WO2019144826A1

WO2019144826A1 - Network identifier mapping method and system, terminal, and identification gateway

Info

Publication number: WO2019144826A1
Application number: PCT/CN2019/071730
Authority: WO
Inventors: 谢大雄; 郝振武; 吴强; 张军
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-01-24
Filing date: 2019-01-15
Publication date: 2019-08-01
Also published as: CN110071984A

Abstract

Disclosed in the present application are a network identifier mapping method and system, a terminal, and an identification gateway. The network identifier mapping method comprises: pre-establishing a first corresponding relationship between a first Internet Protocol address of a terminal and a network identifier, wherein the network identifier corresponds to a user identifier of the terminal; and performing network identifier conversion on a data packet sent from the terminal or sent to the terminal according to the first corresponding relationship.

Description

Network identification mapping method and system, terminal and identification gateway

The present application claims priority to Chinese Patent Application No. PCT Application No. No. No. No. No. No. No. No. No. No. No. No. No. No.

Technical field

The present application relates to the field of the Internet, such as a network identity mapping method and system, and a terminal and an identity gateway.

Background technique

In a traditional Transmission Control Protocol (TCP)/Internet Protocol (IP) network environment, a terminal accesses an Internet or an enterprise network through an access network. FIG. 1 is a schematic structural diagram of a related art network. As shown in Figure 1, it includes:

User Equipment (UE): Connects to the access gateway through wired or wireless access technology. After authentication, the IP address is obtained from the access gateway, and then the IP address is used to access the application server in the Internet or enterprise network.

Access Gateway (AGW): According to different access technologies, the access gateway has different specific forms. For example, a packet gateway (PGW) in mobile communication, a broadband access server (BAS) in a fixed access, a three-layer switch in an enterprise network, and an Internet of Things gateway in an Internet of Things, in an authentication server. The terminal is authenticated. After the authentication is passed, the unoccupied IP address is selected from the locally configured IP address pool and assigned to the user. Therefore, the IP address obtained by the user is different depending on the user access location and access time.

Authentication Server (AS): Authenticates the validity of the terminal with the access gateway to determine whether the terminal is allowed to access the network.

Internet/Intranet: Provides various services for the terminal. The terminal uses the IP address assigned by the access gateway to communicate with the application server in the Internet/enterprise network. The IP address serves as the identifier of the terminal at the network layer, and identifies the terminal. And to ensure that the data packet can be delivered to each terminal correctly.

Usually, the IP address allocation adopts a dynamic IP address allocation scheme. When the user's network location changes, an IP address must be reacquired. The IP address can only be used in the topology location (for example, only in the jurisdiction of the access gateway). Intra-use), and even in the same network location, due to dynamic allocation, access at different times, the assigned IP address will be different.

As can be seen from the above discussion, the IP address of the terminal is dynamically changed. The IP address carried in the IP packet cannot be directly associated with the user. That is to say, the Internet or the enterprise network is an anonymous network, which is not conducive to network supervision. (such as user identity traceability, network behavior analysis, etc.). The related art traces the source through the IP allocation log, and there are cases where the efficiency is low and the accuracy is low.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The present application provides a network identity mapping method and system, and a terminal and an identifier gateway, which can represent a user identity through a network identifier, thereby improving the monitoring efficiency.

The present application provides a network identity mapping method, including: pre-establishing a first correspondence between a first Internet Protocol address and a network identifier of a terminal; wherein, the network identifier corresponds to a user identifier of the terminal; The relationship performs network identity conversion on data packets from the terminal or to the terminal.

The present application provides a network identity mapping method, including: acquiring access information; wherein the access information includes a user identifier and a first Internet Protocol address of the terminal; and the access information is sent to the identity gateway.

The present application provides a network identifier mapping method, including: receiving a network identifier request for identifying a gateway, where the network identifier request carries a user identifier; in a second correspondence between a preset user identifier and a network identifier, The network identifier corresponding to the user identifier is searched; or the network identifier is allocated according to the user identifier, and the second correspondence between the user identifier and the network identifier is saved; and the network identifier is sent to the identifier gateway.

The present application provides an identification gateway, including: an establishing module, configured to pre-establish a first correspondence between a first Internet Protocol address and a network identifier of the terminal; wherein the network identifier corresponds to a user identifier of the terminal; and a conversion module, And being configured to perform network identifier conversion on the data packet from the terminal or sent to the terminal according to the first correspondence.

The present application provides a terminal, comprising: an obtaining module, configured to obtain access information; wherein the access information includes a user identifier and an internet protocol address of the terminal; and the first sending module is configured to send the access information to the identifier gateway. .

The present application provides an identity management server, including: a receiving module, configured to receive a network identifier request for identifying a gateway, the network identifier request carrying a user identifier; and a processing module configured to set a user identifier and a network identifier in advance In the second correspondence, the network identifier corresponding to the user identifier is searched; or the network identifier is allocated according to the user identifier, and the second correspondence between the user identifier and the network identifier is saved; the second sending module is set to Send the network ID to the identity gateway.

The present application provides an identification gateway including a first processor and a first computer readable storage medium, wherein the first computer readable storage medium stores a first instruction when the first instruction is the first When the processor executes, any of the above network identifier mapping methods are implemented.

The present application proposes a terminal comprising a second processor and a second computer readable storage medium, wherein the second computer readable storage medium stores a second instruction when the second instruction is processed by the second When the device is executed, any of the above network identifier mapping methods is implemented.

The present application provides an identification management server including a third processor and a third computer readable storage medium, wherein the third computer readable storage medium stores a third instruction when the third instruction is When the three processors are executed, any one of the above network identifier mapping methods is implemented.

The present application proposes a computer readable storage medium having stored thereon a computer program, characterized in that the computer program is executed by a processor to implement the steps of any of the above network identification mapping methods.

The present application provides a network identity mapping system, including: a terminal, configured to obtain access information; wherein the access information includes a user identifier and a first Internet Protocol address of the terminal; the access information is sent to the identity gateway; The access information is set to receive the access information of the terminal, where the access information includes a user identifier and a first Internet Protocol address of the terminal; querying a network identifier corresponding to the user identifier, and saving or updating the first correspondence relationship; The first correspondence relationship performs network identifier conversion on a data packet from the terminal or sent to the terminal.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

DRAWINGS

The drawings are used to provide a further understanding of the technical solutions of the present application, and constitute a part of the specification, which is used together with the embodiments of the present application to explain the technical solutions of the present application, and does not constitute a limitation of the technical solutions of the present application.

1 is a schematic structural diagram of a related art network;

2 is a schematic structural diagram of a network structure of the present application;

3 is a flowchart of a method for mapping a gateway side network identifier according to the present application;

4 is a flowchart of a method for mapping a network side of a terminal side according to the present application;

5 is a flowchart of a method for mapping a network identifier of an identity management server on the present application;

6 is a schematic structural diagram of a terminal of a first embodiment of the present application;

FIG. 7 is a schematic diagram of interaction of a network identity mapping method according to a second embodiment of the present application;

8 is a schematic diagram of interaction of a terminal offline process according to a third embodiment of the present application;

9 is a schematic diagram of interaction of a method for a terminal to move a better access gateway according to a fourth embodiment of the present application;

FIG. 10 is a schematic diagram of interaction of a user state maintenance process according to a fifth embodiment of the present application;

11 is a schematic structural diagram of a gateway of the identification of the present application;

12 is a schematic structural diagram of a terminal of the present application;

13 is a schematic structural diagram of an identity management server of the present application;

14 is a schematic structural diagram of another identification gateway of the present application;

15 is a schematic structural diagram of another terminal of the present application;

16 is a schematic structural diagram of another identity management server of the present application;

FIG. 17 is a schematic structural diagram of a network identity mapping system of the present application.

Detailed ways

Embodiments of the present application will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

The steps illustrated in the flowchart of the figures may be executed in a computer system such as a set of computer executable instructions. Also, although logical sequences are shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.

In the related technology network, the AGW and the AS cooperate with each other to authenticate the validity of the terminal. After the authentication is passed, the AGW selects an unoccupied IP address from the locally configured IP address pool and allocates it to the terminal. After that, the terminal accesses the Internet based on the assigned IP address. Or the application server in the enterprise network. In this process, because the IP address assigned by the terminal is dynamically changed, the IP address carried in the data packet cannot be known which user is sent, which is very unfavorable for network supervision.

This application uses a network identity (NID) to represent the user's identity, and realizes the identity of the user through the network identity, thereby improving the efficiency of supervision.

In an embodiment, based on the network composition structure of the related art, refer to FIG. 2, and add an Identity Client (IDC) to the terminal, and add an identity gateway between the AGW and the application server, or add an identity gateway and The Identity Management Center (IDGW) is used to maintain the user's network identity. The network identity is used to represent the user identity without changing the related network infrastructure, thereby improving the efficiency of supervision.

Referring to FIG. 3, the present application provides a network identity mapping method, which is applied to identify a gateway, and includes

steps

300 and 301.

In step 300, a first correspondence between the first Internet Protocol address of the terminal and the network identifier is established in advance.

In this application, since the network identifier corresponds to the user identifier of the terminal and does not change with the change of the first IP address, the identity of the user is represented by the network identifier, thereby improving the monitoring efficiency.

In the present application, the first correspondence may be statically configured or dynamically configured.

When the first correspondence is dynamically configured, various methods can be employed. For example, receiving the access information of the terminal; querying the network identifier corresponding to the user identifier, and saving or updating the first correspondence between the first Internet Protocol address and the network identifier. For example, receiving access information of the terminal, assigning a network identifier to the terminal, and saving the first correspondence.

In the present application, the access information includes a user identifier and a first Internet Protocol (IP) address of the terminal.

The user identifier may be a username, an email address, a phone number, and the like.

In an embodiment, the access information further includes access information (such as 3G/4G access, Wireless Fidelity (WiFi) access, etc.), access location information, access time information, and the like.

In one embodiment, the device information of the terminal is also received. The device information includes at least one of the following: a terminal device identifier, component information, a hardware state, and a software state.

In the present application, the access information is received by receiving a notification message or a keep-alive message of the terminal, and the notification message or the keep-alive message includes the access information. In one embodiment, the notification message or keep-alive message also includes device information.

In the present application, the form of the network identifier may be in the form of a second IP address or a second IP address + port range. For example, the second IP address 202.100.100.100 is used to indicate the network identity, or the second IP address 202.100.100.100+port range (1024 to 2047) is used to represent the network identity.

In this application, the network identifier corresponding to the user identifier may be queried by using any one of the following methods.

The second correspondence between the user identifier and the network identifier is set in advance, and the network identifier corresponding to the user identifier is searched for in the second correspondence.

2. Sending a network identifier request to the identifier management server, where the network identifier request carries the user identifier; and receiving the network identifier returned by the identifier management server.

In the present application, after the network identifier corresponding to the user identifier is queried, if the first correspondence corresponding to the network identifier is not saved, the first correspondence between the first IP address in the access information and the network identifier of the query is directly saved. If the first correspondence corresponding to the network identifier has been saved before, the first IP address is updated when the first IP address in the access information is different from the first IP address corresponding to the network identifier in the first correspondence. relationship.

In step 301, the data identifier from the terminal or the data packet addressed to the terminal is converted according to the first correspondence.

For example, (1) when the network identifier takes the form of a second IP address:

If the data packet from the terminal is received, the first IP address of the terminal in the source Internet Protocol address field of the data packet of the terminal is obtained, and the network identifier corresponding to the first IP address of the terminal is searched in the first correspondence relationship, The first IP address in the source Internet Protocol address field of the data packet from the terminal is replaced with the found network identifier, and then the data packet from the terminal is sent to the application server in the Internet or enterprise network. In this way, the network identifier is used in the Internet or the enterprise network instead of the first IP address to indicate the user identity. Since the network identifier corresponds to the user identifier and does not change with the change of the first IP address, the monitoring efficiency is improved.

In the above case, when the network identifier corresponding to the first IP address of the terminal is not found in the first correspondence, one of the following operations is performed: discarding data from the terminal includes: performing network address translation on the data packet from the terminal (Network Address Translation, NAT), to ensure that the service can be carried out normally; NAT the data packets from the terminal, but limit the scope of data packet transmission, for example, can only be passed to the application server with lower security level.

If the data packet sent to the terminal is received, the network identifier in the destination Internet Protocol address field of the data packet sent to the terminal is obtained, and the first IP address of the terminal corresponding to the network identifier is searched in the first correspondence relationship, and is sent to The network identifier in the destination Internet Protocol address field of the data packet of the terminal is replaced with the first IP address found, and then the data packet is sent to the terminal.

In the above case, when the first IP address corresponding to the network identifier is not found in the first correspondence, the data packet sent to the terminal is discarded; or the data packet addressed to the terminal is NAT.

(2) When the network identifier adopts the form of the second IP address + port range:

If the data packet from the terminal is received for the first time, the first IP address of the terminal in the source IP address field of the data packet from the terminal and the first port of the terminal in the source port field are acquired; in the first correspondence relationship Finding a network identifier corresponding to the first IP address of the terminal; replacing the first IP address in the source IP address field of the data packet from the terminal with the second IP address of the found network identifier, and the source of the data packet from the terminal The first port of the terminal in the port field is replaced with the second port that is not used in the port range of the found network identifier, and the first IP address, the first port, the second IP address, and the second port are established. Three correspondence.

If the data packet from the terminal is received again, the first IP address and the second IP address of the network identifier corresponding to the first port and the second port of the network identifier are first searched in the third correspondence, and the data from the terminal is used. The first IP address in the source IP address field of the packet is replaced with the found second IP address, and the first port in the source port field of the data packet from the terminal is replaced with the found second port.

If the first IP address and the second IP address and the second port corresponding to the first port are not found in the third correspondence, the network identifier corresponding to the first IP address is searched in the first correspondence relationship; The first IP address in the source IP address field of the data packet is replaced with the second IP address of the discovered network identifier, and the first port in the source port field of the data packet from the terminal is replaced with the port of the discovered network identifier. The second port is not used in the range, and establishes a third correspondence between the first IP address, the first port, the second IP address, and the second port.

In the above case, when the network identifier corresponding to the first IP address is not found in the first correspondence, one of the following operations is performed: discarding the data packet from the terminal; performing network address port conversion on the data packet from the terminal ( Network Address Port Translation (NAPT) ensures that the service can be performed normally. NAPT is applied to the data packets from the terminal to ensure that the service can be performed normally, but the range of data packet transmission is limited, for example, it can only be transmitted to an application server with a lower security level.

If the data packet addressed to the terminal is received, the second IP address of the network identifier in the destination IP address field of the data packet addressed to the terminal and the second port of the network identifier in the destination port field are searched in the third correspondence. Corresponding first IP address and first port, replacing the second IP address in the destination IP address field of the data packet sent to the terminal with the first IP address found, and the destination port field of the data packet to be sent to the terminal The second port in the middle is replaced with the first port found.

In the above case, when the third correspondence is not found, the second IP address of the network identifier in the destination IP address field of the data packet addressed to the terminal and the first port corresponding to the second port of the network identifier in the destination port field are not found. When the IP address and the first port are used, the data packet sent to the terminal is discarded; or, the data packet sent to the terminal is NAPT.

In the above case, when the third correspondence is not used for the conversion of the network identifier within a certain period of time, the third correspondence may be deleted to save storage space.

In an embodiment, when at least one of the received access information and the device information changes, the method further includes: sending an information update message to the identity management server, so that the identity management server updates the user status, accesses At least one of information and device information; upon receiving an acknowledgment message returned by the identity management server, returning a confirmation message to the terminal.

In an embodiment, the method further includes deleting the first correspondence when the notification message or the keep-alive message is not received within the preset time, or when the offline message of the terminal is received.

When receiving the offline message of the terminal, the acknowledgment message may be returned to the terminal, so that the terminal receives the acknowledgment message and then goes offline and releases the IP address; or may not return the acknowledgment message to the terminal.

When receiving the offline message of the terminal, the offline management message of the terminal may be sent to the identity management server, so that the identity management server updates the user status in the second correspondence, and when the confirmation message of the identity management server is received, the first message is deleted. A correspondence relationship and a third correspondence relationship, and returning a confirmation message to the terminal.

When the notification message or the keep-alive message is not received within the preset time, the offline message of the terminal may also be sent to the identity management server, so that the identity management server updates the user state in the second correspondence.

Referring to FIG. 4, the present application provides a network identifier mapping method, which is applied to a terminal, and includes

steps

400 and 401.

In step 400, access information is obtained.

In the present application, the access information includes a user identifier and a first IP address of the terminal.

In an embodiment, the access information further includes related information such as an access mode (such as 3G/4G access, wireless fidelity access, etc.), access location information, and access time information.

In one embodiment, the device information of the terminal is also obtained.

The device information includes at least one of the following: a terminal device identifier, component information, a hardware state, and a software state.

In step 401, the access information is sent to the identity gateway.

In this application, when the access information is sent to the identifier gateway, the third IP address of the identifier gateway needs to be known in advance, and the third IP address of the identifier gateway can be obtained by using any of the following methods.

1. Pre-configure the third IP address of the identification gateway in the terminal.

The domain name of the gateway is pre-configured in the terminal. When the domain name system (DNS) resolves the domain name of the gateway, the third IP address of the gateway is returned according to the access location of the user.

When the first IP address assigned to the terminal is sent to the terminal, the access gateway sends the third IP address or domain name of the gateway to the terminal.

In this application, the access information may be sent to the identification gateway by using a notification message or a keep-alive message, and the notification message or the keep-alive message includes the access information. In one embodiment, the notification message or keep-alive message also includes device information.

In an embodiment, the notification message or the keep-alive message may be sent to the identifier gateway periodically; the notification message or the keep-alive message is sent to the identifier gateway when the access information changes; or the notification is sent to the identifier gateway when the device information changes. Message or keep-alive message.

In an embodiment, when the terminal needs to go offline, the method further includes: sending an offline message to the identification gateway; when receiving the confirmation message returned by the identification gateway, the control terminal goes offline and releases the first IP address of the terminal. .

The network identifier mapping method can be implemented by setting an identifier client in the terminal, and the identifier client is a component of the terminal, and can obtain access information and device information from other components of the terminal. Therefore, on the basis of not changing the hardware structure of the relevant terminal, the identity of the user is represented by the network identifier, thereby improving the supervision efficiency.

Referring to FIG. 5, the present application provides a network identifier mapping method, which is applied to an identity management server, and includes

steps

500, 501, and 502.

In step 500, a network identification request is generated that identifies the gateway, and the network identification request carries the user identifier.

In this application, the network identifier request may also carry at least one of the following: device information, access mode, access location information, and access time information of the terminal.

In step 501, in the second correspondence between the user identifier and the network identifier, the network identifier corresponding to the user identifier is searched for; or the network identifier is allocated according to the user identifier, and the user identifier and the network identifier are saved. The second correspondence between the two.

In this application, the correspondence between the user identifier and the network identifier may be a one-to-one correspondence or a one-to-many relationship. When the correspondence between the user identifier and the network identifier is a one-to-many correspondence, the appropriate network identifier may be selected according to the user identifier, other access information, or device information. For example, the second correspondence further includes at least one of the following:

Device information, access mode, access location information, access time information, and user status of the terminal.

The user status includes at least one of the following: online and offline.

In this way, if the network identifier request further carries at least one of the following: device information, access mode, access location information, and access time information of the terminal, searching for a network corresponding to the user identifier and at least one of the following in the second correspondence ID: Device information, access mode, access location information, and access time information of the terminal.

In a specific implementation, the second correspondence may be a correspondence between the user identifier, the access time information, and the network identifier, and the network identifier request carries the user identifier and the access time information, and the user identifier is searched for in the second correspondence. Network identifier corresponding to the access time information.

In this application, when the network identifier is allocated according to the user identifier, an unused network identifier may be selected from the network identifier resource pool for allocation.

In step 502, the network identity is sent to the identity gateway.

In one embodiment, the method further includes updating the second correspondence and returning an acknowledgement message to the identity gateway when the information update message is received.

The information update message includes at least one of the following: device information of the terminal, and access information.

In an embodiment, the method further includes: when receiving the offline message of the terminal, updating the user status in the second correspondence to the offline, and returning an acknowledgement message to the identity gateway.

The specific implementation process of the network identity mapping method of the present application is described in detail below through a specific embodiment.

First embodiment

FIG. 6 is a schematic structural diagram of a terminal of a first embodiment of the present application. As shown in Figure 6, a typical terminal typically contains the underlying hardware and program modules running on the underlying hardware.

The basic hardware includes: a central processing unit, a memory or a memory, a modem, and the like.

Program modules include: operating system, communication module for driving modem, and application programs, etc.

Program modules are typically stored in memory or memory and executed by a central processing unit.

The communication module can drive the modem to communicate, for example, accessing the access gateway, receiving the first IP address allocated by the access gateway, or leaving the access gateway to release the first IP address;

The application communicates with the application server of the Internet or the enterprise network using the first IP address in the online state to provide services to the user.

In this embodiment, the identification client is added to the terminal, and has an interaction interface and capability with the communication module, for example, can control the uplink or downlink of the communication module; can sense the uplink or downlink of the communication module; can use the first IP address to pass The communication module communicates with the identification gateway; the access information can be obtained from the communication module, such as the user identifier used by the user to go online, the first IP address of the terminal, the access time information, and the access location information.

In one embodiment, the identity gateway can interact with the underlying hardware to obtain device information.

In the structural composition of the above terminal, the identification client is a component superimposed on the relevant terminal architecture, and does not affect the basic functions of the related components, especially the functions of the application, and has good compatibility.

Second embodiment

FIG. 7 is a schematic diagram of interaction of a network identity mapping method according to a second embodiment of the present application. As shown in FIG. 7, the method includes steps 700 to 709.

In step 700, the terminal accesses the access gateway, and the authentication server authenticates the validity of the user.

In this step, the authentication process and the access mode are closely related and will not be described here.

In this step, the terminal identifier is used in the process of accessing the access gateway by using the user identifier, and the user identifier may be a username (such as a QQ username), an email address, a phone number, and the like.

In step 701, after the authentication is passed, the access gateway allocates a first IP address to the terminal.

In this step, the first IP address is generally dynamically allocated.

In step 702, the identity client of the terminal sends a notification message to the identity gateway, where the notification message carries the user identifier, the assigned first IP address, and may further include device information and other access information.

In this step, the device information includes but is not limited to the terminal device identifier, component information, hardware status, and software status.

The access information may further include an access method (such as 3G/4G access, Wifi access), access location information, access time information, and the like.

In this step, the identifier client is a component of the terminal, and can obtain access information and device information from other components of the terminal.

In this embodiment, the identifier client needs to know the address of the identifier gateway when sending the notification message to the identifier gateway, and the manner of obtaining includes, but is not limited to, pre-configuring the third IP address of the identifier gateway in the terminal; The domain name, when the domain name is resolved, the DNS returns a third IP address identifying the gateway according to the user's access location information; when the access gateway allocates the first IP address, the access gateway notifies the third IP address or domain name of the identity gateway.

In step 703, the identifier gateway sends an NID request to the identity management server, where the user identifier is carried, and the device information and other access information may be further carried.

In step 704, the identity management server queries the corresponding NID in the second correspondence between the user identifier and the NID, and sends the NID to the identity gateway.

In this step, the second correspondence between the user identifier and the NID is configured in the identifier management server, and the most basic correspondence is a one-to-one relationship, and may further be a one-to-many relationship. In the one-to-one relationship, the identity management server directly obtains the NID according to the user identifier. In the one-to-many relationship, the identity management server selects an appropriate NID according to the user identifier, the device identifier, and other access location information.

In this step, the NID form may be a second IP address or a second IP address + port range. The NID is represented by using the second IP address 202.100.100.100, or by using the second IP address 202.100.100.100+port range (1024-2047).

According to different representations, the NID is also in the location of the data packet. If the second IP address is used, it is carried in the source IP address field in the data packet from the terminal, in the destination IP field in the data packet addressed to the terminal. Carrying; if the second IP address + port range is used, carried in the source IP address field and the source port field in the data packet from the terminal, carried in the destination IP address field and the destination port field in the data packet addressed to the terminal .

In step 705, the gateway establishes a first correspondence between the first IP address and the NID of the terminal, and returns an acknowledgement message to the identity client.

In this step, the first correspondence may further include a user identifier.

In step 706, after the identifier gateway receives the uplink data packet from the terminal, the identifier gateway performs the network identifier conversion, and converts the first IP address of the terminal in the data packet, or the first IP address and the first port of the terminal into NID.

In this step, the terminal can uniquely identify the user through the NID in the Internet or the enterprise network. For example, when the NID is represented by the second IP address, the identity gateway replaces the first IP address of the terminal in the source IP address field of the data packet with the NID, and the source port remains unchanged. This process and network address translation (Network Address Translation) , NAT) functions similarly.

When the NID is represented by the second IP address + port range, the identification gateway replaces the first IP address of the terminal in the source IP address field of the data packet with the second IP address of the NID, and replaces the source first port in the data packet. This is the second port that is not used in the port range of the NID. This process is similar to the Network Address Port Translation (NAPT) function.

When the foregoing process is performed, a third correspondence between the first IP address, the first port, the second IP address, and the second port is established, and the state of the third correspondence is maintained, for example, the third correspondence is If there is no data flow for a certain period of time, the third correspondence will be released.

In step 707, the identification gateway sends the data packet containing the NID to the application server in the Internet or the government enterprise network.

In step 708, the application server sends a data packet containing the NID, and the data packet is sent to the identity gateway.

In step 709, the identifier gateway queries the first correspondence according to the NID, determines the first IP address of the corresponding terminal and the first port of the terminal, and then replaces the second IP address of the NID in the destination IP address field in the data packet. For the first IP address of the terminal, the second port of the NID in the destination port is replaced with the first port of the terminal, and then the data packet is sent to the terminal.

The above process is the same as the processing of the downlink data stream in the NAT and NAPT technologies.

The subsequent data packets are repeated in steps 706-709. It should be noted that the identifier gateway receives the subsequent uplink data packet, and firstly searches for the third correspondence relationship. If yes, the network identifier is converted according to the existing third correspondence relationship. If not, a third correspondence is established in accordance with the process in step 706.

If the identity gateway receives the data packet from the terminal before steps 702-705 are completed, the identity gateway can process the data packet as follows:

1) Discard the data packet;

2) Perform NAT or NAPT according to the relevant technology to ensure that the service can be carried out normally;

3) Perform NAT or NAPT according to the related technology, but limit the range that data packets can be transmitted, for example, only to application servers with low security level requirements.

In 2) and 3), the data packet transmitted in the Internet or the government-enterprise network carries the first IP address of the terminal, or the first IP address + the first port, and can no longer uniquely identify the user.

Third embodiment

FIG. 8 is a schematic diagram of interaction of a terminal offline process according to a third embodiment of the present application. As shown in FIG. 8, step 800 to step 812 are included.

Steps 800 to 805 are the same as steps 700 to 705.

In step 806, the client is notified that the user is offline, for example, the user operates the client to go offline to enter the offline state.

In step 807, the identification client sends an offline message to the identity gateway.

In step 808, the identity gateway sends a downline message to the identity management server.

In step 809, the identity management service updates the user status in the second correspondence to be offline, and returns a confirmation response.

In step 810, the gateway is deleted from the user, and the first correspondence and the third correspondence that have been established are deleted, and the packet forwarding relationship is deleted.

At step 811, the identification gateway returns a confirmation response to the identification client.

In step 812, the client control terminal is offlined and the first IP address is released.

Fourth embodiment

FIG. 9 is a schematic diagram of interaction of a method for a terminal to move a better access gateway according to a fourth embodiment of the present application. As shown in FIG. 9, when the terminal moves, the access gateway 1 is replaced with the access gateway 2, and the first IP address assigned by the network is also replaced. The execution process includes steps 900 to 910.

In step 900, according to the process described in the second embodiment, the terminal accesses the application server of the Internet or the enterprise network through the access gateway 1 and the identification gateway.

In step 901, the terminal accesses the access gateway 2 due to the movement of the terminal or the like.

In step 902, the access gateway 2 assigns a new first IP address to the terminal.

In step 903, the identifier client detects that the access changes, sends a notification message to the identity gateway, and carries the user identifier, and the information such as the new first IP address, to identify the gateway to update the first correspondence.

In step 904, the identity gateway sends an information update message to the identity network management server.

In step 905, the identification network management server updates the second correspondence, such as the user's access location information, user status, and returns a confirmation message.

In step 906, the identity gateway returns an acknowledgement message to the identity network client.

Steps 907-910 are the same as steps 706-709. At this time, the terminal uses the new first IP address to communicate, and identifies the gateway to complete the conversion of the new first IP address and the network identifier.

It can be seen from the embodiment that when the user replaces the access gateway and the first IP address is changed, but the network identifier used in the Internet/enterprise network remains unchanged, the user can be directly located through the network identifier, and the user is strengthened. Network supervision capabilities.

Fifth embodiment

FIG. 10 is a schematic diagram of interaction of a user state maintenance process according to a fifth embodiment of the present application. As shown in FIG. 10, steps 1000 to 1016 are included.

Steps 1000 to 1005 are the same as steps 700 to 705 in the second embodiment.

In step 1006, both the identity client and the identity gateway enable a keepalive timer, and the period of the keepalive timer on the client side is less than the period of the timer that identifies the gateway.

In step 1007, step 1008, the client keepalive timer is timed out, and the client is sent a notification message to the identity gateway or a keep-alive message.

In step 1009, if the access information is updated, the identity gateway sends an information update message to the identity management server, otherwise directly jumps to step 1011.

At step 1010, the identification management server returns a confirmation message.

In step 1011, the identity gateway returns a confirmation message to the identity client.

In step 1012, the gateway is reset to keep the keepalive timer, and the online state of the maintenance user is unchanged.

In step 1013, if the terminal is offline, the identity client can no longer send a notification message or keep-alive message to the identity gateway. At this time, the keep-alive timer on the identity gateway will time out.

In step 1014, the identity gateway considers that the terminal is offline, then logs out the terminal and deletes all correspondences of the terminal.

In step 1015, the identification gateway sends an offline message of the terminal to the identity management server.

In step 1016, the identity management server updates the user status in the second correspondence to the offline, and returns an acknowledgement message.

Through the above process, the network side can correctly maintain the online status of the terminal.

Based on the above method, on the basis of not changing the related network device, the identification gateway and the identity management server are deployed to enhance the terminal function, thereby realizing the use of the network identifier to identify the user, facilitating network supervision, and realizing functions such as rapid traceability.

Referring to FIG. 11, the present application provides an identification gateway, which includes: an establishing module, configured to pre-establish a first correspondence between a first Internet Protocol address and a network identifier of a terminal; wherein, the network identifier corresponds to a user identifier of the terminal. And a conversion module configured to perform network identifier conversion on the data packet from the terminal or sent to the terminal according to the first correspondence.

In an embodiment, the establishing module is configured to: receive access information of the terminal, where the access information includes a user identifier and a first internet protocol address of the terminal; query a network identifier corresponding to the user identifier, and save Or update the first correspondence.

In an embodiment, the establishing module is configured to: receive a notification message or a keep-alive message of the terminal, where the notification message or the keep-alive message includes the access information, and the access information includes a user identifier and a terminal. The first Internet Protocol address; querying the network identifier corresponding to the user identifier, and saving or updating the first correspondence.

In an embodiment, the establishing module is further configured to: when the notification message or the keep-alive message is not received within a preset time, deleting the first correspondence; or when receiving the And sending the offline message of the terminal to the identifier management server, receiving the confirmation message of the identifier management server, deleting the first correspondence, and returning the confirmation message to the terminal.

In an embodiment, the establishing module is configured to implement the network identifier corresponding to the query user identifier in the following manner: in a second correspondence between the preset user identifier and the network identifier, searching for the user identifier corresponding to Or the network identifier is sent to the identifier management server, where the network identifier request carries the user identifier; and the network identifier returned by the identifier management server is received.

In an embodiment, the establishing module is further configured to: send an information update message to the identity management server; receive an acknowledgement message returned by the identity management server, and return an acknowledgement message to the terminal.

In one embodiment, the network identifier includes a second internet protocol address; the conversion module is configured to: acquire a first internet protocol address of the terminal in a data packet from the terminal; Searching, in the relationship, a network identifier corresponding to the first Internet Protocol address of the terminal; replacing the first Internet Protocol address of the terminal in the data packet from the terminal with the found network identifier; or The mapping of the network identifier to the data packet sent to the terminal includes: obtaining the network identifier in the data packet sent to the terminal; searching for the first terminal corresponding to the network identifier in the first correspondence relationship The internet protocol address; the network identifier in the data packet sent to the terminal is replaced with the first internet protocol address of the found terminal.

In an embodiment, the converting module is further configured to: when the network identifier corresponding to the first Internet address of the terminal is not found in the first correspondence, discard the data packet from the terminal, or The data from the terminal includes performing network address translation; or, when the first Internet Protocol address of the terminal corresponding to the network identifier is not found in the first correspondence, discarding data sent to the terminal Packet, or network address translation for packets sent to the terminal.

In one embodiment, the network identifier includes a second internet protocol address and a port range, and the conversion module is configured to: acquire a first internet protocol address of the terminal in a data packet from the terminal, and the terminal a first port; searching for a network identifier corresponding to the first Internet Protocol address of the terminal in the first correspondence; replacing the first Internet Protocol address of the terminal in the data packet from the terminal with the found a second Internet Protocol address of the network identifier, the first port of the terminal in the data packet from the terminal is replaced with a second port not used in the port range of the found network identifier; establishing the first Internet of the terminal A third correspondence between the protocol address, the first port of the terminal, the second Internet Protocol address of the network identifier, and the second port of the network identifier.

In an embodiment, the converting module is further configured to: when the network identifier corresponding to the first Internet Protocol address of the terminal is not found in the first correspondence, discard the data packet from the terminal, Or perform network address port translation on the data packet from the terminal.

Referring to FIG. 12, the present application provides a terminal, including: an obtaining module, configured to acquire access information; wherein, the access information includes a user identifier and a first Internet Protocol address of the terminal; and the first sending module is configured to connect The incoming information is sent to the identity gateway.

In an embodiment, the first sending module is configured to perform an operation of: transmitting the access information to the identity gateway according to a third configured Internet Protocol address of the pre-configured gateway; The third Internet Protocol address of the identity gateway that is returned when the domain name of the identifier gateway is parsed is sent to the identity gateway; and the access is performed according to a third Internet Protocol address of the gateway that is sent by the access gateway. Information is sent to the identity gateway.

In an embodiment, the first sending module is configured to: send a notification message or a keep-alive message to the identity gateway, where the notification message or the keep-alive message includes the access information.

In an embodiment, the first sending module is configured to: periodically send the notification message or the keep-alive message to the identity gateway; or send the identifier information to the identity gateway when the access information changes The notification message or the keep-alive message.

In an embodiment, the first sending module is further configured to: send an offline message to the identity gateway; receive an acknowledgement message returned by the identity gateway, control the terminal to go offline, and release the terminal First internet protocol address.

Referring to FIG. 13 , the present application provides an identity management server, including: a receiving module, configured to receive a network identifier request for identifying a gateway, where the network identifier request carries a user identifier; and a processing module is configured to be a preset user. In the second correspondence between the identifier and the network identifier, searching for a network identifier corresponding to the user identifier; or, assigning a network identifier according to the user identifier, and saving a second correspondence between the user identifier and the network identifier; Module, set to send the network ID to the identity gateway.

In an embodiment, the second correspondence further includes a user status, where the user status includes at least one of the following: online, offline.

In an embodiment, the receiving module is further configured to: receive an information update message; the processing module is further configured to: update the second correspondence; the second sending module is further configured to: return to the identity gateway Confirm the message.

In an embodiment, the receiving module is further configured to: receive an offline message of the terminal; the processing module is further configured to: update a user status in the second correspondence to be offline; The second sending module is further configured to: return an acknowledgement message to the identity gateway.

Referring to FIG. 14, the present application provides an identification gateway including a first processor and a first computer readable storage medium, where the first computer readable storage medium stores a first instruction, wherein when When the first instruction is executed by the first processor, any one of the above network identifier mapping methods is implemented.

Referring to FIG. 15, the present application provides a terminal, including a second processor and a second computer readable storage medium, where the second computer readable storage medium stores a second instruction, where When the two instructions are executed by the second processor, any one of the above network identifier mapping methods is implemented.

Referring to FIG. 16, the present application provides an identification management server, including a third processor and a third computer readable storage medium, where the third computer readable storage medium stores a third instruction, which is characterized by When the third instruction is executed by the third processor, any one of the above network identifier mapping methods is implemented.

The above computer readable storage medium comprises at least one of the following: a flash memory, a hard disk, a multimedia card, a card type memory. For example, a secure digital memory card (SD card) or a data register (DR) memory, a random access memory (RAM), a static random access memory (SRAM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Programmable Read-Only Memory (PROM), magnetic memory, Disk, CD, etc.

The processor may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip.

Referring to FIG. 17, the present application provides a network identity mapping system, including: a terminal, configured to acquire access information; where the access information includes a user identifier and a first Internet Protocol address of the terminal; and the access information is sent to the identifier. a gateway, configured to receive access information of the terminal, where the access information includes a user identifier and a first internet protocol address of the terminal; querying a network identifier corresponding to the user identifier, saving or updating the first Corresponding relationship; converting the network identifier from the terminal or the data packet sent to the terminal according to the first correspondence relationship.

In an embodiment, the identifier gateway is configured to query the network identifier corresponding to the user identifier in the following manner: in a second correspondence between the preset user identifier and the network identifier, searching for a network corresponding to the user identifier The identifier is sent to the identifier management server, where the network identifier request carries the user identifier, and the network identifier returned by the identifier management server is received. The network identifier mapping system further includes: an identifier management server, configured to receive the network identifier request for identifying the gateway, where the network identifier request carries the user identifier; in a second correspondence between the preset user identifier and the network identifier, The network identifier corresponding to the user identifier is searched; or the network identifier is allocated according to the user identifier, and the second correspondence between the user identifier and the network identifier is saved; and the network identifier is sent to the identifier gateway.

In an embodiment, the terminal is configured to: acquire access information, where the access information includes a user identifier and a first internet protocol address of the terminal; and send a notification message or a keep-alive message to the identity gateway, where the notification message or The keep-alive message includes the access information. The identifier gateway is configured to receive a notification message or a keep-alive message of the terminal, where the notification message or the keep-alive message includes the access information, query a network identifier corresponding to the user identifier, and save or update the a correspondence relationship; converting, according to the first correspondence, a network identifier from a data packet sent by the terminal or sent to the terminal.

In an embodiment, the terminal is further configured to: send an offline message to the identity gateway; receive an acknowledgement message returned by the identity gateway, control the terminal to go offline, and release the first internet protocol address of the terminal. The identifier gateway is further configured to: delete the first correspondence when the notification message or the keep-alive message is not received within a preset time; or, when receiving the offline message of the terminal, Sending an offline message of the terminal to the identity management server, receiving an acknowledgement message of the identity management server, deleting the first correspondence, and returning a confirmation message to the terminal. The identity management server is further configured to: when receiving the offline message of the terminal, update the user status in the second correspondence to the offline line, and return an acknowledgement message to the identity gateway.

Claims

A network identity mapping method includes:

Determining, in advance, a first correspondence between the first Internet Protocol address of the terminal and the network identifier; wherein the network identifier corresponds to a user identifier of the terminal;

Converting a network identifier from a data packet sent by the terminal or to the terminal according to the first correspondence.
The network identity mapping method according to claim 1, wherein the first correspondence between the first Internet Protocol address and the network identifier of the pre-established terminal comprises:

Receiving access information of the terminal; wherein the access information includes the user identifier and an internet protocol address of the terminal;

Querying a network identifier corresponding to the user identifier, and saving or updating the first correspondence.
The network identity mapping method according to claim 2, further comprising:

And deleting the first correspondence, and sending the offline message of the terminal to the identity management server, in response to not receiving the access information within a preset time;

Or, in response to receiving the offline message of the terminal, sending an offline message of the terminal to the identity management server, receiving an acknowledgement message of the identity management server, deleting the first correspondence, and The terminal returns a confirmation message.
The network identifier mapping method according to claim 2, wherein the network identifier corresponding to the query user identifier comprises:

Searching, in a second correspondence between the preset user identifier and the network identifier, the network identifier corresponding to the user identifier;

Or sending a network identifier request to the identity management server, where the network identity request carries the user identifier; and receiving the network identifier returned by the identity management server.
The network identity mapping method according to claim 2, further comprising:

Sending an information update message to the identity management server;

Receiving an acknowledgement message returned by the identity management server, and returning an acknowledgement message to the terminal.
The network identity mapping method according to claim 1, wherein the network identifier comprises a second internet protocol address;

The converting the network identifier of the data packet from the terminal according to the first correspondence relationship comprises: acquiring a first internet protocol address of the terminal in a data packet from the terminal; searching for the first correspondence relationship Determining, by the first Internet Protocol address, a network identifier; replacing the first Internet Protocol address in the data packet from the terminal with the found network identifier;

Or the converting the network identifier to the data packet sent to the terminal according to the first correspondence: acquiring the network identifier in the data packet sent to the terminal; searching for the network identifier in the first correspondence relationship Corresponding first internet protocol address; replacing the network identifier in the data packet sent to the terminal with the first internet protocol address.
The network identity mapping method according to claim 1, wherein the network identifier comprises a second internet protocol address and a port range,

The converting the network identifier of the data packet from the terminal according to the first correspondence relationship includes:

Obtaining a first internet protocol address of the terminal in a data packet from the terminal and a first port of the terminal;

Searching, in the first correspondence, a network identifier corresponding to an internet protocol address of the terminal;

Replacing the first internet protocol address of the terminal in the data packet from the terminal with the second internet protocol address of the found network identifier, the first port of the terminal in the data packet from the terminal Replace with the second port that is not used in the port range of the discovered network identifier;

Establishing a third correspondence between the first internet protocol address and the first port and the second internet protocol address and the second port.
A network identity mapping method includes:

Obtaining access information, where the access information includes a user identifier and a first internet protocol address of the terminal;

Sending the access information to the identity gateway.
The network identity mapping method according to claim 8, wherein the sending the access information to the identity gateway comprises one of the following:

Sending the access information to the identity gateway according to a second Internet Protocol address of the pre-configured identifier gateway;

Sending the access information to the identity gateway according to the second internet protocol address of the identity gateway returned by the domain name system when parsing the domain name of the identity gateway;

Sending the access information to the identity gateway according to a second internet protocol address of the gateway that is sent by the access gateway.
The network identity mapping method according to claim 8 or 9, further comprising:

Sending an offline message to the identity gateway;

Receiving an acknowledgment message returned by the identity gateway, controlling the terminal to go offline, and releasing the first internet protocol address of the terminal.
A network identity mapping method includes:

Receiving a network identifier request for identifying a gateway, where the network identifier request carries a user identifier;

Searching, in a corresponding relationship between the user identifier and the network identifier, a network identifier corresponding to the user identifier; or assigning the network identifier according to the user identifier, and saving the user identifier and Corresponding relationship between the network identifiers;

Sending the network identifier to the identity gateway.
The network identifier mapping method according to claim 11, wherein the correspondence relationship further includes a user status, and the user status includes at least one of the following: online and offline.
The network identity mapping method according to claim 12, further comprising:

Responding to receiving the information update message, updating the correspondence and returning an acknowledgement message to the identity gateway;

Or, in response to receiving the offline message of the terminal, updating the user status in the correspondence relationship to the offline line, and returning an acknowledgement message to the identity gateway.
An identification gateway that includes:

Establishing a module, configured to pre-establish a correspondence between an Internet Protocol address of the terminal and a network identifier; wherein the network identifier corresponds to a user identifier of the terminal;

The conversion module is configured to perform network identifier conversion on the data packet from the terminal or sent to the terminal according to the correspondence.
The identification gateway of claim 14, wherein the establishing module is configured to:

Receiving the access information of the terminal, where the access information includes the user identifier and an internet protocol address of the terminal; querying a network identifier corresponding to the user identifier, and saving or updating the corresponding relationship.
A terminal comprising:

An obtaining module, configured to obtain access information, where the access information includes a user identifier and an internet protocol address of the terminal;

The sending module is configured to send the access information to the identity gateway.
The terminal according to claim 16, wherein the sending module is further configured to:

Sending an offline message to the identity gateway;

Receiving an acknowledgment message returned by the identity gateway, controlling the terminal to go offline, and releasing an internet protocol address of the terminal.
An identity management server, including:

a receiving module, configured to receive a request for obtaining a network identifier from the identifier gateway, where the request for acquiring the network identifier carries a user identifier;

The processing module is configured to: search for a network identifier corresponding to the user identifier in a correspondence between the preset user identifier and the network identifier, or allocate the network identifier according to the user identifier, and save Corresponding relationship between the user identifier and the network identifier;

And a sending module, configured to send the network identifier to the identity gateway.
An identification gateway comprising a processor and a computer readable storage medium having computer instructions stored therein, when said computer instructions are executed by said processor, implementing said claims 1-7 Network identity mapping method.
A terminal, comprising a processor and a computer readable storage medium, wherein the computer readable storage medium stores computer instructions, when the computer instructions are executed by the processor, implementing the method of claims 8-10 Network identity mapping method.
An identification management server comprising a processor and a computer readable storage medium having computer instructions stored therein, when the computer instructions are executed by the processor, implementing as claimed in claims 11-13 The network identity mapping method described.
A computer readable storage medium having stored thereon a computer program, the computer program being executed by a processor to implement the network identification mapping method according to claims 1-13.
A network identity mapping system includes:

The terminal is configured to obtain access information, where the access information includes a user identifier and an internet protocol address of the terminal, and the access information is sent to the identifier gateway.

The identifier gateway is configured to receive the access information of the terminal, where the access information includes a user identifier and an internet protocol address of the terminal, query a network identifier corresponding to the user identifier, and save or update an internet protocol address and a network identifier of the terminal. a first correspondence between the two; converting the network identifier from the terminal or the data packet addressed to the terminal according to the first correspondence.
The network identifier mapping system according to claim 23, wherein the identifier gateway is configured to implement the network identifier corresponding to the query user identifier in the following manner:

Sending a request for acquiring a network identifier to the identifier management server, where the request for obtaining the network identifier carries the user identifier; and receiving the network identifier returned by the identifier management server;

The network identity mapping system further includes:

An identifier management server is configured to receive a request for obtaining a network identifier from the identifier gateway, where the request for obtaining the network identifier carries a user identifier; and in a second correspondence between the preset user identifier and the network identifier, searching for the user The network identifier is identified; or the network identifier is allocated according to the user identifier, and the second correspondence between the user identifier and the network identifier is saved; and the network identifier is sent to the identifier gateway.