WO2016131358A1 - 家庭网关及其通信管理方法、通信系统 - Google Patents

家庭网关及其通信管理方法、通信系统 Download PDF

Info

Publication number
WO2016131358A1
WO2016131358A1 PCT/CN2016/071228 CN2016071228W WO2016131358A1 WO 2016131358 A1 WO2016131358 A1 WO 2016131358A1 CN 2016071228 W CN2016071228 W CN 2016071228W WO 2016131358 A1 WO2016131358 A1 WO 2016131358A1
Authority
WO
WIPO (PCT)
Prior art keywords
server
network management
home gateway
management server
redirection
Prior art date
Application number
PCT/CN2016/071228
Other languages
English (en)
French (fr)
Inventor
刘海明
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP16751889.3A priority Critical patent/EP3313039A4/en
Publication of WO2016131358A1 publication Critical patent/WO2016131358A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2803—Home automation networks
    • H04L12/283—Processing of data at an internetworking point of a home automation network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2803—Home automation networks
    • H04L12/283—Processing of data at an internetworking point of a home automation network
    • H04L12/2834—Switching of information between an external network and a home network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/563—Data redirection of data network streams

Definitions

  • This application relates to, but is not limited to, the field of communications.
  • the operating pressure of the network management server increases. Especially, the network management platform in the related art communication system is directly exposed to the user, which causes some illegal terminals to access relatively easily. On the other hand, the operating pressure of the network management platform server is further increased. Even when the current network security is very sensitive, if these illegal terminals maliciously attack the network management server, the network management server may be paralyzed, the home gateway cannot be remotely controlled, and the normal installation cannot be performed.
  • This paper provides a home gateway and its communication management method and communication system, which solves the problem of security risks caused by the network management platform directly exposed to users in the related art communication system.
  • the embodiment of the invention provides a home gateway communication management method, and the process of connecting the home gateway to the network management server includes:
  • the home gateway is connected to the redirect server by redirecting server connection information
  • the home gateway receives the real network management server connection information sent by the redirect server;
  • the home gateway is connected to the network management service according to the real network management server connection information. Device.
  • the method further includes: sending, to the redirecting server, first authentication information, where The real network management server connection information is sent after the redirection server authenticates and passes the first authentication information.
  • the real network management server connection information includes network management server address information and a redirection attribute value, where the redirection attribute value includes a permanent setting and a temporary setting;
  • the home gateway After the home gateway receives the real network management server connection information sent by the redirecting server, the home gateway is connected to the network management server according to the real network management server connection information, and further includes: the home gateway according to the weight The orientation attribute value sets the network management server address information redirection attribute;
  • the home gateway is connected to the network management server according to the real network management server connection information, and the home gateway is connected to the network management server according to the network management server address information.
  • the connecting, by the home gateway, to the network management server according to the network management server address information includes:
  • the home gateway After receiving the authentication success response message fed back by the network management server, the home gateway is connected to the network management server by using a certificate encryption manner.
  • the method before the home gateway is connected to the redirect server by redirecting server connection information, the method further includes:
  • the home gateway connects to the authentication server through the fake network management connection information, and sends the third authentication information to the authentication server;
  • the home gateway receives the connection redirection server authority that is fed back by the authentication server after the third authentication information is successfully authenticated;
  • the home gateway After receiving the connection redirection server permission, the home gateway initiates a connection to the redirect server according to the redirect server connection information.
  • the embodiment of the invention provides a home gateway communication management method, and the process of connecting the home gateway to the network management server includes:
  • the home gateway is connected to the redirect server by redirecting server connection information
  • the redirecting server sends real network management server connection information to the home network
  • the home gateway is connected to the network management server according to the real network management server connection information.
  • the embodiment of the invention further provides a home gateway, including a communication connection management unit and a redirection management unit;
  • the redirection management unit is configured to: connect to the redirection server by using the redirection server connection information, and receive real network management server connection information sent by the redirection server;
  • the communication connection management unit is configured to connect to the network management server according to the real network management server connection information.
  • the redirection management unit is further configured to: after connecting to the redirection server, send the first authentication information to the redirection server before receiving the real network management server connection information
  • the real network management server connection information is sent by the redirect server after the first authentication information is authenticated and passed.
  • the real network management server connection information includes network management server address information and a redirection attribute value, where the redirection attribute value includes a permanent setting and a temporary setting; and the redirection management unit further The setting is: setting a redirection attribute of the network management server address information according to the redirect attribute value;
  • the communication connection management unit is configured to: after the redirection management unit sets the redirection attribute of the network management server address information, connect to the network management server according to the network management server address information.
  • the communication connection management unit is configured to:
  • the certificate After receiving the authentication success response message fed back by the network management server, the certificate is encrypted and connected to the network management server.
  • the communication connection management unit is further configured to: connect to the authentication server through the fake network management connection information before the redirection management unit connects to the redirection server by redirecting the server connection information, And sending the third authentication information to the authentication server, and receiving the connection redirection server authority that is fed back by the authentication server after the third authentication information is successfully authenticated;
  • the redirection management unit is further configured to: after receiving the connection redirection server permission, initiate a connection to the redirection server according to the redirection server connection information.
  • the embodiment of the invention further provides a communication system, including a home gateway, a redirect server, and a network management server;
  • the home gateway is configured to: connect to the redirect server by redirecting server connection information;
  • the redirecting server is configured to: send real network management server connection information to the home network;
  • the home gateway is further configured to: connect to the network management server according to the real network management server connection information.
  • the embodiment of the present invention further provides a computer readable storage medium storing computer executable instructions for performing the method of any of the above.
  • the home gateway, the communication management method, and the communication system provided by the embodiments of the present invention are not directly exposed to the user.
  • the home gateway needs to connect to the heavy server connection information first.
  • the directional server then receives the real network management server connection information sent by the redirect server, and then jumps to the real network management server connection information, and can actually connect to the network management server according to the real network management server connection information; the related technology directly connects the network management server
  • the method of being exposed to the user can be redirected to the real network management server by redirecting the server, which can avoid the easy access of the illegal terminal and cause additional operational pressure and security risks to the network management server. Can improve the satisfaction of the user experience.
  • FIG. 1 is a schematic flowchart of a home gateway communication management method according to Embodiment 1 of the present invention.
  • FIG. 2 is a schematic flowchart of a first authentication process of a home gateway according to Embodiment 1 of the present invention
  • FIG. 3 is a schematic flowchart of a last authentication process of a home gateway according to Embodiment 1 of the present invention.
  • FIG. 4 is a schematic structural diagram of a communication system according to Embodiment 2 of the present invention.
  • FIG. 5 is a schematic structural diagram of a home gateway according to Embodiment 2 of the present invention.
  • FIG. 6 is a schematic structural diagram of a home gateway according to Embodiment 3 of the present invention.
  • FIG. 7 is a schematic flowchart of a home gateway communication management method according to Embodiment 3 of the present invention.
  • FIG. 8 is a schematic flowchart of a home gateway connected to a network management server according to Embodiment 3 of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • the network management server in this embodiment is not directly exposed to the user.
  • the connection information is first connected to the redirect server through the redirect server connection information, and then the real network management server connection information sent by the redirect server is received. Then, the connection information of the real network management server can be redirected, and the connection information of the real network management server can be truly connected to the network management server; the illegal access of the illegal terminal can be avoided, thereby causing additional operational pressure and security risks to the network management server.
  • Figure 1 including:
  • Step 101 The home gateway connects to the redirect server by redirecting the server connection information.
  • the redirection server connection information in this embodiment includes the redirection server connection address, and the redirection server connection information may be pre-stored in the home gateway, or may be temporarily acquired when the user needs to connect to the network management server;
  • Step 102 The redirect server sends real network management server connection information to the home network.
  • Step 103 The home gateway connects to the network management system according to the received real network management server connection information. server.
  • the redirecting server in this embodiment may also authenticate the home gateway to which the connection is initiated, and only feed back the real network management server connection information after the authentication is passed, and if the authentication fails, it is considered to be an illegal terminal. Do not feed back the real network management server connection information.
  • the method further includes sending the first authentication information to the redirecting server, and the redirecting server sends the real network management server connection to the home gateway according to the first authentication information. information. This adds an authentication mechanism to further enhance network security.
  • the home gateway can be authenticated once before the home gateway is connected to the redirect server. Only the home gateway successfully authenticated can obtain the permission to connect to the redirect server, and the authentication fails. The home gateway does not have permission to connect to the redirect server, and thus the real connection information of the network management server is not obtained.
  • the connection information of the authentication server that performs the authentication may be set as the false network management server connection information, so that the information presented to the terminal user is still The network management server connects information, and the user does not feel the subsequent execution process, which can improve user experience satisfaction and security.
  • the first authentication process shown in FIG. 2 is also included, including:
  • Step 201 The home gateway connects to the authentication server through the fake network management connection information, and sends the third authentication information to the authentication server.
  • Step 202 The home gateway receives the connection redirection server authority that is fed back by the authentication server after the third authentication information is successfully authenticated.
  • Step 203 After obtaining the connection redirection server permission, the home gateway initiates a connection to the redirect server according to the redirect server connection information.
  • the real network management server connection information fed back to the home network server includes the network management server address information and the redirect attribute value, and the redirect attribute value is Permanent settings or temporary settings;
  • the home gateway sets the network management server address information redirection attribute according to the redirection attribute value, that is, when the redirection attribute value is a permanent setting, the home gateway internally sets the address information of the network management server to the network management server address information permanently.
  • the home gateway does not need to be redirected when it connects to the network management server next time.
  • the redirect attribute value is temporarily set, the home gateway temporarily sets the address information of the network management server to the network management server address information temporarily. The next time the home gateway connects to the network management server, it needs to be redirected again.
  • the network management server can further perform the last authentication, and the authentication passes the home gateway. Establish a connection.
  • the process is shown in Figure 3. It includes:
  • Step 301 The home gateway sends the second authentication information to the network management server according to the network management server address information.
  • Step 302 After receiving the authentication success response message fed back by the network management server, the home gateway is connected to the network management server by using a certificate encryption manner.
  • the content included in the first authentication information, the second authentication information, and the third authentication information in this embodiment depends on factors such as an authentication mechanism adopted by the authenticator; and the first authentication information and the first in the embodiment.
  • the third authentication information may be the same or different, and the second authentication information may be the same as or different from the first authentication information and/or the third authentication information; that is, each authenticating party in this embodiment may be independent of each other or may be shared.
  • the first authentication information, the second authentication information, and the third authentication information in the embodiment may be in the form of a certificate chain, for example, the first authentication information and the third authentication information adopt a root certificate in the certificate chain; the second authentication information Sub-certificates in the certificate chain are used; of course, the certificate chain can be used instead of a single certificate or other forms.
  • redirection in this embodiment is not limited to redirection.
  • multiple redirections may be performed according to requirements, and the authentication may be added one or more times according to requirements.
  • the authentication information used for each redirection may be the same or different.
  • the home gateway device in this embodiment includes, but is not limited to, a network camera device, a network storage device, a PC device, and other home devices that support network control.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • a communication system provided in this embodiment, as shown in FIG. 4, includes a home gateway 1, a redirect server 2, and a network management server 3;
  • the home gateway 1 is configured to connect to the redirect server 2 through the redirect server connection information, receive the real network management server connection information fed back by the redirect server 2, and connect to the network management server 3 according to the received real network management server connection information.
  • the redirection server connection information in this embodiment includes the redirection server 2 connection address, and the redirection server connection information may be pre-stored in the home gateway 1 or may be temporarily acquired when the user needs to connect to the network management server 3;
  • the redirection server 2 in this embodiment may also be configured to: authenticate the home gateway 1 to which the connection is initiated, and only feed back the real network management server connection information after the authentication is passed, and if the authentication fails, it is considered It is an illegal terminal and does not feed back the real network management server connection information.
  • the method further includes sending the first authentication information to the redirecting server 2, and the redirecting server 2 authenticates the home gateway 1 based on the first authentication information. Send real network management server connection information. This adds an authentication mechanism to further enhance network security.
  • the home gateway 1 can be authenticated once before being connected to the redirecting server 2. Only the home gateway 1 with successful authentication can obtain the connection to the redirecting server 2. Permission, otherwise, there is no permission to connect to the redirect server 2, and the real connection information of the network management server 3 is not obtained.
  • the communication system in this embodiment therefore also includes an authentication server 4 for performing the authentication process. Considering that the authentication is performed by the first step of the home gateway 1 to connect to the network management server 3, the connection information of the authentication server 4 that performs the authentication may be set as the fake network management server connection information, so that the information presented to the terminal user is still The network management server 3 connects the information, and the user does not feel the subsequent execution process, which can improve the user experience satisfaction and security.
  • the certification process is:
  • the home gateway 1 is connected to the authentication server 4 through the fake network management connection information, and sends the third authentication information to the authentication server 4;
  • the home gateway 1 receives the connection redirection server 2 authority that the authentication server 4 feeds back after the third authentication information is successfully authenticated;
  • the home gateway 1 After obtaining the permission of the connection redirection server 2, the home gateway 1 initiates a connection to the redirection server 2 according to the information of the redirection server 2.
  • the real network management server connection information fed back to the home network server includes the network management server 3 address information and the redirect attribute value.
  • the targeting attribute value is a permanent setting or a temporary setting
  • the home gateway 1 is further configured to: set the network management server 3 address information redirection attribute according to the redirection attribute value, that is, when the redirection attribute value is a permanent setting, the home gateway 1 internally internally sets the address information of the network management server 3 to be permanent.
  • the setting of the attribute is the network management server 3 address information, and the home gateway 1 does not need to be redirected when connecting to the network management server 3 next time; when the redirect attribute value is set temporarily, the home gateway 1 internally sets the network management server 3
  • the address information is temporarily set to the address information of the network management server 3, and the home gateway 1 needs to be redirected again when it connects to the network management server 3 next time.
  • the network management server 3 may also be configured to: perform the last authentication on the home gateway 1 The authentication is established to establish a connection with the home gateway 1. The process is as follows:
  • the home gateway 1 sends the second authentication information to the network management server 3 according to the network management server 3 address information;
  • the home gateway 1 After receiving the authentication success response message fed back by the network management server 3, the home gateway 1 is connected to the network management server 3 by means of certificate encryption.
  • the home gateway in this embodiment includes a communication connection management unit 11 and a redirection management unit 12;
  • the redirection management unit 12 is configured to: connect to the redirection server 2 through the redirect server connection information, and receive the real network management server connection information sent by the redirection server 2;
  • the communication connection management unit 11 is configured to connect to the network management server 3 based on the real network management server connection information.
  • the redirection management unit 12 is further configured to: after connecting to the redirection server 2, before receiving the real network management server connection information, send the first authentication information to the redirection server 2, and the real network management server connection information is the redirection server 2 based on the first If the authentication information is passed, the home gateway 1 is considered to be an illegal terminal.
  • the real network management server connection information fed back by the redirect server 2 includes the network management server address information and the redirection attribute value, and the redirection attribute value includes a permanent setting and a temporary setting; the redirection management unit 12 is further configured to: according to the redirection attribute value Set the redirection attribute of the network management server address information.
  • the redirection attribute value is a permanent setting
  • the address information of the network management server inside the home gateway is permanently set to the network management server address information, and the home gateway does not need to be redirected when connecting to the network management server next time
  • the redirection attribute value is temporarily set
  • the address information of the internal network management server of the home gateway is temporarily set to the network management server address information, and the home gateway needs to re-redirect the next time it connects to the network management server.
  • the communication connection management unit 11 connects to the network management server according to the network management server address information, and the connection process includes:
  • the communication connection management unit 11 sends the second authentication information to the network management server according to the network management server address information
  • the communication connection management unit 11 After receiving the authentication success response message fed back by the network management server, the communication connection management unit 11 is connected to the network management server by using a certificate encryption method.
  • the communication connection management unit 11 is further configured to connect to the authentication through the fake network management connection information before the redirection management unit 12 connects to the redirection server 2 through the redirection server connection information.
  • the server 4 sends the third authentication information to the authentication server 4, and receives the connection redirection server authority that the authentication server 4 feeds back based on the third authentication information after the authentication succeeds;
  • the redirection management unit 12 is further configured to: obtain the connection weight
  • the server permission is directed to initiate a connection to the redirect server 2 based on the redirect server information.
  • the content included in the first authentication information, the second authentication information, and the third authentication information in this embodiment depends on factors such as an authentication mechanism adopted by the authenticator; and the first authentication information and the third in the embodiment.
  • the authentication information may be the same or different; the second authentication information may also be the same as or different from the first authentication information and/or the third authentication information; that is, each authenticating party in the embodiment (for example, an authentication server that performs authentication, The redirection server and the network management server may be independent of each other, and may share the authentication information.
  • the first authentication information, the second authentication information, and the third authentication information may be in the form of a certificate chain.
  • the gateway can then include a certificate chain unit.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • the home gateway 6 includes a certificate chain unit 61, a redirection management unit 62, and a TR069 management unit (corresponding communication connection management unit) 63; the first authentication information and the third authentication information are authenticated.
  • the root certificate in the chain is implemented, and the second authentication information is implemented by the sub-certificate in the authentication chain.
  • the certificate chain is previously set by the certificate chain unit 61, and the corresponding certificate is imported.
  • the TR069 management unit 63 After the certificate chain is added, the TR069 management unit 63 is notified, and the TR069 management unit 63 uses the root certificate to connect to the fake network management server connection information, so that the home gateway can be normally connected to the network management platform according to the following steps. See Figure 7, including:
  • Step 701 The TR069 management unit 63 actively connects to the authentication server through the root certificate, and determines whether the authentication is successful according to the status returned by the authentication server.
  • Step 702 After the authentication succeeds, the connection redirection server authority is obtained, and the redirection management unit 62 actively redirects the server through the root certificate connection, and receives the real network management server connection information fed back by the redirection server when the authentication succeeds; otherwise, the connection fails. ;
  • Step 703 The TR069 management unit 63 connects to the real network management platform according to the network management server address information in the real network management server connection information.
  • the home gateway redirection management unit 62 sets the information of the internal network management server of the home gateway according to the redirection attribute value returned by the redirection server, including:
  • the home gateway redirection management unit 62 permanently modifies the network management connection address.
  • the home gateway redirection management unit 62 When the returned redirect attribute value is temporarily set, the home gateway redirection management unit 62 The network management connection address will be temporarily modified. When the home gateway connects to the network management server next time, the redirection will be repeated. After obtaining the network management server address information, the home gateway TR069 management unit 63 uses the sub-certificate in the certificate chain to connect to the real network management server, so that the home gateway can be normally connected to the network management server (that is, the network management platform) according to the steps shown in FIG. 8 below. ):
  • Step 801 The home gateway TR069 management unit 63 actively connects to the network management server through the sub-certificate, and determines whether the authentication is successful according to the status returned by the network management server.
  • Step 802 After the home gateway is successfully authenticated, the home gateway TR069 management unit 63 connects to the network management server by using the certificate encryption mode. At this time, the network management platform can normally manage the home gateway; if the home gateway authentication fails, the connection fails.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the embodiment of the present invention can be redirected to the real network management server after being re-scheduled by the redirecting server, thereby avoiding the easy access of the illegal terminal and causing additional effects on the network management server. Operating pressure and security risks can increase the satisfaction of the user experience.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Automation & Control Theory (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

本文公布一种家庭网关及其通信管理方法、通信系统；本发明实施例中的网管服务器并未直接暴露给用户，当家庭网关要连接至网管服务器时，该家庭网关通过重定向服务器连接信息先连接至重定向服务器，然后在接收重定向服务器发送的真实网管服务器连接信息后，根据该真实网管服务器连接信息才能真正连接至网管服务器。

Description

家庭网关及其通信管理方法、通信系统 技术领域
本申请涉及但不限于通信领域。
背景技术
随着宽带网络的发展，智能家庭网关已经悄然走进普通用户家中。它借助计算机网络技术，将家庭网关设备通过拨号接入互联网，并通过CWMP(CPE WAN Management Protocol，客户终端设备广域网管理协议，简称TR069)或者其他基于TCP(Transmission Control Protocol，传输控制协议)方式的协议连接网管平台，从而实现远程管理、远程监控的目的。
然而随着终端用户数不断递增，会造成网管服务器运行压力增加；尤其由于相关技术的通信系统中的网管平台是直接暴露给用户的，这导致一些不合法的终端也能比较轻易的接入，在另一方面进一步增加了网管平台服务器的运行压力。甚至在当前网络安全非常敏感的时刻，如果这些不合法的终端恶意攻击网管服务器，可能会导致网管服务器瘫痪，无法远程控制家庭网关以及无法进行正常的放装。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本文提供一种家庭网关及其通信管理方法、通信系统，解决相关技术通信系统中网管平台直接暴露给用户造成的安全隐患问题。
本发明实施例提供一种家庭网关通信管理方法，家庭网关连接至网管服务器的过程包括：
所述家庭网关通过重定向服务器连接信息连接至重定向服务器；
所述家庭网关接收所述重定向服务器发送的真实网管服务器连接信息；
所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务 器。
在本发明的一种实施例中，所述家庭网关连接至所述重定向服务器之后，接收所述真实网管服务器连接信息之前，还包括：向所述重定向服务器发送第一认证信息，所述真实网管服务器连接信息为所述重定向服务器基于所述第一认证信息认证通过后发送的。
在本发明的一种实施例中，所述真实网管服务器连接信息包括网管服务器地址信息和重定向属性值，所述重定向属性值包括永久性设置和临时性设置；
所述家庭网关接收所述重定向服务器发送的真实网管服务器连接信息之后，所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务器之前，还包括：所述家庭网关根据所述重定向属性值设置所述网管服务器地址信息重定向属性；
所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务器包括：所述家庭网关根据所述网管服务器地址信息连接至所述网管服务器。
在本发明的一种实施例中，所述家庭网关根据所述网管服务器地址信息连接至所述网管服务器包括：
所述家庭网关根据所述网管服务器地址信息向所述网管服务器发送第二认证信息；
所述家庭网关在接收到所述网管服务器反馈的认证成功响应消息后，通过证书加密方式连接至所述网管服务器。
在本发明的一种实施例中，所述家庭网关通过重定向服务器连接信息连接至所述重定向服务器之前，还包括：
所述家庭网关通过虚假网管连接信息连接至认证服务器，并向认证服务器发送第三认证信息；
所述家庭网关接收所述认证服务器基于所述第三认证信息认证成功后反馈的连接重定向服务器权限；
所述家庭网关收到所述连接重定向服务器权限后，根据所述重定向服务器连接信息向所述重定向服务器发起连接。
本发明实施例提供了一种家庭网关通信管理方法，家庭网关连接至网管服务器的过程包括：
所述家庭网关通过重定向服务器连接信息连接至重定向服务器；
所述重定向服务器向所述家庭网络发送真实网管服务器连接信息；
所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务器。
本发明实施例还提供了一种家庭网关，包括通信连接管理单元和重定向管理单元；
所述重定向管理单元设置为：通过重定向服务器连接信息连接至重定向服务器，接收所述重定向服务器发送的真实网管服务器连接信息；
所述通信连接管理单元设置为：根据所述真实网管服务器连接信息连接至所述网管服务器。
在本发明的一种实施例中，所述重定向管理单元还设置为：连接至所述重定向服务器后，接收所述真实网管服务器连接信息之前，向所述重定向服务器发送第一认证信息，所述真实网管服务器连接信息为所述重定向服务器基于所述第一认证信息认证通过后发送的。
在本发明的一种实施例中，所述真实网管服务器连接信息包括网管服务器地址信息和重定向属性值，所述重定向属性值包括永久性设置和临时性设置；所述重定向管理单元还设置为：根据所述重定向属性值设置所述网管服务器地址信息的重定向属性；
所述通信连接管理单元是设置为：在所述重定向管理单元对所述网管服务器地址信息的重定向属性设置完成后，根据所述网管服务器地址信息连接至所述网管服务器。
在本发明的一种实施例中，所述通信连接管理单元是设置为：
根据所述网管服务器地址信息向所述网管服务器发送第二认证信息；
在接收到所述网管服务器反馈的认证成功响应消息后，通过证书加密方式连接至所述网管服务器。
在本发明的一种实施例中，所述通信连接管理单元还设置为：在所述重定向管理单元通过重定向服务器连接信息连接至重定向服务器之前，通过虚假网管连接信息连接至认证服务器，并向认证服务器发送第三认证信息，以及接收所述认证服务器基于所述第三认证信息认证成功后反馈的连接重定向服务器权限；
所述重定向管理单元还设置为：接收到所述连接重定向服务器权限后，根据所述重定向服务器连接信息向所述重定向服务器发起连接。
本发明实施例还提供了一种通信系统，包括家庭网关、重定向服务器以及网管服务器；
所述家庭网关设置为：通过重定向服务器连接信息连接至重定向服务器；
所述重定向服务器设置为：向所述家庭网络发送真实网管服务器连接信息；
所述家庭网关还设置为：根据所述真实网管服务器连接信息连接至所述网管服务器。
本发明实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项的方法。
本发明实施例提供的家庭网关及其通信管理方法、通信系统，网管服务器并未直接暴露给用户，当家庭网关要连接至网管服务器时，该家庭网关需通过重定向服务器连接信息先连接至重定向服务器，然后在接收重定向服务器发送的真实网管服务器连接信息后，再跳转至该真实网管服务器连接信息，根据该真实网管服务器连接信息才能真正连接至网管服务器；相对相关技术将网管服务器直接暴露给用户的做法，本发明实施例通过重定向服务器进行重定成功后才能跳转到连接到真正的网管服务器，可以避免非法终端轻易的接入从而对网管服务器造成额外的运行压力和安全隐患，能提升用户体验的满意度。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例一提供的家庭网关通信管理方法流程示意图；
图2为本发明实施例一提供的家庭网关第一次认证过程流程示意图；
图3为本发明实施例一提供的家庭网关最后一次认证过程流程示意图；
图4为本发明实施例二提供的通信系统结构示意图；
图5为本发明实施例二提供的家庭网关结构示意图；
图6为本发明实施例三提供的家庭网关结构示意图；
图7为本发明实施例三提供的家庭网关通信管理方法流程示意图；
图8为本发明实施例三提供的家庭网关连接到网管服务器的流程示意图。
本发明的实施方式
下面结合附图对本发明的实施方式进行说明。
实施例一：
本实施例中的网管服务器并未直接暴露给用户，当家庭网关要连接至网管服务器时，通过重定向服务器连接信息先连接至重定向服务器，然后在接收重定向服务器发送的真实网管服务器连接信息后，再跳转至该真实网管服务器连接信息，根据该真实网管服务器连接信息才能真正连接至网管服务器；可避免非法终端轻易的接入从而对网管服务器造成额外的运行压力和安全隐患。其过程请参见图1所示，包括：
步骤101：家庭网关通过重定向服务器连接信息连接至重定向服务器；
本实施例中的重定向服务器连接信息包括重定向服务器连接地址，且该重定向服务器连接信息可以是预先存储于家庭网关中的，也可以用户需要连接到网管服务器时临时获取的；
步骤102：重定向服务器向家庭网络发送真实网管服务器连接信息；
步骤103：家庭网关根据接收到的真实网管服务器连接信息连接至网管 服务器。
另外，由于传统的远程管理系统不需要进行证书认证就直接连接网管服务器，缺乏安全性和运行效率，这在另外一方面也导致网管平台直接暴露给用户，也造成网络安全方面的隐患。为此，本实施例中的重定向服务器还可对向其发起连接的家庭网关进行认证，只有认证通过后才向其反馈真实网管服务器连接信息，对于认证失败的，则认为其是非法终端，不向其反馈真实网管服务器连接信息。此时本实施例中的家庭网关连接至重定向服务器之后还包括向重定向服务器发送第一认证信息，重定向服务器基于第一认证信息对该家庭网关认证通过后才向其发送真实网管服务器连接信息。这样增加一道认证机制可进一步提升网络安全性。
为了进一步增加网络安全性，在本实施例中甚至可以在家庭网关连接至重定向服务器之前先对其进行一次安全认证，只有认证成功的家庭网关才能获取到连接到重定向服务器的权限，认证失败的家庭网关没有权限连接到重定向服务器，也就获取不到网管服务器的真实连接信息。本实施例中，由于该认证是家庭网关触发连接到网管服务器的第一步执行的，因此可以设置执行该认证的认证服务器的连接信息为虚假网管服务器连接信息，这样呈现给终端用户的仍是网管服务器连接信息，用户感觉不到后续的执行过程，能提升用户体验满意度和安全性。此时，家庭网关通过重定向服务器连接信息连接至重定向服务器之前，还包括图2所示的第一次认证过程，包括：
步骤201：家庭网关通过虚假网管连接信息连接至认证服务器，并向认证服务器发送第三认证信息；
步骤202：家庭网关接收认证服务器基于第三认证信息认证成功后反馈的连接重定向服务器权限；
步骤203：家庭网关获取到连接重定向服务器权限后，根据重定向服务器连接信息向重定向服务器发起连接。
本实施例中，重定向服务器根据家庭网关发送的第一认证信息对家庭网关认证成功后，向其反馈的真实网管服务器连接信息包括网管服务器地址信息和重定向属性值，该重定向属性值为永久性设置或临时性设置；
家庭网关根据重定向属性值设置网管服务器地址信息重定向属性，也即在重定向属性值为永久性设置时，则家庭网关在内部将网管服务器的地址信息永久性的设置为该网管服务器地址信息，家庭网关下次连接至该网管服务器时不需要再重定向；在重定向属性值为临时性设置时，则家庭网关在内部将网管服务器的地址信息暂时性的设置为该网管服务器地址信息，家庭网关下次连接至该网管服务器时需要再重新重定向。
本实施例中，为了进一步提升网络连接安全性，在家庭网关获取到真实网管服务器连接信息后，连接至网管服务器时，网管服务器还可进一步对其进行最后一次认证，认证通过才与该家庭网关建立连接，该过程请参见图3所示，包括：
步骤301：家庭网关根据网管服务器地址信息向网管服务器发送第二认证信息；
步骤302：家庭网关在接收到所网管服务器反馈的认证成功响应消息后，通过证书加密方式连接至该网管服务器。
应当理解的是，本实施例中的第一认证信息、第二认证信息和第三认证信息包含的内容取决于认证方采用的认证机制等因素；且本实施例中的第一认证信息和第三认证信息可以相同，也可以不同；第二认证信息也可与第一认证信息和/或第三认证信息相同或不同；也即本实施例中的每个认证方可以相互独立，也可以共享认证信息；本实施例中第一认证信息、第二认证信息和第三认证信息可以采用证书链的形式，例如第一认证信息和第三认证信息采用证书链中的根证书；第二认证信息采用证书链中的子证书；当然还可不采用证书链，而直接采用单证书或者其他形式实现。
另外，应当理解的是，对于本实施例中的重定向，并不仅限于重定向一次，为了进一步提升安全性，可根据需求进行多次重定向，且认证也可根据需求增加一次或多次，且每次重定向所采用的认证信息可以相同，也可以不同。
本实施例中的家庭网关设备则包括但不限于网络摄像装置、网络存储设备、PC设备以及其他支持网络控制的家居设备等。
实施例二：
本实施例提供的一种通信系统，请参见图4所示，其包括家庭网关1、重定向服务器2以及网管服务器3；
家庭网关1设置为：通过重定向服务器连接信息连接至重定向服务器2，接收重定向服务器2反馈的真实网管服务器连接信息；以及根据接收到的真实网管服务器连接信息连接至网管服务器3。
本实施例中的重定向服务器连接信息包括重定向服务器2连接地址，且该重定向服务器连接信息可以是预先存储于家庭网关1中的，也可以用户需要连接到网管服务器3时临时获取的；
由于传统的远程管理系统不需要进行证书认证就直接连接网管服务器3，缺乏安全性和运行效率，这在另外一方面也导致网管平台直接暴露给用户，也造成网络安全方面的隐患。为此，本实施例中的重定向服务器2还可设置为：对向其发起连接的家庭网关1进行认证，只有认证通过后才向其反馈真实网管服务器连接信息，对于认证失败的，则认为其是非法终端，不向其反馈真实网管服务器连接信息。此时本实施例中的家庭网关1连接至重定向服务器2之后还包括向重定向服务器2发送第一认证信息，重定向服务器2基于第一认证信息对该家庭网关1认证通过后才向其发送真实网管服务器连接信息。这样增加一道认证机制可进一步提升网络安全性。
为了进一步增加网络安全性，在本实施例中甚至可以在家庭网关1连接至重定向服务器2之前先对其进行一次安全认证，只有认证成功的家庭网关1才能获取到连接到重定向服务器2的权限，否则，没有权限连接到重定向服务器2，也就获取不到网管服务器3的真实连接信息。因此本实施例中的通信系统还包括用于执行该认证过程的认证服务器4。同时考虑到该认证是家庭网关1触发连接到网管服务器3的第一步执行的，因此可以设置执行该认证的认证服务器4的连接信息为虚假网管服务器连接信息，这样呈现给终端用户的仍是网管服务器3连接信息，用户感觉不到后续的执行过程，能提升用户体验满意度和安全性。该认证过程为：
家庭网关1通过虚假网管连接信息连接至认证服务器4，并向认证服务器4发送第三认证信息；
家庭网关1接收认证服务器4基于第三认证信息认证成功后反馈的连接重定向服务器2权限；
家庭网关1获取到连接重定向服务器2权限后，根据重定向服务器2信息向重定向服务器2发起连接。
本实施例中，重定向服务器2根据家庭网关1发送的第二认证信息对家庭网关1认证成功后，向其反馈的真实网管服务器连接信息包括网管服务器3地址信息和重定向属性值，该重定向属性值为永久性设置或临时性设置；
家庭网关1则还设置为：根据重定向属性值设置网管服务器3地址信息重定向属性，也即在重定向属性值为永久性设置时，则家庭网关1在内部将网管服务器3的地址信息永久性的设置为该网管服务器3地址信息，家庭网关1下次连接至该网管服务器3时不需要再重定向；在重定向属性值为临时性设置时，则家庭网关1在内部将网管服务器3的地址信息暂时性的设置为该网管服务器3地址信息，家庭网关1下次连接至该网管服务器3时需要再重新重定向。
本实施例中，为了进一步提升网络连接安全性，在家庭网关1获取到真实网管服务器连接信息后，连接至网管服务器3时，网管服务器3还可设置为：对家庭网关1进行最后一次认证，认证通过才与该家庭网关1建立连接，该过程如下：
家庭网关1根据网管服务器3地址信息向网管服务器3发送第二认证信息；
家庭网关1在接收到所网管服务器3反馈的认证成功响应消息后，通过证书加密方式连接至该网管服务器3。
本实施例中的家庭网关请参见图5所示，包括通信连接管理单元11和重定向管理单元12；
重定向管理单元12设置为：通过重定向服务器连接信息连接至重定向服务器2，接收重定向服务器2发送的真实网管服务器连接信息；
通信连接管理单元11设置为：根据真实网管服务器连接信息连接至网管服务器3。
重定向管理单元12还设置为：连接至重定向服务器2后，接收真实网管服务器连接信息之前，向重定向服务器2发送第一认证信息，真实网管服务器连接信息为重定向服务器2基于该第一认证信息认证通过后发送的；如认证失败，则认为该家庭网关1为非法终端。重定向服务器2反馈的真实网管服务器连接信息包括网管服务器地址信息和重定向属性值，重定向属性值包括永久性设置和临时性设置；重定向管理单元12还设置为：根据该重定向属性值设置所述网管服务器地址信息的重定向属性。在重定向属性值为永久性设置时，则将家庭网关内部的网管服务器的地址信息永久性的设置为该网管服务器地址信息，家庭网关下次连接至该网管服务器时不需要再重定向；在重定向属性值为临时性设置时，则将家庭网关在内部的网管服务器的地址信息暂时性的设置为该网管服务器地址信息，家庭网关下次连接至该网管服务器时需要再重新重定向。
通信连接管理单元11在重定向管理单元12对网管服务器地址信息的重定向属性设置完成后，根据网管服务器地址信息连接至网管服务器，连接过程包括：
通信连接管理单元11根据网管服务器地址信息向网管服务器发送第二认证信息；
通信连接管理单元11在接收到网管服务器反馈的认证成功响应消息后，通过证书加密方式连接至所述网管服务器。
本实施例中，为了进一步提升网络安全性，通信连接管理单元11还设置为：在重定向管理单元12通过重定向服务器连接信息连接至重定向服务器2之前，先通过虚假网管连接信息连接至认证服务器4，并向认证服务器4发送第三认证信息，以及接收认证服务器4基于所述第三认证信息认证成功后反馈的连接重定向服务器权限；重定向管理单元12还设置为：获取到连接重定向服务器权限，才根据重定向服务器信息向重定向服务器2发起连接。
本实施例中的第一认证信息、第二认证信息和第三认证信息包含的内容取决于认证方采用的认证机制等因素；且本实施例中的第一认证信息和第三 认证信息可以相同，也可以不同；第二认证信息也可与第一认证信息和/或第三认证信息相同或不同；也即本实施例中的每个认证方(例如执行认证的认证服务器、重定向服务器和网管服务器)可以相互独立，也可以共享认证信息；本实施例中第一认证信息、第二认证信息和第三认证信息可以采用证书链的形式，此时本实施例中的家庭网关则可包括证书链单元。
实施例三：
下面以一种家庭网关为示例进行说明。请参见图6所示，在本示例中家庭网关6包括证书链单元61、重定向管理单元62和TR069管理单元(对应通信连接管理单元)63；上述第一认证信息和第三认证信息通过认证链中的根证书实现，第二认证信息则通过认证链中的子证书实现。本实施例中通过证书链单元61预先对证书链进行设定，导入相应的证书。在完成证书链添加后通知TR069管理单元63，TR069管理单元63会使用根证书连接虚假网管服务器连接信息，就可以依照以下步骤，使家庭网关正常连接网管平台。请参见图7，包括：
步骤701：TR069管理单元63主动通过根证书主动连接认证服务器，并根据认证服务器返回的状态判断是否认证成功；
步骤702：当认证成功后会获取到连接重定向服务器权限，重定向管理单元62主动通过根证书连接重定向服务器，并在认证成功时接收重定向服务器反馈的真实网管服务器连接信息；否则连接失败；
步骤703：TR069管理单元63根据真实网管服务器连接信息中的网管服务器地址信息去连接真实的网管平台。
上述步骤703中，在连接真实的网管平台之前，家庭网关重定向管理单元62会根据重定向服务器返回的重定向属性值，设置家庭网关内部网管服务器的信息，包括：
当返回的重定向属性值为永久性设置时，家庭网关重定向管理单元62会永久修改网管连接地址。
当返回的重定向属性值为暂时性设置时，家庭网关重定向管理单元62 会临时修改网管连接地址，当家庭网关下次连接网管服务器时会重复重定向。在获取网管服务器地址信息后，家庭网关TR069管理单元63会使用证书链中的子证书连接真实网管服务器，就可以依照以下图8所示的步骤，使家庭网关正常连接网管服务器(也即网管平台)：
步骤801：家庭网关TR069管理单元63主动通过子证书主动连接网管服务器，并根据网管服务器返回的状态判断是否认证成功；
步骤802：当家庭网关认证成功后，家庭网关TR069管理单元63会使用证书加密的方式连接网管服务器，此时网管平台就可以正常管理家庭网关；若家庭网关认证失败，则连接失败。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
本发明实施例通过重定向服务器进行重定成功后才能跳转到连接到真正的网管服务器，可以避免非法终端轻易的接入从而对网管服务器造成额外的 运行压力和安全隐患，能提升用户体验的满意度。

Claims (13)

  1. 一种家庭网关通信管理方法，家庭网关连接至网管服务器的过程包括：
    所述家庭网关通过重定向服务器连接信息连接至重定向服务器；
    所述家庭网关接收所述重定向服务器发送的真实网管服务器连接信息；
    所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务器。
  2. 如权利要求1所述的家庭网关通信管理方法，其中，所述家庭网关连接至所述重定向服务器之后，接收所述真实网管服务器连接信息之前，还包括：向所述重定向服务器发送第一认证信息，所述真实网管服务器连接信息为所述重定向服务器基于所述第一认证信息认证通过后发送的。
  3. 如权利要求2所述的家庭网关通信管理方法，其中，所述真实网管服务器连接信息包括网管服务器地址信息和重定向属性值，所述重定向属性值包括永久性设置和临时性设置；
    所述家庭网关接收所述重定向服务器发送的真实网管服务器连接信息之后，所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务器之前，还包括：所述家庭网关根据所述重定向属性值设置所述网管服务器地址信息重定向属性；
    所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务器包括：所述家庭网关根据所述网管服务器地址信息连接至所述网管服务器。
  4. 如权利要求3所述的家庭网关通信管理方法，其中，所述家庭网关根据所述网管服务器地址信息连接至所述网管服务器包括：
    所述家庭网关根据所述网管服务器地址信息向所述网管服务器发送第二认证信息；
    所述家庭网关在接收到所述网管服务器反馈的认证成功响应消息后，通过证书加密方式连接至所述网管服务器。
  5. 如权利要求1-4任一项所述的家庭网关通信管理方法，其中，所述家 庭网关通过重定向服务器连接信息连接至所述重定向服务器之前，还包括：
    所述家庭网关通过虚假网管连接信息连接至认证服务器，并向认证服务器发送第三认证信息；
    所述家庭网关接收所述认证服务器基于所述第三认证信息认证成功后反馈的连接重定向服务器权限；
    所述家庭网关收到所述连接重定向服务器权限后，根据所述重定向服务器连接信息向所述重定向服务器发起连接。
  6. 一种家庭网关通信管理方法，家庭网关连接至网管服务器的过程包括：
    所述家庭网关通过重定向服务器连接信息连接至重定向服务器；
    所述重定向服务器向所述家庭网络发送真实网管服务器连接信息；
    所述家庭网关根据所述真实网管服务器连接信息连接至所述网管服务器。
  7. 一种家庭网关，包括通信连接管理单元和重定向管理单元；
    所述重定向管理单元设置为：通过重定向服务器连接信息连接至重定向服务器，接收所述重定向服务器发送的真实网管服务器连接信息；
    所述通信连接管理单元设置为：根据所述真实网管服务器连接信息连接至所述网管服务器。
  8. 如权利要求7所述的家庭网关，其中，所述重定向管理单元还设置为：连接至所述重定向服务器后，接收所述真实网管服务器连接信息之前，向所述重定向服务器发送第一认证信息，所述真实网管服务器连接信息为所述重定向服务器基于所述第一认证信息认证通过后发送的。
  9. 如权利要求8所述的家庭网关，其中，所述真实网管服务器连接信息包括网管服务器地址信息和重定向属性值，所述重定向属性值包括永久性设置和临时性设置；所述重定向管理单元还设置为：根据所述重定向属性值设置所述网管服务器地址信息的重定向属性；
    所述通信连接管理单元是设置为：在所述重定向管理单元对所述网管服 务器地址信息的重定向属性设置完成后，根据所述网管服务器地址信息连接至所述网管服务器。
  10. 如要求9所述的家庭网关，其中，所述通信连接管理单元是设置为：
    根据所述网管服务器地址信息向所述网管服务器发送第二认证信息；
    在接收到所述网管服务器反馈的认证成功响应消息后，通过证书加密方式连接至所述网管服务器。
  11. 如权利要求7-10任一项所述的家庭网关，其中，所述通信连接管理单元还设置为：在所述重定向管理单元通过重定向服务器连接信息连接至重定向服务器之前，通过虚假网管连接信息连接至认证服务器，并向认证服务器发送第三认证信息，以及接收所述认证服务器基于所述第三认证信息认证成功后反馈的连接重定向服务器权限；
    所述重定向管理单元还设置为：接收到所述连接重定向服务器权限后，根据所述重定向服务器连接信息向所述重定向服务器发起连接。
  12. 一种通信系统，包括家庭网关、重定向服务器以及网管服务器；
    所述家庭网关设置为：通过重定向服务器连接信息连接至重定向服务器；
    所述重定向服务器设置为：向所述家庭网络发送真实网管服务器连接信息；
    所述家庭网关还设置为：根据所述真实网管服务器连接信息连接至所述网管服务器。
  13. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-6任一项的方法。
PCT/CN2016/071228 2015-07-22 2016-01-18 家庭网关及其通信管理方法、通信系统 WO2016131358A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP16751889.3A EP3313039A4 (en) 2015-07-22 2016-01-18 Home gateway, communication management method and communication system thereof

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510436062.1A CN106375265A (zh) 2015-07-22 2015-07-22 家庭网关及其通信管理方法、通信系统
CN201510436062.1 2015-07-22

Publications (1)

Publication Number Publication Date
WO2016131358A1 true WO2016131358A1 (zh) 2016-08-25

Family

ID=56688647

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/071228 WO2016131358A1 (zh) 2015-07-22 2016-01-18 家庭网关及其通信管理方法、通信系统

Country Status (3)

Country Link
EP (1) EP3313039A4 (zh)
CN (1) CN106375265A (zh)
WO (1) WO2016131358A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10256991B2 (en) 2017-04-18 2019-04-09 At&T Intellectual Property I, L.P. System for managing network termination

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107249209A (zh) * 2017-06-09 2017-10-13 苏州汉明科技有限公司 无线局域网网关管理方法及系统
CN111901396B (zh) 2020-07-08 2021-08-06 厦门网宿有限公司 一种资源请求响应方法、重定向服务器及决策分发服务器

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101026582A (zh) * 2007-03-06 2007-08-29 中兴通讯股份有限公司 网络访问控制方法及系统
CN101127792A (zh) * 2006-08-18 2008-02-20 因福皮亚有限公司 用在生物信息测量中的具有温度补偿功能的移动通信终端
CN101483551A (zh) * 2009-02-24 2009-07-15 中兴通讯股份有限公司 远程监控家庭网关设备的方法及系统
CN101651595A (zh) * 2008-08-11 2010-02-17 株式会社日立制作所 通信系统以及家庭网关

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101127631A (zh) * 2006-08-15 2008-02-20 华为技术有限公司 针对网络中设备实现配置管理的方法及系统
WO2008019624A1 (fr) * 2006-08-15 2008-02-21 Huawei Technologies Co., Ltd. Procédé et système destinés à mettre en oeuvre la gestion de configuration de dispositifs dans un réseau
US8650297B2 (en) * 2007-03-14 2014-02-11 Cisco Technology, Inc. Unified user interface for network management systems
CN101771541B (zh) * 2008-12-26 2012-11-28 中兴通讯股份有限公司 一种用于家庭网关的密钥证书生成方法和系统
CN102647405A (zh) * 2011-12-16 2012-08-22 中兴通讯股份有限公司 用户端接入控制的方法和系统
WO2015050892A1 (en) * 2013-10-01 2015-04-09 Ruckus Wireless, Inc. Secure network access using credentials

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101127792A (zh) * 2006-08-18 2008-02-20 因福皮亚有限公司 用在生物信息测量中的具有温度补偿功能的移动通信终端
CN101026582A (zh) * 2007-03-06 2007-08-29 中兴通讯股份有限公司 网络访问控制方法及系统
CN101651595A (zh) * 2008-08-11 2010-02-17 株式会社日立制作所 通信系统以及家庭网关
CN101483551A (zh) * 2009-02-24 2009-07-15 中兴通讯股份有限公司 远程监控家庭网关设备的方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3313039A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10256991B2 (en) 2017-04-18 2019-04-09 At&T Intellectual Property I, L.P. System for managing network termination

Also Published As

Publication number Publication date
EP3313039A1 (en) 2018-04-25
EP3313039A4 (en) 2018-06-06
CN106375265A (zh) 2017-02-01

Similar Documents

Publication Publication Date Title
US20170353442A1 (en) Proximity-based authentication
JP5139423B2 (ja) ネットワーク資源に対するシングルサインオン及び安全なアクセスのためのポリシ駆動の証明情報委譲
US9378345B2 (en) Authentication using device ID
EP3675451A1 (en) Method, computer readable storage medium and apparatus for seamless single sign-on (sso) for native mobile-application initiated open-id connect (oidc) and security assertion markup language (saml) flows
CN105516163B (zh) 一种登录方法及终端设备及通信系统
US20090307486A1 (en) System and method for secured network access utilizing a client .net software component
US20100100950A1 (en) Context-based adaptive authentication for data and services access in a network
WO2017049387A1 (en) Secure enrolment of security device for communication with security server
US20120246226A1 (en) System and method for sharing data from a local network to a remote device
US9344417B2 (en) Authentication method and system
JP5239341B2 (ja) ゲートウェイ、中継方法及びプログラム
EP2979420B1 (en) Network system comprising a security management server and a home network, and method for including a device in the network system
US11812263B2 (en) Methods and apparatus for securely storing, using and/or updating credentials using a network device at a customer premises
CN114995214A (zh) 远程访问应用的方法、系统、装置、设备及存储介质
Huang et al. A token-based user authentication mechanism for data exchange in RESTful API
US8024784B1 (en) Method and system for providing remote secure access to a peer computer
WO2016131358A1 (zh) 家庭网关及其通信管理方法、通信系统
US9825942B2 (en) System and method of authenticating a live video stream
JP6185934B2 (ja) サーバー・アプリケーションと多数の認証プロバイダーとの統合
JP4950095B2 (ja) サービス提供システム、サービス提供方法およびサービス提供プログラム
CN112333214B (zh) 一种用于物联网设备管理的安全用户认证方法及系统
US20050097322A1 (en) Distributed authentication framework stack
JP5302665B2 (ja) 認証サーバ提示方法、サービス提供システム、サービス提供装置、およびサービス提供プログラム
WO2017024588A1 (zh) 业务处理方法及装置
EP3815297B1 (en) Authentication through secure sharing of digital secrets previously established between devices

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16751889

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2016751889

Country of ref document: EP