体用于根据所述用户报文的公网地址查找所述接收单元接收到的所述关联关系，获得与所述用户报文的公网地址对应的用户名。
  15. 根据权利要求13所述的策略执行设备，其特征在于，所述获得单元包括：
    地址上报子单元，用于将所述用户报文的公网地址上报给所述控制设备；
    用户名获得子单元，用于接收所述控制设备返回的与所述用户报文的公网地址对应的用户名，所述用户名为所述控制设备根据所述用户报文的公网地址查找所述关联关系后获得的用户名。
  16. 根据权利要求13至15任意一项所述的策略执行设备，其特征在于，所述关联关系中与每个用户名对应的每个公网地址包含：公网互联网协议IP地址和端口段，所述端口段为所述NAT设备将所述用户设备的私网IP地址转 换为所述公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
  17. 一种控制设备，其特征在于，所述控制设备包括：
    接收单元，用于接收认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
    生成单元，用于根据所述接收单元接收到的所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系。
  18. 根据权利要求17所述的控制设备，其特征在于，所述控制设备还包括：
    第一发送单元，用于向所述策略执行设备下发所述生成单元生成的所述用户名与公网地址的关联关系。
  19. 根据权利要求17所述的控制设备，其特征在于，
    所述接收单元，还用于接收所述策略执行设备上报的所述用户报文的公网地址；
    所述控制设备还包括：
    查找单元，用于根据所述接收单元接收到的所述用户报文的公网地址查找所述关联关系，获得与所述用户报文的公网地址对应的用户名；
    第二发送单元，用于将所述查找单元获得的用户名发送给所述策略执行设备。
  20. 根据权利要求17至19任意一项所述的控制设备，其特征在于，所述关联关系中与每个用户名对应的每个公网地址包含：公网IP地址和端口段， 所述端口段为所述NAT设备将所述用户设备的私网IP地址转换为所述公网IP地址时为所述用户设备分配的所述公网IP地址下的一段连续的端口号。
  21. 一种策略执行设备，其特征在于，所述策略执行设备包括：网络接口和处理器，其中，
    所述网络接口，用于接收用户报文；
    所述处理器，用于通过控制设备获得与所述用户报文的公网地址对应的用户名，并执行与所述用户名对应的用户策略，其中，所述控制设备用于根据认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息生成用户名与公网地址的关联关系，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系。
  22. 一种控制设备，其特征在于，所述控制设备包括：网络接口和处理器，其中，
    所述网络接口，用于接收认证设备传输的用户信息，以及网络地址转换NAT设备传输的地址转换信息，其中，所述用户信息包含用户设备的用户名与私网地址的对应关系，所述地址转换信息包含所述用户设备的私网地址与转换后的公网地址的对应关系；
    所述处理器，用于根据所述用户信息和所述地址转换信息生成用户名与公网地址的关联关系。
PCT/CN2015/070338 2014-02-24 2015-01-08 策略执行方法、系统、策略执行设备及控制设备 WO2015124043A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410065318.8 2014-02-24
CN201410065318.8A CN103841221B (zh) 2014-02-24 2014-02-24 策略执行方法、系统、策略执行设备及控制设备

Publications (1)

Publication Number Publication Date
WO2015124043A1 true WO2015124043A1 (zh) 2015-08-27

Family

ID=50804342

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/070338 WO2015124043A1 (zh) 2014-02-24 2015-01-08 策略执行方法、系统、策略执行设备及控制设备

Country Status (2)

Country Link
CN (1) CN103841221B (zh)
WO (1) WO2015124043A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103841221B (zh) * 2014-02-24 2018-01-02 华为技术有限公司 策略执行方法、系统、策略执行设备及控制设备
CN109327395B (zh) * 2018-11-30 2021-09-10 新华三信息安全技术有限公司 一种报文处理方法及装置
CN111600971A (zh) * 2020-04-30 2020-08-28 新华三信息安全技术有限公司 一种设备管理的方法和设备管理的装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100040057A1 (en) * 2008-08-14 2010-02-18 Mediatek Inc. Communication method
CN102316042A (zh) * 2011-09-30 2012-01-11 杭州华三通信技术有限公司 一种报文的传输方法、设备和系统
CN103118147A (zh) * 2013-01-24 2013-05-22 中国联合网络通信集团有限公司 内网服务器访问方法、设备和系统
CN103139326A (zh) * 2013-03-06 2013-06-05 中国联合网络通信集团有限公司 Ip溯源方法、设备和系统
CN103841221A (zh) * 2014-02-24 2014-06-04 华为技术有限公司 策略执行方法、系统、策略执行设备及控制设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100040057A1 (en) * 2008-08-14 2010-02-18 Mediatek Inc. Communication method
CN102316042A (zh) * 2011-09-30 2012-01-11 杭州华三通信技术有限公司 一种报文的传输方法、设备和系统
CN103118147A (zh) * 2013-01-24 2013-05-22 中国联合网络通信集团有限公司 内网服务器访问方法、设备和系统
CN103139326A (zh) * 2013-03-06 2013-06-05 中国联合网络通信集团有限公司 Ip溯源方法、设备和系统
CN103841221A (zh) * 2014-02-24 2014-06-04 华为技术有限公司 策略执行方法、系统、策略执行设备及控制设备

Also Published As

Publication number Publication date
CN103841221A (zh) 2014-06-04
CN103841221B (zh) 2018-01-02

Similar Documents

Publication Publication Date Title
JP6423047B2 (ja) 仮想ネットワークインタフェースオブジェクト
JP5711754B2 (ja) スマートクライアントルーティング
WO2019201043A1 (zh) 网络通信方法、系统、设备及存储介质
US9554276B2 (en) System and method for on the fly protocol conversion in obtaining policy enforcement information
WO2015124045A1 (zh) 一种通道建立的方法和设备
WO2017024791A1 (zh) 一种处理授权的方法和设备
US9419940B2 (en) IPv4 data center support for IPv4 and IPv6 visitors
US10439988B2 (en) On premises, remotely managed, host computers for virtual desktops
US20080089323A1 (en) System and method for assigning virtual local area networks
WO2018019262A1 (zh) 云桌面系统、云桌面、云终端及组播方法
CN107800743B (zh) 云桌面系统、云管理系统和相关设备
RU2007148416A (ru) Объединенная архитектура для удаленного доступа к сети
US9654439B2 (en) Methods and gateways for processing DNS request
WO2019080320A1 (zh) 一种多系统网络互联设备、方法及装置
WO2015158250A1 (zh) 一种资源分配方法、报文通信方法及装置
US20230291706A1 (en) Method for accessing network, media gateway, electronic device and storage medium
CN105516171A (zh) 基于认证服务集群的Portal保活系统及方法、认证系统及方法
WO2017124965A1 (zh) 多操作系统终端接入网络的方法及多操作系统终端
WO2018019216A1 (zh) Ap接入控制
WO2015124043A1 (zh) 策略执行方法、系统、策略执行设备及控制设备
WO2015043550A1 (zh) 多媒体分享方法、注册方法、服务器及代理服务器
WO2015014085A1 (zh) 一种协议转换的方法及协议转换器
CN114025009B (zh) 转发请求的方法、系统、代理服务器和装置
US20120300776A1 (en) Method for creating virtual link, communication network element, and ethernet network system
CN106385471A (zh) 一种用于物联网的端口映射与网关动态ip地址解析方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15752318

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15752318

Country of ref document: EP

Kind code of ref document: A1